Windows Vista™ Administrator's Pocket Consultant

Next Page

Book Cover
Windows Vista™ Administrator's Pocket Consultant
By William R. Stanek
...............................................
Publisher: Microsoft Press
Pub Date: November 29, 2006
Print ISBN-10: 0-7356-2296-5
Print ISBN-13: 978-0-7356-2296-8
Pages: 576

Table of Contents | Index
Overview

Heres the ideal, on-the-go reference that desktop administrators and support professionals can carry with them as they support and manage Windows Vista.

Next Page


Table of Contents

Previous Page
Next Page

Book Cover
Windows Vista™ Administrator's Pocket Consultant
By William R. Stanek
...............................................
Publisher: Microsoft Press
Pub Date: November 29, 2006
Print ISBN-10: 0-7356-2296-5
Print ISBN-13: 978-0-7356-2296-8
Pages: 576

Table of Contents | Index

Copyright
Acknowledgments
Introduction
Chapter 1. Introduction to Windows Vista Administration
 | Getting Started with Windows Vista
 | Installing and Running Windows Vista
 | Navigating Architecture Changes in Windows Vista
Chapter 2. Managing Windows Vista Systems
 | Getting Around Windows Vista
 | Managing User Account Control and Elevation Prompts
 | Supporting Computers Running Windows Vista
 | Using System Support Tools
 | Managing System Properties
Chapter 3. Configuring Systems, Hardware Devices, and Drivers
 | Introducing Automated Help And Support
 | Working with the Automated Help System
 | Installing and Maintaining Devices: The Essentials
 | Getting Started with Device Manager
 | Working with Device Drivers
 | Managing Hardware
 | Customizing Hardware Device Settings
 | Managing Internet Time
Chapter 4. Customizing the Desktop and the Interface
 | Optimizing Windows Vista Menus
 | Customizing the Taskbar
 | Optimizing Toolbars
 | Working with Desktop Themes
 | Optimizing the Desktop Environment
 | Screen Saver Dos and Don'ts
 | Modifying Display Appearance and Video Settings
Chapter 5. Installing and Maintaining Programs
 | Managing Application Virtualization and Run Levels
 | Installing Programs: The Essentials
 | Deploying Applications Through Group Policy
 | Configuring Program Compatibility
 | Managing Installed and Running Programs
Chapter 6. Managing User Access and Security
 | Understanding User and Group Accounts
 | Managing Local Logon
 | Managing Stored Passwords
 | Managing Local User Accounts and Groups
 | Managing Remote Access to Workstations
Chapter 7. Managing Laptops and Traveling Users
 | Working with Windows Mobility Center
 | Configuring Power Management Settings
 | Configuring Networking for Laptops
Chapter 8. Configuring User and Computer Policies
 | Group Policy Essentials
 | Configuring Policies
 | Working with File and Data Management Policies
 | Working with Access and Connectivity Policies
 | Working with Computer and User Script Policies
 | Working with Logon and Startup Policies
Chapter 9. Managing Disk Drives and File Systems
 | Disk Management Essentials
 | Improving Disk Performance
 | Working with Basic and Dynamic Disks
 | Using Basic and Dynamic Disks
 | Working with Disks, Partitions, and Volumes
 | Partitioning Disks and Preparing Them for Use
 | Moving a Dynamic Disk to a New System
 | Troubleshooting Common Disk Problems
Chapter 10. Managing File Security and Resource Sharing
 | File Security and Sharing Options
 | Controlling Access to Files and Folders with NTFS Permissions
 | Sharing Files and Folders Over the Network
 | Using and Configuring Public Folder Sharing
Chapter 11. Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas
 | Configuring Advanced Windows Explorer Options
 | Managing Offline Files
 | Configuring Disk Quotas
Chapter 12. Configuring and Troubleshooting TCP/IP Networking
 | Navigating Windows Vista Networking Features
 | Installing Networking Components
 | Configuring Local Area Connections
 | Managing Local Area Connections
 | Troubleshooting and Testing Network Settings
Chapter 13. Managing Mobile Networking and Remote Access
 | Understanding Mobile Networking and Remote Access
 | Creating Connections for Remote Access
 | Configuring Connection Properties
 | Establishing Connections
 | Wireless Networking
Chapter 14. Managing Advanced Internet Options and Security
 | Customizing URLs
 | Customizing the Browser User Interface
 | Setting Default Internet Programs
 | Managing Connection and Proxy Settings
 | Managing Browser Cookies and Other Temporary Internet Files
 | Secure Browsing and Local Machine Lockdown
 | Managing Internet Explorer Security Zones
 | Additional Policies That Might Be Useful for Managing Internet Options
Chapter 15. Optimizing Windows Vista
 | Optimizing and Safeguarding Disk Drives
 | Enhancing Computer Security
Chapter 16. Supporting and Troubleshooting Windows Vista
 | Using Remote Assistance to Resolve Problems
 | Detecting and Resolving Windows Vista Errors
 | Scheduling Maintenance Tasks
 | Backing Up and Recovering a Computer
 | Troubleshooting Startup and Shutdown
About the Author
Additional Resources for IT Professionals
 | Microsoft Windows Server
 | Microsoft Windows Client
 | Microsoft SQL Server 2005
 | Microsoft Exchange Server 2003
 | Scripting
 | Related Titles
More Great Resources for IT Professionals
 | Administrator's Pocket Consultant
 | Administrator's Companion
 | Resource Kit
Index

Previous Page


Copyright

Published by
Microsoft Press
A Division of Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399

Copyright © 2007 by William Stanek

All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher.

Library of Congress Control Number: 2006934393

Printed and bound in the United States of America.

1 2 3 4 5 6 7 8 9 QWE 1 0 9 8 7 6

Distributed in Canada by H.B. Fenn and Company Ltd.

Microsoft Press books are available through booksellers and distributors worldwide. For further information about international editions, contact your local Microsoft Corporation office or contact Microsoft Press International directly at fax (425) 936-7329. Visit our Web site at www.microsoft.com/mspress. Send comments to mspinput@microsoft.com.

Microsoft, Microsoft Press, Active Desktop, Active Directory, ActiveX, Aero, Authenticode, BitLocker, DirectX, Excel, FrontPage, Internet Explorer, JScript, MS-DOS, MSN, Outlook, PowerPoint, SuperFetch, Visual Basic, Windows, Windows Media, Windows NT, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

This book expresses the author's views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book.

Acquisitions Editor: Martin DelRe
Developmental Editor: Jenny Moss Benson
Project Editor: Maria Gargiulo
Technical Editor: Ben Smith
Copy Editor: Sarah Wales-McGrath
Indexer: Jeanne Busemeyer

Body Part No. X13-23788


Acknowledgments

Writing Windows Vista Administrator's Pocket Consultant was a lot of funand a lot of work. As I set out to write this book, my first goal was to determine what had changed between Windows XP and Windows Vista and what new administration options were available. With any new operating system, and especially with Windows Vista, this meant a great deal of research to determine exactly how things work and a lot of digging into the operating system internals. Thankfully, I'd already written a book introducing Windows Vista and its new features, so I had a point of reference for my research, but not necessarily a complete one.

When you start working with Windows Vista, you'll see at once that this operating system is different from earlier releases of Windows. On the desktop, you'll see the fancy interfaces featuring Aeroglass and the cool new bells and whistles like the sidebar gadgets. In the Control Panel, you'll see the increased focus on centralized management and configuration. What won't be readily apparent, however, is just how different Windows Vista is from its predecessorsand that's because many of the most significant changes to the operating system are under the surface. These changes affect the underlying architecture and not just the interfacesand these changes were some of the hardest for me to research and write about.

As Pocket Consultants are meant to be portable and readablethe kind of book you use to solve problems and get the job done wherever you might beI had to carefully review my research to make sure I focused on the core of Windows Vista administration. The result is the book you hold in your hands, which I hope you'll agree is one of the best practical, portable guides to Windows Vista.

It is gratifying to see techniques I've used time and again to solve problems put into a printed book so that others may benefit from them. But no man is an island and this book couldn't have been written without help from some very special people. As I've stated in all my previous books with Microsoft Press, the team at Microsoft Press is top-notch. Throughout the writing process, Maria Gargiulo was instrumental in helping me stay on track and getting the tools I needed to write this book. Maria did a first rate job managing the editorial process. Thanks also to Martin DelRe for believing in my work and shepherding it through production.

Unfortunately for the writer (but fortunately for readers), writing is only one part of the publishing process. Next came editing and author review. I must say, Microsoft Press has the most thorough editorial and technical review process I've seen anywhereand I've written a lot of books for many different publishers. Ben Smith was the technical editor for the book. It was a great pleasure working with Ben. He watched the technical details very carefully and was always ready to help out if needed. Two additional reviewers, Kai Axford and Shawn Rabourn, focused on security issues and technologies, and provided helpful feedback throughout the review process. Thank you, Kai and Shawn.

Last but not least, I want to thank my agents at Studio B: David Rogelberg and Neil Salkind. It has been a pleasure having you as my non-fiction agents over the past decadehard to believe it's already been 10 years.

Hopefully, I haven't forgotten anyone but if I have, it was an oversight. Honest. ;-)


Introduction

Windows Vista Administrator's Pocket Consultant is designed to be a concise and compulsively usable resource for Microsoft Windows Vista administrators. This is the readable resource guide that you'll want on your desk at all times. The book covers everything you need to perform the core administrative tasks for computers running Windows Vista.

Because the focus is on giving you maximum value in a pocket-sized guide, you don't have to wade through hundreds of pages of extraneous information to find what you're looking for. Instead, you'll find exactly what you need to get the job done. In short, the book is designed to be the one resource you turn to whenever you have questions regarding Windows Vista administration. To this end, the book zeroes in on daily administration procedures, frequently used tasks, documented examples, and options that are representative while not necessarily inclusive.

One of the goals is to keep the content so concise that the book remains compact and easy to navigate while at the same time ensuring that the book is packed with as much information as possiblemaking it a valuable resource. Thus, instead of a hefty 1,000-page tome or a lightweight 100-page quick reference, you get a valuable resource guide that can help you quickly and easily perform common tasks, solve problems, and implement everyday solutions for systems and users.

Who Is This Book For?

Windows Vista Administrator's Pocket Consultant is designed for

  • Current Windows system administrators

  • Accomplished users who have some administrator responsibilities

  • Administrators upgrading to Windows Vista from earlier Windows releases

  • Administrators transferring from other platforms

To pack in as much information as possible, I had to assume that you have basic networking skills and a basic understanding of Windows operating systems. With this in mind, I don't devote entire chapters to understanding Windows basics, Windows architecture, or Windows networks. I do, however, cover desktop customization, mobile networking, TCP/IP configuration, user profiles, system optimization, and troubleshooting.

I also assume that you are fairly familiar with Windows commands and procedures as well as the basics of navigating the Windows user interface. If you need help learning Windows basics, you should read the Windows Vista documentation.

How Is This Book Organized?

Windows Vista Administrator's Pocket Consultant is designed to be used in daily administration, and as such, the book is organized by job-related tasks rather than by Windows Vista features. The books in the Pocket Consultant series are down-and-dirty, in-the-trenches books.

Speed and ease of reference is an essential part of this hands-on guide. The book has an expanded table of contents and an extensive index for finding answers to problems quickly. Many other quick reference features have been added as well. These features include step-by-step instructions, lists, tables with fast facts, and extensive cross-references.

Chapters 1 through 5 cover the fundamental tasks you need for Windows Vista administration. Chapter 1 introduces key administration tools, techniques, and concepts. Chapter 2 covers customizing system and environment settings. Chapter 3 explores hardware and device management. Chapter 4 focuses on customizing the Windows desktop. Chapter 5 discusses how to install, manage, and maintain programs.

Chapters 6 through 11 focus on the essential tasks for managing access, permissions, and more. Chapter 6 discusses techniques you can use to manage user access to systems and configure global settings. Chapter 7 zeroes in on administration issues that are specific to laptops and traveling users. The chapter details considerations you should make when configuring laptops, such as power management, hardware profiles, and networking. Group Policy is the subject of Chapter 8. In this chapter, you'll find extensive lists that tell you exactly what policies you should use to manage permissions, rights, and capabilities. Chapter 9 discusses partitioning, monitoring, and optimizing drives. The chapter also details file compression and encryption. Chapter 10 covers working with files and folders with a particular focus on security. Chapter 11 discusses additional file and folder options including offline files, shadow copies, and disk quotas.

Chapters 12 through 16 zero in on networking, optimization, and security techniques and tasks. Networking is the subject of Chapter 12, which examines local area network settings. You'll find a complete discussion of installing and configuring TCP/IP networking. The chapter also covers troubleshooting networking and provides steps for performing detailed network diagnostics. Chapter 13 moves from corporate network environments to mobile environments, examining dial-up networking, wireless client connections, and remote access with virtual private networks (VPNs). Chapter 14 explains how to configure advanced Internet options and security, such as default applications, trusted sites, and security zones. You'll also learn how to customize Internet security settings through Group Policy. In Chapter 15, you'll learn how to improve system performance, optimize drives, and enhance data security. In Chapter 16, you'll learn how to use Remote Assistance to remotely troubleshoot problems with devices, applications, and the Windows operating system itself. You'll also learn how to troubleshoot problems with startup and shutdown and how to back up and recover a computer. Hopefully, after reading these chapters, you'll be able to improve the overall experience of your users and reduce downtime.

Conventions Used in This Book

I've used a variety of elements to help keep the text clear and easy to follow. You'll find code terms and listings in monospace type, except when I tell you to actually type a command. In that case, the command appears in bold type. When I introduce and define a new term, I put it in italics.

Other conventions include:

Note To provide additional details on a particular point that needs emphasis

Tip To offer helpful hints or additional information

Caution To warn you when there are potential problems you should look out for

Real World To provide real-world advice when discussing advanced topics

Best Practice To examine the best technique to use when working with advanced configuration and administration concepts

I truly hope you find that Windows Vista Administrator's Pocket Consultant provides everything you need to perform the essential administrative tasks on Windows Vista systems as quickly and efficiently as possible. You are welcome to send your thoughts to me at williamstanek@aol.com. Thank you.

Support

Every effort has been made to ensure the accuracy of this book. Microsoft Press provides corrections for books through the World Wide Web at the following address:

http:/www.microsoft.com/mspress/support

If you have comments, questions, or ideas about this book, please send them to Microsoft Press using either of the following methods:

Postal Mail:

Microsoft Press
Attn: Windows Vista Administrator's Pocket Consultant Editor
One Microsoft Way
Redmond, WA 98052-6399

E-mail:
MSPINPUT@MICROSOFT.COM


Chapter 1. Introduction to Windows Vista Administration

In this chapter:
Getting Started with Windows Vista | 2
Installing and Running Windows Vista | 4
Navigating Architecture Changes in Windows Vista | 16

Microsoft Windows Vista is the single largest rollout of the Windows operating system since Windows 95. From startup to shutdown, Microsoft Windows Vista is different from earlier versions of Windows. Not only is the operating system more versatile than its predecessors are, but it also introduces revolutionary architecture that fundamentally changes the way you work with and manage computers running the operating system. The most significant architecture changes are the following:

  • Modularization and disk imaging

  • Preinstallation and pre-boot environments

  • User account controls and elevation of privilege

This chapter covers getting started with Windows Vista and exploring the extent to which these architecture changes affect working with and managing computers running Windows Vista. Throughout this and all the other chapters this book, you'll also find detailed discussion of the all-encompassing security changes that introduce techniques for enhancing all aspects of computer security including physical security, information security, and network security. Although this book focuses on Windows Vista administration, the tips and techniques discussed throughout the text can help anyone who supports, develops for, or works with the Windows Vista operating system.

Keep in mind that this book is meant to be used in conjunction with the Microsoft Windows Server 2003 Administrator's Pocket Consultant, Second Edition (Microsoft Press, 2006) or the Microsoft Windows Vista Server Administrator's Pocket Consultant (Microsoft Press, 2007). In addition to coverage of broad administration tasks, these server-focused Administrator's Pocket Consultants examine directory services administration, data administration, and network administration. This book, on the other hand, zeroes in on user and system administration tasks. You'll find detailed coverage of the following topics:

  • Customizing the operating system and Windows environment

  • Configuring hardware and network devices

  • Managing user access and global settings

  • Configuring laptops and mobile networking

  • Using remote management and remote assistance capabilities

  • Troubleshooting system problems


Getting Started with Windows Vista

Windows Vista is the latest release of the Windows operating system for client computers. The six main editions of Windows Vista available are:

  • Windows Vista Starter A budget edition of Windows Vista for emerging markets. It is compatible with the latest applications and devices, and is more reliable and secure than earlier releases of Windows are.

  • Windows Vista Home Basic A budget edition of Windows Vista for home users. It includes a basic set of entertainment features, but does not include features for joining a domain.

  • Windows Vista Home Premium An enhanced edition of Windows Vista that includes a premium set of entertainment features, but does not include features for joining a domain.

  • Windows Vista Business A basic edition of Windows Vista for business users. It includes a basic set of management features as well as features for joining a domain.

  • Windows Vista Enterprise An enhanced edition of Windows Vista for business users. It includes an extended set of management features as well as features for joining a domain.

  • Windows Vista Ultimate An enhanced edition of Windows Vista that includes the best of all the available home user and business user features as well as features for joining a domain.

Thanks to Windows Vista's new hardware-independent architecture, which is discussed later in this chapter, all editions of Windows Vista except Starter support both 32-bit and 64-bit hardware. This means every product edition except Starter can be used with computers that have 32-bit x86, 64-bit (IA-64), and 64-bit extension architecture. Computers with 32-bit x86 architecture can have up to 4 gigabytes (GB) of RAM. Computers with 64-bit architecture can have up to 8 GB RAM on Home Basic; 16 GB RAM on Home Premium; and 128+ GB on Business, Enterprise, and Ultimate editions. Business, Enterprise, and Ultimate editions also provide two-processor support. A detailed list of differences between the various Windows Vista editions is provided online at http://www.williamstanek.com/vista/.

While earlier releases of the Windows operating system could not be upgraded from one edition to another, Microsoft provides an easy upgrade path from the basic editions to the enhanced editions of Windows Vista using Windows Anytime Upgrade. You can buy an upgrade disc at a retail store or use the built-in Windows Upgrade Anytime feature to buy the upgrade online. To start an upgrade using the built-in Windows Anytime Upgrade feature, click Start and then click Control Panel. In Control Panel, click System And Maintenance and then click Windows Anytime Upgrade. To complete the upgrade, follow the instructions provided. You'll need the Windows Vista distribution media. The distribution media contains the components for all Windows Vista versions, and it is the product key you provide that unlocks and installs the features for a specific version.

Table 1-1 provides an overview of the upgrade paths. As the table shows, you have several options for upgrading the most basic editions to the enhanced editions.

Table 1-1. Upgrade Paths for Windows Vista Editions

Version of Windows

Upgrades to...

Upgrades to...

Home Version

Windows Vista Home Premium

Windows Vista Ultimate

Windows Vista Home Basic

Yes

Yes

Windows Vista Home Premium

Yes

Business Version

Windows Vista Enterprise

Windows Vista Ultimate

Windows Vista Business

Yes

Yes

Windows Vista Enterprise

Yes

Additionally, Windows Vista provides four levels of user experience:

  • Windows Classic Provides a Windows 2000 look and feel while retaining the functionality improvements in Windows Vista. The Classic user experience can be used on any edition of Windows Vista, including Starter, and has no hardware requirements beyond the core Windows Vista system requirements.

  • Windows Vista Basic Provides the basic user experience for entry-level desktops. The user interface (UI) is upgraded and streamlined compared to earlier versions of Windows. You'll find a refined Start menu that allows you to instantly find and start anything on your PC, streamlined Explorer windows with integrated desktop search and icons that let you more easily see your data, live icons that show their contents, preview and reading panes, and new wizards and dialog boxes. The Basic user experience can be used on any edition of Windows Vista, including Starter, and has no hardware requirements beyond the core Windows Vista system requirements.

  • Windows Standard Adds improved performance and enhanced reliability to the Basic user experience. This experience level is ideal for mid-level computers equipped with graphics hardware that supports the new Windows Driver Display Model (WDDM). With the Standard experience, Windows Vista uses the advanced WDDM graphics technology to enable smooth window handling, increase stability, and reduce glitches, such as relics and slow screen refreshes while moving UI elements. The Standard user experience can be used with any edition of Windows Vista except the Starter edition, and has the same hardware requirements as Windows Aero.

  • Windows Aero Adds improved visual design and enhanced dynamic effects to the Standard user experience. These enhancements allow you to use UI elements with transparent glass, live taskbar thumbnails, and the Windows Flip and Flip 3D viewsall of which are discussed in Chapter 2. Aero is available only on the Home Premium, Business, Enterprise, and Ultimate editions of Windows Vista.

As you can see, each user experience level builds on and includes the features of the preceding level. It is important to point out, however, that the user experience level that can be used on a computer depends on the Windows Vista edition and the computer's hardware, as discussed in the next section.


Installing and Running Windows Vista

When you install Windows Vista on a computer with an existing operating system, you can either perform a clean installation or an upgrade. With a clean installation, the Windows Vista Setup program completely replaces the original operating system on the computer, and all user and application settings are lost. With an upgrade, the Windows Vista Setup program performs a clean installation of the operating system followed by a migration of user settings, documents, and applications from the earlier version of Windows. Setup migrates previous settings because Windows Vista doesn't store user and application information in the same way as earlier versions of Windows do.

Installing Windows Vista

Before you install Windows Vista on a computer, you should determine whether the underlying hardware meets the requirements for physical memory, processing power, and graphics capabilities. Microsoft provides both minimum requirements and recommended requirements. Requirements for memory and graphics are measured in megabytes (MB) and gigabytes (GB); requirements for processors are measured in gigahertz (GHz).

Windows Vista Starter and Home Basic editions require a minimum of 512 MB of RAM; an 800 Mhz or higher processor; and a graphics processor that supports Microsoft DirectX 9. For Windows Vista Home Premium, Business, Enterprise, and Ultimate editions, you'll have a better experience and get better performance if the computer has at least 1 GB of RAM; a 1.0 GHz 32-bit (x86) or 64-bit (x64) processor; and a graphics processor with 128 MB of graphics memory that supports Microsoft DirectX 9.

Note

Before installing Windows Vista, you should also check the size of the computer's hard disk. Although a base installation of Windows XP uses about 2 GB of disk space, a base installation of Windows Vista uses 4 GB or more of disk space. Various features in Windows Vista, such as protection points that include previous versions of files and folders that have been modified, can quickly increase the size of the installation to 6 GB or more. For optimal performance of the hard disk, you'll also need at least 10 percent free space at all times.

Any computer that meets or exceeds these requirements can run Windows Vista. You can perform an interactive installation of Windows Vista by completing these steps:

1.
Start the Windows Vista Setup program using one of the following techniques:

  • For a new installation, turn on the computer and insert the Windows Vista distribution media into the computer's CD-ROM or DVD-ROM drive. When prompted, press a key to start the program from the CD or DVD.

  • For an upgrade, start the computer and log on using an account with administrator privileges. Insert the Windows Vista distribution media into the computer's CD-ROM or DVD-ROM drive. The Windows Vista Setup program should start automatically. If Setup doesn't start automatically, use Windows Explorer to access the distribution media and then double-click Setup.exe.

2.
Click Install Now to start the installation. If you are starting the installation from an existing operating system and are connected to a network or the Internet, choose whether to get updates during the installation. Either click Go Online To Get The Latest Updates For Installation or click Do Not Get The Latest Updates For Installation.

Tip

You don't have to get updates during the installation. If you decide not to get updates, you can update the computer later using the Windows Update feature.

3.
With retail versions of Windows Vista, you typically have to provide a product key. If prompted for a product key, enter the product key and then click Next.

4.
Read the license terms. If you agree, click I Accept The License Terms (Required To Use Windows) and then click Next.

5.
If you are upgrading the computer, you can specify the installation type as either Upgrade or Custom (Advanced). Select Upgrade if you want to upgrade the previously installed operating system to Windows Vista. Otherwise, select Custom (Advanced) to install a clean copy of Windows Vista.

Note

When you install a clean copy of Windows Vista on a computer running an earlier version of Windows, Setup moves folders and files for the previous installation to a folder named Windows.old, and the previous installation will no longer run.

6.
When prompted for an installation location, choose the disk drive on which you want to install the operating system and then click Next.

7.
If the disk you've selected contains a previous Windows installation, you'll see a prompt telling you that existing user and application settings will be moved to a folder named Windows.old and that you must copy these settings to the new installation to use them. Click OK.

8.
Setup will then start the installation. During this process, Setup copies the full disk image of Windows Vista to the disk you've selected and then expands it. Afterward, Setup installs features based on the computer's configuration and detected hardware. This process requires several automatic restarts. When Setup finishes the installation, the operating system will be loaded and you can complete the installation.

9.
When prompted, choose your country or region and your keyboard layout. Then click Next.

10.
You must next create a local machine account that will be created as a computer administrator account. Enter a user name. Type and then confirm a password. Enter an optional password hint and then choose a picture for the account. Click Next.

Tip

Passwords used with user accounts should be fairly complex. You make passwords difficult to guess and crack by using combinations of all available character types, including lowercase letters, uppercase letters, numbers, and symbols.

11.
Type a computer name and select a desktop background. Click Next.

12.
Select a Windows Update option for the computer. Typically, you'll want to use the recommended settings to allow Windows Vista to automatically install all available updates and security tools as they become available. If you choose Ask Me Later, Windows Update will be disabled.

13.
Review the date and time settings, and then make changes as necessary. Click Next.

14.
If a network card was detected during set up, networking components were installed automatically. Depending on your location type, click Home, Work, or Public Location. Windows Vista will then configure networking for this location.

15.
Click Start. Windows Vista will then check the computer performance and assign a performance rating.

When the operating system starts, you'll see the Welcome Center. By default, Windows Vista stores user profile data under %SystemDrive%\Users\%UserName%. Within the user profile folder, each user who logs on to the system has a personal folder, and that personal folder contains the following additional folders:

  • Contacts The default location for storing contacts and contact groups

  • Desktop The default location for storing the user's desktop

  • Documents The default location for the user's document files

  • Downloads The default location for storing programs and data downloaded from the Internet

  • Favorites The default location for storing a user's Internet favorites

  • Links The default location for storing a user's Internet links

  • Music The default location for storing a user's music files

  • Pictures The default location for storing a user's pictures

  • Searches The default location for storing a user's saved searches

  • Videos The default location for storing a user's video files

Note

%SystemDrive% and %UserName% refer to the SystemDrive and UserName environment variables, respectively. The Windows operating system has many environment variables, which are used to refer to user-specific and system-specific values. Often, I'll refer to environment variables using this syntax: %VariableName%. If you've upgraded to Windows Vista from an earlier version of Windows, the user's personal folder will also contain shortcuts to the folders and settings used by that earlier version.

Using Welcome Center and Activating Windows

By default, when you log on, the operating system displays the Welcome Center window. If you don't want the Welcome Center window to be displayed the next time you start the computer, clear the Run At Startup check box. You can start Welcome Center as necessary later on by following these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click Welcome Center.

Welcome Center, shown in Figure 1-1, provides quick access to common configuration tasks, such as setting up devices, transferring files and settings, managing user accounts, and viewing computer information. Click Show All Items to display all the available options, which include the following tasks:

  • Add New Users When you click this option and then click Add User Accounts in the View Pane, you can configure user accounts for each person who will log on to the computer locally. You can manage account settings and parental controls for accounts, as discussed in Chapter 6, "Managing User Access and Security." This option isn't available when you log on to a domain.

  • Personalize Windows When you click this option and then click the like-named option in the View Pane, you can use the Personalization console to control the appearance and sound effects used by Windows Vista. You can manage settings for the display, visual appearance, desktop background, screen saver, sound effects, mouse pointers, and themes, as discussed in Chapter 4, "Customizing the Desktop and the Interface."

  • Register Windows Online Register your copy of Windows Vista online. When you choose this option and then click the like-named option in the View Pane, Welcome Center launches Microsoft Windows Internet Explorer 7 and accesses the Microsoft Web site so you can register the copy of Windows Vista. Because registration is different from product activation, you will still need to activate the copy of Windows Vista.

  • View Computer Details Displays the default view for the Welcome Center, which provides an overview of the system configuration. Use the More Details link to access the System console and view additional information about the computer.

  • Transfer Files And Settings Click this option and then select Start Windows Easy Transfer to run the Windows Easy Transfer wizard, which can be used to migrate user and application settings from an old computer to a computer running Windows Vista. For the transfer, you can use removable media, external hard drives, network folders, or a Windows Easy Transfer cable that connects to both computers. To transfer settings, the old computer must be running Windows 2000, Windows XP, or Windows Vista.

Figure 1-1. The Welcome Center window.

[View full size image]

Although volume-licensed versions of Windows Vista might not require activation or product keys, retail versions of Windows Vista require both activation and product keys. In the Welcome Center, the Activation Status entry specifies whether you have activated the operating system. If Windows Vista has not been activated, you can activate the operating system by clicking More Details to access the System console and then selecting Click Here To Activate Windows Now under Windows Activation.

Unlike earlier versions of Windows, the product key provided during installation can be changed as necessary to stay in compliance with your licensing plan. To change the product key, follow these steps:

1. | In Welcome Center, click More Details. This opens the System window.
2. | In the System window, under Windows Activation, click Change Product Key.
3. | In the Windows Activation window, shown in Figure 1-2, type the product key and then click Next.

Figure 1-2. Changing the product key.

[View full size image]

Running Windows Vista in Workgroups and Domains

Computers running Windows Vista can be members of a workgroup or a domain. A workgroup is a loose association of computers in which each computer is managed separately. A domain is a collection of computers that you can manage collectively by means of domain controllers, which are servers running Windows that manage access to the network, to the directory database, and to shared resources.

Some aspects of Windows Vista are different depending on whether a computer is a member of a workgroup or a domain. The sections that follow discuss these differences as they pertain to user account controls, logon, fast user switching, and password management.

Understanding User Account Control in Windows Vista

In a workgroup, a computer running Windows Vista has only local machine accounts. In a domain, a computer running Windows Vista has both local machine accounts and domain accounts. Windows Vista has two primary types of local user accounts:

  • Standard Standard user accounts can use most software and can change system settings that do not affect other users or the security of the computer.

  • Administrator Administrator user accounts have complete access to the computer and can make any desired changes.

Windows Vista introduces User Account Control (UAC) as a way to enhance computer security by ensuring that there is true separation of standard user and administrator user accounts. Because of the UAC feature in Windows Vista, all applications run using either standard user or administrator user privileges. Whether you log on as a standard user or as an administrator user, you see a security prompt by default whenever you run an application that requires administrator privileges. The way the security prompt works depends on Group Policy settings (as discussed in Chapter 6) and whether you are logged on with a standard user account or an administrator user account.

When you are logged on using a standard user account, you are asked to provide a password for an administrator account as shown in Figure 1-3. In a workgroup, each local computer administrator account is listed by name. To proceed, you must click an account, type the account's password, and then click Submit.

Figure 1-3. Prompting for administrator privileges.

In a domain, administrator accounts for users who have logged on to the computer are listed. These accounts can be either domain administrator accounts or local computer administrator accounts. To proceed, you must click an account, type the account's password, and then click Submit.

In a domain, you also have the option of choosing an administrator account other than those listed. To do this, click Use Another Account, type the account name, and then type the account's password. If the account is in the default domain, you don't have to specify the domain name. If the account is in another domain, you must specify the domain and the account name using the format domain\username, such as cpandl\williams.

When you are logged on using an administrator user account, you are asked to confirm that you want to continue, as shown in Figure 1-4. You can click Continue to allow the task to be performed or Cancel to stop the task from being performed. Clicking Details shows the full path to the program being executed.

Figure 1-4. Prompting for confirmation to continue.

An important related change has to do with elevation of privileges. Elevation allows a standard user application to run with administrator privileges. You can run applications with elevated privileges by following these steps:

1. | Right-click the application's shortcut on the menu or on the desktop and then select Run As Administrator.
2. | When you see the UAC elevation prompt, proceed as you normally would to allow the application to run with administrator privileges.

Note

You must run the Command Prompt window with elevated privileges to perform administration at the command line. If you do not do this, you will see an error when you try to run an administrator utility or perform a task that requires administrator privilege.

Logging on to Windows Vista

In a workgroup, Windows Vista displays a Log On screen at startup. All standard user and administrator accounts that you've created on the computer are listed on the Log On screen. To log on, you click the account name. If the account is password protected, you must click the account name, type the account password, and then click the arrow button.

In a domain, Windows Vista displays a blank startup screen after initializing the operating system. You must press Ctrl+Alt+Del to display the Log On screen. By default, the last account to log on to the computer is listed in computer\username or domain\username format. To log on to this account, you type the account password and then click the arrow button. To log on to a different account, click the Switch User button, press Ctrl+Alt+Del, and then click Other User. The logon information you must provide depends on what type of account you are using.

  • If the account is in the default domain, type the user name and password and then click the arrow button.

  • If the account is in another domain, you must specify the domain and the account name using the format domain\username, such as cpandl\williams.

  • If you want to log on to the local machine, type .\username where username is the name of the local account, such as .\williams.

Using Fast User Switching with Windows Vista

Windows Vista supports fast user switching in both domain and workgroup configurations. When a user is already logged on to a computer running Windows Vista, you can use fast user switching to allow another user to log on without requiring the current user to log off.

To switch users, press Ctrl+Alt+Del and then click the Switch User button. In a workgroup, the Log On screen is displayed as at startup. In a domain, a screen appears with the message "Press Ctrl+Alt+Del To Log On," and you must press Ctrl+Alt+Del again to display the Log On screen.

Managing User Account Passwords with Windows Vista

Unlike earlier versions of Windows, Windows Vista provides fast and easy ways to manage user account passwords. You can easily perform the following tasks:

  • Change the current user's password

  • Change the password for another domain or local computer account

  • Create a password reset disk

  • Reset a user's password

These tasks are discussed in the sections that follow.

Changing the Current User's Password

You can change the current user's password by completing the following steps:

1. | Press Ctrl+Alt+Del and then click the Change A Password option. Note In a domain, the current user's domain account name is listed in domain\username format. In a workgroup, the current user's local account name is listed.
2. | Type the current password for the account in the Old Password text box.
3. | Type and confirm the new password for the account in the New Password and the Confirm Password text boxes.
4. | Click the arrow button to confirm the change.
Changing Other Account Passwords

You can change the password for a domain or local account other than the current user's account by completing these steps:

1. | Press Ctrl+Alt+Del and then click the Change A Password option.
2. | Click in the User Name text box and then type the name of the account. Note For a domain account, specify the domain and the account name using the format domain\username, such as cpandl\williams. For a local computer account, type .\username where username is the name of the local account, such as .\williams.
3. | Type the current password for the account in the Old Password text box.
4. | Type and confirm the new password for the account in the New Password and the Confirm Password text boxes.
5. | Click the arrow button to confirm the change.
Creating and Using a Password Reset Disk

Passwords for domain users and local users are managed in different ways. In domains, passwords for domain user accounts are managed by administrators. Administrators can reset forgotten passwords using the Active Directory Users And Computers console.

In workgroups, passwords for local machine accounts can be reset using a password reset disk. You can create a password reset disk for the current user by completing these steps:

1. | Press Ctrl+Alt+Del and then click the Change A Password option.
2. | Click Create A Password Reset Disk to start the Forgotten Password wizard.
3. | In the Forgotten Password wizard, read the introductory message and then click Next.
4. | Insert a blank, formatted disk into drive A and then click Next.
5. | Type the password for the current account in the text box provided and then click Next.
6. | After the wizard creates the password reset disk, remove the disk and then click Finish.

Be sure to store the password reset disk in a secure location, because any user with access to the disk can use it to gain access to the user's data. If a user is unable to log in because he or she has forgotten the password, you can use the password reset disk to create a new password and log in to the account using this password.

Resetting a User's Password

You can reset a password by following these steps:

1. | On the Log On screen, click the arrow button without entering a password and then click OK. The Reset Password option should be displayed. If the user has already entered the wrong password, the Reset Password option might already be displayed.
2. | Click Reset Password. This starts the Reset Password wizard.
3. | In the Reset Password wizard, read the introductory message and then click Next.
4. | Insert the password disk into drive A and then click Next.
5. | Follow the prompts to complete the password reset process.

Turning Off and Shutting Down Computers Running Windows Vista

By default, when you turn off a computer running Windows Vista, the computer enters the sleep state rather than turning off completely. When entering the sleep state, the operating system automatically saves all work, turns off the display, and puts the computer in sleep mode. Sleep mode is a low-power consumption mode in which the state of the computer is maintained in the computer's memory, and the computer's fans and hard disks turn off.

You can cause most computers to enter the sleep state by clicking the Start button and then clicking the Power button on the Start menu. To wake the computer from the sleep state, you can press the power button on the computer's case or press any key on the keyboard. Because Windows Vista saves the computer state before entering sleep mode, you don't need to exit programs before you do this. Because the computer uses very little energy in the sleep state, you don't have to worry about wasting energy.

Tip

Sleep mode works in a slightly different way with mobile computers. You can turn off and turn on mobile computers by closing or opening the lid. When you close the lid, the laptop enters the sleep state. When you open the lid, the laptop wakes up from the sleep state. If, while in the sleep state, the mobile computer's battery runs low on power, the state of the computer is saved to the hard disk and then the computer shuts down completely. This final state is similar to the hibernate state used in Windows XP. To learn more about mobile computers and power options, see Chapter 7, "Managing Laptops and Traveling Users."

There are instances in which a computer can't use the sleep state. The system hardware, state, and configuration can affect the way the Power button works. Some computer hardware doesn't support the sleep state. In this case, the computer can't use the sleep state, and turning off the computer turns it off completely. This is also the case when the computer has updates installed that require a restart or you've installed programs that require a restart. Additionally, if an administrator has reconfigured the power options on the computer and set the Power button to the Shut Down action, the computer can't use the sleep state, and turning off the computer turns it off completely.

To help you determine at a glance how the Power button works, Windows Vista displays two different views for the Power button. If Windows Vista shows an amber Power button, depicting a shield with a line through the top of it, the computer will turn off and enter the low-power sleep state when you click the Power button. If Windows Vista shows a red Power button, depicting a shield with a line through the middle of it, the computer will shut down and completely turn off when you click the Power button.

Caution

When working with computers in the sleep state, it is important to keep in mind that the computer is still drawing power. You should never install hardware inside the computer or connect devices to the computer when it is in the sleep state. To avoid possible confusion regarding the sleep state and the power-down state, be sure to unplug a computer running Windows Vista before installing or connecting devices. The only exceptions are external devices that use universal serial bus (USB) or IEEE 1394 (FireWire) ports. You can connect USB and FireWire devices without shutting down the computer.


Navigating Architecture Changes in Windows Vista

Windows Vista is very different from its predecessors. These differences present a special challenge when you are planning to deploy and use Windows Vista in the enterprise, especially if you want to maximize your return on investment (ROI) and reduce your total cost of ownership (TCO). To help you get the most from Windows Vista, the sections that follow examine the operating system and its key features.

Understanding Modularization and Windows Imaging

Windows Vista features a revolutionary architecture that is both language-independent and hardware-independent. Windows Vista achieves language-independence from its new modular component design and hardware-independence from its new imaging format. In a modular component design, each component is designed as a smaller, independent unit that performs a particular task or function. Thanks to modularization, every component of the operating system, from device drivers to language packs and service packs, can be created as a module that can be selectively swapped in or out to customize the operating system environment.

When you update Windows Vista by adding or removing features, applying hotfixes, or installing service packs, you are simply modifying the set of modules available. And because these modules are independent, you can make these changes without impacting the system as a whole. Because language packs are separate modules as well, you can easily implement different language configurations and don't need separate installations for each language.

Microsoft distributes Windows Vista on media with Windows Imaging Format (WIM) disk images. WIM uses compression and single-instance storage to dramatically reduce the size of image files. Compression reduces the size of the image in much the same way that Zip compression reduces the size of files. Using single-instance storage reduces the size of the image because only one physical copy of a file is stored for each instance of that file in the disk image. Because WIM is hardware-independent, Microsoft can ship a single binary to all its customers around the world: one binary for 32-bit architectures and one binary for 64-bit architectures.

Windows Vista can be installed using either automated or interactive setup. You can automate the installation of Windows Vista in several ways. You can:

  • Create an unattended installation answer file Requires creating an unattended installation answer file. Windows Vista uses a standards-based single-format answer file. This file, called Unattend.xml, is written in the Extensible Markup Language (XML), making it easier to process using standard tools. By creating a custom answer file and then running Setup using this answer file, you can perform unattended installations of computers running Windows Vista. Setup can then install the operating system from a distribution share or from media.

  • Use Sysprep Image-Based Installation Requires running the System Preparation command-line tool (Sysprep.exe) on a computer that you want to act as the master deployment computer, and then creating a disk image of this computer's configuration. Sysprep is stored in the %SystemRoot%\System32\Sysprep folder. The Windows Automated Installation Kit (Windows AIK) includes Windows System Image Manager and XImage to help you use Sysprep for deployments. You use Windows System Image Manager to create answer files for unattended installations. You use XImage to create and manage disk images.

By using WIM as its disk imaging format and taking advantage of the modular design of Windows Vista, XImage significantly reduces the number of disk images that must be maintained. You no longer need to maintain multiple hardware-dependent disk images or multiple language-dependent disk images. Instead, you typically will need only a single disk image for each chip architecture used in your organization. You can then use different installation scripts to customize the operating system installation as necessary.

WIM has other advantages over earlier disk image formats as well. WIM enables you to modify and maintain disk images offline, which means you can add or remove optional components and drivers or perform updates without having to create a new disk image. To do this, you mount the disk image as a folder and then use Windows Explorer or other tools to update, manage, or remove files as necessary.

Windows System Image Manager, XImage, and Sysprep provide several different ways to automate deployment. The basic steps follow:

1. | Set up and configure Windows Vista on a computer not being used for normal operations, and then install and configure any necessary components and applications.
2. | Run Sysprep to prepare the computer for capture. Sysprep removes unique identifiers from the computer and designates it as a master deployment computer. At the end of this process, the computer no longer has identifying information that allows it to be logged onto and used within a domain or workgroup setting.
3. | Use the XImage/Capture option to capture a disk image and store this image on media or in a distribution share. The image can be maintained offline by using the XImage/Mountrw option to mount the image in read/write mode so you can make any necessary changes. Use the XImage/Unmount command to unmount the image when you are finished making changes.
4. | Use Windows System Image Manager to create your unattended installation answer files. You can then create deployment scripts that configure the computer, run Setup using the answer file, and apply the disk image you've previously created.
5. | Run your deployment script to configure the computer and install the operating system.

Understanding the Windows Preinstallation Environment

With Windows Vista, Windows Preinstallation Environment 2.0 (Windows PE 2.0) replaces MS-DOS as the preinstallation environment. Windows PE 2.0 is a bootable startup environment that provides operating system features for:

  • Installation When you install Windows Vista, the graphical tools that collect system information during the setup phase are running within Windows PE.

  • Deployment When a new computer performs a network boot, the built-in Pre-boot Execution Environment (PXE) client can connect to a Windows Deployment Service server, download a Windows PE image across the network, and then run deployment scripts from within this environment.

  • Recovery Windows PE enables you to access and run the Startup Repair Tool if Windows Vista fails to start because of a corrupted system file.

  • Troubleshooting You can manually start Windows PE to perform troubleshooting or diagnostics testing if Windows Vista is experiencing problems that can't otherwise be diagnosed.

Windows PE is modular, extensible, and provides full access to partitions formatted using file allocation table (FAT) and NT file system (NTFS). Because Windows PE is built from Windows Vista components, you can run many Windows Vista applications, work with hardware devices, and communicate across Internet Protocol (IP) networks. Several command-line tools are available in Windows PE, including:

  • DiskPart A management tool for creating and working with disks, partitions, and volumes

  • Drvload A support tool for adding device drivers and dynamically loading a driver after Windows PE has started

  • Net A set of support commands that enables you to manage local users, start and stop services, and connect to shared folders

  • Netcfg A management tool that configures network access

For deployment, you can execute these tools from within configuration scripts to perform key configuration tasks. You can:

  • Use Netcfg to configure network access.

  • Use Drvload to install a driver and use the hardware without restarting the computer.

  • Run DiskPart to partition and format the computer's hard disk.

  • Use NET SHARE to connect to a shared folder containing the Windows Vista Setup files.

  • Run the Windows Vista Setup program to install the operating system.

As with Windows Vista itself, Windows PE can be contained within a WIM disk image. When you store a Windows Vista image in a WIM disk image, the only way to start Windows Vista is to copy the full image to the computer's hard disk. When you store Windows PE in a disk image, however, you can start it directly from the image without having to copy it to the computer's hard disk. This enables you to store Windows PE disk images on bootable media, such as a DVD or USB flash drive, and then start Windows PE directly from that media. The Windows Vista distribution media uses this technique to load Windows PE into RAM during setup of the operating system.

You can load Windows PE into RAM as well, which might be necessary for troubleshooting. When you do this, the Windows PE boot loader creates a virtual RAM disk in memory and then copies a compressed version of Windows PE to the RAM disk. Afterward, the boot loader mounts the RAM disk as if it were a disk drive and starts Windows PE. Running Windows PE from RAM enables you to write temporary files to the virtual RAM disk, which isn't possible when running from read-only media such as a CD. It also enables you to remove the Windows PE media after Windows PE has started, and then insert different media into the computer's CD-ROM or DVD-ROM drive.

When working with Windows PE, keep the following in mind:

  • Windows PE requires a computer with a VESA-compatible display and a minimum of 256 MB of RAM. During startup, if Windows PE can't detect the video settings, it uses a screen resolution of 640 x 480 pixels. Otherwise, it uses the highest resolution possible.

  • Windows PE supports both IPv4 and IPv6. Although you can access shared folders on other computers from Windows PE, other computers cannot access files or folders on a computer running Windows PE.

  • Windows PE always starts with the default drive letter assignments. This means drive letter assignments aren't persistent between sessions.

  • Windows PE doesn't support the Microsoft .NET Framework or Windows On Windows (WOW). This means you cannot use .NET applications on any versions of Windows PE, 16-bit applications on 32-bit versions of Windows PE, or 32-bit applications on 64-bit versions of Windows PE.

  • Windows PE automatically restarts after running for 24 hours. This is meant as a safeguard to prevent Windows PE from being used as a general-purpose operating system.

Understanding the Windows Pre-Boot Environment

Although earlier versions of the Windows operating system use Ntldr, Ntdetect.com, and Boot.ini to start up the operating system, Windows Vista has an extensible pre-operating system boot environment that can be customized to meet the needs of various firmware interfaces. This boot environment has two key components:

  • Windows Boot Manager Controls the startup experience and enables you to choose which boot application to run

  • Boot applications Load a specific operating system or operating system version At startup, computers running Windows Vista enter the pre-boot environment prior to the loading of the operating system. The pre-boot environment uses Windows Boot Manager to control the boot experience and determine which boot applications are run. The standard boot application for Windows Vista is the Windows Boot Loader. Windows Boot Loader is responsible for accessing entries in the Boot Configuration Data (BCD) store. Entries in the BCD store contain boot configuration parameters and control how the operating system is started.

The BCD store is used to abstract the underlying firmware, thereby making it easier for Windows Vista to work with new firmware models such as the Extensible Firmware Interface (EFI). BCD also provides the foundation for a variety of new features in Windows Vista, including the Startup Repair Tool and Multi-User Install shortcuts, which can be launched in the pre-boot environment.

The BCD store is contained in a file called the BCD registry file. The BCD registry file is located in the \Boot\Bcd directory of the active partition on BIOS-based computers and in the EFI system partition on EFI-based computers. The BCD store contains multiple entries on most computers. These entries include:

  • One Windows Boot Manager entry. Because there is only one boot manager, there is only one boot manager entry in the BCD store.

  • One Windows Boot Loader application entry for each Windows Vista operating system installed on the computer.

  • One legacy operating system entry.

The legacy operating system entry is not for a boot application. Instead, this entry uses Ntldr and Boot.ini to start up a Windows operating system earlier than Windows Vista. You will use this entry to start up Microsoft Windows Server 2003, Windows XP, and earlier operating systems if they are installed on a computer.

Several administrator utilities are provided to help manage BCD entries, including:

  • Startup And Recovery Used to configure basic startup options

  • System Configuration Used to configure advanced startup options

  • BCDEdit Used to display and manage BCD entries

Startup And Recovery, shown in Figure 1-5, enables you to select the default operating system to start if you have multiple operating systems installed on your computer. You can also specify timeout values for operating system selection lists and recovery options. To access Startup And Recovery, follow these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link and then click System.
3. | In the System utility, click Advanced System Settings in the left pane.
4. | On the Advanced tab of the System Properties dialog box, click Settings under Startup And Recovery.

Figure 1-5. The Startup And Recovery dialog box.

The System Configuration utility, which is discussed in detail in Chapter 2 and shown in Figure 1-6, enables you to control boot options. You can use the boot options to:

  • Set the default operating system and start the operating system in safe mode

  • Boot to the Windows prompt without loading the graphical components of the operating system

  • Force the computer to use standard video graphics adaptor (VGA) display settings

  • Perform other advanced configuration options

Figure 1-6. The System Configuration utility.

[View full size image]

To open the System Configuration utility, follow these steps:

1. | Click Start.
2. | Type msconfig.exe in the Search box.
3. | Press Enter.

BCDEdit is an administrative command-line utility that enables you to display and manage BCD entries. You can use BCDEdit to display the contents of the BCD store by completing these steps:

1. | Click Start, point to All Programs, and then click Accessories.
2. | Right-click Command Prompt and then select Run As Administrator.
3. | Type bcdedit at the command prompt.

Note

Because of changes to the operating system due to User Account Controls, you must run the command prompt with administrator credentials to perform administrative tasks at the command line. If you don't start the command prompt as an administrator, you will be denied permission to run BCDEdit and perform tasks that require administrator credentials.

Example output from BCDEdit is shown as Listing 1-1. This example output includes three entries: one for Windows Boot Manager, one for the Windows legacy operating system loader, and one for Windows Boot Loader. You can type bcdedit /? at a command prompt to display all the options for using this utility.

Listing 1-1. BCD store entries displayed using BCDEdit

Windows Boot Manager
--------------------
identifier       {bootmgr}
device           partition=C:
description      Windows Boot Manager
locale           en-US
inherit          {globalsettings}
bootdebug        No
default          {current}
resumeobject     {0c848f2d-e023-123a-c23b-23435353de20}
displayorder     {ntldr}
                 {current}
toolsdisplayorder{memdiag}
timeout          30

Windows Legacy OS Loader
------------------------
identifier       {ntldr}
device           partition=C:
path             \ntldr
description      Legacy (pre-Longhorn) Microsoft Windows Operating System

bootdebug        No

Windows Boot Loader
-------------------
identifier       {current}
device           partition=D:
path             \Windows\system32\winload.exe
description      Microsoft Windows
locale           en-US
inherit          {bootloadersettings}
bootdebug        Yes
osdevice         partition=D:
systemroot       \Windows
resumeobject     {0c32432d-d232-1def-d23a-2342a35432a0}
nx               OptIn
debug            No
ems              No


Chapter 2. Managing Windows Vista Systems

In this chapter:
Getting Around Windows Vista | 26
Managing User Account Control and Elevation Prompts | 31
Supporting Computers Running Windows Vista | 36
Using System Support Tools | 46
Managing System Properties | 55

One of your primary responsibilities as an administrator is to manage the operating system configuration. As you'll learn in this chapter, managing Microsoft Windows Vista is very different from managing earlier versions of the Windows operating system, and these differences all stem from the important architecture changes discussed in Chapter 1, "Introduction to Windows Vista Administration." The previous chapter discussed the following changes:

  • Windows Vista has a modular architecture and its binaries are distributed using Windows Imaging Format (WIM) disk images. Because of this, you can update and maintain Windows Vista in different ways than you can its predecessors.

  • Windows Vista doesn't use Ntldr and Boot.ini to load the operating system. Instead, Windows Vista has a pre-boot environment in which Windows Boot Manager is used to control startup and load the boot application that you've selected.

  • Windows Vista provides User Account Control (UAC), a fundamental change in the way security is implemented and managed. Because of UAC, Windows Vista handles user privileges and access controls differently than its predecessors do.

As a system administrator, you need to know how these changes affect system management, and you need to know how to use Windows Vista's redesigned system management tools to configure the operating system.


Getting Around Windows Vista

Prior to performing administration of Windows Vista, you should take a few minutes to get to know its enhanced interface. In this section, I'll introduce some key interface enhancements of Windows Vista, including those for the taskbar, the Start menu, and Control Panel. For additional information on interface changes, see Chapter 4, "Customizing the Desktop and the Interface."

Working with the Taskbar

The taskbar and the menu system are the primary means of getting around in Windows Vista. You use the Start button on the taskbar to display the Start menu. The Start menu in turn enables you to run programs, open folders, get help, and search for items stored on the computer. The taskbar also features Quick Launch items, quick access buttons for running programs, and a notification area.

By default, the taskbar is locked and appears as shown in Figure 2-1. Quick Launch items, displayed to the right of the Start button, enable you to quickly start commonly used programs, such as Microsoft Internet Explorer 7, to quickly switch to 3D flip view, and to quickly display the Desktop. You can add any program directly to the Quick Launch toolbar from the Start menu by clicking the Start button, navigating to the program that you want to be able to access quickly, right-clicking the program name, and then selecting Add To Quick Launch.

Figure 2-1. The taskbar.

[View full size image]

Although the Quick Launch toolbar is displayed by default, it can be removed by right-clicking the task bar, pointing to Toolbars, and selecting Quick Launch. If the Quick Launch toolbar isn't displayed and you want to display it, right-click the taskbar, point to Toolbars, and then select Quick Launch.

The taskbar displays a button for each program running interactively. Clicking the button enables you to display the program window in front of all other windows. When you are running multiple similar programs, these programs are grouped automatically under one taskbar button. Clicking the taskbar button then displays a dialog box with an entry for each folder window, enabling you to select which item to display.

With Windows Aero, when you move the mouse pointer over a taskbar button, Windows Vista displays a live thumbnail of the window, showing the content of that window. For grouped taskbar buttons, Windows displays a thumbnail of the most recently opened window and the thumbnail appears to include a group of windows.

Beyond this, you can work with running programs in several different ways:

  • If you press Alt+Tab, Windows Vista displays a view window containing live thumbnails of all open windows. This view is called a flip view. Holding down the Alt key keeps the flip view open. Pressing Tab while holding down the Alt key allows you to cycle through the windows. When you release the Alt key, the currently selected window is brought to the front. You can also select a window and bring it to the front by clicking the thumbnail.

  • If you press the Windows logo key and Tab, Windows Vista displays a skewed 3D view of all open windows. This view is called a 3D flip view. Holding down the Windows logo key keeps the 3D flip view open. Pressing the Tab key while holding down the Windows logo key enables you to cycle through the windows. When you release the Windows logo key, the currently selected window is brought to the front. You can also select a window and bring it to the front by clicking the 3D window view.

The notification area, on the far right on the taskbar, is divided into an area for standard notification icons, such as those used by programs you've installed, and an area for system notification icons, such as those for the clock, volume, network, and power. To manage the notification area settings, right-click the Start button and then select Properties. In the Taskbar And Start Menu Properties dialog box, click the Notification Area tab and then use the options provided to configure notification.

Working with the Start Menu

The Start menu is the gateway to all the programs installed on a computer running Windows Vista. As shown in Figure 2-2, when you click the Start button, you see a list of recently used programs and programs that have been pinned to the Start menu. By default, Internet Explorer and Windows Mail (previously called Microsoft Outlook Express) are pinned to the Start menu, and up to eight recent programs are displayed as well.

Figure 2-2. The Start menu.

The Search box on the Start menu enables you to search a computer for files, folders, or programs that match the search text you've entered. Working with the Search box is easy. To do so, follow these steps:

1. | Begin a search by typing your search text into the Search box. Search results are displayed in the left pane of the Start menu.
2. | Click an item in the results list to open that item.
3. | Click the Clear button to the right of the Search box, or press the Esc key, to clear the search results and return to normal view.

Tip

If you're already at the Start menu, you don't need to click in the Search box before you begin typing. Just type your search text.

The system feature that performs the search is the Windows Search service. Windows Search service is the next generation of the Indexing service included in earlier versions of Windows. Windows Search service searches the entire computer for the search text you've specified. The search service returns any related results after performing the following tasks.

  • Matching the search text to words that appear in the title of any program, file, or folder

  • Matching the search text to properties of programs, files, and folders as well as the contents of text-based documents

  • Matching the search text to entries in the Favorites and History folders

By default, the service indexes the documents contained in the %SystemDrive%\Users folders and the %SystemDrive%\ProgramData\Microsoft\Windows\StartMenu folders, enabling it to quickly identify matches with items stored in these folders. You can use the Indexing Options utility in Control Panel to view indexing status and to configure indexing options. By default, index data is stored in the %SystemRoot%\ ProgramData\Microsoft\Search folder.

Note

When you install and configure Microsoft Office Outlook 2007, user mailboxes stored or locally cached on the computer are indexed automatically. Any locally cached public folders are indexed as well.

Tip

You can perform local folder and Internet searches as well. When you open a folder, you'll find a Search text box in the upper-right corner of the Windows Explorer window. By default, typing search text in this text box and pressing Enter results in localized searches of the currently open folder and its subfolders. To perform an Internet search, click the Start button and then enter your search text. Afterward, click the Options button to the right of the Search box and then select the Search The Internet option. Search The Internet uses the computer's default search provider to search the Internet using the search text that you've provided. The default search provider is MSN Search. You can use the Internet Options utility in Control Panel to set the default search provider.

The right pane of the Start menu provides options buttons that you can use to access commonly used folders and features. From top to bottom, the option buttons appear as follows:

  • Current user Shows the name of the currently logged-on user. Clicking this option opens the user's personal folder in Windows Explorer.

  • Documents Displays the current user's Documents folder in Windows Explorer.

  • Pictures Displays the current user's Pictures folder in Windows Explorer.

  • Music Displays the current user's Music folder in Windows Explorer.

  • Games Displays the Microsoft Games folder in Windows Explorer. The Games button is not listed in the Start menu for business editions of Windows Vista.

  • Search Displays Windows Explorer, which you can use to search the computer.

  • Recent Items Displays a menu that lists recently opened files.

  • Computer Displays a window in which you can access hard disk drives and devices with removable storage. In the Computer window, double-click a disk to browse its contents.

  • Network Displays a window in which you can access the computers and devices on your network.

  • Connect To Displays the Connect To A Network dialog box for connecting to wireless networks.

  • Control Panel Displays Control Panel, which provides access to system configuration and management tools.

  • Default Programs Displays the Default Programs window, which lets you choose the programs that Windows Vista uses by default for documents, pictures, and more. You can also associate file types with programs and configure AutoPlay settings.

  • Help And Support Displays the Windows Help And Support console, which you can use to browse or search help topics.

Several additional options can be added to the right pane, including:

  • Administrative Tools Displays a list of system administration tools.

  • Printers Displays a Printers window, which lists and provides access to currently configured printers.

  • Run Displays the Run dialog box, which can be used to run commands.

To display these additional options, follow these steps:

1. | Right-click the Start button and then select Properties. This displays the Taskbar And Start Menu Properties dialog box.
2. | On the Start Menu tab, click the Customize button. In the Customize Start Menu dialog box, scroll down through the options.
3. | To display the Printers option, select the Printers check box.
4. | To display the Run option, select the Run Command check box.
5. | To Display the Administrative Tools option, select Display On The All Programs Menu And The Start Menu option under System Administrative Tools.
6. | Click OK.

Working with Control Panel

Most of the tools you use to manage computers running Windows Vista are accessible from Control Panel. You can access Control Panel by clicking the Start button on the taskbar and then clicking Control Panel. You can also display Control Panel in any Windows Explorer view by clicking the leftmost option button in the Address bar and then selecting Control Panel.

Control Panel in Windows Vista has two views:

  • Category Control Panel, or simply Control Panel, is the default view. This view provides access to system utilities by category and task.

  • Classic Control Panel is an alternative view. This view provides the look and functionality of Control Panel in Windows 2000 and earlier versions of Windows.

Unlike Classic Control Panel, which lists each individual utility available, Category Control Panel is a console window in which 10 categories of utilities are listed. As shown in Figure 2-3, each category includes a top-level link, and under this link are some of the most frequently performed tasks for the category. If you click a category link, Control Panel displays a list of utilities in that category. Each utility has a link that opens the utility, and under this link are several of the most frequently performed tasks for the utility.

Figure 2-3. Control Panel.

[View full size image]


Managing User Account Control and Elevation Prompts

User Account Control (UAC) represents a significant change in the way user accounts are used and configured. It affects which privileges standard users and administrator users have, how applications are installed and run, and much more. In this section, I'll extend the discussion provided in Chapter 1 and provide a comprehensive look at how UAC affects user and administrator accounts. This is essential information to know when managing Windows Vista systems.

Note

Learning how UAC works will help you be a better administrator. To support UAC, many aspects of the Windows operating system had to be reworked. Some of the most extensive changes have to do with how applications are installed and run. In Chapter 5, "Installing and Maintaining Programs," you'll find a complete discussion of how the architecture changes affect programs running on Windows Vista.

Redefining Standard User and Administrator User Accounts

In Windows XP and earlier versions of Windows, malicious software programs can exploit the fact that most user accounts are configured as members of the local computer's administrators group. Not only does this allow malicious software to install itself, but it also allows malicious software to use these elevated privileges to wreak havoc on the computer, because programs installed by administrators can write to otherwise secure areas of the registry and file system.

To combat the growing threat of malicious software, organizations have locked down computers, required users to log on using standard user accounts, and required administrators to use Run As for performing administrative tasks. Unfortunately, these procedural changes can have serious negative consequences on productivity. A person logged on as a standard user under Windows XP can't perform some of the most basic tasks, such as changing the system clock and calendar, changing the computer's time zone, or changing the computer's power management settings. Many software programs designed for Windows XP simply will not function properly without local administrator rightsthese programs use local administrative rights to write to system locations during installation and during normal operations. Additionally, Windows XP doesn't let you know beforehand when a task you are performing requires administrator privileges.

User Account Control seeks to improve usability while at the same time enhancing security by redefining how standard user and administrator user accounts are used. User Account Control represents a fundamental shift in computing by providing a framework that limits the scope of administrator-level access privileges and that requires all applications to run in a specific user mode. In this way, UAC prevents users from making inadvertent changes to system settings and locks down the computer to prevent unauthorized applications from installing or performing malicious actions.

Because of UAC, Windows Vista defines two levels of user accounts: standard and administrator. Windows Vista also defines two modes (run levels) for applications: standard user mode and administrator mode. Although standard user accounts can use most software and can change system settings that do not affect other users or the security of the computer, administrator user accounts have complete access to the computer and can make any desired changes. When an administrator user starts an application, her access token and its associated administrator privileges are applied to the application, giving her all the rights and privileges of a local computer administrator for that application. When a standard user starts an application, her access token and its associated privileges are applied to the application at run time, limiting her to the rights and privileges of a standard user for that application. Further, all applications are configured to run in a specific mode during installation. Any tasks run by standard mode applications that require administrator privileges are not only identified during setup but also require user approval to run.

In Windows Vista, the set of privileges assigned to standard user accounts has changed. Standard user accounts can perform the following tasks:

  • Install fonts, view the system clock and calendar, and change the time zone.

  • Change the display settings and the power management settings.

  • Add printers and other devices (when the required drivers are installed on the computer or are provided by an IT administrator).

  • Download and install updates (when the updates use UAC-compatible installers).

  • Create and configure virtual private network (VPN) connections. VPN connections are used to establish secure connections to private networks over the public Internet.

  • Install Wired Equivalent Privacy (WEP) to connect to secure wireless networks. The WEP security protocol provides wireless networks with improved security.

Windows Vista also defines two run levels for applications: standard and administrator. Windows Vista determines whether a user needs elevated privileges to run a program by supplying most applications and processes with a security token. If an application has a standard token, or an application cannot be identified as an administrator application, elevated privileges are not required to run the application, and Windows Vista starts it as a standard application by default. If an application has an administrator token, elevated privileges are required to run the application, and Windows Vista prompts the user for permission or confirmation prior to running the application.

The process of getting approval prior to running an application in administrator mode and prior to performing tasks that change system configuration is known as elevation. Elevation enhances security and reduces the impact of malicious software by notifying users prior to performing any action that could impact system settings and by preventing applications from using administrator privileges without first notifying users. Elevation also protects administrator applications from attacks by standard applications. For more information on elevation and how UAC works with applications, see Chapter 5.

Optimizing User Account Control and Admin Approval Mode

Admin Approval Mode is the key component of UAC that determines whether and how administrators are prompted when running administrator applications. The default way that Admin Approval Mode works is as follows:

  • All administrators, including the built-in local administrator account, run in, and are subject to, Admin Approval Mode.

  • Because they are running in and subject to Admin Approval Mode, all administrators, including the built-in local administrator account, see the elevation prompt whenever they run administrator applications.

In Group Policy under Local Policies\Security Options, five security settings determine how Admin Approval Mode and elevation prompting work. These security settings are:

  • User Account Control: Behavior Of The Elevation Prompt For Standard Users Determines whether users logged on with a standard user account see an elevation prompt when running administrator applications. By default, users logged on with a standard user account are prompted for the credentials of an administrator when running administrator applications. You can also configure this option so users are not prompted, in which case, the users will not be able to elevate privileges by supplying administrator credentials. This doesn't prevent users from right-clicking an application shortcut and selecting Run As Administrator.

  • User Account Control: Switch To The Secure Desktop When Prompting For Elevation Determines whether Windows Vista switches to the secure desktop before prompting for elevation. As the name implies, the secure desktop restricts the programs and processes that have application to the desktop environment and in this way reduces the possibility that a malicious program or user could gain access to the process being elevated. By default, this security option is enabled. If you don't want Windows Vista to switch to the secure desktop prior to prompting for elevation, you can disable this setting. However, this makes the computer more susceptible to malware and attack.

  • User Account Control: Run All Administrators In Admin Approval Mode Determines whether users logged on with an administrator account are subject to Admin Approval Mode. By default, this feature is enabled, which means administrators are subject to Admin Approval Mode and further subject to the elevation prompt behavior stipulated for administrators in Admin Approval Mode. If you disable this setting, users logged on with an administrator account are not subject to Admin Approval and therefore are not subject to the elevation prompt behavior stipulated for administrators in Admin Approval Mode.

  • User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode Determines whether administrators subject to Admin Approval Mode see an elevation prompt when running administrator applications and also determines how the elevation prompt works. By default, administrators are prompted for consent when running administrator applications. You can configure this option so administrators are prompted for credentials, as is the case with standard users. You can also configure this option so administrators are not prompted at all, in which case, the administrator will not be able to elevate privileges. This doesn't prevent administrators from right-clicking an application shortcut and selecting Run As Administrator.

  • User Account Control: Admin Approval Mode For The Built-In Administrator Account Determines whether users and processes running as the built-in local administrator account are subject to Admin Approval Mode. By default, this feature is enabled, which means the built-in local administrator account is subject to Admin Approval Mode and further subject to the elevation prompt behavior stipulated for administrators in Admin Approval Mode. If you disable this setting, users and processes running as the built-in local administrator are not subject to Admin Approval and therefore not subject to the elevation prompt behavior stipulated for administrators in Admin Approval Mode.

In a domain environment, you can use Microsoft Active Directory directory servicebased Group Policy to apply the desired security configuration to a particular set of computers. You can also configure these settings on a per-computer basis using local security policy. To do this, follow these steps:

1.
Click Start, All Programs, Administrative Tools, Local Security Policy. This starts the Local Security Policy console.

2.
In the console tree, under Security Settings, expand Local Policies and then select Security Options, as shown in Figure 2-4.

Figure 2-4. The Local Security Policy console.

[View full size image]

3.
Double-click the setting you want to work with, make any necessary changes, and then click OK. Repeat this step to modify other security settings as necessary.


Supporting Computers Running Windows Vista

To successfully manage a computer, diagnose problems, and troubleshoot support issues, you need to know how the computer is configured. Support tools you can use to get information on a computer's configuration include:

  • Computer Management Computer Management is a Microsoft Management Console that provides access to important system, services, and storage management tools.

  • System System is a tool for viewing basic information about a computer and managing system properties. The default view for the System tool replaces My Computer Information.

  • System Information System Information is a tool for obtaining detailed system statistics regarding configuration and resource availability. You can also use System Information to troubleshoot system problems.

  • Performance Rating And Tools Performance Rating And Tools is a tool for viewing a computer's performance rating and determining whether there are any issues causing performance problems.

In this section, I'll discuss techniques for working with these tools. A related tool for maintaining system performance is the Problem Reports And Solutions console. Details on working with Problem Reports And Solutions are discussed in Chapter 16, "Supporting and Troubleshooting Windows Vista."

Working with the Computer Management Console

The Computer Management console is designed to handle core system administration tasks on local and remote systems. If you've added the Administrative Tools menu to the Start menu as discussed previously, you can start the Computer Management console by clicking Start, clicking Administrative Tools, and then clicking Computer Management. You can also start the Computer Management console by following these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click Administrative Tools and then double-click Computer Management.

As Figure 2-5 shows, the main window has a multi-pane view similar to that in Windows Explorer. You use the console tree in the left pane for navigation and tool selection. The Action pane, on the far right, is similar to the shortcut menu that is displayed when you right-click an item. To display or close the Action pane, you need to click the Show/Hide Action Pane button on the console toolbar. Tools are divided into three broad categories:

  • System Tools General-purpose tools for managing systems and viewing system information

  • Storage Provides access to drive management tools

  • Services And Applications Used to view and manage the properties of services and applications installed on the server

Figure 2-5. Use the Computer Management console to manage network computers and resources.

[View full size image]

Within these categories are the following available tools:

  • Task Scheduler View and manage scheduled tasks. Scheduled tasks are used to automate processes, such as disk cleanup or diagnostics testing. Scheduled tasks and automation are discussed in Chapter 15, "Optimizing Windows Vista."

  • Event Viewer View the event logs on the selected computer. Event logs record important events that have taken place on the computer and can be used to determine if a computer has configuration issues or other types of problems. Events and event logs are covered in Chapter 16, "Supporting and Troubleshooting Windows Vista."

  • Local Users And Groups Manage local users and local user groups on the currently selected computer. Each client computer has both local users and local groups, which are separate from domain users and groups. Working with local users and groups is covered in Chapter 6, "Managing User Access and Security."

  • Performance Diagnostics Provides monitoring and reporting tools that you can use to determine a computer's current performance and to track performance over time. You can also use Performance Diagnostics to track a computer's reliability and stability relative to software changes and component failures. See Chapter 15 for more information.

  • Device Manager Use as a central location for checking the status of any device installed on a computer and for updating the associated device drivers. You can also use it to troubleshoot device problems. Managing devices is covered in Chapter 3, "Configuring Systems, Hardware Devices, and Drivers."

  • Disk Management Manages hard disks, disk partitions, and volume sets. Windows Vista supports disk spanning and disk striping. Disk spanning enables you to create a single volume that extends across multiple disks. Disk striping enables you to write data stripes across multiple disks for fast access to data. Neither technique provides failure protection, however, and if any disk in a spanned or striped volume fails, the entire volume fails.

  • Services View and manage system services running on a computer. In Windows Vista, every service has a recovery policy. If a service fails, Windows Vista will try to restart it automatically and automatically handle both service and non-service dependencies as well. Any necessary dependent services and system components start prior to attempting to start a failed service. Working with services is discussed in Chapter 16.

  • WMI Control View and manage Windows Management Instrumentation (WMI). WMI gathers system information, monitors system health, and manages system components. See the "Working with WMI Control" section in this chapter for more information.

When working with Computer Management, you can select a remote computer to manage by completing the following steps:

1. | Right-click the Computer Management entry in the console tree and then select Connect To Another Computer. This opens the Select Computer dialog box.
2. | Choose Another Computer and then type the fully qualified name of the computer you want to work with, such as cspc85.microsoft.com, where cspc85 is the computer name and microsoft.com is the domain name. Or click Browse to search for the computer with which you want to work.
3. | Click OK.

Getting Basic System and Performance Information

You use the System console to view and manage system properties. To access the System console, follow these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click System.

As Figure 2-6 shows, the System console is divided into four basic areas that provide links for performing common tasks and a system overview. These four areas are:

  • Windows Edition Shows the operating system edition and version.

  • System Lists the processor, memory, performance rating, and type of operating system installed on the computer. The type of operating system is listed as 32-bit or 64-bit.

  • Computer Name, Domain, And Workgroup Settings Provides the computer name, description, domain, and workgroup details. If you want to change any of this information, click Change Settings and then click the Network ID button in the System Properties dialog box.

  • Windows Activation Shows whether you have activated the operating system and the product key. If Windows Vista isn't activated yet, click the link provided to start the activation process and then follow the prompts. If you want to change the product key, click the Change Product Key link and then provide the new product key.

Figure 2-6. Use the System console to view and manage system properties.

[View full size image]

When you're working in the System console, links in the left pane provide quick access to key support tools, including the following:

  • Device Manager

  • Remote Settings

  • System Protection

  • Advanced System Settings

Clicking Change Settings under Computer Name, Domain, And Workgroup Settings displays the System Properties dialog box. Using System Properties to manage a computer's configuration is discussed in this chapter in the "Managing System Properties" section.

A computer's Windows Experience Index rating is important in determining which operating system features it supports. If the computer has not yet been rated for performance, you can click Score This Computer under System to start the performance rating process. Once you've rated a computer, you can click the Check Your Computer's Windows Experience Index Base Score link under System to access the Performance Rating And Tools console, shown in Figure 2-7.

Figure 2-7. Use the Performance Rating And Tools console to rate or view a computer's performance.

[View full size image]

The main part of the Performance Rating And Tools console shows the system's overall rating and lists the installed hardware in five categories:

  • Processor Shows the processor and processor speed

  • Memory Shows the total physical memory

  • Primary Hard Disk Shows the total capacity and total free space of the computer's system disk

    Note

    The system disk is the one where the operating system is installed. Typically, the system disk is also the boot, page file, and crash dump disk.

  • Graphics Shows the graphics card installed on the computer

  • Gaming Graphics Shows the amount of physical memory on the graphics card

Windows Vista uses the computer's overall rating and subratings to determine which personalization features should be configured for use. If a computer has a low rating, Windows Vista will recommend turning off some features, such as Aero glass, to improve system performance. Based on performance over time, Windows Vista may also recommend turning off or modifying other features to improve performance.

Tip

Several factors can adversely affect the performance rating, including the primary disk running low on free disk space. If you install new hardware on a computer or resolve a performance issue that affects the computer rating, such as low disk space, you can click Update My Score to update the computer's performance rating.

In Performance Information And Tools, any current performance issues can be reviewed by clicking Problem Reports And Solutions under See Also, and then, under Tasks, clicking See Problems To Check. Clicking the related View Details link for an issue enables you to view a detailed description of the problem. (See Figure 2-8.) Selecting the related check box for an issue and then clicking Check For Solutions enables you to get possible solutions to the problem.

Figure 2-8. Windows Vista offers solutions that may help you resolve performance issues.

[View full size image]

Once you've resolved all performance issues, you can remove the list of problems by following these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click Problem Reports And Solutions.
4. | In Problem Reports And Solutions, click Clear Solution And Problem History.
5. | Click Clear All.

Getting Advanced System Information

When you want to get detailed system information or check computer information on remote systems, use System Information (MSINFO32.EXE). You can access system information by clicking Start, typing msinfo32 into the Search box, and then pressing Enter. As shown in Figure 2-9, you can view system summaries by selecting the System Summary node. All configuration statistics provided are collected using the WMI service.

Figure 2-9. Advanced System Information can help you troubleshoot system configuration problems.

[View full size image]

The System Information tool provides detailed information on several major areas of the operating system:

  • Hardware Resources Provides detailed information on input/output (I/O), interrupt requests (IRQs), memory, direct memory access (DMA), and Plug and Play devices. A key area you'll want to check if a system is having a device problem is the Conflicts/Sharing node. This area provides a summary of devices that are sharing resources or causing system conflicts.

  • Components Provides detailed information on installed components from audio codecs to input devices to universal serial bus (USB) ports. A key area you'll want to check if a system is having a component problem is the Problem Devices node. This area provides information on components that have errors.

  • Software Environment Provides detailed information on the running configuration of the operating system. When you are troubleshooting problems with a remote system, you'll find the Software Environment area to be extremely useful. In addition to drivers, environment variables, print jobs, and network connections, you can also check running tasks, services, program groups, and startup programs.

If you want to browse configuration information for a remote computer, follow these steps:

1. | Access System Information. Select Remote Computer on the View menu. This displays the Remote Computer dialog box.
2. | In the Remote Computer dialog box, select Remote Computer On The Network.
3. | Type the computer name in the field provided.
4. | Click OK.

The account you use must have the appropriate administrator access permissions for the domain or the local machine as appropriate. If you have other problems obtaining information from a remote system, you may need to check the namespace used by the WMI service, as discussed in the following section of this chapter.

Working with WMI Control

Windows Management Instrumentation (WMI) is a key part of the Windows Vista operating system. It is used to gather system statistics, monitor system health, and manage system components. To work properly, WMI relies on the WMI service. This service must be running and properly configured for the environment.

You control the configuration of the WMI service through WMI Control, which can be accessed on a local or remote system using the following steps:

1. | Click Start, All Programs, Administrative Tools, and then click Computer Management. Alternatively, access Control Panel, click the System And Maintenance category heading link, click Administrative Tools, and then double-click Computer Management.
2. | Right-click the Computer Management entry in the console tree and select Connect To Another Computer. You can now choose the system that has the services that you want to manage.
3. | Expand the Services And Applications node by clicking the plus sign (+) next to it. Next, click WMI Control to select it. (This is necessary so the control is read in.) Right-click WMI Control and then select Properties.
4. | You can now use the WMI Control Properties dialog box to configure WMI.

As shown in Figure 2-10, the WMI Control Properties dialog box has the following tabs:

  • General Fields on this tab provide summary information for the system and WMI. WMI uses the credentials of the current user to obtain system information.

  • Backup/Restore Statistics gathered by WMI are stored in a repository. By default, this repository is located in %SystemRoot%\System32\Wbem\Repository. These statistics are automatically backed up at regular intervals. You can back up or restore the repository manually using the fields on this tab.

  • Security Security settings determine who has access to different levels of WMI statistics. By default, the Administrators group has full access to WMI, and the Authenticated Users group has permissions to execute methods, enable accounts, and write gathered statistics.

  • Advanced Advanced settings determine the default namespace for WMI. The default namespace is used in WMI scripting when a full namespace path isn't set for a WMI object. You can change the default setting by clicking Change, selecting a new default namespace, and then clicking OK.

Figure 2-10. WMI Control is used to manage the configuration of the WMI service.

Note

WMI maintains error logs that can be used for troubleshooting problems with the WMI service. These logs are stored by default in %SystemRoot%\System32\ Wbem\Logs. WMI maintenance files, logs, and repositories can use up a considerable amount of disk space on a system. On average, these files used 65 MB on my test systemsthe bulk of this (4050 MB) being used to maintain repository backup files.

Information gathered by WMI is stored in a collection of system files called a repository. By default, the repository files are stored under %SystemRoot%\System32\ Wbem\Repository. The repository is the heart of WMI and the Help And Support services framework. Information is moved through the repository using a staging file. If repository data or the staging file becomes corrupt, WMI might not function properly. This condition is usually temporary, but you can safeguard against it by backing up the repository file manually.

To back up the WMI repository manually, complete the following steps:

1. | Access the WMI Control Properties dialog box and click the Backup/Restore tab.
2. | Click Back Up Now. Next, use the Specify A Name For Your Backup File dialog box to set the file location and name of the WMI backup file. Then click Save.
3. | The Backup In Progress dialog box is displayed while the recovery file is being created. The recovery file is saved with an .rec extension, and its size depends on how much information is being stored. Usually this file is between 20-30 MB in size.

If you later need to restore the WMI repository from a backup file, complete these steps:

1. | Access the WMI Control Properties dialog box and click the Backup/Restore tab.
2. | Click Restore Now. Next, use the Specify A Backup File To Restore dialog box to set the location and name of the existing recovery file. Then click Open.
3. | The Restore In Progress dialog box is displayed temporarily, and then you'll see a warning prompt. Click OK.
4. | Your connection to WMI Control is broken. Once the restore operation is complete, you can reconnect to the computer. To do this, close and reopen the WMI Control Properties dialog box. This forces WMI Control to reconnect to the local or remote computer, but you can only do this if the restore is complete.

Note

If the connection fails, it usually means that WMI Control isn't finished restoring the repository. Wait for another 30 to 60 seconds and then try again.


Using System Support Tools

Windows Vista provides a wide range of support tools. Tools that are available include the following:

  • Backup (SDCLT.EXE) Runs Backup Status And Configuration, which you can use to back up and recover the Windows Vista system. See Chapter 16 for more information.

  • Built-In Diagnostics Scans the system, examining hardware components and software configurations for problems. This can be used to troubleshoot and resolve performance and configuration issues. Working with diagnostics tools is discussed in Chapter 12 and Chapter 16.

  • DirectX Diagnostic Tool (DXDIAG.EXE) Runs a diagnostic tool that you can use to troubleshoot problems with Microsoft DirectX. DirectX is used to speed up the performance of applications, provided the system hardware supports this feature.

  • Disk Cleanup (CLEANMGR.EXE) Runs the Disk Cleanup utility, which examines disk drives for files that aren't needed. By default, Disk Cleanup examines temporary files, the Recycle Bin, and various types of offline files to see whether there are files that can be deleted.

  • Disk Defragmenter (dfrgui.exe) Runs the Disk Defragmenter utility, which examines disk drives for fragmentation and can then be used to defragment the drive. A drive with many fragmented files can reduce the system's performance. See Chapter 15 for more information about this utility.

  • File Signature Verification Utility (SIGVERIF.EXE) Used to check operating system files that have been digitally signed. Any critical files that aren't digitally signed are displayed in a results list. The complete list of system files checked is available in a log file stored in %SystemRoot%\SIGVERIF.TXT.

  • Offer Remote Assistance Enables you to offer remote assistance to a user. If the user accepts the offer, you can troubleshoot problems on his system as discussed in Chapter 16.

  • Remote Assistance Enables you to create a remote assistance invitation that can be used to get remote help from a technician. Remote Assistance is discussed in detail in Chapter 16.

  • System Configuration Utility (MSCONFIG.EXE) Enables you to manage system configuration information. You can configure normal, diagnostic, and selective startup as well.

  • System Restore (RSTRUI.EXE) Accesses the System Restore utility, which can be used to create restore points or to roll back a system to a specific restore point. The System Restore utility is discussed in Chapter 16.

The tools you might want to take a closer look at include Disk Cleanup, File Signature Verification, and System Configuration.

Working with Disk Cleanup

Disk Cleanup checks disk drives for files that aren't needed. You can start to work with Disk Cleanup by completing the following steps:

1.
Click Start, Programs or All Programs, Accessories, System Tools. Then select Disk Cleanup.

Note

The executable for Disk Cleanup is CLEANMGR.EXE. To run Disk Cleanup directly, click Start, type cleanmgr, and then press Enter.

2.
You must now choose whether to clean up only the current user's files or all files on the computer. If you want to clean up all files on the computer, you'll need to provide administrator consent or credentials as appropriate.

3.
If the computer has multiple hard disk drives, the Drive Selection dialog box is displayed. Use the Drives drop-down list to choose the drive you want to clean up and then click OK.

4.
Disk Cleanup then examines the selected drive, looking for temporary files that can be deleted and files that are candidates for compression. The more files on the drive, the longer the search process takes.

5.
When Disk Cleanup finishes, you'll see a report similar to the one shown in Figure 2-11. File categories that you might see in the report include the following:

  • Downloaded Program Files Contains programs downloaded for use by your browser, such as ActiveX controls and Java applets. These files are temporary and can be deleted.

  • Files Discarded By Windows Upgrade Contains files from a previous upgrade that were not identified as Windows system files. After you've saved any necessary data from previous Windows installations, including user data, you can use this option to remove the related files and free up space.

  • Hibernation File Cleaner Contains details about the state of the computer when it enters hibernation. If the computer doesn't use hibernation, you can remove this file to free up space.

  • Microsoft Office Temporary Files Contains temporary files and logs used by Microsoft Office. These files can be deleted to free up space.

  • Offline Files Contains local copies of network files that you've designated for offline use. These files are stored to enable offline access and can be deleted.

  • Previous Windows Installation(s) Saved under Windows.old, this contains files from previous Windows installations. After you've saved any necessary data from previous Windows installations, including user data, you can use this option to remove the related files and free up space.

  • Temporary Offline Files Contains temporary data and work files for recently used network files. These files are stored to enable working and can be deleted.

  • Recycle Bin Contains files that have been deleted from the computer but not yet purged. Emptying the Recycle Bin permanently removes the files.

  • Temporary Files Contains information stored in the Temp folder. These files are primarily temporary data or work files for applications.

  • Temporary Internet Files Contains Web pages stored to support browser caching of pages. These files are temporary and can be deleted.

  • Thumbnails Contains thumbnails of pictures, videos, and documents created by Windows Vista. When you access a folder the first time, Windows Vista creates thumbnails of pictures, videos, and documents. These thumbnails are saved so they can be quickly displayed the next time you access a folder. If you delete thumbnails, they are recreated the next time you access a folder.

Figure 2-11. Use Disk Cleanup to help you find files that can be deleted.

6.
Use the check boxes provided in the Files To Delete list to choose files that you want to clean up. Then click OK. When prompted to confirm the action, click Yes.

Verifying System Files Using File Signature Verification

Critical files used by the operating system are digitally signed. Digital signatures help to prove the authenticity of these files and ensure that it is easy to track changes that might cause problems on a system. When you are having problems that cannot easily be explained, such as happens when a system becomes unstable after an application installation, it is a good idea to verify that critical system files haven't been changed. You can do this using the File Signature Verification utility.

The executable file for the File Signature Verification utility is SIGVERIF.EXE. You can start and work with the File Signature Verification utility by completing the following steps:

1. | Click Start, type sigverif, and then press Enter.
2. | Click Start to run the File Signature Verification utility using the default configuration. By default, the File Signature Verification utility displays a list of system files that aren't digitally signed and writes verification results to %SystemRoot%\SIGVERIF.TXT.
3. | Notice the list of files displayed in the File Signature Verification utility report. These files don't have digital signatures and could have been maliciously replaced by other programs of the same name. Review event logs and other error reports to see if these files show up in the error reports.
4. | Use Microsoft Notepad to access the verification log located in %SystemRoot%\SIGVERIF.TXT. Check the log to see if there are files that have been altered since they were installed. Files are listed by status, such as Signed, Unsigned, and Not Scanned. Any files that have been changed will be marked as such.

Managing System Configuration, Startup, and Boot

Whether you want to update system configuration files or troubleshoot startup problems, your tool of choice should be the System Configuration utility. System Configuration is an integrated tool for managing system configuration information. Using this utility, you can manage the following elements:

  • Operating system startup options

  • Startup applications

  • Service-startup options

The following sections examine key tasks that you can perform with the System Configuration utility. The executable file for the System Configuration utility is MSCONFIG.EXE. You can access the utility by clicking Start, typing msconfig, and then pressing Enter.

Understanding Startup Modes and Troubleshooting System Startup

You can use the System Configuration utility to select the startup mode for a computer. The following three startup modes are available:

  • Normal Startup Normal startup is used for normal system operations. In this mode, the operating system loads all system configuration files and device drivers and also runs all startup applications and enabled services.

  • Diagnostic Startup Diagnostic startup is used to troubleshoot system problems. In diagnostic mode, the system loads only basic device drivers and essential services. Once you start the system in diagnostic mode, you can modify system settings to resolve configuration problems.

  • Selective Startup Selective startup is used to pinpoint problem areas in the configuration. Here, you can elect to use a modified boot configuration and selectively use system services and startup items. This can help you identify the settings that are causing system problems and correct them as necessary.

Normal is the default startup mode. If you are experiencing problems with a system and want to use a different startup mode, complete the following steps:

1.
Click Start, type msconfig, and then press Enter to display the System Configuration utility, shown in Figure 2-12.

Figure 2-12. Use the System Configuration utility's General tab to control system startup.

[View full size image]

2.
On the General tab, select either Diagnostic Startup or Selective Startup. If you choose selective startup, you can use the following options to select the items that you want the system to use:

  • Load System Services Tells the system to load Windows services on startup. If you select this option, use the settings on the Services tab to specify which services are started.

  • Load Startup Items Tells the system to run applications designated for startup at boot time. If you select this option, you can enable and disable startup applications using the option on the Startup tab.

  • Use Original Boot Configuration Tells the system to process the original boot configuration on startup instead of one you've created by modifying the boot settings using the System Configuration utility.

  • Use Modified Boot Configuration You can change settings on the Boot tab to control how the system starts and what additional boot flags, if any, are used. If you make changes on the Boot tab, the Selective Startup and Use Modified Boot Configuration options are automatically selected on the General tab.

3.
When you are ready to continue, click OK and then reboot the system. If you have problems rebooting the system, restart the system in Safe Mode and then repeat this procedure. Safe Mode appears automatically as an option after a failed boot.

Changing Boot Options

As discussed in Chapter 1, Windows Vista uses the Windows Boot Manager and a boot application to start up the operating system. Windows Vista doesn't use Boot.ini or other boot files in a standard configuration. When troubleshooting, you can use the options on the System Configuration utilities Boot tab to control the boot partition, boot method, and boot options used by the operating system.

As shown in Figure 2-13, when you start the System Configuration utility and click the Boot tab, the operating systems that are bootable on the computer are listed. To specify that an operating system other than the current one should be used, you simply click the related operating system entry. When working with operating system entries, you can select the following options:

  • Set As Default Sets the currently selected boot partition as the default partition. The default partition is selected automatically if you don't choose an option before the timeout interval.

  • Timeout Sets the amount of time the computer waits before using the default boot partition.

  • Delete Deletes an operating system entry. The entry cannot be easily recreated, so only delete an entry if absolutely necessary.

Note

On a computer with a single operating system, the Set As Default and Delete buttons are grayed out. This is because there is no other operating system to switch to or from.

Figure 2-13. The Boot tab controls the boot partition, boot method, and boot options used by the operating system.

[View full size image]

You can also set the following boot options:

  • Safe Boot Starts the computer in Safe Mode with additional flags for minimal, network, and alternate shell minimal boots as well as the directory service repair state (dsrepair). Once you successfully boot a system in Safe Mode, you can modify system settings to resolve configuration problems.

  • No GUI Boot Boots the computer to the Windows prompt and doesn't load the graphical components of the operating system. Booting to the prompt is useful when you are having problems with the graphical components of Windows Vista.

  • Boot Log Turns on boot logging so that key startup events are written to a log.

  • Base Video Forces the computer to use video graphics adapter (VGA) display settings. Use this mode when you are trying to resolve display settings, such as when the display mode is set to a size that the monitor cannot display.

  • OS Boot Information Starts the computer using verbose output so that you can view the details of startup activities prior to the loading of Windows graphical components.

Any changes you make are stored as modified boot configuration data by the System Configuration utility. After you make changes and click OK, you can restart the computer to apply the temporary changes. To go back to a normal startup after you've made and applied changes, you must select Normal Startup on the General tab and then click OK. You must then reboot the system so that the normal settings are used.

If you click the Advanced Options button, you can set boot options for processors, maximum memory, PCI locking, HAL detection, and debugging. To make any of the standard or advanced boot options you've selected permanent, select the Make All Boot Settings Permanent check box before clicking OK. In most cases, you won't want troubleshooting or debugging options to be permanent, so be sure to clear these options first.

Enabling and Disabling Startup Applications for Troubleshooting

If you suspect that an application loaded at startup is causing problems with the system, there is an easy way to diagnose this. Disable the program from starting automatically and then reboot the system. If the problem no longer appears, you might have pinpointed the problem and might remedy it by permanently disabling automatic startup of this program. If the problem still occurs, you might want to repeat this process with other startup applications.

To disable startup applications, follow these steps:

1.
Click Start, type msconfig, and then press Enter to display the System Configuration utility.

2.
Click the Startup tab. As shown in Figure 2-14, this tab displays a list of programs that currently load at startup.

Figure 2-14. To troubleshoot problems with startup applications, use the options on the Startup tab.

[View full size image]

3.
Clear the check box next to any application that you do not want to load at startup.

Caution

Disable only those programs that you've identified as potential problems, and do so only if you know how they are used by the operating system. If you don't know what a program does, don't disable it. Sometimes you can learn more about a startup program by following its command path and then examining its base installation folder.

4.
Click OK. You need to reboot the system to check the changes, so if you are prompted to restart the system, click Yes. Otherwise, reboot manually.

5.
Repeat this procedure as necessary to pinpoint the program causing the system problems. If you can't identify an application as the cause of the problem, the trouble might be with a Windows component, service, or device driver.

Enabling and Disabling Services for Troubleshooting

Just as automatically started applications can cause problems on a system, so can automatically started services. To help troubleshoot service problems, you can temporarily disable services using the System Configuration utility and then reboot to see whether the problem goes away. If so, you might have pinpointed it. You can then permanently disable the service or check with the service vendor to see if an updated executable is available for the service.

To temporarily disable services, follow these steps:

1.
Click Start, type msconfig, and then press Enter to display the System Configuration utility.

2.
Click the Services tab. As shown in Figure 2-15, this tab displays a list of all services installed on the computer and includes flags that identify the state of the service, such as running or stopped, and whether the service is essential to the proper operation of the system.

Figure 2-15. To troubleshoot problems with Windows services, use the options on the Services tab.

[View full size image]

3.
Clear the check box next to any service that you do not want to run at startup.

Caution

Disable only those services that you've identified as potential problems and only if you know how they are used by the operating system. If you don't know what a service does, don't disable it. You can learn the specific purpose of a service by using the Services utility in the Administrative Tools menu. Select the service to view its description on the Extended tab or double-click the service to read its description on the General tab of the related properties dialog box.

4.
Click OK. You need to reboot the system to check the changes, so if you are prompted to restart the system, click Yes. Otherwise, reboot the system manually.

5.
Repeat this procedure as necessary to pinpoint the service causing the system problems. If you can't identify a service as the cause of the problem, the trouble might be caused by a Windows component, a startup application, or a device driver.


Managing System Properties

You use the System Properties dialog box to manage system properties. The following sections examine key areas of the operating system that can be configured using the System Properties dialog box.

The Computer Name Tab

The computer's network identification can be displayed and modified with the Computer Name tab of the System Properties dialog box, shown in Figure 2-16. As the figure shows, the Computer Name tab displays the full computer name of the system and the domain membership. The full computer name is essentially the Domain Name System (DNS) name of the computer, which also identifies the computer's place within the Active Directory hierarchy.

Figure 2-16. Use the Computer Name tab to display and configure system identification.

To access the Computer Name tab of the System Properties dialog box, follow these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click System.
4. | In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.
5. | Click the Computer Name tab.

The options on the Computer Name tab enable you to:

  • Join a computer to a domain Click Network ID to start the Connect To A

    Domain Or Workgroup wizard, which guides you through modifying network access information for the computer. To join a computer to a domain, click Network ID and then click Next twice to accept the default options. Enter the name of your domain user account, the password for this account, and the name of the domain. Click Next and then follow the remaining prompts.

  • Change a computer's name Click Change to change the computer name and the domain or workgroup associated with the computer.

Real World

For client computers to use the Domain Name System (DNS), the computer must have an appropriate computer name and a properly configured primary DNS suffix. Rather than using names that are cute or arbitrary, you should decide on a naming scheme that is meaningful to both users and administrators. In DNS, the computer's name serves as its host name, and the primary DNS suffix determines the domain to which it is assigned for name resolution purposes. Any unqualified host names that are used on a computer are resolved using the primary DNS suffix. For example, you are logged on to a computer with a primary DNS suffix of tech.cpandl.com and you ping CorpSvr28 at a command prompt. The computer directs the query to corpsvr28.tech.cpandl.com.

By default, the primary DNS suffix is the domain in which the computer is a member. You can change a computer's primary DNS suffix if necessary. For example, if a computer's primary DNS suffix is seattle.tech.cpandl.com, you might want it to use the primary DNS suffix of cpandl.com to simplify name resolution in this large DNS hierarchy. To change a computer's primary DNS suffix, click Change on the Computer Name tab and then click More. Enter the desired primary DNS suffix in the text box provided and then close all open dialog boxes by clicking OK three times.

The Hardware Tab

The System Properties dialog box's Hardware tab provides access to Device Manager and Windows Update Driver settings. To access the Hardware tab of the System Properties dialog box, follow these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click System.
4. | In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.
5. | Click the Hardware tab.

The Device Manager, also included in the Computer Management console as an MMC snap-in, is discussed in Chapter 3. When you connect a new device, Windows Vista checks for drivers automatically using Windows Update. If you don't want a computer to check for drivers automatically, click the Windows Update Driver Settings button, and then, as appropriate, select either Ask Me Each Time I Connect A New Device Before Checking For Drivers or Never Check For Drivers When I Connect A Device, and then click OK.

Note

The Hardware tab no longer provides access to driver signing settings or hardware profiles. With Windows Vista, you configure driver signing settings through Active Directorybased Group Policy or Local Group Policy. Additionally, because Windows Vista uses a hardware-independent architecture, you can no longer configure hardware profiles on the Hardware tab.

The Advanced Tab

The System Properties dialog box's Advanced tab, shown in Figure 2-17, controls many of the key features of the Windows operating system, including application performance, virtual memory usage, user profile, environment variables, and startup and recovery.

Note

User profiles contain global user settings and configuration information. They are created the first time a user logs on to a local computer or domain and are different for local and domain accounts. A user's profile maintains the desktop environment so that it is the same each time the user logs on. You'll find an extensive discussion on user profiles in the chapter "Managing Existing User and Group Accounts" in Microsoft Windows Server 2003 Administrator's Pocket Consultant (Microsoft Press, 2003).

Figure 2-17. The Advanced tab lets you configure advanced features, including performance options, environment variables, and startup and recovery.

Setting Windows Performance

Many graphics enhancements have been added to the Windows Vista interface. These enhancements include many visual effects for menus, toolbars, windows, and the taskbar. You can configure Windows performance by completing the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click System.

4.
In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.

5.
To display the Performance Options dialog box, click the Advanced tab in the System Properties dialog box and then click Settings on the Performance panel.

6.
The Visual Effects tab is selected by default. You have the following options for controlling visual effects:

  • Let Windows Choose What's Best For My Computer Enables the operating system to choose the performance options based on the hardware configuration. For a newer computer, this option will probably be identical to the Adjust For Best Appearance option. The key distinction, however, is that this option is chosen by Windows based on the available hardware and its performance capabilities.

  • Adjust For Best Appearance When you optimize Windows for best appearance, you enable all visual effects for all graphical interfaces. Menus and the taskbar use transitions and shadows. Screen fonts have smooth edges. List boxes have smooth scrolling. Folders use Web views and more.

  • Adjust For Best Performance When you optimize Windows for best performance, you turn off the resource-intensive visual effects, such as slide transitions and smooth edges for fonts, while maintaining a basic set of visual effects.

  • Custom You can customize the visual effects by selecting or clearing the visual effects options in the Performance Options dialog box. If you clear all options, Windows does not use visual effects.

7.
When you are finished changing visual effects, click Apply. Click OK twice to close the open dialog boxes.

Setting Application Performance

Application performance is related to processor scheduling caching options that you set for the Windows Vista system. Processor scheduling determines the responsiveness of applications that are running interactively (as opposed to background applications that might be running on the system as services). You control application performance by completing the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click System.

4.
In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.

5.
To display the Performance Options dialog box, click the Advanced tab in the System Properties dialog box and then click Settings on the Performance panel.

6.
The Performance Options dialog box has several tabs. Click the Advanced tab.

7.
In the Processor Scheduling panel, you have the following options:

  • Programs To give the active application the best response time and the greatest share of available resources, select Programs. Generally, you'll want to use this option for all Windows Vista workstations.

  • Background Services To give background applications a better response time than the active application, select Background Services. Generally, you'll want to use this option for Windows Vista computers running as servers (meaning they have server-like roles and are not being used as Windows Vista workstations). For example, a Windows Vista computer may be the print server for the department.

8.
Click OK.

Configuring Virtual Memory

Virtual memory enables you to use disk space to extend the amount of available RAM on a system. This feature of processors using Intel 386 and later writes RAM to disks using a process called paging. With paging, a set amount of RAM, such as 1024 MB, is written to the disk as a paging file, where it can be accessed from the disk when needed in place of physical RAM.

An initial paging file is created automatically for the drive containing the operating system. By default, other drives don't have paging files, so you must create these paging files manually if you want them. When you create a paging file, you set an initial size and a maximum size. Paging files are written to the volume as a file named PAGEFILE.SYS.

Real World

Windows Vista does a much better job than its predecessors do of automatically managing virtual memory. Typically, Windows Vista will allocate virtual memory at least as large as the total physical memory installed on the computer. This helps to ensure paging files don't become fragmented, which can result in poor system performance. If you want to manually manage virtual memory, you use a fixed virtual memory size in most cases. To do this, set the initial size and the maximum size to the same value. This ensures that the paging file is consistent and can be written to a single contiguous file (if possible, given the amount of space on the volume). In most cases, I recommend setting the total paging file size so that it's twice the physical RAM size on the system. For instance, on a computer with 1024 MB of RAM, you would ensure that the Total Paging File Size For Each Drive setting is at least 2048 MB.

You can manually configure virtual memory by completing the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click System.

4.
In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.

5.
Click the Advanced tab in the System Properties dialog box.

6.
Click Settings in the Performance section to display the Performance Options dialog box.

7.
Click the Advanced tab and then click Change to display the Virtual Memory dialog box, shown in Figure 2-18. The following information is provided:

  • Drive [Volume Label] and Paging File Size (MB) Shows how virtual memory is currently configured on the system. Each volume is listed with its associated paging file (if any). The paging file range shows the initial and maximum size values set for the paging file.

  • Paging File Size For Each Drive Provides information on the currently selected drive and enables you to set its paging file size. Space Available indicates how much space is available on the drive.

  • Total Paging File Size For All Drives Provides a recommended size for virtual RAM on the system and tells you the amount currently allocated. If this is the first time you're configuring virtual RAM, notice that the recommended amount has already been given to the system drive (in most instances).

Figure 2-18. Virtual memory extends the amount of physical memory (RAM) on a system.

8.
By default, Windows Vista manages the paging file size for all drives. If you want to manually configure virtual memory, clear the Automatically Manage Paging File Size For All Drives check box.

9.
In the Drive list box, select the volume you want to work with.

10.
Select Custom Size and then enter an initial size and a maximum size.

11.
Click Set to save the changes.

12.
Repeat steps 911 for each volume you want to configure.

13.
Click OK and if prompted to overwrite an existing PAGEFILE.SYS file, click Yes.

14.
If you updated the settings for a paging file that is currently in use, you'll see a prompt explaining that you need to restart the system for the changes to take effect. Click OK.

15.
Click OK twice to close the open dialog boxes. When you close the System utility, you'll see a prompt asking if you want to restart the system. Click Restart.

You can have Windows Vista automatically manage virtual memory by following these steps:

1. | Click the Advanced tab in the System Properties dialog box.
2. | Click Settings in the Performance section to display the Performance Options dialog box.
3. | Click the Advanced tab and then click Change to display the Virtual Memory dialog box.
4. | Select the Automatically Manage Paging File Size For All Drives check box.
5. | Click OK three times to close the open dialog boxes.

Tip

Clearing the pagefile on shutdown is a recommended security best practice. You can clear the pagefile on shutdown by enabling the Shutdown: Clear Virtual Memory Pagefile option. In Group Policy, this option is located under Local Policies\Security Options.

Configuring Data Execution Prevention

Data Execution Prevention (DEP) is a memory protection technology. DEP tells the computer's processor to mark all memory locations in an application as non-executable unless the location explicitly contains executable code. If code is executed from a memory page marked as non-executable, the processor can raise an exception and prevent it from executing. This prevents malicious code, such as a virus, from inserting itself into most areas of memory, because only specific areas of memory are marked as having executable code.

Note

32-bit versions of Windows support DEP as implemented by Advanced Micro Devices, Inc. (AMD) processors that provide the no-execute page-protection (NX) processor feature. Such processors support the related instructions and must be running in Physical Address Extension (PAE) mode. 64-bit versions of Windows also support the NX processor feature.

Using and configuring DEP

You can determine whether a computer supports DEP by using the System utility. If a computer supports DEP, you can also configure it by completing the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click System.

4.
In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.

5.
Click the Advanced tab in the System utility and then on the Performance panel, click Settings to display the Performance Options dialog box.

6.
The Performance Options dialog box has several tabs. Click the Data Execution Prevention tab. The text at the bottom of this tab specifies whether the computer supports execution protection.

7.
If a computer supports execution protection and is configured appropriately, you can configure DEP by using the following options:

  • Turn On DEP For Essential Windows Programs And Services Only Enables DEP only for the operating system services, programs, and components. This is the default and recommended option for computers that support execution protection and are configured appropriately.

  • Turn On DEP For All Programs Except Those I Select Configures DEP and allows for exceptions. Select this option and then click Add to specify programs that should run without execution protection. In this way, execution protection will work for all programs except those you have listed.

8.
Click OK.

Understanding DEP compatibility

To be compatible with DEP, applications must be able to explicitly mark memory with Execute permission. Applications that cannot do this will not be compatible with the NX processor feature. If you are experiencing memory-related problems running applications, you should determine the applications that are having problems and configure them as exceptions rather than completely disabling execution protection. In this way, you still get the benefits of memory protection and can selectively disable memory protection for programs that aren't running properly with the NX processor feature.

Execution protection is applied to both user-mode and kernel-mode programs. A user-mode execution protection exception results in a STATUS_ACCESS_VIOLATION exception. In most processes, this exception will be an unhandled exception and will result in termination of the process. This is the desired behavior because most programs violating these rules, such as a virus or worm, will be malicious in nature.

Unlike applications, execution protection for kernel-mode device drivers cannot be selectively disabled or enabled. Furthermore, on compliant 32-bit systems, execution protection is applied by default to the memory stack. On compliant 64-bit systems, execution protection is applied by default to the memory stack, the paged pool, and the session pool. A kernel-mode execution protection access violation for a device driver results in an ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY exception.

Configuring System and User Environment Variables

System and user environment variables are configured by means of the Environment Variables dialog box, shown in Figure 2-19. To access this dialog box, click the Advanced tab in the System Properties dialog box and then click the Environment Variables button.

Figure 2-19. The Environment Variables dialog box lets you configure system and user environment variables.

Creating an environment variable

You can create environment variables by completing the following steps:

1. | Click New under User Variables or under System Variables, whichever is appropriate. This opens the New User Variable dialog box or the New System Variable dialog box, respectively.
2. | In the Variable Name field, type the variable name. Then in the Variable Value field, type the variable value.
3. | Click OK.
Editing an environment variable

You can edit an existing environment variable by completing the following steps:

1. | Select the variable in the User Variables or System Variables list box.
2. | Click Edit under User Variables or under System Variables, whichever is appropriate. The Edit User Variable dialog box or the Edit System Variable dialog box will open.
3. | Type a new value in the Variable Value field and click OK.
Deleting an environment variable

You can delete an environment variable by selecting it and clicking Delete.

Note

When you create or modify system environment variables, the changes take effect when you restart the computer. When you create or modify user environment variables, the changes take effect the next time the user logs on to the system.

Configuring System Startup and Recovery

System startup and recovery properties are configured by means of the Startup And Recovery dialog box, shown in Figure 2-20. To access this dialog box, click the Advanced tab in the System Properties dialog box and then click the Settings button under Startup And Recovery.

Figure 2-20. The Startup And Recovery dialog box lets you configure system startup and recovery procedures.

Setting startup options

The System Startup area of the Startup And Recovery dialog box controls system startup. In a computer with multiple bootable operating systems, to set the default operating system, select one of the operating systems listed in the Default Operating System field. These options change the configuration settings used by the Windows Boot Manager.

At startup of a computer with multiple bootable operating systems, Windows Vista displays the startup configuration menu for 30 seconds by default. You can affect this by either of the following actions:

  • Boot immediately to the default operating system by clearing the Time To Display List Of Operating Systems check box.

  • Display the available options for a specific amount of time by selecting the Time To Display List Of Operating Systems check box and then setting a time delay in seconds.

Generally, on most systems you'll want to use a value of three to five seconds. This is long enough to be able to make a selection, yet short enough to expedite the system startup process.

When the system is in a recovery mode and booting, a list of recovery options might be displayed. As with the standard startup options, you can configure recovery startup options in one of two ways. You can set the computer to boot immediately using the default recovery option by clearing the Time To Display Recovery Options When Needed check box, or you can display the available options for a specific amount of time by selecting Time To Display Recovery Options When Needed and then setting a time delay in seconds.

Setting recovery options

The System Failure and Write Debugging Information areas of the Startup And Recovery dialog box control system recovery. Recovery options enable administrators to control precisely what happens when the system encounters a fatal system error (also known as a STOP error). The available options for the System Failure area are as follows:

  • Write An Event To The System Log Logs the error in the system log, which allows administrators to review the error later using the Event Viewer.

  • Automatically Restart Check this option to have the system attempt to reboot when a fatal system error occurs.

Note

Configuring automatic reboots isn't always a good thing. Sometimes you might want the system to halt rather than reboot to ensure that the system gets proper attention. Otherwise, you would know that the system rebooted only when you viewed the system logs or if you happened to be in front of the system's monitor when it rebooted.

The Write Debugging Information selection menu enables you to choose the type of debugging information that you want to write to a dump file. The dump file can in turn be used to diagnose system failures. The options are as follows:

  • None Use this option if you don't want to write debugging information.

  • Small Memory Dump Use this option to dump the physical memory segment in which the error occurred. This dump is 64 KB in size.

  • Kernel Memory Dump Use this option to dump the physical memory area being used by the Windows kernel. The dump file size depends on the size of the Windows kernel.

  • Complete Memory Dump Use this option to dump all physical memory being used at the time of the failure. The maximum dump file size is the same as the total physical memory size.

If you elect to write a dump file, you must also set a location for it. The default dump locations are %SystemRoot%\Minidump for small memory dumps and %SystemRoot%\MEMORY.DMP for all other memory dumps. You'll usually want to select Overwrite Any Existing File as well. This option ensures that any existing dump files are overwritten if a new STOP error occurs.

Best Practices

The dump file can be created only if the system is properly configured. The system drive must have a sufficiently large memory-paging file (as set for virtual memory on the Advanced tab), and the drive where the dump file is written must have sufficient free space as well. For example, my system has 128 MB of RAM and requires a paging file on the system drive of the same size128 MB. Because the same drive is used for the dump file, the drive must have at least 256 MB of free space to correctly create a complete dump of debugging information (that's 128 MB for the paging file and 128 MB for the dump file).

The System Protection Tab

The System Properties dialog box's System Protection tab, shown in Figure 2-21, provides access to manage the configuration of System Restore. In Windows Vista, System Restore includes Previous Versions as a subcomponent. The sections that follow discuss techniques for working with and configuring System Restore. Using restore points to recover a computer is discussed in Chapter 16.

Figure 2-21. System Restore manages restore points on a per-drive basis.

Working with System Restore and Previous Versions

With System Restore enabled, a computer makes periodic snapshots of the system configuration. These snapshots are called restore points. These restore points include Windows settings, lists of programs that have been installed, and so on. If the computer has problems starting or isn't working properly because of a system configuration change, you can use a restore point to restore the system configuration to the point at which the snapshot was made. For example, suppose your system is working fine and then you install a new service pack release for Microsoft Office. Afterward, the computer generates errors and Office applications won't run. You try to uninstall the update, but that doesn't work, so you decide to run System Restore. Using System Restore, you can restore the system using a snapshot taken prior to the update.

Note

System Restore can provide several different types of restore points. One type, System Checkpoint, is scheduled by the operating system and occurs at regular intervals. Another type of snapshot, Installation Restore Point, is created automatically based on events that are triggered by the operating system when you install applications. Other snapshots, known as Manual Restore Points, are created manually by users. You should recommend that users create Manual Restore Points prior to performing an operation that might cause problems on the system.

System Restore manages restore points on a per-drive basis. Each drive with critical applications and system files should be monitored for configuration changes. By default, System Restore is enabled only for the System drive. You can modify the System Restore configuration by turning on monitoring of other drives as needed. If a drive isn't configured for System Restore monitoring, configuration changes are not tracked and the disk cannot be recovered if problems occur.

In Windows Vista, previous versions of files and folders are created automatically as part of a restore point. Any file or folder that was modified since the last restore point is saved and made available as a previous version. The only exceptions are for system files and folders. Previous versions are not available for system folders, such as C:\Windows.

You can use previous versions of files to restore files that were inadvertently modified, deleted, or damaged. When System Restore is enabled on a drive, Windows Vista automatically makes daily copies of files and folders that have changed on that drive. You can also create copies of files and folders that have changed by setting a restore point on the System Protection tab.

Note

Protection points are created daily for all drives being monitored by System Restore. However, only those versions of files that are actually different from the current version are stored as previous versions. You can enable or disable previous versions on a per-drive basis by enabling or disabling System Restore on that drive. Previous versions are saved as part of a volume's automatically or manually created protection points.

Configuring System Restore

You control how System Restore works using the System Restore tab of the System utility. The system process responsible for monitoring configuration and application changes is the System Restore Service. This service is configured for automatic startup and runs under the Local System account. System Restore won't work properly if this service isn't running or configured appropriately.

System Restore saves system checkpoint information for all monitored drives and requires at least 300 MB of disk space on the System volume to save restore points. System Restore reserves additional space for restore points as necessary, up to 10 percent of the total disk capacity, but this additional space is always available for user and application storage. System Restore frees up additional space for you as necessary. If System Restore runs out of available space, the operating system overwrites previously created restore points. You cannot configure the amount of disk space used by System Restore.

Complete the following steps to manage System Restore monitoring of a computer:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link.
3. | Click System. In the System Console, click Change Settings under Computer Name, Domain, And Workgroup Settings. Or click Advanced System Settings in the left pane.
4. | To enable System Restore for a volume, select the volume's check box. When you enable System Restore, restore points are created automatically as discussed previously. You can manually create a restore point by clicking the volume and then clicking Create.
5. | To disable System Restore for a volume, clear the volume's check box and then confirm the action by clicking Yes. When you disable System Restore, all restore points on that volume are removed and you cannot undo this action.
6. | When you are finished making configuration changes, click OK.
Restoring a Previous Version

When you right-click a file or folder for which previous versions are available and then select Properties, you see a Previous Versions tab. If you select this tab, you should see previous versions of the file or folder. You can then use:

  • The Open button to open any of the previous versions

  • The Copy button to create a copy of a previous version

  • The Restore button to revert the file or folder to a selected previous version

There are several possible reasons you might not see a previous version of a file on your computer:

  • System Restore might not be enabled on the volume. If System Restore isn't enabled on a volume, Windows Vista doesn't create previous versions and therefore folders don't have any previous versions.

  • The file might be an offline file. Offline files are copies of network files. Client computers do not create previous versions of offline files. Previous versions may be available on the server where the file is stored, however.

  • The file might be a system file. Previous Versions does not create copies of system files. Changes made to system files are tracked with restore points, and you must recover the computer to the restore point to go back to a previous state.

  • The folder in which the file was stored has been deleted. In this case, you must open the properties for the folder that contained the folder that was deleted. Use this folder's Previous Versions tab to restore the folder and then access the folder to recover the previous version of the file you are looking for.

The Remote Tab

The System Properties dialog box's Remote tab controls Remote Assistance invitations and Remote Desktop connections. These options are discussed in Chapter 6 in the section entitled "Managing Remote Access to Workstations."


Chapter 3. Configuring Systems, Hardware Devices, and Drivers

In this chapter:
Introducing Automated Help And Support | 74
Working with the Automated Help System | 77
Installing and Maintaining Devices: The Essentials | 82
Getting Started with Device Manager | 86
Working with Device Drivers | 88
Managing Hardware | 97
Customizing Hardware Device Settings | 101
Managing Internet Time | 108

Managing the configuration of computers running Microsoft Windows Vista is largely about installing and maintaining operating system components, hardware devices, and device drivers. However, managing the configuration of Windows Vista computers is very different from managing the configuration of earlier releases of Windows. Many aspects of Windows Vista are automatically monitored and updated and don't need to be configured or maintained in the same way as earlier releases of Windows do. Windows Vista uses the following:

  • Built-in diagnostics to monitor hardware devices, physical memory, networking, and performance

  • Problem reporting to try to automatically resolve configuration and performance issues

  • Problem diagnosis to offer solutions to issues that cannot be automatically resolved

  • Automatic updating to keep the operating system components up to date

  • Driver updating to obtain necessary drivers and driver updates for detected hardware devices

From the moment you first install the operating system, these features start working to help you monitor and maintain computers running Windows Vista. As an administrator, you can use these features to help guide your configuration and maintenance efforts. Separate tools are provided for managing the various areas monitored by diagnostics. These include hardware diagnostics, memory diagnostics, networking diagnostics, and performance diagnostics tools.

For configuring and maintaining hardware devices and drivers, you can also use Device Manager and the Add Hardware wizard. You'll use these tools whenever you install, uninstall, or troubleshoot hardware devices and drivers. Other tools are available for managing specific types of hardware devices, such as keyboards and sound cards. To manage automatic updating and driver updating, you'll use Windows Update, which is provided as a Control Panel utility.


Introducing Automated Help And Support

Windows Vista includes an extensive diagnostics and problem resolution architecture. These automated features are the next generation Automated Help System. Although earlier releases of Windows include some help and diagnostics features, those features are, for the most part, not self-correcting or self-diagnosing. Windows Vista, on the other hand, can detect many types of hardware, memory, and performance issues and either resolve them automatically or help users through the process of resolving them.

Windows Vista includes more reliable and better performing device drivers to prevent many common causes of hangs and crashes. Improved input/output (I/O) cancellation for device drivers ensures that the operating system can recover gracefully from blocking calls and that there are fewer blocking disk I/O operations.

To reduce downtime and restarts required for application installations and updates, Windows Vista can use the update process to mark in-use files for update and then automatically replace the files the next time the application is started. In some cases, Windows Vista can save the application's data, close the application, update the in-use files, and then restart the application. To improve overall system performance and responsiveness, Windows Vista uses memory more efficiently, provides ordered execution for groups of threads, and provides new process scheduling mechanisms. By optimizing memory and process usage, Windows Vista ensures that background processes have less performance impact on system performance.

Windows Vista provides improved guidance on the causes of unresponsive conditions. By including additional error reporting details in the event logs, Windows Vista makes it easier to identify and resolve issues. To automatically recover from service failures, Windows Vista uses service recovery policies more extensively than its predecessors do. When recovering a failed service, Windows Vista automatically handles both service and non-service dependencies as well. Any necessary dependent services and system components are started prior to starting the failed service.

In earlier releases of Windows, an application crash or hang is marked as not responding, and it is up to the user to exit and then restart the application. Windows Vista attempts to resolve the issue of unresponsive applications by using Restart Manager. Restart Manager can shut down and restart unresponsive applications automatically. Thanks to Restart Manager, you might not have to intervene to try to resolve issues with frozen applications.

Failed installation and nonresponsive conditions of applications and drivers are also tracked through Problem Reports And Solutions. Should this occur, the built-in diagnostics displays a "Check For Solutions" balloon message. If you click the balloon, Windows Vista opens the Problem Reports And Solutions dialog box, which enables you to check on the Internet for solutions to selected problems. You can view a list of current problems at any time by following these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click System And Maintenance and then click Problem Reports And Solutions.

3.
In the Problem Reports And Solutions console, click See Problems To Check in the left pane.

4.
A list of known problems is displayed, similar to what is shown in Figure 3-1. Select the check box for a problem and then click Check For Solutions to search the Microsoft Web site for possible solutions.

Figure 3-1. Check for known problems using the Problem Reports And Solutions dialog box.

[View full size image]

Windows Vista attempts to resolve issues related to running out of virtual memory by providing Resource Exhaustion Detection And Recovery. This feature monitors the system-wide virtual memory commit limit and alerts you if the computer is running low on virtual memory. To enable you to correct this issue, it also identifies the processes consuming the largest amount of memory, allowing you to close any or all of these highly resource-consuming applications directly from the Close Programs To Prevent Information Loss dialog box provided. The resource exhaustion alert is also logged in the System event log.

In earlier releases of Windows, corrupted system files are one of the most common causes of startup failure. Windows Vista includes built-in diagnostics to automatically detect corrupted system files during startup and guide you through automated or manual recovery. To resolve startup problems, Windows Vista includes the Startup Repair Tool (StR). Once started, StR attempts to determine the cause of the startup failure by analyzing startup logs and error reports. Then StR attempts to fix the problem automatically. If StR is unable to resolve the problem, it restores the system to the last known working state and then provides diagnostic information and support options for further troubleshooting.

StR is included on the Windows Vista installation disc and can be preinstalled on computers. By preinstalling StR, you make it available as an option on the Windows Advanced Startup Options menu. If you don't preinstall StR and the system fails to start up, you can run it from the Windows Vista installation disc by following these steps:

1. | Insert the Windows Vista installation disc and then restart the computer.
2. | Click View System Recovery Options (Advanced).
3. | Type the name and password for an account on the computer.
4. | Click Startup Repair in the list of recovery tools.
5. | Follow the Startup Repair prompts to recover the system.

Hardware problems addressed by built-in diagnostics include error detection and disk failure detection. If a device is having problems, hardware diagnostics can detect error conditions and either repair the problem automatically or guide the user through a recovery process. With disk drives, hardware diagnostics can use fault reports provided by disk drives to detect potential failure and alert you before this happens. Hardware diagnostics can also help guide you through the backup process after alerting you that a disk might be failing.

Performance problems addressed by built-in diagnostics include slow application startup, slow boot, slow standby/resume, and slow shutdown. If a computer is experiencing degraded performance, performance diagnostics can detect the problem and provide possible solutions for resolving the problem. For advanced performance issues, you can track related performance and reliability data in the Performance Diagnostics console, which includes a performance monitor and a reliability monitor. (This is discussed in Chapter 15, "Optimizing Windows Vista.")

Memory problems addressed by built-in diagnostics include both memory leaks and failing memory. A memory leak occurs if an application or system component doesn't completely free areas of physical memory after it is done with them. If you suspect that a computer has a memory problem that is not being automatically detected, you can run Windows Memory Diagnostics manually by completing the following steps:

1. | Click Start, All Programs, Accessories.
2. | Right-click Command Prompt and then select Run As Administrator.
3. | At the command prompt, type mdsched.exe.
4. | Choose whether to restart the computer and run the tool immediately or schedule the tool to run at the next restart.
5. | Windows Memory Diagnostics runs automatically after the computer restart, enabling you to choose the type of testing to perform. Three different levels of memory testing can be performed, from basic to exhaustive.

To detect system crashes possibly caused by failing memory, memory diagnostics works with the Microsoft Online Crash Analysis tool (OCA). If a computer crashes due to failing memory, and memory diagnostics detect this, you are prompted to schedule a memory test the next time the computer is restarted.


Working with the Automated Help System

Windows Vista's many Automated Help And Support enhancements fundamentally change how the operating system works and how you support it. As an administrator, it is important to understand how this help architecture works. Beyond the operating system components that provide the low-level functionality, and over which you have little or no control, the Help And Support architecture includes the following:

  • Support services that provide top-level functionality

  • Support policies that control how diagnostics and problem resolution work

These features are introduced in the sections that follow.

Introducing Support Services

To support automated diagnostics and problem resolutions, Windows Vista provides separate components and tools for working with and managing diagnostics, problem reporting, and user assistance. These components all rely on the availability of the support services installed with the operating system. If you access the Services node in the Computer Management administrative tool, you'll find a bundle of services dedicated to the system support.

Table 3-1 provides an overview of key support services. Windows Vista's problem detection, troubleshooting, and resolution features are largely supported by the Diagnostic Policy and Diagnostic System Host services. A third related service, the Diagnostic Service Host service, starts only as needed.

Table 3-1. Support Services in Windows Vista

Name

Description

Application Experience

Processes application compatibility cache requests for applications

Application Information

Allows users to run applications with additional administrative privileges

Application Management

Processes installation, removal, and enumeration requests for software deployed through Group Policy

Background Intelligent Transfer Service

Transfers files in the background using idle network bandwidth

Diagnostic Policy

Enables problem detection, troubleshooting, and resolution for Windows components

Diagnostic System Host

Enables problem detection, troubleshooting, and resolution for Windows components

Problem Reports and Solutions Control Panel Support

Provides support for system-level problem reports

Program Compatibility Assistant Service

Provides support for the Program Compatibility Assistant

Secondary Logon

Enables starting processes under alternate credentials

Superfetch

Helps maintain and improve performance by prefetching component and application data based on usage patterns

System Event Notification Service

Monitors system events and provides notification services

Task Scheduler

Enables a user to configure and schedule automated tasks

Themes

Provides user experience for themes management

User Profile Service

Responsible for loading and unloading user profiles during logon and logoff

Windows Error Reporting Service

Allows errors to be reported when programs stop responding and allows solutions to be retrieved

Windows Event Log

Responsible for logging events

Windows Management Instrumentation

Provides system management information

Windows Modules Installer

Supports Windows updates of recommended and optional components

Windows Time

Used to synchronize system time with world time

Windows Update

Enables updating of Windows components and other programs

As you can see from the number of support services, the automated help system built into Windows Vista is fairly complex. The system is designed to automatically monitor system health, perform preventative maintenance, and report problems so they can be resolved. Related performance and reliability data can be tracked in the Performance Diagnostics console, which includes a performance monitor and a reliability monitor, and is discussed in Chapter 15.

Support services provide the foundation for the enhanced support features in Windows Vista. If critical services are not running or configured properly, you might have problems using certain support features. You can view these and other services in Computer Management by completing the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click Administrative Tools and then double-click Computer Management.

4.
Right-click the Computer Management entry in the console tree and select Connect To Another Computer. You can now select the system whose services you want to view.

5.
Expand the Services And Applications node by clicking the plus sign (+) next to it. Then select Services, as shown in Figure 3-2.

Figure 3-2. Use the Services view to manage services on Windows Vista.

[View full size image]

Introducing Support Policies

To control how diagnostics and problem resolution works, Windows Vista relies on policy settings in Group Policy. You'll find related policy settings under Computer Configuration\Administrative Templates\System\Troubleshooting And Diagnostics. The related policies are:

  • Application Compatibility Alerts Together with the Program Compatibility Assistant Service, the related policies determine how application incompatibility alerting works. By default, Windows Vista alerts you if you try to start an incompatible application. The application is either not allowed to execute or allowed to execute with a warning message.

  • Disk Diagnostic Together with Diagnostic Policy Service, the related policies determine how disk fault alerting is handled. Disk faults can indicate that a disk is failing and might need to be repaired or replaced. By default, Windows Vista uses fault reports provided by disk drives to alert you to potential problems. Related events are also recorded in the event logs.

  • Corrupted File Recovery Together with Diagnostic Policy Service, the related policies determine detection and recovery behavior for corrupted system files. Corrupted system files can cause the operating system to fail to load. In earlier releases of Windows, you couldn't easily recover the operating system if system files were corrupted. By default, during startup, Windows Vista automatically detects corrupted system files and then enters a recovery state with either minimal or no user interface. Recovery of the corrupted file is then either automatic or manual depending on the system configuration.

  • Windows Memory Leak Diagnosis Together with Diagnostic Policy Service, the related policies determine detection and recovery behavior for memory leaks. By default, Windows Vista alerts you if it detects an application or component with a memory leak. A memory leak occurs if an application or system component doesn't completely free areas of physical memory after it is done with them. Over time, memory leaks can cause poor performance. They can also cause the system to run out of available memory.

  • Windows Boot Performance Diagnostics Together with Diagnostic Policy Service, the related policies determine detection and resolution behavior for boot performance issues. By default, Windows Vista alerts you when it detects boot, standby/resume, and shutdown issues that affect performance. Related events are also logged in the event logs. For troubleshooting, Windows Vista also attempts to determine the root cause of any related problem and then assists you through the resolution.

  • Windows Standby/Resume Performance Diagnostics Together with Diagnostic Policy Service, the related policies determine detection and resolution behavior for standby/resume performance issues. By default, Windows Vista alerts you when it detects standby/resume issues that affect performance. Related events are also logged in the event logs. For troubleshooting, Windows Vista also attempts to determine the root cause of any related problem and then assists you through the resolution.

  • Windows System Responsiveness Performance Diagnostics Together with Diagnostic Policy Service, the related policies determine detection and resolution behavior for performance issues that affect system responsiveness. By default, Windows Vista alerts you when it detects these performance issues. Related events are also logged in the event logs. For troubleshooting, Windows Vista also attempts to determine the root cause of any related problem and then assists you through the resolution.

  • Windows Shutdown Performance Diagnostics Together with Diagnostic Policy Service, the related policies determine detection and resolution behavior for shutdown performance issues. By default, Windows Vista alerts you when it detects shutdown issues that affect performance. Related events are also logged in the event logs. For troubleshooting, Windows Vista also attempts to determine the root cause of any related problem and then assists you through the resolution.

  • Windows Resource Exhaustion Detection And Resolution Together with Diagnostic Policy Service, the related policies determine detection and resolution behavior conditions where the operating system is running low on virtual memory. By default, Windows Vista alerts you when it detects low virtual memory conditions. Related events are also logged in the event logs. For troubleshooting, Windows Vista alerts you and identifies the processes consuming the largest amount of memory, allowing you to close any or all of these highly resource-consuming processes.

Most of these policies have a default Not Configured state that permits automated detection, troubleshooting, and resolution, as well as an enabled state that explicitly sets the behavior for detection, troubleshooting, and resolution. If you don't want diagnostics to indicate to the user that assisted resolution is available, you can configure most of these policies with an enabled state and an execution level of Detection And Troubleshooting Only. In this execution level, built-in diagnostics will detect the problem and attempt to resolve it automatically. While it will log related events in the event logs, it will neither alert the user if automated resolution is unsuccessful nor will it provide possible solutions. See Chapter 9, "Managing Disk Drives and File Systems," for details on working with Group Policy.


Installing and Maintaining Devices: The Essentials

Many different types of devices can be installed in or connected to computers. The following are the key device types:

  • Cards/adapters Circuit cards and adapters are plugged into expansion slots on the motherboard inside the computer case or, in the case of a laptop, into expansion slots available directly on the side of the system. Most cards and adapters have a connector into which you can plug other devices.

  • Internal drives Many different types of drives can be installed, from CD drives, DVD drives, and Zip drives to floppy disks and hard disks. Internal drives usually have two types of cables. One cable attaches to the motherboard, to other drives, or to interface cards. The other cable attaches to the computer's power supply.

  • External drives and devices External drives and devices plug into ports on the computer. The port can be standard, such as LPT1 or COM1; a port that you added with a circuit card; or a high-speed serial port such as a universal serial bus (USB) port or an IEEE-1394 port (commonly called a FireWire port). Printers, scanners, USB flash drives, and most digital cameras are external devices.

  • Memory Memory chips are used to expand the total amount of physical memory on the computer. Memory can be added to the motherboard or to a particular device, such as a video card. The most commonly used type of memory is random access memory (RAM).

You don't manage the configuration of hardware devices on Windows Vista in the same way that you manage the configuration of hardware devices on earlier releases of Windows. Devices installed on the computer but not detected during an upgrade or installation of the operating system are configured differently from new devices you install.

Installing Pre-Existing Devices

Unlike earlier releases of Windows, Windows Vista automatically detects devices that were not installed after upgrading or installing the operating system. If a device wasn't installed because Windows Vista didn't include the driver, the built-in hardware diagnostics will, in many cases, detect the hardware and then use the automatic update framework to retrieve the required driver the next time Windows Update runs, provided that Windows Update is enabled and you've allowed driver updating as well as operating system updating.

Driver updates are not installed automatically. After upgrading or installing the operating system, you should check for driver updates and apply them as appropriate before trying other techniques to install device drivers. Although a complete discussion of working with automatic updating is covered in Chapter 15, the basic steps of checking for updates are as follows:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click the System And Maintenance category heading link and then click Windows Update.
3. | In Windows Update, click the Check For Updates button.

Typically device driver updates are seen as optional updates. The exceptions are for essential drivers, such as those for video, sound, and hard disk controllers. Because of this, you'll want to view all available updates on a computer, rather than only the important updates, to determine whether device driver updates are available. To install available device driver updates, follow these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link and then click Windows Update.

3.
In Windows Update, click Check For Updates in the left pane and then click View Available Updates.

4.
On the View Available Updates page, shown in Figure 3-3, you can review the available updates. By default, optional updates are not selected for installation. To ensure that an update is installed, select the related check box.

Figure 3-3. Select the update to install.

[View full size image]

5.
Click Install to download and install the selected updates.

After you've installed the device driver, Windows Vista should both detect the hardware within several minutes and install the device automatically. If Windows Vista detects the device but isn't able to install the device automatically, Windows Vista starts the Driver Software Installation component, which in turn starts the Found New Hardware wizard. In the Found New Hardware wizard, shown in Figure 3-4, you can then click Locate And Install Driver Software (Recommended) to continue with the installation. The Driver Software Installation component will then search for preconfigured drivers.

Figure 3-4. Start the installation by clicking Locate And Install Driver Software (Recommended).

The Driver Software Installation component should use the driver that you've just made available on the computer to complete the installation. If it doesn't do this for some reason, you'll see a wizard page that asks you to allow Windows to search online for the driver software. Click Don't Search Online. You'll then be prompted to insert the disk that came with the hardware device. Continue with the installation as discussed in the next section, starting with step 3.

Installing New Devices

Most available new devices are Plug and Play compatible. This means that you should be able to install new devices easily by using one of the following techniques:

  • For a non-USB or non-FireWire device, simply shut down the computer, insert the device into the appropriate slot or connect it to the computer, restart the computer, and then let Windows Vista automatically detect the new device.

  • For a USB or FireWire device, simply insert the device into the appropriate slot or connect it to the computer, restart the computer, and then let Windows Vista automatically detect the new device.

Depending on the device, Windows Vista should automatically detect the new device and install a built-in driver to support it. The device should then run immediately without any problems. Well, that's the idea, but it doesn't always work out that way. The success of an automatic detection and installation depends on the device being Plug and Play compatible and a device driver being available.

Windows Vista includes many device drivers in a standard installation, and in this case, the device should be installed automatically. If driver updating is allowed through Windows Update, Windows Vista checks for drivers automatically using Windows Update either when you connect a new device or when it first detects the device. Because Windows Update does not automatically install device drivers, you'll need to check for available updates to install the driver.

Note

For details on whether to use Windows Update to check for drivers automatically, see the section titled "The Hardware Tab" in Chapter 2, "Managing Windows Vista Systems." As discussed in Chapter 15, Windows Update must be enabled for this feature to work.

Windows Vista might also automatically detect the new device and then start the Driver Software Installation component, which in turn starts the Found New Hardware wizard. In this case, you can complete the installation by following these steps:

1.
In the Found New Hardware wizard, click Locate And Install Driver Software (Recommended) to continue with the installation.

2.
The Driver Software Installation component will then search for preconfigured drivers. If it doesn't find a preconfigured driver, you are prompted to insert the disk that came with the hardware device.

3.
Use one of the following techniques to continue:

  • If you have an installation disk for the device, insert it and then follow the prompts. The device should then be installed properly. Skip the remaining steps.

  • If you don't have an installation disk, click I Don't Have The Disk. Show Me Other Options and then follow the remaining steps in this procedure.

4.
On the next wizard page, click Browse My Computer For Driver Software.

5.
Click Browse to select a search location.

6.
Use the Browse For Folder dialog box to select the start folder for the search and then click OK. Because all subfolders of the selected folder are searched automatically, you can select the drive root path, such as C, to search an entire drive.

7.
When you click Next, the wizard will search for and install any appropriate driver. If the wizard can't find an appropriate driver, you'll need to obtain one and then follow the procedure in the "Installing and Updating Device Drivers" section in this chapter to complete the installation.

Note

If the wizard fails to install the device, there might be a problem with the device itself or the driver, or a conflict with existing hardware. For additional details on adding hardware and troubleshooting, see the "Managing Hardware" section in this chapter.

Once you've successfully installed a device, you'll need to periodically perform maintenance tasks for the device and its drivers. When new drivers for a device are released, you might want to test them in a development or support environment to see whether the drivers resolve problems that users have been experiencing. If the drivers install without problems and resolve outstanding issues, you might then want to install the updated drivers on computers that use this device. The driver update procedure should be implemented as follows:

1. | Check the device and driver information on each system prior to installing the new driver. Note the location, version, and file name of the existing driver.
2. | Create a System Restore point as discussed in Chapter 16, "Supporting and Troubleshooting Windows Vista."
3. | Install the updated driver and reboot the computer. If the computer and the device function normally after the reboot, the update can be considered a success.
4. | If the computer or the device malfunctions after the driver installation, use the standard Device Manager utilities to roll back to the previously installed driver. If the computer cannot be restarted and the driver cannot be restored, recover the system by starting with the last known good configuration and then restoring the system to the System Restore point that you created previously.


Getting Started with Device Manager

You use Device Manager to view and configure hardware devices. You'll spend a lot of time working with this tool, so you should get to know it before working with devices.

To access Device Manager and obtain a detailed list of all the hardware devices installed on a system, complete the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click the System And Maintenance category heading link.

3.
Click Administrative Tools and then double-click Computer Management.

Note

To work with a remote computer, right-click the Computer Management entry in the console tree and then select Connect To Another Computer. Choose Another Computer and then type the fully qualified name of the computer you want to work with, or click Browse to search for the computer with which you want to work. Click OK.

4.
In the Computer Management console, click the plus sign (+) next to the System Tools node. This expands the node to display its tools.

5.
Select Device Manager. As shown in Figure 3-5, you should now see a complete list of devices installed on the system. By default, this list is organized by device type.

Figure 3-5. Use Device Manager to work with hardware devices.

[View full size image]

6.
Click the plus sign (+) next to a device type to see a list of the specific instances of that device type.

Once you access Device Manager, you can work with any of the installed devices. If you right-click a device entry, a shortcut menu is displayed. The options available depend on the device type, but they include the following:

  • Properties Displays the Properties dialog box for the device

  • Uninstall Uninstalls the device and its drivers

  • Disable Disables the device but doesn't uninstall it

  • Enable Enables a device if it's disabled

  • Update Driver Starts the Hardware Update wizard, which you can use to update the device driver

  • Scan For Hardware Changes Tells Windows Vista to check the hardware configuration and determine whether there are any changes

Tip

The device list shows warning symbols if there are problems with a device. A yellow warning symbol with an exclamation point indicates a problem with a device. A red X indicates a device that was improperly installed or disabled by the user or the administrator for some reason.

You can use the options on the View menu in the Computer Management console to change the defaults for which types of devices are displayed and how the devices are listed. The options are as follows:

  • Devices By Type Displays devices by the type of device installed, such as disk drive or printer. The connection name is listed below the type. This is the default view.

  • Devices By Connection Displays devices by connection type, such as audio and video codecs.

  • Resources By Type Displays the status of allocated resources by type of device using the resource. Resource types are direct memory access (DMA) channels, input/output (I/O) ports, interrupt requests (IRQ), and memory addresses.

  • Resources By Connection Displays the status of all allocated resources by connection type rather than device type.

  • Show Hidden Devices Displays nonPlug and Play devices as well as devices that have been physically removed from the computer but haven't had their drivers uninstalled.


Working with Device Drivers

For each hardware component installed on a computer, there is an associated device driver. The job of the device driver is to describe how the operating system uses the hardware abstraction layer (HAL) to work with a hardware component. The HAL handles the low-level communications tasks between the operating system and a hardware component. By installing a hardware component through the operating system, you are telling the operating system about the device driver it uses, and from then on, the device driver loads automatically and runs as part of the operating system.

Device Driver Essentials

Windows Vista includes an extensive library of device drivers. In the base installation of the operating system, these drivers are maintained in the file repository of the driver store. Some service packs you install will also include updates to the driver store. You can find drivers in the FileRepository folder under %SystemRoot%\System32\DriverStore. The DriverStore folder also contains subfolders for localized driver information. You'll find a subfolder for each language component configured on the system. For example, for localized U.S. English driver information, you'll find a subfolder called en-US.

Every device driver in the driver store is certified to be fully compatible with Windows Vista and also digitally signed by Microsoft to assure the operating system of its authenticity. When you install a new Plug and Play compatible device, Windows Vista checks the driver store for a compatible device driver. If one is found, the operating system automatically installs the device.

Every device driver has an associated Setup Information file. This file ends with the .inf extension and is a text file containing detailed configuration information about the device being installed. The information file identifies any source files used by the driver as well. Source files have the .sys extension. Drivers are also associated with a component manifest (component.man) file. The manifest file is written in extensible markup language (XML), includes details on the driver's digital signature, and might also include Plug and Play information used by the device to automatically configure itself.

Every driver installed on a system has a source (.sys) file in the %SystemRoot%\ System32\Drivers folder. When you install a new device driver, the driver is written to a subfolder of %SystemRoot%\System32\Drivers, and configuration settings are stored in the registry. The driver's .inf file is used to control the installation and write the registry settings. If the driver doesn't already exist in the driver store, it does not already have an .inf file or other related files on the system. In this case, the driver's .inf file and other related files are written to a subfolder of %SystemRoot%\System32\ DriverStore\FileRepository when you install the device.

Using Signed and Unsigned Device Drivers

Every device driver in the driver cache is digitally signed, which authenticates the driver as having passed extensive testing by the Windows Hardware Quality Lab. A device driver with a digital signature from Microsoft should not cause your system to crash or become unstable. The presence of a digital signature from Microsoft also ensures that the device driver hasn't been tampered with. If a device driver doesn't have a digital signature from Microsoft, it hasn't been approved for use through testing, or its files might have been modified from the original installation by another program. This means unsigned drivers are much more likely than any other program you've installed to cause the operating system to freeze or the computer to crash.

To prevent problems with unsigned drivers, by default, Windows Vista warns you when you try to install an unsigned device driver. Windows can also be configured to eliminate this warning or to prevent unsigned drivers from being installed altogether. To manage device driver settings for computers throughout the organization, you can use Group Policy. When you do this, Group Policy specifies the least secure setting using one of three configuration settings. These settings are:

  • Ignore Use this setting to allow users to install any unsigned driver without having to see and respond to a warning prompt.

  • Warn Use this setting to prompt users each time either to continue with the installation of an unsigned driver or to stop the installation.

  • Block Use this setting to prevent users from installing unsigned driver software.

Note

When Group Policy is set to Ignore or Warn, unsigned drivers can be installed. When Group Policy is set to Block, unsigned device drivers can't be installed without first overriding Group Policy.

You can configure device driversigning settings on a per user basis using the Code Signing For Device Drivers policy. This policy is located in User Configuration\Administrative Templates\System\Driver Installation. When you enable this policy, you can specify the action to take as Ignore, Warn, or Block. Once enabled, the system doesn't implement any setting less secure than the established setting.

Tip

See Chapter 9 for details on working with Group Policy. If you're trying to install a device and find that you can't install an unsigned driver, you should first check the System utility settings for driver signing. If you find that the settings are set to Block and you can't change the setting, the Code Signing For Device Drivers policy has been enabled and set to Block in Group Policy. You must override Group Policy to install the unsigned device driver.

Tracking Driver Information

Each driver being used on a system has a driver file associated with it. You can view the location of the driver file and related details by completing the following steps:

1.
Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.

2.
Select Device Manager. You should now see a complete list of devices installed on the system. By default, this list is organized by device type.

3.
Right-click the device you want to manage and then select Properties. The Properties dialog box for that device opens.

4.
In the Driver tab, click Driver Details to display the Driver File Details dialog box. As shown in Figure 3-6, the following information is displayed:

Driver Files Displays the full file path to locations where the driver exists

Provider The creator of the driver

File Version The version of the file

Figure 3-6. The Driver File Details dialog box displays information on the driver file locations, the provider, and the file versions.

Installing and Updating Device Drivers

To keep devices operating smoothly, it's essential that you keep the device drivers current. You install and update drivers using the Found New Hardware, Add Hardware, and Update Driver Software Wizards. By default, these wizards can search for updated device drivers in the following locations:

  • On the local computer

  • On a hardware installation CD

  • On the Windows Update site or your organization's Windows Update server

In Group Policy, several policies control the search possibilities.

  • Turn Off Access To All Windows Update Features under Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication Settings If this policy setting is enabled, all Windows Update features are blocked and not available to users. Users will also be unable to access the Windows Update Web site.

  • Turn Off Windows Update Device Driver Searching under Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication Settings By default, Windows Update searching is optional when installing a device. If you enable this setting, Windows Update will not be searched when a new device is installed. If you disable this setting, Windows Update will always be searched when a new device is installed, if no local drivers are present.

  • Turn Off Windows Update Device Driver Search Prompt under Computer Configuration\Administrative Templates\System\Driver Installation If you disable, or do not configure, Turn Off Windows Update Device Driver Searching, this policy setting affects whether a search prompt is displayed for Windows Update of device drivers. If this policy setting is enabled, administrators aren't prompted to search Windows Update and the search will or will not take place automatically based on the Turn Off Windows Update Device Driver Searching setting. Otherwise, administrators will be prompted before Windows Update is searched.

  • Configure Driver Search Locations under User Configuration\Administrative Templates\System\Driver Installation If this policy setting is enabled, users can be restricted from searching floppy disk drives, CD drives, Windows Update, or any combination of these locations.

You can install and update device drivers by completing the following steps:

1.
Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.

2.
Select Device Manager in the Computer Management console. You should now see a complete list of devices installed on the system. By default, this list is organized by device type.

3.
Right-click the device you want to manage and then select Update Driver. This starts the Update Driver Software Wizard.

Best Practices

Updated drivers can add functionality to a device, improve performance, and resolve device problems. However, you should rarely install the latest drivers on a user's computer without first testing them in a test environment. Test first, then install.

4.
As shown in Figure 3-7, you can specify whether you want to install the drivers automatically or manually by selecting the driver from a list or specific location.

Figure 3-7. Choose whether to install automatically or manually.

[View full size image]

5.
If you elect to install the driver automatically, Windows Vista looks for a more recent version of the device driver and installs the driver if found. If a more recent version of the driver is not found, Windows Vista keeps the current driver. In either case, click Close to complete the process and then skip the remaining steps.

6.
If you chose to install the driver manually, you'll have the opportunity to do one of the following:

  • Search for the driver If you want to search for drivers, click Browse to select a search location. Use the Browse For Folder dialog box to select the start folder for the search and then click OK. Because all subfolders of the selected folder are searched automatically, you can select the drive root path, such as C, to search an entire drive.

  • Choose the driver to install If you want to choose the driver to install, click Let Me Pick From A List Of Device Drives On My Computer. The wizard then shows a list of compatible hardware. Click the device that matches your hardware. To view a wider array of choices, clear the Show Compatible Hardware check box. You'll then see a full list of manufacturers for the type of device you are working with. As shown in Figure 3-8, scroll through the list of manufacturers to find the manufacturer of the device, and then choose the appropriate device in the right pane.

    Figure 3-8. Select the appropriate device driver for the device you're adding.

    [View full size image]

Note

If the manufacturer or device you want to use isn't listed, insert your device driver disk into the floppy drive or CD-ROM drive and then click the Have Disk button. Follow the prompts. Afterward, select the appropriate device.

7.
After selecting a device driver through a search or a manual selection, continue through the installation process by clicking Next. Click Close when the driver installation is completed. If the wizard can't find an appropriate driver, you'll need to obtain one and then repeat this procedure. Keep in mind that in some cases you'll need to reboot the system to activate the newly installed or updated device driver.

Restricting Device Installation Using Group Policy

In addition to code signing and search restrictions, Group Policy settings can be used to allow or prevent installation of devices based on device type. The related policy settings are found under Computer Configuration\Administrative Templates\ System\Device Installation\Device Installation Restrictions and include the following settings:

  • Allow Administrators To Override Device Installation Restriction Policies

  • Allow Installation Of Devices That Match Any Of These Device IDs

  • Allow Installation Of Devices Using Drivers That Match These Device Setup Classes

  • Prevent Installation Of Devices Not Described By Other Policy Settings

  • Prevent Installation Of Devices That Match Any Of These Device IDs

  • Prevent Installation Of Removable Devices

You can configure these policies by completing the following steps:

1. | Access policy for the appropriate domain, site, or organizational unit (OU).
2. | Expand Computer Configuration, Administrative Templates, System, Device Installation, Device Installation Restrictions.
3. | Double-click the appropriate policy to view its properties dialog box.
4. | Set the state of the policy as Not Configured if you don't want the policy to be applied, Enabled if you want the policy to be applied, or Disabled if you want to block the policy from being used (all as permitted by the Group Policy configuration).
5. | If you are enabling the policy and it has a Show option, click the Show button to use the Show Contents dialog box to specify which device IDs should be matched to this policy. Click OK.
6. | Click OK.

Rolling Back Drivers

Sometimes you'll find that a device driver that you've installed causes device failure or other critical problems on a system. Don't worry: You can recover the system to the previously installed device driver. To do this, follow these steps:

1. | If you are having problems starting the system, you will need to boot the system in Safe mode as discussed in the "Troubleshooting Startup and Shutdown" section in Chapter 16.
2. | Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.
3. | Select Device Manager in the Computer Management console. You should now see a complete list of devices installed on the system. By default, this list is organized by device type.
4. | Right-click the device you want to manage and then select Properties. This opens the Properties dialog box for the device.
5. | Click the Driver tab and then click Roll Back Driver. When prompted to confirm the action, click Yes.
6. | Click Close to close the driver's properties dialog box.

Note

If the driver file hasn't been updated, a backup drive file won't be available. In this case, the Roll Back Driver button will be disabled and you will not be able to click it.

Removing Device Drivers for Removed Devices

Usually when you remove a device from a system, Windows Vista detects this action and automatically removes the drivers for that device. However, sometimes when you remove a device, Windows Vista doesn't detect the change and you must remove the drivers manually. You can remove device drivers by completing the following steps:

1. | Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.
2. | Select Device Manager in the Computer Management console.
3. | Right-click the device you want to remove and then select Uninstall.
4. | When prompted to confirm the action, click OK.

Uninstalling, Reinstalling, and Disabling Device Drivers

Uninstalling a device driver uninstalls the related device. When a device isn't working properly, sometimes you can completely uninstall the device, restart the system, and then reinstall the device driver to restore normal operations. You can uninstall and then reinstall a device by completing the following steps:

1. | Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.
2. | Select Device Manager in the Computer Management console. You should now see a complete list of devices installed on the system. By default, this list is organized by device type.
3. | Right-click the device you want to manage and then select Uninstall.
4. | When prompted to confirm the action, click OK.
5. | Reboot the system. Windows Vista should detect the presence of the device and automatically reinstall the necessary device driver. If the device isn't automatically reinstalled, reinstall manually as discussed in the section of this chapter entitled "Installing and Updating Device Drivers."

To prevent a device from being reinstalled automatically, disable the device instead of uninstalling it. You disable a device by right-clicking it in Device Manager and then selecting Disable.


Managing Hardware

Windows Plug and Play technology does a good job of detecting and automatically configuring new hardware. However, if the hardware doesn't support Plug and Play or it isn't automatically detected, you'll need to enter information about the new hardware into the Windows Vista system. You do this by installing the hardware device and its related drivers on the system using the Add Hardware Wizard. You can also use this wizard to troubleshoot problems with existing hardware.

Adding NonPlug and Play Hardware

Using the Add Hardware Wizard, you can install older devices that do not support Plug and Play. Before you do this, you must turn off the computer and connect the hardware. Once you've connected the hardware and started the computer, you can use the Add Hardware Wizard to install the device by completing the following steps:

1.
In Control Panel, click Classic View and then double-click Add Hardware.

2.
In the Add Hardware Wizard, read the introductory message and then click Next.

3.
Determine whether the wizard should search for new hardware or you want to select the hardware from a list.

  • If you choose the search option, the wizard searches for and attempts to automatically detect the new hardware. The wizard takes a few minutes to go through all the device types and options. When the search is complete, any new devices found are displayed, and you can select one.

  • If you choose the manual option, or if no new devices are found in the automatic search, you'll have to select the hardware type yourself. Select the type of hardware, such as Modems or Network Adapters, and then click Next. Scroll through the list of manufacturers to find the manufacturer of the device and then choose the appropriate device in the right pane.

4.
Once you complete the selection and installation process, click Next. Confirm that you want to install the hardware by clicking Next again.

5.
After the wizard installs the drivers for the hardware device, click Finish. The new hardware should now be available.

Enabling and Disabling Hardware

When a device isn't working properly, sometimes you'll want to uninstall or disable it. Uninstalling a device removes the driver association for the device so that it temporarily appears that the device has been removed from the system. The next time you restart the system, Windows Vista might try to reinstall the device. Typically, Windows Vista reinstalls Plug and Play devices automatically, but does not automatically reinstall nonPlug and Play devices.

Disabling a device turns it off and prevents Windows Vista from using it. Because a disabled device doesn't use system resources, you can be sure that it isn't causing a conflict on the system.

You can uninstall or disable a device by completing the following steps:

1.
Start Computer Management. In the Computer Management console, click the plus sign (+) next to the System Tools node.

2.
Select Device Manager in the Computer Management console. You should now see a complete list of devices installed on the system. By default, this list is organized by device type.

3.
Right-click the device you want to manage and then select one of the following options:

  • Enable to enable the device

  • Uninstall to uninstall the device

  • Disable to disable the device

4.
If prompted to confirm the action, click Yes or OK as appropriate.

Troubleshooting Hardware

Built-in hardware diagnostics in Windows Vista can detect many types of problems with hardware devices. If a problem is detected, you might see a Problem Reports And Solutions balloon telling you there is a problem. Clicking this balloon should open the Problem Reports And Solutions console. The Problem Reports And Solutions console can also be accessed in Control Panel by clicking the System And Maintenance heading link and then selecting Problem Reports And Solutions. Details on working with Problem Reports And Solutions are discussed in Chapter 16.

Whenever a device is installed incorrectly or has another problem, Device Manager displays a warning icon indicating that the device has a problem. If you double-click the device, an error code is displayed on the General tab of the device's Properties dialog box. As Table 3-2 shows, this error code can be helpful when trying to solve device problems as well. Most of the correction actions assume that you've selected the General tab on the device's Properties dialog box.

Table 3-2. Common Device Errors and Techniques to Resolve Them

Error Message

Correction Action

This device is not configured correctly. (Code 1)

Obtain a compatible driver for the device and click Update Driver to start the Hardware Update Wizard.

The driver for this device might be corrupted, or your system might be running low on memory or other resources. (Code 3)

Click the Update Driver button on the Driver tab to run the Hardware Update Wizard. You might see an "Out of Memory" message at startup because of this.

This device cannot start. (Code 10)

Click the Update Driver button on the Driver tab to run the Hardware Update Wizard. Don't try to automatically find a driver. Instead, choose the manual install option and select the device.

This device cannot find enough free resources that it can use. (Code 12)

Resources assigned to this device conflict with another device, or the BIOS is incorrectly configured. Check the BIOS and check for resource conflicts on the Resources tab of the device's Properties dialog box.

This device cannot work properly until you restart your computer. (Code 14)

Typically, the driver is installed correctly, but will not be started until you restart the computer.

Windows cannot identify all the resources this device uses. (Code 16)

Check whether a signed driver is available for the device. If one is available and you've already installed it, you might need to manage the resources for the device. Check the Resources tab of the device's Properties dialog box.

This device is asking for an unknown resource type. (Code 17)

Reinstall or update the driver using a valid, signed driver.

Reinstall the drivers for this device. (Code 18)

After an upgrade, you might need to log on as an administrator to complete device installation. If this is not the case, click Update Driver on the Driver tab to reinstall the driver.

Your registry might be corrupted. (Code 19)

Remove and reinstall the device. This should clear out incorrect or conflicting registry settings.

Windows is removing this device. (Code 21)

The system will remove the device. The registry might be corrupted. If the device continues to display this message, restart the computer.

This device is disabled. (Code 22)

This device has been disabled using Device Manager. To enable it, select Use This Device (Enable) under Device Usage on the General tab of the device's Properties dialog box.

This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

This might indicate a bad device or bad hardware. This error code can also occur with legacy ISA devices; upgrade the driver to resolve.

The drivers for this device are not installed. (Code 28)

Obtain a compatible driver for the device and then click Update Driver to start the Hardware Update Wizard.

This device is disabled because the firmware of the device did not give it the required resources. (Code 29)

Check the device documentation on how to assign resources. You might need to upgrade the BIOS or enable the device in the system BIOS.

This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

The device driver might be incompatible with Windows Vista. Obtain a compatible driver for the device and click Update Driver to start the Hardware Update Wizard.

A driver for this device was not required and has been disabled. (Code 32)

A dependent service for this device has been set to Disabled. Check the event logs to determine which services should be enabled and started.

Windows cannot determine which resources are required for this device. (Code 33)

This might indicate a bad device or bad hardware. This error code can also occur with legacy ISA devices; upgrade the driver and/or refer to the device documentation on how to set resource usage.

Windows cannot determine the settings for this device. (Code 34)

The legacy device must be manually configured. Verify the device jumpers or BIOS settings and then configure the device resource usage using the Resources tab of the device's Properties dialog box.

Your computer's system firmware does not include enough information to properly configure and use this device. (Code 35)

This error occurs on multiprocessor systems. Update the BIOS; check for a BIOS option to use MPS 1.1 or MPS 1.4. Usually you want MPS 1.4.

This device is requesting a PCI interrupt but is configured for an ISA interrupt (or vice versa). (Code 36)

ISA interrupts are non-shareable. If a device is in a PCI slot but the slot is configured in BIOS as "reserved for ISA," the error might display. Change the BIOS settings.

Windows cannot initialize the device driver for this hardware. (Code 37)

Run the Hardware Update Wizard by clicking the Update Driver button on the Driver tab.

Windows cannot load the device driver for this hardware because a previous instance of the device driver is still in memory. (Code 38)

A device driver in memory is causing a conflict. Restart the computer.

Windows cannot load the device driver for this hardware. The driver might be corrupted or missing. (Code 39)

Check to ensure the hardware device is properly installed and connected and that it has power. If it is properly installed and connected, look for an updated driver or reinstall the current driver.

Windows cannot access this hardware because its service key information in the registry is missing or recorded incorrectly. (Code 40)

The registry entry for the device driver is invalid. Reinstall the driver.

Windows has stopped this device because it has reported problems. (Code 43)

The device was stopped by the operating system. You might need to uninstall and then reinstall the device. The device might have problems with the no-execute processor feature. In this case, check for a new driver.

An application or service has shut down this hardware device. (Code 44)

The device was stopped by an application or service. Restart the computer. The device might have problems with the no-execute processor feature. In this case, check for a new driver.


Customizing Hardware Device Settings

Few system settings have more impact on the user experience than the settings for hardware devices such as the keyboard and mouse. Although these devices might seem to have straightforward uses, you can control several settings for them.

Configuring Keyboard Settings

Keyboard settings are controlled with the Keyboard utility. In Control Panel, click Hardware And Sound and then double-click Keyboard to display the Keyboard Properties dialog box. You can now use the settings on the Speed tab to update the basic keyboard configuration. These settings are as follows:

  • Repeat Delay Controls the delay for repeating characters when you hold down a key. The default repeat delay is fairly short. For novice typists, you might want to set a longer delay rate.

  • Repeat Rate Controls how quickly characters repeat when you hold down a key. The default repeat rate is fast. You'll rarely want to change this setting.

  • Cursor Blink Rate Controls the rate at which the cursor blinks. If you find the blinking cursor annoying, set Cursor Blink Rate to None.

Keyboards also have device drivers that can be managed like any other device driver. You can view driver details, update drivers, and uninstall drivers. You can also roll back drivers if necessary. One way to access the device drivers for a keyboard is to follow these steps:

1. | In Control Panel, click Hardware And Sound and then double-click Keyboard. This displays the Keyboard Properties dialog box.
2. | On the Hardware tab, click Properties. Then in the Keyboard Properties dialog box, click the Driver tab.

Configuring Mouse Settings

Mouse settings are controlled with the Mouse utility. In Control Panel, click Hardware And Sound and then double-click Mouse to display the Mouse Properties dialog box. Here are some tips for optimizing mouse behavior for different users:

  • On the Buttons tab, select Switch Primary And Secondary Buttons to configure the mouse buttons for left-handed users.

  • On the Buttons tab, select Turn On ClickLock to select or drag without having to hold down the mouse button.

  • Customize the display of the mouse pointer by using schemes. In the Pointers tab, use the options in the Scheme list to set a pointer scheme.

  • If you have problems double-clicking, in the Buttons tab, change the Double-Click Speed rate to match your clicking speed.

  • If the pointer distracts you when you are typing, in the Pointer Options tab, select Hide Pointer While Typing.

  • If you need a better visual cue as to the location of the pointer when you move it, in the Pointer Options tab, select Display Pointer Trails.

As with keyboards, mouse devices also have device drivers. One way to access the device drivers for a mouse is to follow these steps:

1. | In Control Panel, click Hardware And Sound and then double-click Mouse. This displays the Mouse Properties dialog box.
2. | On the Hardware tab, click Properties. Then in the Mouse Properties dialog box, click the Driver tab.

Configuring Audio Devices and Sound Themes

Most computers have sound cards, audio input devices (such as microphones), and audio output devices (such as built-in speakers or attached stereo speakers). In Windows Vista, you can use the Volume control, which is accessible from the system tray, to set the computer's main volume level and the volume for each application that is running. By default, the volume level for running applications is set relative to the main volume, such that if you increase or reduce the main volume, the application's volume increases or reduces as well, relative to its initial value.

Double-click the Volume icon in the system tray to display the Volume control. You can then adjust the main volume as necessary, and the application's volume will be adjusted relative to its initial value. You can also independently adjust the volume for running applications. Because the main volume must always be at least as high as the applications volume, the main volume is increased automatically if you increase the applications volume past the main volume level.

To control the main volume for sound cards and audio devices, you'll use the Audio Devices And Sound Themes utility. In Control Panel, click Hardware And Sound and then click Sound to display the dialog box shown in Figure 3-9. Using this Properties dialog box to configure audio playback devices, audio recording devices, and sound effects is discussed in the sections that follow.

Figure 3-9. Use Sound to configure audio recording and playback devices.

Configuring Audio Playback Devices

Output and input levels for sound are controlled separately. To set the output levels for audio playback, follow these steps:

1.
In Control Panel, click Hardware And Sound and then click Sound.

2.
In the Sound dialog box, double-click the appropriate device on the Playback tab.

3.
Select the Levels tab, shown in Figure 3-10. The Volume Control panel provides the master controls. You can work with the main controls as follows:

  • Use the Volume Control slider to set the playback volume as appropriate.

  • To mute the device, click the sound button to the right of the Volume Control slider. To unmute the device, click the sound button again.

  • To adjust the speaker balance, click the Balance button, drag the L and R sliders as appropriate to set the desired balance between the computer's left and right speakers, and then click OK.

Figure 3-10. Use the Volume Control panel options to manage the master volume and individual controls to set the volume of individual audio devices.

4.
You can use similar techniques to set playback levels for other devices.

5.
Click OK to save the settings.

Audio performance options control how Windows Vista plays audio. You can use the sample rate to control the playback quality of audio and the amount of system resources used to manage audio playback. To configure the sample rate, double-click the device under Audio Output (Playback) Devices. On the Options tab, use the Default Format selection list to set the sample rate and bit depth to use. In most cases, the default setting is 16 bit, 44100 Hz CD Quality sound.

Configuring Audio Recording Devices

To set the input levels for audio recording, follow these steps:

1. | In Control Panel, click Hardware And Sound and then click Sound.
2. | In the Sound dialog box, double-click the appropriate device on the Recording tab.
3. | On the Levels tab, use the slider provided to set the recording volume as appropriate. If a Balance button is provided, click the Balance button, drag the L and R sliders as appropriate to set the desired balance, and then click OK.
4. | Click OK to save the settings.

Some microphones have a MIC Boost option that is used to boost the microphone's input volume. To boost the microphone and set the level to boost, double-click on the Recording tab of the Sound dialog box. In the Properties dialog box for the device, select MIC Boost on the Custom tab. On the Levels tab, use the slider provided to set the boost level as appropriate. If a Balance button is provided, click the Balance button, drag the L and R sliders as appropriate to set the desired balance, and then click OK.

Configuring System Sound Effects

System sound effects enable you to play audio files when certain program events occur. You can choose sounds for each event individually, or you can use a Windows Vista sound scheme to apply sound settings automatically. Several sound schemes are available. Windows Vista desktop themes can also have sound schemes associated with them. This means that if you change your desktop theme, the system's sound scheme might also change.

You can configure sound effects and schemes by completing the following steps:

1. | In Control Panel, click Hardware And Sound and then click Sound.
2. | Click the Sound tab.
3. | To choose a sound scheme, use the Sound Scheme list box.
4. | To preview a sound for a particular event, select the event in the Program Events list and then click the play button (the button with the right-pointing triangle).
5. | To change the sound for an event, select the event in the Program Events list and then use the Sounds list to choose an available sound. You can also click Browse to select other sounds available on the system. The sound files must be in Microsoft .wav format.
6. | To save a changed sound scheme, click Save As, type a name for the scheme in the field provided, and then click OK.
7. | Click OK to close the Sound dialog box.

Adjusting Regional Settings

Regional settings are used to set country-specific standards and formats. In different countries, the unit of measurement, currency, and date formatting can be different. By choosing a region, you choose all the appropriate settings for it. Regional settings are also used to specify your present location for the purposes of presenting local information in dialog boxes and within Help And Support Services windows.

To configure regional settings, follow these steps:

1. | In Control Panel, click Clock, Language, And Region and then click Regional And Language Options.
2. | On the Formats tab, use the Current Format list to select a country or region. The Examples area should now display the formatting standards for the region. To customize these settings, click Customize This Format and then use the Customize Regional Options dialog box to modify the basic number, currency, time, and date settings for the region.
3. | On the Location tab, use the selection list provided to set the current location.
4. | On the Keyboards And Languages tab, click Settings. In the Text Services And Input Languages dialog box, use the Default Input Language selection list to set the default input language to use with the keyboard and then click OK.
5. | Click OK to save these settings.

Any regional settings applied to the currently logged on user can be applied to a computer's default user account and to system accounts. Applying regional settings to the default user account ensures that any new user accounts created on the computer use the settings. Applying the regional settings to system accounts ensures the operating system uses the settings for all background processing handled by system accounts, such as Local System.

To apply the current regional settings to a computer's default user account and to system accounts, follow these steps:

1. | In Control Panel, click Clock, Language, And Region and then click Regional And Language Options.
2. | On the Administrative tab, click Copy To Reserved Accounts.
3. | To apply the current regional settings to the default user account, select the Default User Account check box.
4. | To apply the current regional settings to system accounts, select the System Accounts check box.
5. | Click OK.

Tip

If you make a mistake and apply the wrong settings to the default user account or system accounts, simply correct the regional settings as appropriate for the current user and then apply them to the default user account, system accounts, or both.

Setting the Date and Time

System time can be set in several different ways. Typically, you'll use the Date And Time Properties dialog box. To adjust the system date and time, follow these steps:

1. | On the desktop taskbar, click the clock in the system tray and then click Date And Time Settings. This displays the Date And Time Settings dialog box.
2. | Click Change Date And Time. Use the options provided to set the system date and time as appropriate and then click OK.
3. | Click Change Time Zone. Use the options provided to set the time zone for the computer and then click OK. Note Some time zones within the United States and abroad use Daylight Saving Time. If you select a time zone where this is applicable, you'll see the Automatically Adjust Clock For Daylight Saving Changes check box. Daylight Saving Time is used by default wherever applicable. If you don't want to use Daylight Saving Time, clear this check box.
4. | Click OK.

To keep system time in close synchronization with world time, you'll want to use Internet time. See the "Configuring Internet Time in Workgroups" and "Configuring Internet Time in Domains" sections of this chapter for more information.

Note

The lithium battery that maintains the complementary metal oxide semi-conductor (CMOS) memory on the motherboard also maintains the PC clock within a computer when the system is shut off. This battery is designed to last several years but it does need to be replaced periodically. If a computer consistently loses time, this battery could be to blame, and you might want to replace it.


Managing Internet Time

System time has an increasingly important role as the Windows operating system matures, particularly with regard to Kerberos security, which is the default Windows Vista authentication mechanism. With NTLM version 2 and Kerberos version 5 security, the network depends on system clocks being in close synchronization. If the clocks on different systems aren't closely synchronized, authentication tickets can become invalid before they reach a destination host, which can prevent logon and authentication.

Internet Time Overview

Keeping the system synchronized with the actual time isn't easy. System clocks can lose time, users can accidentally set the system clock to the wrong time, and other things can also go wrong. To help resolve problems with system time and time synchronization, Windows Vista uses Windows Time service to set a consistent Internet time based on the time at an Internet time server. Windows Time service allows synchronization within 100 milliseconds of world time. Here's a basic overview of how Windows Time service works:

  • Windows Vista systems are configured to synchronize with an Internet time server automatically. This time server is referred to as the authoritative time server. The default time servers are time.microsoft.com and time.nist.gov. Administrators can specify either of these servers or type in the name of another time server.

    Real World

    The authoritative time server for a domain is the domain controller that authenticates a server or workstation in the domain, and all member servers and workstations in a domain automatically sync their clocks with this server. In most cases, you'll want Windows Vista computers configured in workgroups to sync with a local time server (one located on your network, for instance) and then have the local time server synchronize with an authoritative time server, such as time.nist.gov. This reduces network traffic and can improve performance for time synchronization.

  • The Windows Time service uses the Simple Network Time Protocol (SNTP) to poll the authoritative time server. The global settings MinPollInterval and MaxPollInterval control the exact rates.

  • If there are differences in time between the time server and the system, the Windows Time service slowly corrects the time. The global settings UpdateInterval and FrequencyCorrectRate control the exact correction rate.

Note

SNTP defaults to using User Datagram Protocol (UDP) port 123. If this port is not open to the Internet, you can't synchronize the system with an Internet time server.

You can configure the Windows Time service via the Registry or Group Policy. Table 3-3 provides detailed information on the most used time service settings. The related Group Policy settings are under Computer Configuration\Administrative Templates\System\Windows Time Service\Global Configuration Settings. If the Global Configuration Settings policy is enabled, its settings take precedence over local registry settings. The related registry settings are under HKLM\SYSTEM\CurrentControl Set\Services\W32Time\Config. If you change registry values for time services, you can apply them by typing the following command at the command prompt:

w32tm /config /update

Table 3-3. Global Configuration Settings for Windows Time Services

Setting

Description

Accepted Values/Flags

AnnounceFlags

Default value: 10 (8 + 2). Sets the time server classification. A computer must be classified first as a time server to be subsequently classified as a reliable time server. This is why the default flag is 10 (meaning flags 2 and 8 are applied). This setting is only used by domain controllers and determines how the time service is advertised by the Netlogon service.

10 (default with 8 + 2 flags) 0; the domain controller doesn't advertise time service. 1; the domain controller always advertises time service. 2; the domain controller is a time server and automatically determines whether it should advertise time service. 4; the domain controller will always advertise reliable time service. 8; the domain controller is a reliable time server and automatically determines whether it should advertise reliable time service.

EventLogFlags

Determines the types of events that the time service logs. Default value: 2.

1; logs when the time service must make a discontinuous change to the clock. 2; logs when the time service chooses a new source of time information. 3; logs when the time service hasn't acquired time samples for a period of 1.5 times the maximum poll interval and no longer trusts the local clock's accuracy.

FrequencyCorrectRate

Modifies the rate at which the time service corrects (synchronizes) the system clock. The value used is multiplied by the number of clock ticks in 64 seconds to come up with the base gain used to correct the system time. Generally, the smaller the value, the more responsive the system is to time changes. However, if the value is too small, the system time can change too frequently to be stable. A value of 35 is generally a stable range.

4 (default)

HoldPeriod

Determines the number of seconds the last consistently read time sample is held. It is essentially designed to prevent frequent time changes due to inconsistent time samples. During this period, time synchronization (as determined by the FrequencyCorrectRate) and spike detection (for consistent time samples) are switched off to allow for faster time correction (convergence).

5 (default)

LargePhaseOffset

Determines the time offset, in milliseconds, that triggers direct setting of the system clock. If the system clock is off by more than this amount, system time is set directly to the appropriate time rather than using time correction (convergence). Set the offset to a higher value to make it less likely that the system time will be set directly. However, if you do this, it is more likely that bad time samples will be considered good.

128,000 (default)

LocalClockDispersion

Indicates the relative reliability of the local CMOS clock when it's used as a time source for other computers but isn't synchronized with another network time source. The dispersion value is the number of seconds by which the time service should consider the local CMOS clock to be off from the estimated true time at any given time. The higher the reliability by which the local CMOS should be considered, the lower the dispersion value should be set. If the clock is synchronized from a network time source, the dispersion applies to that time source.

10 (default)

MaxAllowedPhaseOffset

Specifies the maximum time correction allowed when convergence is used (rather than direct time setting). If the system clock is off by more than this number of seconds, the time is corrected over multiple convergence intervals. This value is designed to prevent sudden large changes in time.

300 (default for DCs)

1 (default for other computers)

MaxNegPhaseCorrection

Specifies the largest negative time correction the time service is allowed to make. If the time is off by more than this amount, the required change is logged rather than corrected. For example, if the clock is set to 5:00 P.M. but it is really 1:59 A.M. of that same day (an earlier time), the required time change would be logged rather than corrected. An administrator would then need to set the time manually. A smaller value is considered more secure because it could prevent malicious time servers from changing system times erroneously.

54,000 (default)

MaxPollInterval

Determines the longest time interval to be used for checking the time. The value is set in units of 2n seconds where n is the value for this setting. The default value is 215 (32,768 seconds). The Windows Time service will consider itself to be in an unsynchronized state when 1.5 times the MaxPollInterval has elapsed and it is unable to obtain a time reading from a reliable time server. This value is also referred to as the maximum clock age and in the Network Time Protocol, the maximum clock age allowed is 86,400 seconds. Thus, if you set MaxPollInterval to a value greater than 15, the time server may be ignored completely by peers.

15 (default)

MaxPosPhaseCorrection

Specifies the largest positive time correction the time service is allowed to make. If the time is off by more than this amount, the required change is logged rather than corrected. For example, if the clock is set to 1:59 A.M. but it is really 5:00 P.M. of that same day (a later time), the required time change would be logged rather than corrected. An administrator would then need to set the time manually. A smaller value is considered more secure because it could prevent malicious time servers from changing system times erroneously.

54,000 (default)

MinPollInterval

Determines the shortest time interval to be used for checking the time. The value is set in units of 2n seconds where n is the value for this setting. The default value for DCs is 26 (64 seconds) because time synchronization is more important and 210 (1,024 seconds) for other computers to reduce the number of network accesses. Windows Vista and Windows Server 2003 won't poll more frequently than once every 16 seconds regardless of the MinPollInterval used.

6 (default for DCs)

10 (default for other computers)

PhaseCorrectionRate

Specifies the time correction interval in seconds. This is the interval for time correction when convergence is used. With the default value, the time can be corrected once every second.

1 (default)

PollAdjustFactor

Sets an adjustment interval for polling the time. The value is set in units of 2n seconds, where n is the value for this setting.

5 (default)

SpikeWatchPeriod

Sets the period in seconds during which suspicious time changes are watched before they are accepted as valid. If you lower this value, you allow the time server to correct time spikes (sudden changes in time) more quickly, but you also make it more likely that bad time samples will be considered good.

90 (default)

UpdateInterval

Determines the interval used for phase correction adjustments. The lower the value, the more accurate the time. The higher the value, the more efficient the time sampling. Thus there is a trade to be made between accuracy and efficiency. On DCs, you want more accuracy and can use more system resources to maintain the system clock because clock accuracy is very important. On other computers, you balance the need for efficiency against the need for accuracy.

100 (DCs), 30,000 (member servers), 360,000 (standalone computers)

Configuring Internet Time in Workgroups

Most organizations will want to use Internet time so that computers can easily synchronize with external time servers. Because enabling Internet time is the default setting for Windows Vista, the real challenge lies in opening UDP port 123 on your firewall to allow the flow of Windows Time service traffic. Once you open this port on your firewall, the time service should operate normally.

You can enable or disable Internet time for individual systems in a workgroup by completing the following steps:

1. | In Control Panel, click Clock, Language, And Region and then click Date And Time.
2. | Select the Internet Time tab and then click Change Settings.
3. | To enable Internet time, select Automatically Synchronize With An Internet Time Server and then select the time server you want to use. You should also ensure that the Windows Time service is running in the Services utility.
4. | To disable Internet time, clear the Automatically Synchronize With An Internet Time Server check box.
5. | Use the Server field to specify the Internet time server to use. Several default time servers are listed, including time.windows.com and time.nist.gov. You can select one of these or type in the fully qualified domain name of another time server to use.
6. | Click OK.

When you use Internet time, keep in mind that on large networks, it's much more efficient to set up a local time server. With a local time server, SNTP messages from workstations and servers are broadcast locally and don't go out to the Internet. The messages sent between the local time server and the external time servers are the only external time traffic.

If a computer isn't set to the correct time, network access is usually the problem. Computers must have access to the network to access a local time server. They must have access to the Internet to access an Internet time server, which also requires that UDP port 123 be open to the computer on the organization's firewall or proxy server.

You can check the status of time synchronization at any time, and you can force a computer to update the time immediately as well. If you suspect that time synchronization is failing, you can check the status of the last synchronization by following these steps:

1. | In Control Panel, click Clock, Language, And Region and then double-click Date And Time.
2. | Select the Internet Time tab.
3. | Any error encountered during the last synchronization attempt will be displayed.

You can troubleshoot the configuration by following these steps:

1. | In Control Panel, click Clock, Language, And Region and then double-click Date And Time.
2. | Select the Internet Time tab and then click Change Settings.
3. | Ensure that the time server is set correctly. If necessary, retype the value.
4. | Click Update Now to force Windows Vista to attempt to synchronize with the specified time server.
5. | If an error occurs, check the network connectivity as well as the status of the Windows Time service. Again, the computer must have appropriate network or Internet access, and the Windows Time service must be running for this feature to work properly.

Configuring Internet Time in Domains

In Microsoft Active Directory directory service domains, a domain controller is chosen automatically as the reliable time source for the domain, and other computers in the domain synchronize time with this server. Should this server be unavailable to provide time services, another domain controller takes over. You cannot, however, change the Windows Time configuration. If you want to manage Windows Time in a different way, you must first enable and configure Internet Time through Group Policy. The related policies are found under Computer Configuration\Administrative Templates\ System\Windows Time Service\Time Providers and include the following settings:

  • Enable Windows NTP Client When this setting is enabled, this computer can synchronize its clock with designated NTP servers.

  • Enable Windows NTP Server When this setting is enabled, this computer can service NTP requests from other computers.

  • Configure Windows NTP Client When you enable this setting, you are able to set the Internet time configuration options, including the name of the time server to use.

You can also configure global time services options using Global Configuration Settings under Computer Configuration\Administrative Templates\System\Windows Time Service.

With this in mind, you configure Internet Time in a domain by completing the following steps:

1. | Access policy for the appropriate domain, site, or OU.
2. | Expand Computer Configuration, Administrative Templates, System, Windows Time Service, Time Providers.
3. | Double-click Enable Windows NTP Server, select Enabled, and then click OK.
4. | Access the appropriate domain, site, or organizational unit Group Policy Object in the Group Policy Object Editor.
5. | Expand Computer Configuration, Administrative Templates, System, Windows Time Service, Time Providers.
6. | Double-click Enable Windows NTP Client, select Enabled, and then click OK.
7. | Double-click Configure Windows NTP Client and then select Enabled. Use the fields available to set the default NTP settings, including the name of the time server to use. Click OK when you are finished.


Chapter 4. Customizing the Desktop and the Interface

In this chapter:
Optimizing Windows Vista Menus | 120
Customizing the Taskbar | 129
Optimizing Toolbars | 134
Working with Desktop Themes | 137
Optimizing the Desktop Environment | 140
Screen Saver Dos and Don'ts | 148
Modifying Display Appearance and Video Settings | 152

As an administrator, you'll often be asked to help users customize their desktop and user profile data. You might even be asked to create for new users a default working environment that closely maps to the corporate standard or core user preferences. One way to create a default working environment is to create a default user account, log on as that user, set up the environment as necessary, and then use the account and its associated profile as the starting point for new accounts.

Microsoft Windows Vista provides a whole new level of desktop and screen customization options. Although these options are useful, they can cause problems that you, as an administrator, might be asked to help resolve. You might also see users struggling to fix these issues on their own, so you might want to lend a hand. This chapter focuses on the configuration and troubleshooting of the following areas:

  • Menus, the taskbar, and toolbars

  • Desktop themes and backgrounds

  • Custom desktop content

  • Screen saver dos and don'ts

  • Display appearance and settings


Optimizing Windows Vista Menus

The Start menu and its related menus are designed to provide easy access to applications and utilities installed on a system. Unfortunately, the more applications and utilities you install, the more cluttered the menu system becomes. To help users escape the clutter and better use the menu system, this section focuses on techniques you can use to optimize menus.

Changing Between Classic Start Menu and Simple Start Menu

Windows Vista provides two views of the Start menu: Classic and simple. The Classic Start menu provides the traditional view of the menu system as found in Windows 2000 and earlier versions of the Windows operating system. The simple Start menu provides a streamlined view of the menu system that's better organized than its more traditional predecessor. Many hardcore Windows users and administrators are apt to hate the simple Start menu when they first see it, but they grow to love it once they customize it.

You can change between the Classic Start menu and the simple Start menu at any time by following these steps:

1. | Right-click Start on the taskbar and then select Properties on the shortcut menu. The Taskbar And Start Menu Properties dialog box is displayed.
2. | On the Start menu tab, select Start Menu to use the simple view, or select Classic Start Menu to use the classic view.
3. | Click OK. If you've already customized settings for the menu view, these custom settings are restored automatically.

Customizing Classic Start Menu Options

If you choose the Classic Start menu, Windows Vista provides excellent control over the Start menu. You can choose which commands appear on the Start menu and how they are arranged. You can add menus for Control Panel, Network Connections, Printers And Faxes, and other key tools. You can also enable or disable personalized menus on the Programs menu.

To change the Start menu options, follow these steps:

1.
Right-click Start on the taskbar and then select Properties. The Taskbar And Start Menu Properties dialog box is displayed with the Start Menu tab selected by default.

2.
Verify that Classic Start Menu is selected and click Customize to the right of the Classic Start Menu option. This displays the Customize Classic Start Menu dialog box, shown in Figure 4-1.

Figure 4-1. Customize the Classic Start menu using this dialog box.

3.
Select or clear any of the check boxes in the Advanced Start Menu Options list box.

4.
Click OK.

5.
Click OK to close the Taskbar And Start Menu Properties dialog box.

Table 4-1 provides a list of the Classic Start menu options. As the table shows, most of the options control user actions or determine whether various selections are available directly from the Start menu or through separate windows.

Table 4-1. Classic Start Menu Options

Setting

Purpose

Display Administrative Tools

Adds or removes the Administrative Tools menu. When selected, the menu is available from the Programs menu.

Display Favorites

Adds or removes the Favorites menu. When selected, the menu is available from the Start menu. Enable this option if a user uses the Favorites list frequently.

Display Log Off

Adds or removes the LOG OFF command. When selected, the LOG OFF command is available on the Start menu. If you don't select this option, users must press Ctrl+Alt+Del to access the LOG OFF command.

Display Run

Adds or removes the RUN command. When selected, the RUN command is available on the Start menu.

Enable Context Menus And Dragging And Dropping

Controls whether users can right-click to get a shortcut menu and whether users can use the drag-and-drop operation to manage the contents and order of the Start menu. Typically you'll want to enable this option unless there is a specific security reason to disable it.

Expand Control Panel

When enabled, Control Panel options appear as a submenu of the SETTINGS, CONTROL PANEL command. Otherwise, Control Panel appears as a separate option that opens the Control Panel window.

Expand Documents

Same as Expand Control Panel, except it applies to the Start, Documents, Documents submenu.

Expand Pictures

Same as Expand Control Panel, except it applies to the Start, Documents, Pictures submenu.

Expand Network Connections

Same as Expand Control Panel, except it applies to the Settings, Network Connections submenu.

Expand Printers

Same as Expand Control Panel, except it applies to the Settings, Printers And Faxes submenu.

Scroll Programs

Controls whether the Programs menu displays all options or allows for horizontal scrolling. Depending on the screen display size, this option is only used when there are more than 29 or more than 38 items.

Show Small Icons In Start Menu

When selected, this option reduces the size of icons used on menus.

Use Personalized Menus

When selected, this option prompts Windows Vista to track the menu options that you use as you work. It displays only a partial list when you open menus, hiding infrequently used options until you click the down arrow at the bottom of the menu.

Tip

The Scroll Programs and Use Personalized Menus options can be somewhat annoying to users (and to you). I recommend disabling these features. You'll have happier users and fewer questions about disappearing options.

Customizing Simple Start Menu Settings

The simple Start menu has all the options of the Classic Start menu, plus a few additional options that aren't available otherwise. Because of this, you can customize the simple Start menu in many more ways than you can customize the Classic Start menu.

To change the Start menu options, follow these steps:

1.
Right-click Start on the taskbar and then select Properties.

2.
Ensure the Start Menu option is selected and click Customize to the right of the Start Menu option. This displays the Customize Start Menu dialog box, shown in Figure 4-2.

Figure 4-2. Set options for the simple Start menu using the Customize Start Menu dialog box.

3.
Use the options to control the general appearance of the Start menu.

4.
Click OK.

5.
Click OK to close the Taskbar And Start Menu Properties dialog box.

In the Customize Start Menu dialog box, most of the options control which commands appear on the Start menu and how they are arranged. Some items have suboptions of Display As A Link, Display As A Menu, and Don't Display This Item. Display As A Link specifies that an item, such as Control Panel, will appear as a separate option that opens a window when selected. Display As A Menu specifies that an item will provide access to a submenu that allows you to choose its related options. Don't Display This Item removes the item from the Start menu.

Other Customize Start Menu dialog box options you'll see include the following:

  • Enable Context Menus And Dragging And Dropping When this option is selected, users can right-click to display a shortcut menu and use drag-and-drop.

  • Highlight Newly Installed Programs When this option is selected, menus for recently installed applications are highlighted, as are the menu options.

  • Open Submenus When I Pause On Them With The Mouse Pointer Controls the behavior of menus. When this option is selected, menus open when you point to them. Otherwise, menus open only when you click them.

  • Sort All Programs Menu By Name Controls whether menu items are organized alphabetically or by the order of installation. When selected, menu items are sorted alphabetically. When not selected, menu items are listed in the order of installation.

  • Use Large Icons Controls the size of icons for menu options. To reduce the size of icons used on menus, clear this option. Otherwise, select this option to display standard-size icons on menus.

  • Start Menu Size Controls the number of shortcuts to recently used programs that appear on the most-frequently used list on the Start menu. Use the selection menu to assign a value from 0 to 30. The actual number of programs listed in this most-frequently used list will depend on the screen resolution as well as the number of items in the pinned items list, which is above the most-frequently used list.

  • Show On Start Menu Controls shortcuts to Internet browsers and e-mail applications. If you want these items to appear on the Start menu, select the appropriate check boxes and then choose the application to use.

If you make a mistake and want to restore the Start menu to its original configuration, open the Customize Start Menu dialog box, click the Use Default Settings button, and then click OK twice.

Modifying Menus and Their Options

In the Windows Vista file system, the Start menu is represented by a pair of folders, each with the name Start Menu. Programs that are to be made available only to the currently logged on user are placed in the Start Menu folder that is located within the profile data for that user (%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu), and programs that are to be available to any user that logs on to the computer are placed in the Start Menu folder for all users (%SystemDrive%\ProgramData\ Microsoft\Windows\Start Menu).

During system startup, Windows Vista merges the contents of both Start Menu folders to create the single Start menu, accessible when you click the Start button. In each case, below the Start Menu folder, you'll find a Programs folder. The structures for these Programs menus and their related menus are determined by the folders and shortcuts stored in them. Each folder within the Programs folders represents a menu. Shortcuts within folders represent menu options and act as pointers to the programs you want to launch. If you want to modify menus and their options, you have several choices. You can work directly with the appropriate file system representation of the Start menu, or you can work with the menu system itself.

Rearranging Items on the Start Menu

The easiest way to rearrange items on the Start menu is to use the menu system. You can change the position of menus and options within menus. The technique you use is as follows:

1. | Click Start and point to Programs or All Programs as appropriate.
2. | Point to the item that you want to manipulate.
3. | Press and hold the left mouse button.
4. | Drag the item to a new location on any menu or submenu; simply point to a submenu to open it. A horizontal line shows where the selected item is going.
5. | Release the mouse button when the menu or item is in the desired location. Note Administrator permissions are required to move menu items. In many cases, the current user must log off and then log back on to see the menu changes.

In the Classic Start menu, you can drag items to the upper-left corner of the Start menu, where they will remain displayed. When you have the mouse pointer in the proper location, you'll see the horizontal position line that highlights where the item will be placed when you release the mouse button.

With the simple Start menu, there are some other techniques for adding and removing items from this upper-left area of the Start menu, known in the simple Start menu as the pinned items list.

  • To add items to the pinned items area, right-click the item and then select Pin To Start Menu.

  • To remove items from the pinned items area, right-click the item on the menu and then select Remove From This List. There is also an UNPIN FROM START MENU command on this shortcut menu. This command will delete the entry from the pinned items list. But if the item has been recently used, it might then appear in the most-frequently used list. Using the REMOVE FROM THIS LIST command ensures that will not happen.

Reorganizing Menu Options

The Program menu's contents are normally sorted with submenus at the top and menu options below. Within each of those two categories, the menu contents are listed alphabetically.

With the Classic Start menu, as you install applications and move items around on the Programs menu, it is easy for items to become disorganized, largely because menus and menu options for new programs are placed at the bottom of the Programs menu. You can resolve this problem by re-alphabetizing the entire Programs menuand users who have a lot of programs installed will love you for it. To re-alphabetize the entire Programs menu, follow these steps:

1. | Click Start and then select Programs.
2. | Right-click any entry in the Programs list and select Sort By Name.

With the simple Start menu, menus and menu options are automatically sorted alphabetically whenever new menus or menu items are added. Menus and menu items are automatically sorted alphabetically whenever you move items as well. If menus and menu items aren't sorted alphabetically, someone probably cleared the Sort All Programs Menu By Name option in the Customize Start Menu dialog box for the current user. To re-alphabetize the entire Programs menu and keep it alphabetized from now on, follow these steps:

1. | Right-click Start on the taskbar and then select Properties. The Taskbar And Start Menu Properties dialog box is displayed with the Start Menu tab selected by default.
2. | Ensure that the Start Menu option is selected and click Customize to the right of the Start Menu option.
3. | Scroll down through the list of options in the Customize Start Menu dialog box and then select the Sort All Programs Menu By Name check box.
4. | Click OK twice.
Adding, Modifying, and Deleting Menus

As mentioned earlier, the Start menu is represented on the file system as a folder that can be accessed through the profile data for a particular user as well as a folder that can be accessed through the profile data for all users. To access the Start Menu folder for the current user, right-click Start and then select Explore. This opens Windows Explorer with the %UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu folder selected. To access the Start Menu folder for all users, right-click Start and then select Explore All Users. This opens Windows Explorer with the %SystemDrive%\ ProgramData\Microsoft\Windows\Start Menu folder selected. Once you open a Start Menu folder, you can perform all the normal folder operations to update the Start menu, including the following:

  • Add new menus to the Start menu by creating folders within the Programs folder or any subfolder of the Programs folder (except Startup).

  • Modify menus by moving folders or shortcuts to new locations within the Programs folder.

  • Rename folders or shortcuts to update their names on the Start menu. Another way to rename items is through the menu system. With the Start menu active, right-click the item you want to rename and select Rename. Type a new name for the item and then click OK.

Caution

Delete any unwanted folders or shortcuts to remove the related menus or menu options from the Start menu. Another way to delete items is through the menu system. With the Start menu active, right-click the item you want to delete and then select Delete. Don't rename or remove the Startup folder. This folder holds shortcuts for programs that should load automatically at startup. If you alter this folder, Windows Vista might not be able to use it. Additionally, you shouldn't rename or remove the Administrative Tools menu. The availability of the Administrative Tools menu is controlled through Taskbar And Start Menu Properties.

Adding Menu Options to the Start Menu

Menu options are represented as shortcuts in the Windows Vista file system. This means you can create menu options simply by adding shortcuts to the Programs folder or its subfolders. After you create a shortcut, you can update its properties to include comments that are displayed when someone points to the option on the Start menu. The complete steps to create a menu option, unique to the currently logged on user, are as follows:

1. | Right-click Start and then select Explore. This opens Windows Explorer with the %UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu folder selected.
2. | In the left pane of Windows Explorer, select the folder to which you want to add the menu option.
3. | In the Contents or View pane, right-click an open area, point to New, and then select Shortcut. This starts the Create Shortcut Wizard.
4. | In the field provided, type the file path to the program or file you want to associate with the shortcut. If you don't know the file path, click Browse and then use the Browse For Folder dialog box to locate the item you want to use.
5. | Click Next and then type a name for the shortcut. The value you enter is the name that will appear on the Start menu.
6. | Click Finish. If you want to enter comments for the shortcut, right-click the shortcut and then select Properties. Enter the comments in the Comment field and then click OK.
Displaying the Administrative Tools Menu

The Administrative Tools menu is not displayed by default in Windows Vista. If you want to display this menu on your computer or for a user with Administrator privileges, you'll need to customize the Start menu.

With the Classic Start menu, you add the Administrative Tools menu to the Programs submenu of the Start menu by completing the following steps:

1. | Right-click Start and then select Properties. The Taskbar And Start Menu Properties dialog box is displayed with the Start Menu tab selected by default.
2. | If Classic Start Menu isn't selected, select this option and then click the related Customize button. This displays the Customize Classic Start Menu dialog box.
3. | Select Display Administrative Tools in the Advanced Start Menu Options list box.
4. | Click OK twice. Tip You might want to click Sort before you click OK. This forces Windows to re-alphabetize the Programs menus and menu options. If you don't sort the menus, the Administrative Tools menu is displayed at the bottom of the Programs menu.

With the simple Start menu, there are several different ways you can add the Administrative Tools menu to the Start menu. To get started, follow these steps:

1.
Right-click Start and then select Properties. The Taskbar And Start Menu Properties dialog box is displayed with the Start Menu tab selected by default.

2.
If the simple Start menu isn't selected, select Start Menu and then click the related Customize button. This displays the Customize Start Menu dialog box.

3.
Scroll down the Start Menu Items list until you can see the System Administrative Tools heading.

4.
At this point, you have two options:

  • If you want to display the Administrative Tools menu as a submenu of the All Programs menu, select Display On The All Programs Menu.

  • If you want to display the Administrative Tools menu directly on the Start menu and as a submenu of the All Programs menu, select Display On The All Programs Menu And The Start Menu.

5.
Click OK twice.

Enabling and Disabling Personalized Menus

The Classic Start menu offers personalized menus, and when they are enabled, Windows Vista tracks the Start menu options you use as you work. It then displays only a partial list when you open menus, hiding infrequently used options until you click the down arrow at the bottom of the menu. However, many users don't like this behavior because they have difficulty finding options they want to use. Therefore, you might want to change the default setting for personalized menus and disable this feature. If a few users like this feature, you can enable it on a per user basis as necessary.

To enable or disable personalized menus, follow these steps:

1. | Right-click Start and then select Properties. The Taskbar And Start Menu Properties dialog box is displayed with the Start Menu tab selected by default.
2. | If Classic Start Menu isn't currently selected, select this option and then click the related Customize button. This displays the Customize Classic Start Menu dialog box.
3. | Select or clear the Use Personalized Menus item in the Advanced Start Menu Options list box and then click OK twice.


Customizing the Taskbar

The taskbar provides quick access to frequently needed information and active applications. You can change the taskbar's behavior and properties in many ways. This section explores key techniques you can use to do this.

Understanding the Taskbar

The taskbar is one of the least appreciated areas of the Windows desktop. Users and administrators tend to pay very little attention to its configuration, yet we use it day in and day out, relying on it for quick access to just about everything we do with the Windows operating system. If you find that users are having frequent problems accessing Windows features or running applications, you can help them by tailoring the taskbar to their needs. The Windows taskbar can contain several toolbars that can assist the user in different ways, several of which are shown in Figure 4-3.

Figure 4-3. The Windows taskbar can have multiple active toolbars.

[View full size image]

Sometimes, you can provide tremendous productivity increases simply by adding a frequently used item to the taskbar. For example, most people spend a lot of time finding and reading documents. They browse the Web or the corporate intranet to find the latest information. They open documents in Microsoft Word, Excel, PowerPoint, or other applications, finding documents individually and starting applications to read those documents as well. By adding an Address bar to the taskbar, users can access documents directly and launch the appropriate application automatically. They just need to type the document path and click Go. As time passes, the history feature of the Address bar tracks more and more of the user's previously accessed documents, making it easier to find the needed information.

Changing the Taskbar Size and Position

By default, the taskbar appears at the bottom of the screen and is sized so that one row of options is visible. As long as the taskbar position isn't locked, you can dock it to any edge of the Windows desktop and resize it as necessary. To move the taskbar, simply click it and drag it to a different edge of the desktop. You won't see the taskbar move as you drag, but when you release the mouse button, the taskbar appears in the new location. To resize the taskbar, move the mouse pointer over the taskbar edge and then drag it up or down.

Auto Hiding, Locking, and Controlling Taskbar Visibility

When you want to control the visibility of the taskbar, you have several options. You can enable the Auto Hide feature to hide the taskbar from view when it is not in use. You can lock the taskbar so that it can't be resized or repositioned. You can also make the taskbar appear on top of other windows when you point to it. Once the taskbar is positioned and sized the way a user wants it, you should enable all three of these options. In this way, the taskbar has a fixed location so users don't have to hunt for it, and the taskbar isn't hidden behind other windows so it is visible when it is pointed to.

To enable these options, follow these steps:

1. | Right-click the taskbar and then select Properties.
2. | Select the Taskbar tab in the Taskbar And Start Menu Properties dialog box.
3. | Select Lock The Taskbar, Auto-Hide The Taskbar, and Keep The Taskbar On Top Of Other Windows.
4. | Click OK. Tip Locking the taskbar is one of the most useful taskbar options. If you lock the taskbar once it is optimized, users will have fewer problems caused by accidentally altering taskbar options. Locking the taskbar doesn't prevent users from changing the taskbar on purpose. If users really want to change the taskbar, all they need to do is right-click the taskbar, select Properties, and then clear Lock The Taskbar.

Grouping Similar Taskbar Items

The option of grouping taskbar items is designed to remove some of the clutter from the taskbar by grouping related items into a menu. Grouping similar items also makes it possible to use the flip and 3D flip views discussed in Chapter 2, "Managing Windows Vista Systems." You can enable or disable grouping of similar items on the taskbar by completing these steps:

1. | Right-click the taskbar and then select Properties.
2. | Select the Taskbar tab in the Taskbar And Start Menu Properties dialog box if it isn't already selected.
3. | Select Group Similar Taskbar Buttons.
4. | Click OK.

Controlling Programs in the Notification Area

The notification area or system tray is the area on the far right side of the taskbar that shows the system clock and applications that were loaded automatically by the operating system at startup and are running in the background. When you point to icons in the notification area, a ScreenTip provides information on the running application. To control an application in this area, right-click the application icon to display a menu of available options. Each application has a different menu of options, most of which provide quick access to routine tasks.

You can optimize the notification area for users in several ways. One way is to add or remove startup programs. Another is to set properties of the notification area that control whether system icons, such as the clock, volume, and network, are displayed and whether application icons are displayed or hidden.

Adding or Removing Startup Programs

Administrator-installed or user-installed applications that run in the background can be managed through the Startup folder. Startup programs that are to be made available only to the currently logged on user are placed in the Startup folder that is located within the profile data for that user (%UserProfile%\AppData\Roaming\Microsoft \Windows\Start Menu), and startup programs that are to be available to any user that logs on to the computer are placed in the Startup folder for all users (%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu).

To add or remove startup programs for all users, follow these steps:

1. | Right-click Start and then select Explore All Users. This opens Windows Explorer with the %SystemDrive%\ProgramData\Microsoft\Windows\Start Menu folder selected.
2. | In the left pane, click the Programs folder under Start Menu and then click Startup.
3. | You can now add or remove startup programs for all users. To add startup programs, create a shortcut to the program that you want to run. To remove a startup program, delete its shortcut from the Startup folder.

To add or remove startup programs for a specific user, follow these steps:

1. | Log on as the user whose startup applications you want to manage. Right-click Start and then select Explore. This opens Windows Explorer with the %User Profile%\AppData\Roaming\Microsoft\Windows\Start Menu folder selected.
2. | In the left pane, click the Programs folder under Start Menu and then click Startup.
3. | You can now add or remove startup programs for this user. To add startup programs, create a shortcut to the program that you want to run. To remove a startup program, delete its shortcut from the Startup folder. Note Technically, you don't need to log on as the user to manage that user's startup applicationsit's just easier if you do. If you can't log on as the user, access the Users folder on the system drive and work your way down through the user's profile data folders. These are listed by account name.
Controlling Icon Display in the Notification Area

The notification area displays both application and system icons. Icons for applications appear in the notification area for several reasons. Some programs, such as Windows Update, are managed by Windows itself and appear periodically when there are pending notifications. For example, Windows Update runs periodically to check for updates to the operating system. When an update is detected, the user can be notified and given the opportunity to apply the update. Other types of programs are configured to run in the background at startup, such as an antivirus program. You can typically enable or disable the display of icons through setup options in the related applications, but Windows Vista provides a common interface for controlling icon display in the notification area. You can specify whether and how icons are displayed on a per application basis.

To control the display of application icons in the notification area, follow these steps:

1.
Right-click in the notification area of the taskbar and then select Properties. This displays the Taskbar And Start Menu Properties dialog box with the Notification Area tab selected, as shown in Figure 4-4.

Figure 4-4. Configure application and system icons for the notification area using the options provided.

2.
If you want all icons to be displayed, clear the Hide Inactive Icons check box and then click OK. Skip the remaining steps.

3.
If you want to customize the appearance of icons, select the Hide Inactive Icons check box and then click Customize. This displays the Customize Icons dialog box, shown in Figure 4-5.

Figure 4-5. Specify the notification behavior for background applications in the Customize Icons dialog box.

4.
You can now optimize the notification behavior for current items displayed in the notification area as well as items that were displayed in the past but aren't currently active. The Name column shows the name of the application. The Behavior column shows the currently selected notification behavior. Each entry in the Behavior column can be clicked to display a selection menu with the following options:

  • Hide When Inactive Displays only when active

  • Hide Never displays

  • Show Always displays

5.
When you are finished updating the notification entries, click OK twice.

Note

You can directly access the Customize Notifications dialog box when the Hide Inactive Icons option is selected in the Taskbar And Start Menu Properties dialog box. Right-click the notification area and then select Customize Notifications.

System icons are displayed by default in the notification area. On desktops, the clock, network, and volume icons are displayed by default. On laptops, the clock, network, volume, and power icons are displayed by default. To control the display of system icons in the notification area, follow these steps:

1. | Right-click in the notification area of the taskbar and then select Properties. This displays the Taskbar And Start Menu Properties dialog box with the Notification Area tab selected, as shown previously in Figure 4-4.
2. | If you don't want an icon to be displayed, clear the related icon under System Icons.
3. | Click OK.


Optimizing Toolbars

Several toolbars are available for the taskbar. The toolbar that most users are familiar with is the Quick Launch toolbar, which provides quick access to commonly used programs and the Windows desktop. The taskbar can display other toolbars that come with Windows Vista, and users can create their own toolbars as well.

Displaying Toolbars

Toolbars available for the taskbar include:

  • Address Provides an Address box into which you can type Uniform Resource Locators (URLs) and other addresses that you want to access, either on the Web, on the local network, or on the local computer. When full file paths are specified, the default application for the file is launched automatically to display the specified file.

  • Links Provides access to the Links folder on the Favorites menu of Microsoft Windows Internet Explorer 7 for Windows Vista. To add links to files, Web pages, or other resources, drag shortcuts onto the Links toolbar. To remove links, right-click the link and select Delete. When prompted, confirm the action by clicking Yes.

  • Desktop Provides access to all the shortcuts on the local desktop so that you don't have to minimize Windows or click Show Desktop on the Quick Launch toolbar to access them.

  • Quick Launch Provides quick access to commonly used applications. By default, this is the only toolbar displayed on the taskbar.

To display or hide individual toolbars, follow these steps:

1. | Right-click the taskbar to display the shortcut menu.
2. | Point to Toolbars and then select the toolbar name in the list provided. This toggles the toolbar on and off.

Tip

By default, a name label is displayed for all toolbars except Quick Launch. You can turn off the name label by right-clicking the toolbar and then choosing Show Title to deselect that command. If the taskbar is locked, you must first unlock it by selecting Lock The Taskbar on the shortcut menu.

Customizing the Quick Launch Toolbar

The Quick Launch toolbar is displayed to the right of the Start button on the taskbar. By default, this toolbar includes buttons that provide quick access to the Windows Desktop and the default Web browser. If your organization has custom applications or a preferred suite of applications, you can add buttons for these applications on the Quick Launch toolbar. If an application that has an icon on the Quick Launch toolbar is no longer used, you can remove the button to prevent users from accidentally starting the application.

To add a button to the Quick Launch toolbar, follow these steps:

1. | Use the Start menu to find the item that you want to add to the Quick Launch toolbar.
2. | Right-click the item and then select Add To Quick Launch.

To remove a button from the Quick Launch toolbar, follow these steps:

1. | Right-click the button on the toolbar and then select Delete.
2. | When prompted to confirm the action, click Yes.

Restoring the Show Desktop Button

The most useful button on the Quick Launch toolbar is Show Desktop. The first time you click this button, the operating system brings the Windows desktop to the foreground in front of all open windows. The second time you click this button, the operating system restores the original view, sending the desktop to the background. Users often start deleting buttons and accidentally delete the Show Desktop buttonone of the most common problems encountered with the Quick Launch toolbar. Users might not tell you that they've removed this button accidentally (indeed, they might not even know that they did it), and they might get frustrated when they can't get to the desktop quickly. Fixing this problem is easy, but it requires a few steps.

As with other aspects of the menu system, the Quick Launch toolbar options have a representation in the file system. You'll find Quick Launch options in the %UserProfile%\AppData\Roaming\Microsoft\Windows\Internet Explorer\Quick Launch folder. Although the original Show Desktop button was created using a shortcut, you can re-create it using a Windows command file called SHOW DESKTOP.SCF.

Note

AppData is a hidden folder. To view this folder, you'll need to select the advanced folder option Show Hidden Files And Folders. In Windows Explorer, select Folder Options from the Organize menu and then select the View tab. On the View tab, select Show Hidden Files And Folders and then click OK.

To restore the button to the toolbar, you have several options. You can copy SHOW DESKTOP.SCF from another user's profile data, or you can recreate the file. To recreate the file, follow these steps:

1.
Start Microsoft Notepad and then add the following lines of text:

[Shell]
Command=2
IconFile=explorer.exe,3
[Taskbar]
Command=ToggleDesktop

2.
From the File menu, select Save As and then save the file in the %UserProfile%\ AppData\Roaming\Microsoft\Windows\Internet Explorer\Quick Launch folder. Use the file name SHOW DESKTOP.SCF.

Note

If you don't know the actual value for the %UserProfile% environment variable, open a command prompt and type set userprofile. The command prompt then displays the variable value, such as C:\Users\Williams.

Creating Personal Toolbars

You can create personal toolbars for users as well. Personal toolbars are based on existing folders, and their buttons are based on the folder contents. The most common toolbars you might create are ones that point to shared folders on the network. For example, if all users have access to a CorpData shared folder in which corporate information is stored, and a UserData folder in which personal information is stored, you could add toolbars to the taskbar that point to these resources. When users want to access one of the folders, they can simply click the corresponding toolbar button.

You can create personal toolbars by completing these steps:

1. | Right-click the taskbar to display the shortcut menu. Point to Toolbars and then click New Toolbar. This displays the New Toolbar dialog box.
2. | Use the Choose A Folder list box to select the folder you want to make into a toolbar.
3. | When you click OK, the folder is displayed as a new toolbar on the taskbar. If you add shortcuts to the toolbar view, the shortcuts are added to the folder. Similarly, if you delete items from the toolbar view, the items are removed from the folder.

Note

When it comes to personal toolbars, there's good news and bad news. The good news is that most users find them valuable. The bad news is that if a user decides to close the toolbar, it must be recreated before it can be viewed on the taskbar again.


Working with Desktop Themes

Desktop themes are combinations of backgrounds plus sets of sounds, icons, and other elements that help personalize the desktop and the operating environment. Administrators tend to hate themes; users tend to love them. In this section, you'll learn how to apply themes, how to tailor individual theme options, and how to delete themes.

Applying and Removing Themes

Several types of themes are available. Some themes are installed with the operating system. To apply a theme, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize. This opens the Personalization console in Control Panel, as shown in Figure 4-6.

Figure 4-6. Use the Personalization console to access dialog boxes for configuring themes, display settings, and more.

[View full size image]

2.
Click Theme to display the Theme Settings dialog box, shown in Figure 4-7.

Figure 4-7. In the Theme Settings dialog box, select which theme to use.

3.
Use the Theme list to select the theme you want to use. If you want to use a saved theme, select Browse and then use the Open Theme dialog box to select the .theme file that contains the saved theme.

4.
The Sample pane provides an overview of the theme's appearance. If the theme appears as you expected, click OK. Otherwise, select a different theme and then click OK.

To restore the original desktop theme, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click Theme to display the Theme Settings dialog box.
3. | Select Windows Vista as the theme and then click OK.

Tip

Since the display of themes is controlled by the Themes service, you can stop this service if you need to quickly turn off themes without changing the themes configuration, such as when you are troubleshooting or trying to resolve an issue. To stop the Themes service, type the following command at an elevated command prompt: net stop themes. To restart the Themes service, type the following command at an elevated command prompt: net start themes.

Tailoring and Saving Themes

When you apply a theme to the Windows desktop, many different system settings can be affected. Typically, users might like a theme but dislike a specific aspect of it, such as the sounds. To fix this, you can change the system setting the user doesn't like and then save the updated theme so that he or she can restore it in the future.

The primary settings that themes affect are as follows:

  • Screen savers To change the screen saver, right-click an open area of the desktop and then select Personalize. In the Personalization console, click Screen Saver. In the Screen Saver Settings dialog box, select a screen saver and then click OK. Select None to remove the screen saver.

  • Sounds To change sounds, right-click the desktop and then select Personalize. In the Personalization console, click Sounds. In the Sound dialog box, use the Sound Scheme list box to select a different set of program event sounds. To restore the default, select Windows Default. To turn off program event sounds, select No Sounds.

  • Mouse pointers To change mouse pointers, right-click the desktop and then select Personalize. In the Personalization console, click Mouse Pointers. In the Mouse Pointers dialog box, use the Scheme list box on the Pointers tab to select a different set of pointers.

  • Desktop background To change the desktop background, right-click the desktop and then select Personalize. In the Personalization console, click Desktop Background. Use the selection list provided to select the location of the pictures to use for backgrounds. Click Browse to display the Browse For Folders dialog box. You can also choose Windows Wallpapers to use the backgrounds in the %SystemRoot%\Web\Wallpaper folder, which is where standard backgrounds included with Windows Vista are stored by default. Click the background you want to use, set the picture position, and then click OK.

  • Color schemes To change color schemes, right-click the desktop and then select Personalize. In the Personalization console, click Window Color and Appearance. In the list provided, click the color you want to use. Select or clear Enable Transparent Glass as appropriate and then click OK.

Once you've modified the system settings and are satisfied, you can save the settings as a new theme by following these steps:

1. | Right-click an open area of the desktop and then select Personalize. In the Personalization console, click Theme.
2. | In the Theme Settings dialog box, click Save As and then use the Save As dialog box to save the theme. Theme definition files end with the .theme file extension.
3. | Unless deleted in the future, the custom theme will appear as an option in the Theme list box.

Deleting Custom Themes

Themes that users install from other locations can take up a lot of space on the hard disk. To delete a theme and remove the theme-related files, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize. In the Personalization console, click Theme. This opens the Theme Settings dialog box.
2. | Select the name of the theme to be deleted and click Delete. Windows removes that theme's definition file and the theme-related media files.

Tip

By default, themes installed by Windows are located in the %WinDir%\Resources\Themes folder, and themes created by users are stored in their user profile. If you want to determine the total space used by themes, check the space used by these folders and their subdirectories. You shouldn't delete files from these folders manually. Instead, use the technique just outlined.


Optimizing the Desktop Environment

When you open programs or folders, they appear on the desktop. You can arrange open programs and folders on the desktop by right-clicking an empty area of the taskbar and then selecting Cascade Windows, Show Windows Stacked, or Show Windows Side By Side as appropriate. If you click Show The Desktop, Windows minimizes all open windows and displays the desktop. Clicking Show Open Windows restores the minimized windows to their previous states.

You can put files, folders, and shortcuts on the desktop. Any file or folder you save on the desktop appears on the desktop. Any file or folder you drag from a Windows Explorer window to the desktop stays on the desktop. To add a shortcut to a file or folder to the desktop, right-click the file or folder, point to Send To, and then select Desktop (Create Shortcut).

Beyond these basic techniques, Windows Vista provides many additional ways to optimize the desktop environment. One technique is to add a background containing a corporate logo or other symbol to the standard desktop build. This is particularly useful with loaner laptops; for example, you can create a logo with a message such as "Technology Department Loaner." Another technique is to use Windows Sidebar and Windows gadgets to add custom content directly to the desktop.

Setting the Desktop Background

Windows Vista provides multiple sets of background images and groups these images into named sets according to the tags used with the image files. On the computer's hard drive, background images are stored in the %WinDir%\Web\Wallpaper folder. Each unique tag used represents a named set. For example, images with the Vistas tag are displayed in the Vistas set of background images.

Background images can be created as .bmp, .gif, .jpg, .jpeg, .dib, and .png files. If you add an image in one of these formats to any of the subfolders in the %WinDir%\Web \Wallpaper folder and give it an appropriate tag, the image will be available as part of that set. If you want to create a new set, simply add images with the desired tag to the %WinDir%\Web\Wallpaper folder.

To set the background for the desktop, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize. In the Personalization console, click Desktop Background. This displays the Desktop Background page, shown in Figure 4-8.

Figure 4-8. Select which desktop background to use.

[View full size image]

2.
When you select Windows Wallpapers as the Picture Location, Windows Vista organizes desktop backgrounds into sets of similar images. Use the scroll bar to navigate between sets, such as Paintings or Light Auras.

3.
Click the image you want to use as the background. If you can't find a background that you want to use, click Browse to search for a background on the file system or network.

4.
Use the How Should The Picture Be Positioned options to select a display option for the background. You have three display position options:

  • Fit To Screen Stretches or shrinks the image to fill the desktop background. This is a good option for photos and large images.

  • Tile Repeats the image so that it covers the entire screen. This is a good option for small images and icons.

  • Center Centers the image on the desktop background. Any area that the image doesn't fill uses the current desktop color.

5.
When you are finished updating the background, click OK.

Working with the Default Desktop Icons

With the Classic Start menu, several icons are added to the desktop automatically: Computer, Control Panel, Network, Internet Explorer, Recycle Bin, and User's Files. With the simple Start menu, only the Recycle Bin is added to the desktop by default. You can use the common desktop icons as follows:

  • Computer Double-clicking the Computer icon opens a window where you can access hard disk drives and devices with removable storage. Right-clicking the Computer icon and selecting Manage opens the Computer Management console. Right-clicking the Computer icon and selecting Map Network Drive enables you to connect to shared network folders. Right-clicking the Computer icon and selecting Disconnect Network Drive enables you to remove a connection to a shared network folder.

  • Control Panel Double-clicking the Control Panel icon opens Control Panel, which provides access to system configuration and management tools.

  • Internet Explorer Double-clicking the Internet Explorer icon opens the Internet Explorer window with your default home page. Right-clicking the Internet Explorer icon and then selecting Start Without Add-Ons starts Internet Explorer without using browser extensions or other add-ons.

  • Network Double-clicking the Network icon opens a window where you can access the computers and devices on your network. Right-clicking the Network icon and selecting Map Network Drive enables you to connect to shared network folders. Right-clicking the Network icon and selecting Disconnect Network Drive enables you to remove a connection to a shared network folder.

  • Recycle Bin Double-clicking the Recycle Bin icon opens a window where you can view files and folders you've marked for deletion. By selecting Empty The Recycle Bin, you can permanently delete all the items in the Recycle Bin.

  • User's Files Double-clicking the User's Files folder opens your personal folder.

You can add or remove common desktop icons by following these steps:

1.
Right-click an open area of the desktop and then select Personalize. This displays the Personalization console.

2.
In the left pane, click Change Desktop Icons under Tasks. This displays the Desktop Icon Settings dialog box, shown in Figure 4-9.

Figure 4-9. Use the Desktop Icon Settings dialog box to select the desktop icons to display and set their appearance.

3.
The Desktop Icons Settings dialog box has check boxes for each of the default icons. Clear the corresponding check box to remove an icon. Select the check box to add an icon.

4.
Click OK twice.

You can hide all desktop icons by right-clicking an open area of the desktop, pointing to View, and selecting Show Desktop Icons. If you repeat this procedure and select Show Desktop Icons a second time, all the hidden desktop icons are restored.

If you no longer want an icon or a shortcut on the desktop, right-click it and then select Delete. When prompted, confirm the action by clicking Yes.

Working with Windows Sidebar and Gadgets

Windows Vista provides Windows Sidebar and gadgets as a way to add custom content to the desktop. Windows Sidebar is a view pane that you can add to the left or right side of the display. The sidebar is used to display and work with mini programs called gadgets. Gadgets are designed to provide information at a glance and to provide easy access to frequently used tools and operating system features.

Similar to the taskbar, the sidebar is docked to the desktop and can be configured so that it is always displayed on top of other windows. In this configuration, maximized applications windows are sized around the sidebar so that the sidebar and its gadgets can always be seen. The sidebar is meant to boost productivity by keeping information that a user is interested in visible and by making frequently accessed tools readily available for use.

Configuring Windows Sidebar

In a standard configuration, the Windows Sidebar is displayed on the desktop by default. This occurs because the Start Sidebar When Windows Starts check box is selected by default in the Windows Sidebar Properties dialog box. If you don't want the sidebar to be displayed when a user logs on, follow these steps to configure Windows Vista so the sidebar isn't started automatically:

1.
Click Start, click Control Panel, click Appearance And Personalization, and then click Windows Sidebar Properties.

2.
In the Windows Sidebar Properties dialog box, shown in Figure 4-10, clear Start Sidebar When Windows Starts.

Figure 4-10. Use the Windows Sidebar Properties dialog box to configure whether Windows Sidebar starts automatically and set other features as necessary.

3.
Click OK.

You can then start Windows Sidebar manually by clicking Start, All Programs, Accessories, Windows Sidebar. You can also start Windows Sidebar manually by clicking Start, typing sidebar.exe in the Search box, and pressing Enter.

When Windows Sidebar is running, you'll often want to ensure its content and tools are always visible on either the left side or the right side of the desktop. You might also want to display the sidebar on a secondary monitor rather than the primary monitor. You can configure these sidebar options by following these steps:

1. | Click Start, click Control Panel, click Appearance And Personalization, and then click Windows Sidebar Properties. This displays the Windows Sidebar Properties dialog box, shown previously in Figure 4-10.
2. | To ensure the sidebar is always visible, select Sidebar Is Always On Top Of Other Windows.
3. | To ensure the sidebar is always started when a user logs on, select Start Sidebar When Windows Starts.
4. | To display the sidebar on the left or the right side of the desktop, select Left or Right as appropriate.
5. | To display the sidebar on the primary monitor, select 1 as the option for Start Sidebar On This Monitor. Select 2 to display the sidebar on the user's secondary monitor.
6. | Click OK.
Hiding and Exiting Windows Sidebar

When you no longer want to view the sidebar, you have two options for closing it:

  • If you don't want the sidebar to be displayed temporarily, you can hide it by right-clicking in the sidebar and selecting Close Sidebar. Because the sidebar continues to run while hidden, docked gadgets that have dynamic content continue to be able to get updates.

  • If you don't want the sidebar to run, you can exit it by right-clicking the sidebar notification icon and selecting Exit. When prompted to confirm, click Exit Sidebar. Because the sidebar is no longer running, docked gadgets that have dynamic content are not updated.

When you hide the sidebar rather than exiting, you can display it again by clicking Start, All Programs, Accessories, Windows Sidebar Properties.

Real World

A faster (and better) way to hide and display the sidebar is to use the Windows Sidebar icon on the taskbar's notification area. When the Windows Sidebar icon is displayed in the notification area, you double-click the icon to hide the sidebar and then double-click the icon again to display the sidebar. This icon isn't always displayed, however. So the trick to using this technique to work with the sidebar is to set a related notification icon so the Windows Sidebar icon is always displayed. Right-click the notification area and then select Properties. This displays the Taskbar And Start Menu Properties dialog box with the Notification Area tab selected. With Hide Inactive Icons selected, click Customize. This displays the Customize Icons dialog box. Click the Windows Sidebar entry, and then under Behavior, click the related selection list to show the available behavior options. Select Show as the behavior option. Click OK twice. Now when the user logs on, the Windows Sidebar icon in the notification area will always be displayed.

Adding and Removing Windows Gadgets

You can add gadgets to Windows Sidebar by clicking the plus sign (+) button at the top of the sidebar. In the Add Gadgets dialog box, shown in Figure 4-11, double-click each of the gadgets that you want to add to the sidebar. Because multiple pages of gadgets might be available, you might need to use the Previous Page and Next Page buttons to navigate through the list of available gadgets. To find additional gadgets, click Get More Gadgets Online. The sidebar launches the Microsoft Gadgets site (http://microsoftgadgets.com/), where you can download custom gadgets or find instructions on how to build your own gadgets.

Figure 4-11. Double-click gadgets to add them to the sidebar.

Each version of Windows Vista includes a standard set of gadgets. These gadgets typically include:

  • Calendar Displays a desk calendar. The default view shows the current month, day, date, and year in large text. Clicking the top-level calendar view displays a monthly calendar. Clicking the monthly calendar displays a yearly calendar.

  • Clock Displays an analog clock with hour and minute hands. Moving the mouse pointer over the clock shows the digital time, date, and time zone. The time zone used can be different from that used by the computer clock. Several different views are available for the clock face. You can also add a second hand if desired. To change default settings, right-click the Clock gadget and then select Options. Use the Back and Forward buttons provided to select the clock face. Type a name or identifier for the clock, set a time zone, and add a second hand as desired, then click OK to save the settings.

  • CPU Meter Displays the current percentage utilization of the computer's CPU and memory. Similar to a tachometer in a car, the CPU and memory gauges show high utilization in yellow and red.

  • Currency Displays conversion information from one unit of currency to another. For example, you can convert U.S. dollars to Euros by selecting the From currency as US Dollar and the To currency as Euro. The data for currency conversion comes from a data provider, such as MSN Money. To change the conversion settings, right-click the Currency Converter gadget and then select Options. Choose the From unit and the To unit for the conversion and then click OK to save the settings.

  • Feed Headlines Displays the data from a selected Really Simple Syndication (RSS) feed that has been configured in Internet Explorer. RSS feeds can contain news headlines, lists, and other information. After you add an RSS feed to Internet Explorer, you can begin viewing the feed in the Feed Headlines gadget automatically.

    Tip

    RSS feeds are only updated if you've turned on the automatic feed updates. You can enable automatic feed updates in Internet Explorer. Click Internet Options on the Tools menu. In the Internet Options dialog box, select the Content tab. Under Feeds, click Settings. In the Feed Settings dialog box, select the Automatically Check Feeds For Updates check box and then set a schedule, such as Every 1 Day. Click OK twice to save the settings.

  • Notes Displays a note pad into which you can type messages and reminders. After you type the text of a note, you can click the Add button (the large plus sign) to start a new note. Use the Back and Forward buttons provided to navigate the stack of notes. Click the delete button (the large red X) to delete a note.

  • Slide Show Displays pictures from a selected folder as a continuous slide show in which pictures rotate at a specified interval. Moving the mouse pointer over a picture in the slide show causes the navigation buttons to appear. You can navigate through the pictures using the Previous, Pause, and Next buttons. Click the View button (showing a magnifying glass) to open the current picture in the Photo Gallery Viewer. By default, pictures in the %UserProfile%\Pictures folder are used for the slide show. By right-clicking the Slide Show gadget and selecting Settings, you can modify the Directory setting to use any preferred folder. You can also modify the transition and slide show speed settings.

You can work with gadgets in a variety of ways:

  • Gadgets can be detached from the sidebar and moved around the desktop by right-clicking the gadget and selecting Detach From Sidebar. Once you've detached the gadget, you can click and drag to move it to different locations on the desktop. To return the gadget to the sidebar, right-click the gadget and select Attach To Sidebar.

  • When gadgets are detached, they can be displayed on top of all other windows by right-clicking the gadget and selecting Always On Top. Once you've moved the gadget to the top, right-clicking the gadget and selecting Always On Top a second time clears the setting and makes the gadget work like any other window that can be brought to the front when in use or moved to the back when not in use.

  • Whether attached to the sidebar or detached, gadgets can be configured to be translucent or not translucent by setting an opacity percentage. The default opacity percentage is 100%, meaning you can't see through the gadget. If you want to be able to see through the gadget when it is inactive, you can reduce the opacity percentage by right-clicking the gadget, pointing to Opacity, and selecting an opacity percentage less than 100%. When you move the mouse pointer over a gadget, it is always displayed with 100% opacity.

You can remove a gadget from the sidebar or desktop by right-clicking it and selecting Remove. Rather than removing multiple gadgets individually, you can easily remove multiple gadgets by following these steps:

1. | Right-click an open area of the sidebar and then select Properties.
2. | In the Windows Sidebar Properties dialog box, click View List Of Running Gadgets.
3. | In the View Gadgets dialog box, click a gadget to remove from the sidebar or desktop and then click Remove. Repeat this step to remove other gadgets.
4. | Click Close and then click OK.


Screen Saver Dos and Don'ts

Screen savers are designed to turn on when a computer has been idle for a specified period of time. The original job of the screen saver was to prevent image burn-in on CRT monitors by displaying a continuously changing image. With today's monitors, burn-in is no longer a problem, but screen savers are still around. The primary benefit they offer today is the ability to password-lock computers automatically when the screen saver turns on.

Configuring Screen Savers with Password Protection

Password-protecting the screen saver deters unauthorized users from accessing a computer, which can protect both the personal data of the user and the intellectual property of the organization. As an administrator, you should ensure that the computers you deploy have password-protected screen savers enabled.

You can password protect the screen saver by performing the following steps:

1.
Right-click an open area of the desktop and then select Personalize.

2.
Click the Screen Saver link to display the Screen Saver Settings dialog box, shown in Figure 4-12.

Figure 4-12. Set a screen saver with password protection for user and organization security.

3.
Use the Screen Saver list box to select a screen saver. To disable the screen saver, select None and skip the remaining steps.

Real World

Unfortunately, screen savers can use up a lot of the computer's resources, increasing both the energy usage of the computer (which otherwise would be idle) and its memory and processor usage. Some screen savers, particularly the three-dimensional ones such as 3D Text, can cause the processor to run at a high percent utilization. The reason for this is that 3D designs are very complex and the computer must make a lot of computations to maintain and update the screen saver image. For tips on reducing resource usage when screen savers turn on, see the sections of this chapter entitled "Reducing Screen Saver Resource Usage" and "Setting Energy-Saving Settings for Monitors."

4.
Select On Resume, Display Logon Screen.

5.
Use the Wait box to specify how long the computer must be idle before the screen saver is activated. A reasonable value is between 10 and 15 minutes.

6.
Click OK.

Reducing Screen Saver Resource Usage

A computer that is running Windows Vista and that performs background tasks or network duties, such as print services, should not be configured to use a complex screen saver, such as 3D Text. Instead, the computer should be configured with a basic screen saver, such as the Blank screen saver. You can also modify the settings for advanced screen savers to reduce resource usage. Typically, you do this by reducing the redraw and refresh rates of the advanced screen saver.

To reduce screen saver resource usage, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize.

2.
Click the Screen Saver link to display the Screen Saver Settings dialog box.

3.
If you want to use a screen saver that uses fewer resources without making configuration changes, use the Screen Saver list box to select a basic screen saver, such as Blank or Windows Logo.

4.
If you want to use a more advanced screen saver but reduce its resource usage, select that screen saver and then click Settings. Afterward, use the Setup dialog box to reduce the Complexity, Speed, or similar field values that affect the drawing or refreshing of the screen saver. In the example shown in Figure 4-13, I've reduced the resolution and set the Rotation Type to None to reduce the resource usage of the 3D Text screen saver.

Figure 4-13. Advanced screen savers have settings that you can use to reduce resource usage.

[View full size image]

5.
Click OK once or twice as necessary to close the open dialog boxes.

Setting Energy-Saving Settings for Monitors

Many newer monitors have energy-saving features that cause them to shut off after a certain period of inactivity. Enabling this feature can reduce the organization's electricity bill because monitors typically use a lot of electricity to stay powered up. On some systems, this feature might have been automatically enabled by the operating system during installation. This depends, however, on the operating system properly detecting the monitor and installing any necessary drivers.

On a portable laptop computer running on batteries, saving energy is especially important. By configuring the monitor to shut off when the computer is idle, you can save the battery life and extend the battery availability time when the laptop is unplugged.

To manage a monitor's energy settings, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click the Screen Saver link to display the Screen Saver Settings dialog box.
3. | Click Change Power Settings. The Power Options Properties dialog box is displayed.
4. | In the left pane, click Choose When To Turn Off Display.
5. | Use the selection list provided to specify when the monitor should be turned off to save energy. By default, all the standard power plans turn off the computer's monitor after 20 minutes.
6. | Click Save Changes.

Note

If the computer is connected to a monitor that doesn't support Energy Saving settings, some power options might be grayed out or unavailable. If you are configuring the computer in a build area and are using a different monitor than the one the user will have, you might want to obtain the user's monitor model and repeat this process.

Real World

Typically, you'll want to turn off the monitor after 15 to 20 minutes of idle time. On my office computer, I turn on the screen saver after 7 minutes and then turn off the monitor after 15 minutes of idle time. On my laptop, I use settings of 5 minutes and 10 minutes, respectively.


Modifying Display Appearance and Video Settings

The display appearance and video settings have a major impact on the look and feel of the Windows Vista desktop and its graphical elements. Appearance options control window, button, color, and font settings. Video settings control screen resolution, color quality, refresh frequency, hardware acceleration, and color management.

Configuring Window Color And Appearance

By default, Windows Vista uses the Aero design for its windows and dialog boxes. With Aero, three key areas of the display appearance can be optimized: color schemes, window transparency, and color intensity. To configure these display options, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize.

2.
Click the Windows Color And Appearance link to display the page shown in Figure 4-14.

Figure 4-14. Configure the visual appearance of the display using the options from the Change Your Color Scheme page.

[View full size image]

3.
Change the color of windows by clicking one of the available colors. To make your own color, click Show Color Mixer and then use the Color, Saturation, and Brightness sliders to create a custom color.

4.
To enable transparent glass (on computers that have graphics cards with sufficient memory to support this feature), select Enable Transparent Glass. The edges of windows will then be semi-transparent so you can see through them.

5.
Use the Transparency slider to set the strength of the color and the level of transparency. Increase the intensity to make the color brighter. Reduce the intensity to make the color dimmer.

If you prefer, you can use the classic style windows and dialog boxes. When you do so, however, the appearance of most windows and dialog boxes is changed substantially. Additionally, desktop compositing is disabled, which removes features like transparency and glass. To configure Windows Vista to use the classic display appearance, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click the Window Color And Appearance link.
3. | Click Open Classic Appearance Properties.
4. | In the Appearance Settings dialog box, select a color scheme other than Windows Vista Aero and then click OK.

If you later want to restore Windows Vista Aero, you can do so by following these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click the Window And Appearance link and then click Open Classic Properties.
3. | In the Appearance Settings dialog box, select Windows Vista Aero as the color scheme and then click OK.

When working with any display appearance style, you can override default settings for individual graphical elements, such as the desktop or message boxes, using the Advanced Appearance dialog box. To access and work with this dialog box, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click the Window And Appearance link.
3. | Click Open Classic Appearance Properties.
4. | Click Advanced.
5. | Use the Item list to select the items that you want to modify and then set the size, color, and font options as appropriate. (For some items, not all of these options will be available.) Changes you make are recorded when you make them, enabling you to configure multiple elements before clicking OK to apply the changes.
6. | With graphic elements that contain system text, you can use the Font list box to select the typeface to use and the related Size and Color list boxes to set the size and color of the font respectively.
7. | Click OK three times to close all open dialog boxes.

Configuring Video Settings

Video settings control screen resolution, color quality, refresh rate, hardware acceleration, and color management. This section focuses on making sure that Windows Vista has correctly identified the video card and monitor and on optimizing various video settings.

Checking the Current Video Adapter and Monitor

Proper display is dependent on the computer using accurate information about the video adapter and the monitor. Depending on which video adapter and monitor models Windows Vista thinks you have, different driver files are installed. These drivers are extremely important in determining which display resolutions, color depths, and refresh rates are available and appropriate for the system. If the adapter and monitor aren't detected and configured properly, Windows Vista won't be able to take advantage of their capabilities.

Current settings for the video adapter or monitor can be wrong for many reasons. Sometimes, plug and play doesn't detect the device, and a generic device driver is used. At other times, Windows Vista detects the wrong type of device, such as a different model. In this case, the device will probably work, but some features won't be available.

To check the current video adapter and monitor configured for a computer, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize.

2.
Click Display Settings to display the Display Settings dialog box, shown in Figure 4-15.

Figure 4-15. If you're having display problems, check the monitor and video driver being used.

3.
On the Monitor tab, you'll find the currently configured monitor and video card. The format of the entry under Display is <Monitor Type> on <Video Adapter> driver. In the example shown in Figure 4-15, the computer has configurations for multiple monitors stored and the video card driver is for an NVIDIA GeForce FX5200 video card. Check the information shown in the dialog box as follows:

  • If the correct video adapter isn't displayed or you want to examine the driver settings further, see the "Changing the Video Driver" section in this chapter.

  • If the correct monitor isn't displayed or you want to examine the monitor settings further, see the "Changing the Monitor" section in this chapter.

4.
Click OK to close the Display Settings dialog box.

Changing the Video Driver

If the video driver shown in the Display Settings dialog box does not match the make and model installed on the computer, you might want to try to install a different driver. For example, if the computer has a generic S3 video driver configured and you are sure the computer has an NVIDIA GeForce FX 5200 video adapter, you'll want to change the video driver.

To determine whether the video card make and model are correct, you'll need to know how the system is configured. The system documentation can tell you which video adapter is installed. Other administrators are also useful resources. Typically, someone else on the technology team will know immediately what video adapter is installed on a particular type of computer. If you can't figure out the make and model of the video adapter, you have several options. If the current settings are working, you can leave the display settings alone. You can also try the following techniques to determine the video adapter make and model:

  • Shut down the computer and then turn it back ondon't click the Restart button. Watch the screen when the computer is first turned on. The name of the video card might appear briefly before Windows Vista begins loading.

  • Shut down the computer and then remove the computer cover. Locate the name and model number on the video adapter itself. If the monitor is still attached to the rear of the computer, the video adapter is the card to which the monitor cable is connected.

  • If the video adapter is built into the computer's motherboard (meaning there isn't a separate card), check the motherboard to see whether you can find a chip that lists the video information on it, or write down the motherboard model number and visit the manufacturer's Web site to see whether the information is available.

Once you determine the video adapter make and model, see whether you can locate the necessary drivers on the manufacturer's Web site. Some video adapters come with installation disks. On the disk, you might find a setup program (SETUP.EXE). Run this program to install the video driver. If the installation disk contains the drivers but no setup program, you'll need to install the drivers manually.

When you are ready to install the video adapter driver, follow these steps:

1.
Right-click an open area of the desktop and then select Personalize.

2.
Click Display Settings to display the Display Settings dialog box.

3.
On a system with multiple monitors or video cards, use the Monitor Type list box to select the monitor and video card with which you want to work.

4.
Click Advanced Settings.

5.
On the Adapter tab, note the current information in the Adapter Type and Adapter Information panel. Click Properties.

6.
In the Driver tab, click Update Driver. This starts the Update Driver Software Wizard.

7.
Specify whether you want to install the driver automatically or manually by selecting it from a list or specific location.

8.
If you elect to install the driver automatically, Windows Vista looks for a more recent version of the device driver and installs the driver if found. If a more recent version of the driver is not found, Windows Vista keeps the current driver. In either case, click Close to complete the process and then skip the remaining steps.

9.
If you chose to install the driver manually, you'll have the opportunity to do one of the following:

  • Search for the driver If you want to search for drivers, click Browse to select a search location. Use the Browse For Folder dialog box to select the start folder for the search and then click OK. Because all subfolders of the selected folder are searched automatically, you can select the drive root path, such as C, to search an entire driver.

  • Choose the driver to install If you want to choose the driver to install, click Let Me Pick From A List Of Device Drives On My Computer. The wizard then shows a list of compatible hardware. Click the device that matches your video card. To view a wider array of choices, clear the Show Compatible Hardware check box. You'll then see a full list of manufacturers for all monitor manufacturers. Scroll through the list of manufacturers to find the manufacturer of the device and then choose the appropriate device in the right pane.

10.
After selecting a device driver, continue through the installation process by clicking Next. Click Close when the driver installation is completed. If the wizard can't find an appropriate driver, you'll need to obtain one and then repeat this procedure. Keep in mind that in some cases you'll need to restart the system to activate the newly installed or updated device driver.

Changing the Monitor

The overall display quality is controlled by the combined capabilities of a computer's monitor and video adapter. If a computer has a Plug and Play monitor, Windows Vista might have detected it and installed it properly, or it might have installed a similar driver but not the one that exactly matches the monitor make and model. For the best quality, Windows Vista should use the driver designed for the applicable monitor. Otherwise, the display mode, color depth, refresh rate, and color-matching options might not be appropriate for the monitor.

To change the monitor setup, follow these steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click Display Settings to display the Display Settings dialog box.
3. | On a system with multiple monitors or video cards, use the Monitor Type list box to select the monitor and video card with which you want to work.
4. | Click Advanced Settings.
5. | On the Monitor tab, click Properties.
6. | In the Driver tab, click Update Driver. This starts the Update Driver Software Wizard.
7. | Continue with the driver update as discussed in steps 710 of the previous procedure.
Changing the Screen Resolution and Color Quality

Screen resolution and color quality are key factors affecting display appearance. Screen resolution is the number of pixels that make up the display. Color quality is the number of colors that can be displayed simultaneously on the screen.

A low-end monitor has resolutions of 640 x 480, 800 x 600, and 1024 x 768. High-end monitors have additional resolutions of 1280 x 1024, 1600 x 1200, 1920 x 1200, 2048 x 1536, and sometimes even higher. The best resolution to use depends on the size of the monitor and what the user plans to do with the computer. Designers and developers who need a large screen area will appreciate a higher resolution, such as 1920 x 1200. They can then see more of what they're working with on the screen. Users who spend most of their time reading e-mail or working with Word documents might prefer a lower resolution, such as 1280 x 1024. At that resolution, screen elements are easier to see, and users will have less eyestrain.

Color quality depends greatly on screen resolution settings. Color quality can range from 16 colors for standard Video Graphics Adapter (VGA) monitors to four billion colors (32-bit) for high-end monitors. Most video cards display fewer colors the higher you set the screen resolution. This means that a computer might be able to use 16-bit, 24-bit, or 32-bit color, but the screen resolution must be decreased to achieve this color quality. In most cases, the higher the color quality you can set, the better. Keep in mind that the amount of memory required to maintain the video display is determined by multiplying the number of pixels on the screen (based on screen resolution) by the number of bits per pixel (determined by color quality). Furthermore, the maximum resolution and color quality combination allowed is a function of the video memory on the video adapter.

You can set the screen resolution and color quality by completing the following steps:

1. | Right-click an open area of the desktop and then select Personalize.
2. | Click Display Settings to display the Display Settings dialog box.
3. | On a system with multiple monitors or video cards, use the Monitor Type list box to select the monitor and video card you want to work with.
4. | Use the Resolution slider to set the display size, such as 1024 x 768 pixels.
5. | Use the Colors list box to select a color quality, such as Highest (32-bit).
6. | Click OK.
Changing the Display Refresh Rate

The refresh rate is the rate at which the screen is repainted. The higher the refresh rate, the less flicker there is in the display. If you've ever seen video footage of a computer system with a monitor that seemed to be scrolling or blinking, it appeared this way because the computer's refresh rate was out of sync with the video recording speed. Your eyes don't notice the flicker as much, but a low refresh rate (under 72 Hz) can make your eyes tired if you look at the display too long.

To view or set the refresh rates for a video card, follow these steps:

1. | Right-click an open area of the desktop, and select Personalize.
2. | Click Display Settings.
3. | If multiple monitors are configured, select the monitor you want to work with.
4. | Click Advanced Settings.
5. | On the Adapter tab, click List All Modes. The current refresh rates supported by the monitor are listed.
6. | On the Monitor tab, use the Screen Refresh Rate list box to set the refresh rate.

Caution

In many cases, the Hide Modes That This Monitor Cannot Display check box is disabled so that it cannot be selected. If you are able to clear this check box, keep in mind that if the refresh rate exceeds the capabilities of the monitor or the video card, the screen can become distorted. Additionally, running the computer at a higher refresh rate than it supports can damage the monitor and video adapter.


Chapter 5. Installing and Maintaining Programs

In this chapter:
Managing Application Virtualization and Run Levels | 161
Installing Programs: The Essentials | 168
Deploying Applications Through Group Policy | 172
Configuring Program Compatibility | 173
Managing Installed and Running Programs | 178

Administrators and support staff often install and configure the applications that will be used on desktop computers. Typically, you'll need to install and configure applications prior to deploying new computers, install new applications on existing computers as they are requested, and update existing applications as new versions become available. As users install additional applications, you might also be called on to help troubleshoot installation problems or to help uninstall programs. Most program installation problems are fairly easy to solve if you know what to look for. Other problems are fairly difficult to resolve and require more work than you might expect. In this chapter, you'll learn how User Account Control (UAC) affects installing and running applications as well as techniques for installing, uninstalling, and maintaining programs.


Managing Application Virtualization and Run Levels

User Account Control (UAC) changes the way that applications are installed and run, how applications are installed, where applications write data, and what permissions applications have. In this section, I'll provide a comprehensive look at how UAC affects application installation from application security tokens to file and registry virtualization to run levels. This information is essential when you are installing and maintaining applications.

Application Access Tokens and Location Virtualization

All applications used with Microsoft Windows Vista are divided into two general categories:

  • Windows Vistacompliant Any application written specifically for Windows Vista is considered to be a compliant application. Applications that have been certified as compliant with the new Windows Vista architecture have the Windows VistaCompliant logo.

  • Legacy Any application written for an earlier version of Microsoft Windows is considered to be a legacy application.

The distinction between compliant and legacy applications is an important one because of the architecture changes required to support UAC. Windows Vistacompliant applications use UAC to reduce the attack surface of the operating system. They do this by preventing unauthorized programs from installing or running without the user's consent, and by restricting the default privileges granted to applications. This makes it harder for malicious software to take over a computer.

Note

The Windows Vista component responsible for UAC is the Application Information service. This service facilitates the running of interactive applications with an "administrator" access token. You can see the difference between the administrator user and standard user access tokens by opening two Command Prompt windows, one run with elevation (right-click and select Run As Administrator) and one run as a standard user. In each window, type whoami /all and compare the results. Both access tokens will have the same security identifiers (SIDs), but the elevated, administrator user access token will have more privileges than the standard user access token.

All applications that run on Windows Vista derive their security context from the current user's access token. By default, UAC turns all users into standard users even if they are members of the Administrators group. If an administrator user has consented to use their administrator privileges, a new access token is created for the user. It contains all of the user's privileges, and this access tokenrather than the user's standard access tokenis used to start an application or process.

In Windows Vista, most applications can run using a standard user access token. Whether applications need to run with standard or administrator privileges depends on the actions the application performs. Applications that require administrator privileges, referred to as administrator user applications, differ from applications that require standard user privileges, referred to as standard users applications, in the following ways:

  • Administrator user applications require elevated privileges to run and perform core tasks. Once started in elevated mode, an application with a user's administrator access token can perform tasks that require administrator privileges and can also write to system locations of the registry and the file system.

  • Standard user applications do not require elevated privileges to run or to perform core tasks. Once started in standard user mode, an application with a user's standard access token must request elevated privileges to perform administration tasks. For all other tasks, the application should not run using elevated privileges. Further, the application should write data only to nonsystem locations of the registry and the file system.

Applications not written for Windows Vista run using a user's standard access token by default. To support the UAC architecture, these applications run in a special compatibility mode and use file system and registry virtualization to provide "virtualized" views of file and registry locations. When an application attempts to write a system location, Windows Vista gives the application a private copy of the file or registry value. Any changes are then written to the private copy, and this private copy is in turn stored in the user's profile data. If the application attempts to read or write to this system location again, it is given the private copy from the user's profile to work with. By default, if an error occurs when the application is working with virtualized data, the error notification and logging information show the virtualized location rather than the actual location that the application was trying to work with.

Application Integrity and Run Levels

The focus on user and administrator privileges also changes the general permissions required to install and run applications. In earlier versions of Windows, the power users group gave users specific administrator privileges to perform basic system tasks when installing and running applications. Applications written for Windows Vista do not require the use of the power users group; Windows Vista maintains it only for legacy application compatibility.

As part of UAC, Windows Vista detects application installations and prompts users for elevation to continue the installation by default. Installation packages for Windows Vistacompliant applications use application manifests that contain run level designations to help track required privileges. Application manifests define the application's desired privileges as one of the following:

  • RunAsInvoker Run the application with the same privileges as the user. Any user can run the application. For a standard user or a user who is a member of the administrators group, the application runs with a standard access token. The application would run with higher privileges only if the parent process from which it is started has an administrator access token. For example, if you start an elevated Command Prompt window and then launch an application from this window, the application will run with an administrator access token.

  • RunAsHighest Run the application with the highest privileges of the user. The application can be run by both administrator users and standard users. The tasks that can be performed by the application depend on the user's privileges. For a standard user, the application runs with a standard access token. For a user who is a member of a group with additional privileges, such as the backup operators, server operators, or account operators group, the application runs with a partial administrator access token that only contains the privileges the user has been granted. For a user who is a member of the administrators group, the application runs with a full administrator access token.

  • RunAsAdmin Run the application with administrator privileges. Only administrators can run the application. For a standard user or a user who is a member of a group with additional privileges, the application only runs if the user can be prompted for credentials required to run in elevated mode or if the application is started from within an elevated process, such as an elevated Command Prompt window. For a user who is a member of the administrators group, the application runs with an administrator access token.

To protect application processes, Windows Vista labels them with integrity levels ranging from high to low. Applications that modify system data, such as Disk Management, are considered "high" integrity, while those performing tasks that could compromise the operating system, such as Windows Internet Explorer 7 in Windows Vista, are considered "low" integrity. Applications with lower integrity levels cannot modify data in applications with higher integrity levels.

Windows Vista identifies the publisher of any application that attempts to run with an administrator's full access token. Then, depending on that publisher, Windows Vista marks the application as belonging to one of the following three categories:

  • Windows Vista

  • Publisher verified (signed)

  • Publisher not verified (unsigned)

To help you quickly identify the potential security risk of installing or running the application, the color-coded elevation prompt displays a particular message depending on the category to which the application belongs:

  • If the application is from a blocked publisher or is blocked by Group Policy, the elevation prompt has a red background and displays the message "The application is blocked from running."

  • If the application is administrative (such as Computer Management), the elevation prompt has a blue/green background and displays the message "Windows needs your permission to continue."

  • If the application has been signed by Authenticode and is trusted by the local computer, the elevation prompt has a gray background and displays the message "A program needs your permission to continue."

  • If the application is unsigned (or is signed but not yet trusted), the elevation prompt has a yellow background and red shield icon and displays the message "An unidentified program wants access to your computer."

The prompt to the secure desktop, which can only be accessed by core Windows processes, further secures the elevation process. This safeguards the elevation process by preventing spoofing of the elevation prompt. The secure desktop is enabled by default in Group Policy, as discussed in the "Optimizing User Account Control and Admin Approval Mode" section of Chapter 2, "Managing Windows Vista Systems."

Setting Run Levels

By default, only applications running with a user's administrator access token run in elevated mode. Sometimes, you'll want an application running with a user's standard access token to be in elevated mode. For example, you might want to start the Command Prompt window in elevated mode so you can perform administrator tasks.

In addition to application manifests discussed previously, Windows Vista provides three different ways to set the run level for applications. You can choose to perform one of the following:

  • Run an application once as an administrator.

  • Always run an application as an administrator.

  • Always run an application with different credentials.

Each of these techniques is discussed in the sections that follow.

Running an Application Once as an Administrator

To run an application once as an administrator, right-click the application's shortcut or menu item and then select Run As Administrator. If you are using a standard account and prompting is enabled, you are prompted for consent before the application is started. If you are using a standard account and prompting is disabled, the application will fail to run. If you are using an administrator account and prompting for consent is enabled, you are prompted for consent before the application is started.

Always Running an Application as an Administrator

Windows Vista also enables you to mark an application so that it always runs with administrator privileges. This is useful for resolving compatibility issues with legacy applications that require administrator privileges. It is also useful for Windows Vistacompliant applications that normally run in standard mode but which you use to perform administrative tasks. As examples, consider the following:

  • An application written for an earlier version of Windows requires administrator privileges. Because this program is configured to use standard mode by default under Windows Vista, the program isn't running properly and is generating numerous errors. To resolve the compatibility problem, you decide to mark the application to always run as an administrator.

  • A standard application written for Windows Vista is routinely run in elevated mode and used for administration tasks. To eliminate the need to right-click the application shortcut and select Run As Administrator before running the application, you decide to mark it to always run as an administrator.

Note

You cannot mark system applications or processes to always run as an administrator. Only nonsystem applications and processes can be marked to always run as an administrator.

You can mark an application to always run as an administrator by following these steps:

1.
On the Start menu, locate the program that you want to always run as an administrator.

2.
Right-click the application's shortcut and then click Properties.

3.
In the Properties dialog box, select the Compatibility tab.

4.
Under Privilege Level, select the Run This Program As An Administrator check box, as shown in Figure 5-1.

Figure 5-1. Configure an application to run as an administrator.

Note

If the Run This Program As An Administrator option is unavailable, it means that the application is blocked from always running as elevated, the application does not require administrative credentials to run, or you are not logged on as an administrator.

5.
Click OK.

The application will now always run using an administrator access token. Keep in mind that if you are using a standard account and prompting is disabled, the application will fail to run.

Always Running an Application with Different Credentials

Although you cannot mark system applications or processes to run as an administrator, you can specify that an application or process should run using different credentials. Setting an application to run with different credentials allows a non-administrator user to mark an application to run as an administrator. Once set, administrator credentials will need to be provided before the application can be started using the shortcut. Follow these steps to set an application so that it always runs with different credentials:

1.
Use the Start menu to locate the program that you want to always run with different credentials.

2.
Right-click the application's shortcut and then click Properties.

3.
In the Properties dialog box, select the Shortcut tab.

4.
Click the Advanced button.

5.
In the Advanced Properties dialog box, shown in Figure 5-2, select the Run As Administrator check box.

Figure 5-2. Configure an application to run with different credentials.

6.
Click OK.

The application will now always prompt for the credentials of another user before running if it requires more than a standard user access token. Keep in mind that if you are using a standard account and prompting is disabled, the application will fail to run.

Optimizing Virtualization and Installation Prompting for Elevation

With regard to applications, two areas of User Account Control can be customized:

  • Automatic installation detection and prompting

  • Virtualization of write failures

In Group Policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options, two security settings control the related behaviors. These security settings are:

  • User Account Control: Detect Application Installations And Prompt For Elevation Determines whether Windows Vista automatically detects application installation and prompts for elevation or consent. Because this setting is enabled by default, Windows Vista automatically detects application installations and prompts users for elevation or consent to continue the installation. If you disable this setting, users are not prompted, in which case, the users will not be able to elevate permissions by supplying administrator credentials.

  • User Account Control: Virtualize File And Registry Write Failures To Per-User Locations Determines whether file and registry virtualization is on or off. Because this setting is enabled by default, error notifications and error logging related to virtualized files and registry values are written to the virtualized location rather than the actual location to which the application was trying to write. If you disable this setting, the application will silently fail when trying to write to protected folders or protected areas of the registry.

In a domain environment, you can use Microsoft Active Directory directory servicebased Group Policy to apply the desired security configuration to a particular set of computers. You can also configure these settings on a per computer basis using local security policy. To do this, follow these steps:

1. | Click Start, All Programs, Administrative Tools, Local Security Policy. This starts the Local Security Policy console.
2. | In the console tree, under Security Settings, expand Local Policies and then select Security Options.
3. | Double-click the setting you want to work with, make any necessary changes, and then click OK.


Installing Programs: The Essentials

Program installation is fairly straightforward. Not so straightforward are troubleshooting the many things that can go wrong and fixing problems.. To solve problems that might occur, you first need to understand the installation process. In many cases, the typical installation process starts when Autorun is triggered. Autorun in turn invokes a setup program. Once the setup program starts, the installation process can begin. Part of the installation process involves checking the user's credentials to ensure he or she has the appropriate privileges to install the program, and prompting for consent if he or she doesn't. As part of installing a program, you might also need to make a program available to all or selective users on a computer.

Working with Autorun

When you insert an application CD or DVD into a CD or DVD drive, Windows Vista checks for a file named Autorun.inf. If present, Autorun.inf specifies the action that the operating system should take and can also define other installation parameters. Autorun.inf is a text-based file that can be opened in any standard text editor. If you were to examine the contents, you'd see something similar to the following code:

[autorun]
OPEN=SETUP.EXE AUTORUN=1
ICON=SETUP.EXE,4
SHELL=OPEN
DisplayName=Microsoft Digital Image Suite 9
ShortName=PIS
PISETUP=PIP\pisetup.exe

This Autorun.inf file opens a file named Setup.exe when the CD or DVD is inserted into the CD or DVD drive. Because the file is an actual program, this program is invoked. The Autorun.inf file also specifies an icon to use, the status of the shell, the program display name, the program's short name, and an additional parameter, which in this case is the location of another setup program to run.

The file specified to open won't always be a program. Consider the following example:

[autorun]
OPEN=Autorun\ShelExec default.htm

This Autorun.inf file executes a shell and opens a file named Default.htm when the CD or DVD is inserted into the CD or DVD drive. As a result, when Autorun.inf is triggered, Default.htm opens in the computer's Web browser. It's important to note that even in this case, the document opened in the Web browser contains links that point to a setup program.

Tip

With an application CD or DVD in a drive, you can restart the Autorun process at any time. Simply open and then close the drive bay.

Application Setup and Compatibility

Most applications have a setup program that uses InstallShield, Wise Install, or Microsoft Windows Installer. When you start the setup program, the installer helps track the installation process and should also make it possible to easily uninstall the program. If you are installing an older application, the setup program might use an older version of one of these installers, and this might mean the uninstall process won't completely uninstall the program.

Even if you are absolutely certain a program has a current installer, you should consider the possibility that you will need to recover the system if something goes wrong with the installation. To help ensure that you can recover your system, you should create a System Restore checkpoint before installing the program, as discussed in Chapter 16, "Supporting and Troubleshooting Windows Vista." Then if you run into problems, you can try to uninstall the program and use System Restore to recover the system to the state it was in prior to installing the program.

Before installing any application, you should check to see whether it is compatible with Windows Vista. To determine compatibility, you can perform the following check:

  • Check the software packaging, which should specify whether the program is compatible. Look for the Microsoft Windows Vista logo.

  • Check the software developer's Web site for a list of compatible operating systems.

Note

Also as part of the compatibility check, check for updates or patches for the program. If available, install updates or patches after installing the program.

With legacy applications, Windows Vista uses the Program Compatibility Assistant to automatically make changes for known compatibility issues. If the Program Compatibility Assistant detects a known compatibility issue when you run a legacy application, it notifies you about the problem and provides possible solutions for resolving the problem automatically. You can then allow the Program Compatibility Assistant to reconfigure the application for you, or you can elect to manually configure compatibility as discussed in the "Configuring Program Compatibility" section of this chapter.

For legacy applications, you can also use the Compatibility Administrator (CompatAdmin.exe), provided in the Windows Application Compatibility Toolkit, to create an application manifest that sets the application's run level. The Compatibility Administrator can also help identify other types of compatibility issues with legacy applications. The Windows Application Compatibility Toolkit can be downloaded from http://www.microsoft.com/technet/prodtechnol/windows/appcompatibility/default.mspx.

Permissions Required for Installing, Uninstalling, and Maintaining Applications

To install programs under Windows Vista, you must either use an account with administrator permissions or provide administrator permissions when prompted. Keep the following in mind:

  • If you are using a standard user account, you will be prompted for consent when you run the application's setup program. If prompting for consent is disabled, you will not be able to install applications.

  • If you are using an administrator account, you will be prompted for consent when you run the application's setup program. If prompting for consent is disabled, the application's setup program will run immediately.

Administrator privileges are also required to uninstall applications. In many cases, however, you can perform maintenance tasks, such as modifying or repairing an application, with a standard user account.

Making Programs Available to All or Selected Users

Usually when you install a program, the program is made available to all users on a computer. This occurs because the program's shortcuts are placed in the Start Menu folder (%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu) for all users so that any user who logs on to a system has access to the program. Some programs prompt you during installation to choose whether you want to install the program for all users or only for the currently logged on user. Other programs simply install themselves only for the current user.

If setup installs a program so that it is only available to the currently logged on user and you want other users to have access to the program, you'll need to take one of the following actions:

  • Log on to the computer using each user account that should have access to the program. Then rerun setup. In this way, you can selectively make the program available to the appropriate users. You will also need to remember to run setup again each time a new user account is added to the computer and that user needs access to the program.

  • For programs that don't require per-user settings to be added to the registry before running, you can in some cases make the program available to all users on a computer by adding the appropriate shortcuts to the Start Menu folder for all users. Copy or move the program shortcuts from the currently logged on user's profile to the Start Menu folder for all users.

If you want to make a program available to all users on a computer, you can copy or move a program's shortcuts by completing the following steps:

1. | Right-click the Start button and select Explore. This starts Windows Explorer with the currently logged on user's Start Menu folder selected.
2. | Under Programs, right-click the folder for the program group or the shortcut you want to work with. Then select Copy or Cut from the shortcut menu.
3. | Right-click the Start button and select Explore All Users. This starts Windows Explorer with the Start Menu folder for all users selected.
4. | Right-click Program and then select Paste. The program group or shortcut should now be available to all users of the computer.

If you want to make a program available only to the currently logged on user rather than all users on a computer, you can move a program's shortcuts by completing the following steps:

1. | Right-click the Start button and select Explore All Users. This starts Windows Explorer with the Start Menu folder for all users selected.
2. | Select Program, right-click the folder for the program group or shortcut that you want to work with, and select Cut.
3. | Right-click the Start button and select Explore. This starts Windows Explorer with the currently logged on user's Start Menu folder selected.
4. | Right-click Programs and then select Paste. The program group or shortcut should now be available only to the currently logged on user.

Note

Moving the program group or shortcut hides the fact that the program is available on the computerit doesn't prevent other users from running the program. Using the Run dialog box or from Windows Explorer, other users on a computer will still be able to run the program.


Deploying Applications Through Group Policy

You can make applications available to users over the network through Group Policy. When you use Group Policy to deploy applications, administrators have two distribution options.

  • The first option is to assign the application to users or computers. When an application is assigned to a computer, it is completely installed the next time the computer is restarted and becomes available to all users of that computer the next time they log on. When an application is assigned to a user, it is completely installed the next time the user logs on to the network. An assigned application can also be configured for install-on-first-use. In this configuration, the application is made available through shortcuts on the user's desktop or Start menu. With install-on-first-use configured, the application installs when the user clicks on a shortcut to launch the application.

  • The second option is to publish the application and make it available for installation. When you publish an application, the application can be made available through extension activation. With extension activation configured, the program is installed when a user tries to open any file with an extension specific to the application. For example, if a user double-clicks a file with a .doc extension, Microsoft Word could be installed automatically using an extension activation configuration.

You deploy applications for computers using a Microsoft Windows Installer Package (.msi file) and Computer Configuration\Software Settings\Software Installation policy. You deploy applications for users using a Windows Installer Package (.msi file) and User Configuration\Software Settings\Software Installation policy. The basic steps required to deploy applications through Group Policy are as follows:

1. | For clients to access the Windows Installer Package, it must be located on a network share. As necessary, copy the Windows Installer Package (.msi file) to a network share that will be accessible to the appropriate users.
2. | Access the Group Policy Object (GPO) from which you want to deploy the application in the Group Policy Object editor. Once deployed, the application will be made available to all clients for which the GPO is applicable. This means the application will be available to computers and users in the related domain, site, or organizational unit (OU).
3. | Expand Computer Configuration\Software Settings or User Configuration\Software Settings as appropriate, right-click Software Installation, point to New, and then select Package.
4. | Use the Open dialog box to locate the Windows Installer Package (.msi file) for the application and then click Open. You are then given the choice to select the deployment method as Published, Assigned, or Advanced.
5. | To publish or assign the program, select Published or Assigned as appropriate and then click OK. If you are configuring computer policy, the program is available the next time a computer affected by the GPO is restarted. If you are configuring user policy, the program is available to users in the domain, site, or OU the next time they log on. Currently logged on users will need to log off and then log on.
6. | To configure additional deployment options for the program using the properties sheet, select Advanced and then click OK. You can then set additional deployment options as necessary.


Configuring Program Compatibility

When you want to install 16-bit or MS-DOS programs, you might need to make special considerations. Additionally, sometimes to get older programs to run, you might need to adjust compatibility options. Techniques for handling these situations are discussed in the following sections.

Special Installation Considerations for 16-Bit and MS-DOS Programs

Many 16-bit and MS-DOS programs that don't require direct access to hardware will install and run on Windows Vista without any problems. However, most 16-bit and MS-DOS programs do not support long file names. To help ensure compatibility, Windows Vista maps between long and short file names as necessary. This ensures long file names are protected when they are modified by a 16-bit or MS-DOS program. Additionally, it is important to note that some 16-bit and MS-DOS programs require 16-bit drivers, which are not supported on Windows Vista and as a result, these programs won't run.

Most existing 16-bit and MS-DOS programs were originally written for Windows 3.0 or Windows 3.1. Windows Vista runs these older programs using a virtual machine that mimics the 386-enhanced mode used by Windows 3.0 and Windows 3.1. Unlike earlier Windows releases, each 16-bit and MS-DOS application runs as a thread within a single virtual machine. This means if you run multiple 16-bit and MS-DOS applications, they all share a common memory space. Unfortunately, if one of these applications hangs or crashes, it usually means the others will as well.

You can help prevent one 16-bit or MS-DOS application from causing others to hang or crash by running it in a separate memory space. To do this, follow these steps.

1. | Right-click the program's shortcut icon and then select Properties. If the program doesn't have a shortcut, create one and then display the shortcut's Properties dialog box.
2. | On the Shortcut tab, click the Advanced Button. This displays the Advanced Properties dialog box.
3. | Select the Run In Separate Memory Space check box.
4. | Click OK twice to close all open dialog boxes and save the changes.

Note

Running a program in a separate memory space uses additional memory. However, you'll usually find that the program is more responsive. Another added benefit is that you'll be able to run multiple instances of the programas long as all the instances are running in separate memory spaces.

Tip

The Windows Vista command prompt (CMD.EXE) is a 32-bit command prompt. If you want to invoke a 16-bit MS-DOS command prompt, you can use COMMAND.COM. Type command in the Run dialog box.

Forcing Program Compatibility

Some programs won't install or run on Windows Vista even if they work on previous versions of the Windows operating system. If you try to install a program that has known compatibility problems, Windows Vista should display a warning prompt telling you about the compatibility issue. In most cases, you won't want to continue installing or running a program with known compatibility problems, especially if the program is a system utility such as an antivirus program or a disk partitioning program, because running an incompatible system utility can cause serious problems. Running other types of incompatible programs can also cause problems, especially if they write to system locations on disk.

That said, if a program will not install or run on Windows Vista, you might be able to run the program by adjusting its compatibility settings. Windows Vista provides two mechanisms for managing compatibility settings. You can use the Program Compatibility Wizard, or you can edit the program's compatibility settings directly using the program's Properties dialog box. Both techniques work the same way. However, using the Program Compatibility Wizard is the only way you can change compatibility settings for programs that are on shared network drives, CD or DVD drives, or other types of removable media drives. As a result, you can sometimes use the Program Compatibility Wizard to install and run programs that would not otherwise install and run.

Using the Program Compatibility Wizard

To set program compatibility using the Program Compatibility Wizard, follow these steps.

1.
Click Start, All Programs, Accessories. Then select Program Compatibility Wizard.

Alternatively, you can type mshta.exe res://acprgwiz.dll/compatmode.hta at a command prompt.

2.
When the wizard starts, click Next. As shown in Figure 5-3, you now need to specify how you want to locate the program. You can choose from a list of programs, use the program in the CD-ROM or other removable media drive, or locate the program by browsing files and folders.

Figure 5-3. Decide how you want to locate the program.

[View full size image]

3.
Click Next. Use the options provided to choose the program and then click Next again.

4.
Choose the operating system for which the program was designed. As shown in Figure 5-4, the choices are Windows 95, Windows NT 4.0 with Service Pack 5, Windows 98/Windows Me, Windows 2000, or Windows XP with Service Pack 2. Your choice sets the compatibility mode. When running the program, Windows Vista will simulate the environment for the chosen operating system.

Figure 5-4. Select the operating system for which the program was originally designed.

[View full size image]

5.
Click Next. If you are trying to run a game, an educational program, or any other program that requires specific display settings, you can select the required display settings. By selecting 256 Colors, 640 x 480 Screen Resolution, or both, you are restricting the video display. This can help with programs that have problems running at higher screen resolutions and color depths. You can also disable themes, desktop compositing, and display scaling of high dots per inch (dpi) settings.

6.
Click Next. If you want the program to run with administrator privileges, select the Run As Administrator check box.

7.
Click Next twice. The wizard will then run the program with the chosen compatibility settings.

8.
When you are finished testing the program, return to the wizard and complete the configuration process.

Setting Compatibility Options Directly

If you've already installed the program but it won't run correctly, you might want to edit the compatibility settings directly rather than through the wizard. To do this, follow these steps.

1.
Right-click the program's shortcut icon and then select Properties.

2.
On the Compatibility tab, shown in Figure 5-5, select the Compatibility settings that you want Windows Vista to use. Programs that are part of the Windows Vista operating system cannot be run in Compatibility mode. Because of this, the options on the Compatibility tab are unavailable for built-in programs.

Figure 5-5. You can also configure compatibility directly.

3.
Select the Run This Program In Compatibility Mode For check box and then use the selection menu to choose the operating system for which the program was designed.

4.
If necessary, use the options in the Settings panel to restrict the video display settings for the program. Select 256 colors, 640 x 480 screen resolution, or both, as required.

5.
If necessary, you can also disable themes, desktop compositing, and display scaling of high dpi settings.

6.
Click OK. Double-click the shortcut to run the program and test the compatibility settings. If you still have problems running the program, you might need to modify the compatibility settings again.


Managing Installed and Running Programs

Windows Vista provides several management tools for working with programs. These tools include:

  • Software Explorer Helps you determine and manage startup programs, currently running programs, network-connected programs, and programs that use Windows Sockets (Winsock)

  • Task Manager Provides options for viewing and managing currently running programs as well as options for viewing resource usage and performance

  • Windows Features Helps you view and manage the Windows components installed on a computer

  • Programs Provides tasks for viewing installed programs, adding and removing programs, viewing installed updates, and more

  • Default Programs Helps you track and configure global default programs for the computer, personal default programs for individual users, AutoPlay settings for multimedia, and file associations for programs

These tools are discussed in the sections that follow.

Managing Startup and Running Programs with Software Explorer

Windows Defender, discussed in Chapter 15, "Optimizing Windows Vista," is the built-in antivirus program in Windows Vista. Windows Defender tracks a computer's potentially malicious programs using a subcomponent called Software Explorer. Software Explorer is responsible for tracking all the programs running on a computer and identifying how those programs are being used. You access Software Explorer in Windows Defender.

Using Software Explorer, you can quickly determine a computer's:

  • Startup programs

  • Currently running programs

  • Network-connected programs

  • Winsock service providers

To access Software Explorer, click Start, point to All Programs, and click Windows Defender. In Windows Defender, click Tools on the toolbar and then click Software Explorer.

Managing Startup Programs

As discussed in the "Adding or Removing Startup Programs" section in Chapter 4, "Customizing the Desktop and the Interface," programs that run in the background and start automatically when a user logs on can be viewed and managed through the Startup folder that is located within the profile data for that user (%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu) or through the Startup folder for all users (%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu). You can also use Software Explorer to view and manage startup programs for individual users.

In Software Explorer, you select Startup Programs in the Category list to view currently configured startup programs. By default, startup programs are grouped by software publisher. (See Figure 5-6.) You can also group programs by startup type by right-clicking in the left pane and then selecting Startup Type.

Figure 5-6. Use Software Explorer to determine startup programs.

[View full size image]

When you click a program in the left pane, details about the program's configuration are shown in the right pane. The details listed for each startup program include:

  • Classification Shows the classification of the executable file as either allowed or not allowed

  • Date Installed Shows the date and time the file was installed

  • Description Shows a description of the program

  • Display Name Shows the application name that Windows Vista uses

  • File Name Shows the executable file name

  • File Path Shows the complete file path to the executable file

  • File Size Shows the size of the executable file in bytes

  • File Type Shows the type of file listed in the File Name field, such as whether a file is an application file or an application extension file

  • File Version Shows the version and revision number of the executable file

  • Location Shows the folder path where the startup program shortcut was created or the Run registry key value

  • Publisher Shows the company that published the software

  • Ships With OS Shows whether the executable file ships with the operating system (OS)

  • Startup Type Shows how you have configured the program to start automatically, such as whether the startup program is in the Startup folder for all users or the Startup folder for the current user

  • Startup Value Shows the options or parameters passed to the program at startup

  • Verified Shows whether the file has been digitally verified as authentic

When you select a startup program in the left pane, you are then able to use the following options to manage the program:

  • Remove Click Remove to delete the shortcut or registry value that sets the program to start automatically.

  • Disable Click Disable to configure the program so that it doesn't start automatically, without removing the shortcut or registry value that sets the program to start automatically.

  • Enable Click Enable to allow a previously disabled startup program to run automatically when a user logs on.

Managing Currently Running Programs

In Windows Vista, you can view and work with a computer's currently running programs and processes using either Software Explorer's Currently Running Programs category or Task Manager. Software Explorer's Currently Running Programs category enables you to view and manage currently running processes for all users. Both foreground and background processes are listed. By default, Software Explorer groups running programs by software publisher. You can group programs by user by right-clicking in the left pane and then selecting User Name.

You can view details about a running program's configuration by clicking the program in the left pane. Although the details listed for each running program are similar to those for startup programs, the details also show the process ID number of the related process and the user account under which the process is running.

Using the Currently Running Programs category view, you can:

  • Terminate a process When you select a process in the left pane, you can then terminate the process by clicking End Process and then clicking Yes when prompted to confirm the action.

  • Run Task Manager When you click the Task Manager button, Windows Vista opens the Task Manager. You can also open Task Manager by pressing Ctrl+Alt+Delete.

As Figure 5-7 shows, Task Manager has two tabs for working with running programs:

  • Applications Task Manager's Applications tab lists applications that are currently running in the foreground by name and status, such as Running or Not Responding. To exit a program, as might be necessary when it is not responding, click the program in the Task list and then click End Task.

  • Processes Task Manager's Processes tab lists all background and foreground applications running on the computer by image name, user name, and resource usage. To stop a process, click the process and then click End Process.

Figure 5-7. Use Task Manager to work with running processes.

[View full size image]

By default, Task Manager's Processes tab only shows running processes for the currently logged on user and the operating system. To see running processes for all users, you must click Show Processes From All Users.

Tip

On the Processes tab, you can manage processes in additional ways by switching to administrator mode. To do this, right-click in the Processes tab and then select Perform Administrative Tasks. You will then be able to right-click processes and select from an extended list of options, including Open File Location (which opens the folder containing the executable file for the process in Windows Explorer), End Process Tree (which stops the process and all dependent processes), Create Dump File (which creates a memory dump file for the selected process), and Properties (which opens the Properties dialog box for the executable file).

Managing Network-Connected Programs and Winsock Service Providers

Software Explorer provides two additional views. In Software Explorer, you select Network Connected Programs in the Category list to view programs that are connected to the local area network (LAN), the Internet, or both. When you select a network-connected program, you can view that program's configuration details in the right pane. The details provided for a network-connected program show active connections according to the following:

  • Foreign Address Shows the remote Internet Protocol (IP) address and port number being used (if any)

  • Local Address Shows the local IP address and port number being used

  • Protocol Shows the TCP/IP protocol being used

  • State Shows the state of the port being used, such as whether it is listening for incoming requests

Using the Network Connected Programs category view, you can:

  • Stop a program When you select a user-started program in the left pane, you can then terminate the program by clicking End Process and then clicking Yes when prompted to confirm the action.

  • Block incoming connections to a program When you select a user-started program in the left pane, you can block incoming Winsock connections to the program by clicking Block Incoming.

In Software Explorer, you select Winsock Service Providers to list programs that are acting as local service providers for Winsock. When you select a network-connected program, you can view that program's configuration details in the right pane. The details provided for Winsock service providers include the LSP Type (which shows what type of provider the program is) and Special Path (which show the device path being used by the program for Winsock communications).

Managing and Repairing Installed Programs

Windows Vista considers any program you've installed on a computer or made available for a network installation to be an installed program. In earlier versions of Windows, you use the Add Or Remove Programs utility to install and manage applications. In Windows Vista, you use the setup program that comes with the application to install applications, and you use the Installed Programs page in Control Panel to manage applications.

You can use the Installed Programs console to view, add, remove, or repair installed programs by following these steps:

1.
Click Start, Control Panel. In Control Panel, click Programs.

2.
Click Programs And Features. You should now see a list of installed programs.

3.
In the Name list, right-click the program you want to work with and then select one of the following:

  • Uninstall to uninstall the program

  • Change to modify the program's configuration

  • Repair to repair the program's installation

Designating Default Programs

Default programs determine which programs are used with which types of files and how Windows handles files on CDs, DVDs, and portable devices. You configure default programs based on the types of files those programs support, either globally for all users of a computer or only for the current user. Individual user defaults override global defaults. For example, you could consider Windows Media Player the global default for all types of files it supports, and then all users of the computer would use Windows Media Player to play sound, audio, and video files it supports. If a user wanted to use Apple iTunes instead as the default player for sound and audio files, you could then configure iTunes to be her default player for the types of media files it supports.

You can configure global default programs for all the users of a computer by following these steps:

1.
Click Start, Control Panel. In Control Panel, click Programs.

2.
Click Default Programs and then click Set Program Access And Computer Defaults.

3.
As shown in Figure 5-8, choose a configuration from one of the following options:

  • Microsoft Windows Sets the currently installed Windows programs as the defaults for Web browsing, sending e-mail, and playing media files

  • Non-Microsoft Sets the currently installed programs as the defaults for Web browsing, sending e-mail, and playing media files

  • Custom Enables you to choose programs as the defaults for Web browsing, sending e-mail, and playing media files

Figure 5-8. Choose a global default configuration.

[View full size image]

4.
Click OK to save the settings.

To override global defaults, set defaults for individual users. You can configure default programs for the current user by following these steps:

1. | Click Start, Control Panel. In Control Panel, click Programs.
2. | Click Default Programs and then click Set Your Default Programs.
3. | Select a program you want to work with in the Programs list.
4. | If you want the program to be the default for all the file types and protocols it supports, click Set This Program As Default.
5. | If you want the program to be the default for specific file types and protocols, click Choose Defaults For This Program. Select the file extensions for which the program should be the default and then click Save.

Configuring AutoPlay Options

In Windows Vista, AutoPlay options determine how Windows handles files on CDs, DVDs, and portable devices.

You can configure separate AutoPlay options for each type of CD, DVD, and media your computer can handle by following these steps:

1.
Click Start, Control Panel. In Control Panel, click Programs.

2.
Click Default Programs and then click Change AutoPlay Settings. This displays the AutoPlay page in Control Panel.

3.
As shown in Figure 5-9, use the media selection list to set the default AutoPlay option for each media type as appropriate.

Figure 5-9. Set autoplay options for CDs, DVDs, and portable devices.

[View full size image]

4.
Click Save to save your settings.

Adding and Removing Windows Features

In earlier versions of Windows, you use the Add/Remove Windows Components option of the Add Or Remove Programs utility to add or remove operating system components. In Windows Vista, operating system components are considered Windows features that can be turned on or off rather than added or removed.

You can turn on or off Windows features by following these steps:

1.
Click Start, Control Panel. In Control Panel, click Programs.

2.
Click Turn Windows Features On Or Off under Programs And Features. This displays the Windows Features dialog box.

3.
As shown in Figure 5-10, select features to turn them on; clear features to turn them off.

Figure 5-10. Add or remove operating system components.

4.
When you click OK, Windows Vista reconfigures components as appropriate for any changes you've made.


Chapter 6. Managing User Access and Security

In this chapter:
Understanding User and Group Accounts | 187
Managing Local Logon | 193
Managing Stored Passwords | 201
Managing Local User Accounts and Groups | 204
Managing Remote Access to Workstations | 210

Microsoft Windows Vista workstations can be configured as members of a workgroup or members of a domain. When a workstation is configured as a member of a workgroup, user access and security are configured on the workstation itself. When a workstation is configured as a member of a domain, user access and security are configured at two levels: the local system level and the domain level. User access can be configured at the local system level for a specific machine and at the domain level for multiple systems or resources throughout the current Microsoft Active Directory directory service forest. In this chapter, you'll learn how to manage local system access and local accounts. For further discussion of configuring domain access and permissions, see Microsoft Windows Server 2003 Administrator's Pocket Consultant. Keep in mind that every task examined in this chapter can be performed through a local logon or a remote desktop connection.


Understanding User and Group Accounts

Windows Vista provides user accounts and group accounts (of which users can be members). User accounts are designed for individuals. Group accounts, usually referred to as groups, are designed to simplify the administration of multiple users. You can log on to user accounts, but you can't log on to a group account.

Local User Account Essentials

Two general types of user accounts are defined in Windows Vista:

  • Local user accounts User accounts defined on a local computer are called local user accounts. These accounts have access to the local computer only. You add or remove local user accounts with Control Panel's User Accounts options or the Local Users And Groups utility. Local Users And Groups is accessible through Computer Management, a Microsoft Management Console (MMC) tool.

  • Domain user accounts User accounts defined in the Active Directory are called domain user accounts. Through Single Sign-On, these accounts can access resources throughout a forest. When a computer is a member of an Active Directory domain, you can create domain user accounts using Active Directory Users And Computers. This MMC tool is available on the Administrative Tools menu when you install the Windows Server Administrator Tools (Adminpak.msi) on your Windows Vista computer.

Both local user accounts and domain user accounts can be configured as standard user accounts or administrator accounts. As discussed in the "Redefining Standard User and Administrator User Accounts" section in Chapter 2, "Managing Windows Vista Systems," a standard user account on a local computer has limited privileges, and an administrator account on a local computer has extended privileges.

All user accounts are identified with a logon name. In Windows Vista, this logon name has two parts:

  • User name The text label for the account

  • User computer or domain The computer or domain in which the user account exists

For the user WILLIAMS, whose account is created for the computer ENGPC85, the full logon name for Windows Vista is ENGPC85\williams. With a local computer account, WILLIAMS could log on to his local workstation and access local resources but would not be able to access domain resources.

When working with domains, the full logon name can be expressed in two different ways:

  • The user account name and the full domain name separated by the at sign (@). For example, the full logon name for WILLIAMS in the technology.microsoft.com domain would be WILLIAMS@technology.microsoft.com.

  • The user account name and the domain separated by the backslash symbol (\). For example, the full logon name for WILLIAMS in the technology domain would be technology\WILLIAMS.

Although Windows Vista displays user names to describe privileges and permissions, the key identifiers for accounts are security identifiers (SIDs). SIDs are unique identifiers generated when security principals are created. Each consists of a computer or domain security ID prefix combined with a unique relative ID for the user. Windows Vista uses these identifiers to track accounts independently from user names. SIDs serve many purposes, but the two most important ones are to enable you to easily change user names and delete accounts without worrying that someone might gain access to resources simply by recreating an account.

When you change a user name, you tell Windows Vista to map a particular SID to a new name. When you delete an account, you tell Windows Vista that a particular SID is no longer valid. Even if you create an account with the same user name later, the new account won't have the same privileges and permissions as the previous one because the new account will have a new SID.

User accounts can also have passwords and certificates associated with them. Passwords are authentication strings for an account. Certificates combine a public and private key to identify a user. You log on with a password interactively, whereas you log on with a certificate leveraging its private key stored on a smart card and using a smart card reader.

When you install Windows Vista, the operating system installs default user accounts. You'll find several built-in accounts, which have purposes similar to those of accounts created in Windows domains. The key accounts you'll see are the following:

  • Administrator Administrator is a predefined account that provides complete access to files, directories, services, and other facilities. You can't delete or disable this account. In Active Directory, the Administrator account has domain-wide access and privileges. On a local workstation, the Administrator account has access only to the local system.

  • Guest Guest is designed for users who need one-time or occasional access. Although guests have only limited system privileges, you should be very careful about using this account because it opens the system up to potential security problems. The risk is so great that the account is initially disabled when you install Windows Vista.

Before you modify any of the built-in accounts, you should note the property settings and group membership. By default, these accounts are members of various groups. This membership grants or limits the user access to specific system resources. For example, Administrator is a member of the Administrators group and Guest is a member of the Guests group. Being a member of a group makes it possible for the account to use the privileges and rights of the group.

In addition to the built-in accounts, Windows Vista has several pseudo-accounts that are used to perform specific types of system actions. The pseudo-accounts are available only on the local system. You can't change the settings for these accounts with the user administration tools. Users can't log on to a computer with these accounts. The pseudo-accounts available include the following:

  • LocalSystem LocalSystem is a pseudo-account for running system processes and handling system-level tasks. This account grants the logon right Log On As A Service. Most services run under the LocalSystem account. In some cases, these services have privileges to interact with the desktop. Services that need fewer privileges or logon rights run under the LocalService or NetworkService accounts. Services that run as LocalSystem include Background Intelligent Transfer Service, Computer Browser, Group Policy Client, Netlogon, Network Connections, Print Spooler, and User Profile Service.

  • LocalService LocalService is a pseudo-account for running services that need fewer privileges and logon rights on a local system. By default, services that run under this account are granted the right to Log On As A Service and the privileges Adjust Memory Quotas For A Process, Change The System Time, Change The Time Zone, Generate Security Audits, and Replace A Process Level Token. Services that run as LocalService include Alerter, Remote Registry, Smart Card, Smart Card Helper, SSDP Discovery Service, TCP/IP NetBIOS Helper, and WebClient.

  • NetworkService NetworkService is a pseudo-account for running services that need fewer privileges and logon rights on a local system but also must access network resources. As with LocalService, services that run by default under the NetworkService account are granted the right to Log On As A Service and the privileges Adjust Memory Quotas For A Process, Generate Security Audits, and Replace A Process Level Token. Services that run as NetworkService include Distributed Transaction Coordinator, DNS Client, Performance Logs And Alerts, and Remote Procedure Call (RPC) Locator. NetworkService can also authenticate to remote systems as the computer account.

Group Account Essentials

Windows Vista also provides groups, which you use to grant permissions to similar types of users and to simplify account administration. If a user is a member of a group that can access a resource, that particular user can access the same resource. Thus, you can give a user access to various work-related resources just by making the user a member of the correct group. Note that although you can log on to a computer with a user account, you can't log on to a computer with a group. Because different Active Directory domains or local computers might have groups with the same name, groups are often referred to by Domain\GroupName or Computer\GroupName (for example, Technology\GMarketing for the GMarketing group in the Technology domain or computer).

Windows Vista uses the following three types of groups:

  • Local groups Defined on a local computer and used on the local computer only. You create local groups with the Local Users And Groups utility.

  • Security groups Can have security descriptors associated with them. You use a Windows server to define security groups in domains, using Active Directory Users And Computers.

  • Distribution groups Used as e-mail distribution lists. They can't have security descriptors associated with them. You define distribution groups in domains using Active Directory Users And Computers.

As with user accounts, group accounts are tracked using unique SIDs. This means that you can't delete a group account and re-create it, and then expect all the permissions and privileges to remain the same. The new group will have a new SID, and all the permissions and privileges of the old group will be lost.

When you assign user access levels, you have the opportunity to make the user a member of the following built-in or predefined groups:

  • Administrators Members of this group are local administrators and have complete access to the workstation. They can create accounts, modify group membership, install printers, manage shared resources, and more. Because this account has complete access, you should be very careful about adding users to this group.

  • Backup Operators Members of this group can back up and restore files and directories on the workstation. They can log on to the local computer, back up or restore files, and shut down the computer. Because of how the account is set up, they can back up files regardless of whether they have read/write access to the files. However, they can't change access permissions of the files or perform other administrative tasks.

    Operators have privileges to perform very specific administrative tasks, such as backing up file systems. By default, no other group or user accounts are members of the operator groups. This is to make sure that you must grant explicit access to the operator groups.

  • Cryptographic Operators Members of this group can manage the configuration of encryption, IP security (IPSec), digital IDs, and certificates.

  • Guests Guests are users with very limited privileges. Members of this group can access the system and its resources remotely, but they can't perform most other tasks.

  • Network Configuration Operators Members of this group can manage network settings on the workstation. They can also configure Transmission Control Protocol/Internet Protocol (TCP/IP) settings and perform other general network configuration tasks.

  • Performance Log Users Members of this group can view and manage performance counters. They can also manage performance logging.

  • Performance Monitor Users Members of this group can view performance counters and performance logs.

  • Power Users In earlier versions of Windows, this group is used to grant additional privileges, such as the capability to modify computer settings and install programs. In Windows Vista, this group is maintained only for compatibility with legacy applications.

  • Remote Desktop Users Members of this group can log on to the workstation remotely using Terminal Services And Remote Desktop. Once members are logged on, the additional groups of which they are members determine their permissions on the workstation. A user that is a member of the administrators group is granted this privilege automatically. (However, remote logons must be enabled before an administrator can remotely log on to a workstation.)

  • Replicator Members of this group can manage the replication of files for the local machine. File replication is primarily used with Active Directory domains and Windows servers.

  • Users Users are people who do most of their work on a single Windows Vista workstation. Because of this, members of the Users group have more restrictions than privileges. Members of this group can log on to a Windows Vista workstation locally, keep a local profile, lock the workstation, and shut down the workstation.

In most cases, you'll configure user access using the users or administrators groups. You can configure user and administrator access levels by setting the account type to Standard User or Administrator, respectively. To make a user a member of a group, you need to create or modify the account using the Local Users And Groups node of Computer Management.

Domain vs. Local Logon

When computers are members of a domain, you'll typically use domain accounts to log on to computers and the domain. All administrators in a domain have access to resources on the local workstations that are members of the domain. Users, on the other hand, can only access resources on the local workstations to which they are permitted to log on. By default, in a domain, any user with a valid domain account can log on to any computer that is a member of the domain. Once logged on to a computer, the user will have access to any resources that his or her account, or groups to which this account belongs, are granted access. This includes resources on the local machine as well as resources in the domain.

You can restrict logon to specific domain workstations on a per user basis using Active Directory Users And Computers. In Active Directory Users And Computers, right-click the user account and then select Properties. On the Account tab of the user's Properties dialog box, click Log On To and then use the options of the Logon Workstations dialog box to designate the workstations to which the user is permitted to log on.

When you work with Windows Vista, however, you aren't always logging on to a domain. Computers configured in workgroups only have local accounts. You might also need to log on locally to a domain computer to perform administration. Only users with a local user account can log on locally. When you log on locally to a computer, you have access to any resources on the computer that your account, or groups to which your account belongs, are granted access.


Managing Local Logon

All local computer accounts should have passwords. If an account is created without a password, anyone can log on to the account from the console, and there is no protection for the account. However, a local account without a password cannot be used to remotely access a computer.

The sections that follow discuss how to create and work with local user accounts. Every workstation computer has local computer accounts, regardless of whether the computer is a member of a workgroup or a domain.

Creating Local User Accounts in a Workgroup

For a computer that is a member of a workgroup, you can create a local user account on a computer by following these steps:

1.
In Control Panel, click Add Or Remove User Accounts under the User Accounts heading. This displays the Manage Accounts page. As Figure 6-1 shows, the Manage Accounts page lists all configurable user accounts on the local computer by account type with configuration details. If an account has a password, it is listed as being password protected. If an account is disabled, it is listed as being off.

Figure 6-1. In a workgroup, use the Manage Accounts page in Control Panel to add or remove local user accounts.

[View full size image]

2.
Click Create A New Account. This displays the Create New Account page.

3.
Type the name of the local account. This name is displayed on the Welcome screen and Start menu.

4.
Set the type of account as either Standard User or Administrator. To give the user full permissions on the local computer, select Administrator.

Granting Access to an Existing Domain Account to Allow Local Logon

If a user needs to be able to log on locally to a computer and has an existing domain account, you can grant the user permission to log on locally by completing the following steps:

1.
In Control Panel, click User Accounts. On the User Accounts page, click the Give Other Users Access To This Computer link. This displays the User Accounts dialog box. As Figure 6-2 shows, the User Accounts dialog box lists all configurable user accounts on the local computer by account type with group membership details.

Figure 6-2. Use the User Accounts dialog box to manage local user accounts.

2.
Click Add. This starts the Add New User wizard.

3.
You are creating a local computer account for a user with an existing domain account. Type the user's domain account name and domain in the fields provided.

4.
Using the options provided, select the type of user account.

5.
A Standard User account is created as a member of the local User's group. To give the user the permissions of a normal user, select Standard User.

6.
An Administrator account is created as a member of the local Administrator's group. To give the user full permissions on the local computer, select Administrator.

7.
An Other account is created as a member of the specific group you choose. To give the user the permissions of a specific group, select Other and then select the desired group.

8.
Click Finish. If you need to set other permissions or add the user to other local groups, you'll need to follow the steps specified in the "Managing Local User and Group Accounts" section of this chapter.

Changing Local User Account Types

The User Accounts utility provides an easy way to change account types for local users. You can quickly set one of the default account types. For more advanced control, however, you'll need to use Local Users And Groups to assign group membership individually. (See the "Adding and Removing Local Group Members" section of this chapter.)

In a workgroup, you can change the account type for a local computer user by completing the following steps:

1. | In Control Panel, click Add Or Remove User Accounts under the User Accounts heading. This displays the Manage Accounts page.
2. | Click the account you want to change and then click Change The Account Type.
3. | On the Change The Account Type page, set the level of access for the user as either Standard User or Administrator and then click Change The Account Type.

In a domain, you can change the account type for a local computer user by completing the following steps:

1. | In Control Panel, click User Accounts. On the User Accounts page, click the Change Account Type link. This displays the User Accounts dialog box.
2. | On the Users tab, click the user account you want to work with and then click Properties.
3. | In the Properties dialog box, select the Group Membership tab.
4. | Select the type of account as Standard User or Administrator. Or select Other and then select the desired other group.
5. | Click OK twice.

Enabling and Disabling User Account Control

Every computer has a built-in local administrator account. This built-in account is not protected by User Account Control (UAC) and using this account for administration can put your computer at risk. To safeguard computers in environments where you use a local administrator account for administration, you should create a new local administrator account and use this account for administration.

UAC can be enabled or disabled for any individual user account. If you disable UAC for a user account, you lose the additional security protections UAC offers and put the computer at risk. To enable or disable UAC for a particular user account, follow these steps:

1. | In Control Panel, click User Accounts. On the User Accounts page, click the Turn User Account Control On Or Off link.
2. | You can now enable or disable UAC for the currently logged on user account. Disable UAC by clearing the Use User Account Control (UAC) To Help Protect Your Computer check box. Enable UAC by selecting the Use User Account Control (UAC) To Help Protect Your Computer check box.
3. | Click OK. The computer must be restarted for the change to take effect. When prompted to restart the computer, click Restart Now or Restart Later as appropriate.

Creating Passwords for Local User Accounts

In a workgroup configuration, local user accounts are created without passwords by default. This means that, by default, users can log on simply by clicking their account name on the Welcome screen, or clicking OK on the Classic Log On To Windows screen. To improve security, all local accounts should have passwords.

For the easiest management of local accounts, you should log on to each account that should have a password and then use the User Accounts utility to assign a password to the account. If you are logged on as the user when you create a password, you don't have to worry about losing encrypted data. If you create a password without logging on as the user, the user will lose access to his or her encrypted files, encrypted e-mail, and stored passwords. This occurs because the user's master key, which is needed to access his or her personal encryption certificate and unlock this data, is encrypted with a hash that is based on an empty password. So when you create a password, the hash doesn't match, and there's no way to unlock the encrypted data. The only way to resolve this is to restore the original settings by removing the password from the account. The user should then be able to access his or her encrypted files. Again, this issue is only related to local user accounts for computers and not to domain user accounts.

Tip

Only the User Accounts utility allows you to assign a password hint, which can be helpful in recovering a forgotten or lost password. Another technique for recovering a password is a password reset disk. Before assigning passwords, it is important to note that these are the only techniques you should use to recover passwords for local user accounts unless you want to risk data loss. Why? Although you can create, reset, or remove a password from a user account, doing so deletes any personal certificates and stored passwords associated with this account. As a result, the user will no longer be able to access his or her encrypted files or private e-mail messages that have been encrypted with his or her personal key. In addition, he or she will lose stored passwords for Web sites and network resources. It is also important to note that this is only an issue for local user accounts. Administrators can change or reset passwords for domain user accounts without affecting access to encrypted data.

You can create a password for a local user account by completing the following steps:

1.
Log on as the user whose password you want to create. In Control Panel, click Add Or Remove User Accounts under the User Accounts heading. This displays the Manage Accounts page.

2.
All user accounts available on the machine are shown, and you'll need to click the account you want to work with. To prevent possible data loss, this should be the same as the account under which you are currently logged on. Any account that has a current password is listed as Password Protected. Any account without this label doesn't have a password.

3.
Click Create A Password. Type a password and then confirm it, as illustrated in Figure 6-3. Afterward, type a unique password hint. The password hint is a word or phrase that can be used to obtain the password if it is lost. This hint is visible to anyone who uses the computer.

Figure 6-3. Create a password with a password hint.

[View full size image]

4.
Click Change Password.

Recovering Local User Account Passwords

As discussed previously, in order to preserve access to any encrypted data and stored passwords that a user might have, it is preferable to try recovering a user password than to change or remove the password.

Windows Vista provides two ways to recover user passwords:

  • Password hint Hints can be accessed on the Welcome screen. Ordinarily, the Welcome screen is displayed when the computer is started and no one is logged on. If someone is logged on to the workstation, ask him or her to log off. Click the user's name to display the Password prompt and then click the blue arrow mark button to display the password hint. Hopefully, the password hint will help the user remember the password. If it doesn't, you'll need to use the password reset disk.

  • Password reset disk Password reset disks can be created for any local user account with a password. They enable anyone to change the password of the related local account without needing to know the old password. Because anyone with access to these disks can change account passwords, you should store password reset disks in a secure location. If users are allowed to create their own password reset disks, be sure they know how important the disks are.

Note

Passwords for domain users and those for local users are managed differently. Administrators manage passwords for domain user accounts and can reset forgotten passwords using the Active Directory Users And Computers console.

In domains and workgroups, passwords for local computer accounts can be reset using a password reset disk. You can create a password reset disk for the current user by completing these steps:

1. | Press Ctrl+Alt+Del and then click the Change A Password option.
2. | Click Create A Password Reset Disk to start the Forgotten Password Wizard.
3. | In the Forgotten Password Wizard, read the introductory message and then click Next.
4. | Insert a blank, formatted disk into drive A and then click Next.
5. | Type the password for the current account in the text box provided and then click Next.
6. | After the wizard creates the password reset disk, remove the disk and then click Finish.

Be sure to store the password reset disk in a secure location because any user with access to the disk can use it to create a new password for the account. If a user is unable to log in because he or she has forgotten the password, you can use the password reset disk that you created to reset the password and log in to the account using this new password.

You can reset a password by following these steps:

1. | On the Log On screen, click the arrow button without entering a password and then click OK. The Reset Password option should be displayed. If the user has already entered the wrong password, the Reset Password option might already be displayed.
2. | Click Reset Password. This starts the Reset Password Wizard.
3. | In the Reset Password Wizard, read the introductory message and then click Next.
4. | Insert the password disk into drive A and then click Next.
5. | Follow the prompts to complete the password reset process.

Controlling Logon: Welcome Screens and Classic Logons

By default, Windows Vista displays a Welcome screen when computers are part of a workgroup and a Logon screen when computers are part of a domain. The difference between the Welcome screen and the Logon screen is an important one.

In a workgroup, the Welcome screen is displayed when no one is logged on or when the screen saver is activated and you attempt to log back in. With the Welcome screen, you will see a list of accounts on the computer. To log on with one of those accounts, you click the account and type a password if required. Contrary to what many people think, the Welcome screen doesn't display all the accounts that have been created on the computer. Some accounts, such as Administrator, are hidden from view automatically.

The Welcome screen is convenient because it displays a list of available accounts and enables you to log on by clicking on an account name. To enhance security in a workgroup by not giving a list of accounts, you can use the Logon screen instead of the Welcome screen. In a domain, the Logon screen is displayed automatically when no one is logged on or when the screen saver is activated and you attempt to log back in. The Logon screen requires users to type a logon name rather than selecting from a list of available accounts.

The Logon screen has several features that you can control. By default, the name of the last user to log on is displayed in the User Name field of the Log On To Windows dialog box. Hiding the user name of the last user to log on can improve security by requiring users to know a valid account name for the computer. To do this, start the Local Security Policy tool in the Administrative Tools menu or type secpol.msc at an elevated command prompt. Then under Local Policies\Security Options, double-click Interactive Logon: Do Not Display Last User Name. Click Enabled and then click OK.

You can configure whether the Welcome screen is used by way of the Always Use Group Policy setting in Group Policy. You have the following options:

  • Enable the policy to use the Logon screen rather than the Welcome screen.

  • Disable the policy to use the Welcome screen.

  • Use Not Configured to use the default configuration (the Welcome screen).

In a domain environment, you can use Active Directorybased Group Policy to apply the desired security configuration to a particular set of computers. You can also configure this setting on a per computer basis using local security policy. To configure a workgroup computer to use the Logon screen rather than the Welcome screen, you'll use the Group Policy Object Editor, which is a snap-in for the MMC. You can add this snap-in to an empty console and configure a computer to use the Logon screen by following these steps:

1.
Click Start, type mmc and then press Enter. This opens an empty MMC console.

2.
Select Add/Remove Snap-In on the File menu.

3.
In the Add Or Remove Snap-In dialog box, select Group Policy Object under Available Snap-Ins. Then click Add.

4.
By default, the Group Policy Object Editor works with the local computer's Group Policy Object, so all you need to do is click Finish to accept this as the default.

5.
Click OK.

6.
In the Group Policy Object snap-in, expand Local Computer Policy, Computer Configuration, Administrative Templates, System, Logon. (See Figure 6-4.)

Figure 6-4. Enable the Always Use Classic Logon setting to use the Logon screen rather than the Welcome screen.

[View full size image]

7.
Double-click Always Use Classic Logon.

8.
Select Enabled and then click OK.

By default, you cannot bypass the requirement to press Ctrl+Alt+Del to access the Log On To Windows dialog box. You can eliminate this requirement, but it is a poor security practice. In the Local Security Policy tool, expand Local Policies\Security Options and then double-click Interactive Logon: Do Not Require Ctrl+Alt+Del. Click Enabled and then click OK.

Removing Accounts and Denying Local Access to Workstations

Domain administrators are automatically granted access to local resources on workstations. Other users aren't granted access to resources on local workstations other than to the computers to which they are permitted to log on. As workstations are moved around the enterprise, you might find that previous owners of a workstation still have access to its resources or that users who were granted temporary access to a workstation were never removed from the access list.

In a domain, you can control the workstations to which users can log on using the account properties in Active Directory Users And Computers. Double-click the account to display the Properties dialog box. On the Account tab, click the Log On To button.

In a workgroup, you can remove a user's local account and effectively deny logon by completing these steps:

1. | Log on as a user with local administrator privileges. In Control Panel, click Add Or Remove User Accounts under the User Accounts heading. This displays the Manage Accounts page.
2. | Click the account you want to remove.
3. | Click Delete The Account.
4. | Before deleting the account, you have the opportunity save the contents of the user's desktop and Documents folder to a folder on the current user's desktop. To save the user's documents, click Keep Files. To delete the files, click Delete Files.
5. | Confirm the account deletion by clicking Delete Account. Keep in mind that in a domain, unless there are further restrictions with regard to logon workstations, a user might still be able to gain access to the workstation by logging on with a domain account.


Managing Stored Passwords

Windows Vista can store essential network and Web site passwords for the current user. These passwords are stored in an electronic key ring that provides easy logon to essential resources, wherever they might be located. If you find that a user frequently has problems logging on to password-protected resources, such as the company intranet or an external Internet site, you can create a key ring for that user. To do this, you create a logon session for each resource. This logon session includes the resource location, logon account name, and password.

The following sections examine techniques for adding, editing, and removing key ring entries.

Adding Key Ring Entries

Each user account has a unique key ring. Entries in the key ring are stored in the user's profile settings and contain information needed to log on to password-protected resources. If you are logged on to a domain account when you create a key ring entry, and the account has a roaming profile (instead of a local or mandatory profile), the information stored in the key ring entry is available when you log on to any computer in the domain. Otherwise, the information in the key ring entry is only available on the specific computer on which you create the entry.

To add an entry to the current logged-on user's key ring, follow these steps:

1.
Log on as the user whose key ring entries you want to manage. In Control Panel, click User Accounts and then click User Accounts again. This displays the User Accounts page.

2.
In the left pane, click Manage Your Network Passwords.

3.
The Stored User Names And Passwords dialog box appears, and you'll see a list of current entries if there are any.

4.
Click Add and then use the Stored Credential Properties dialog box to configure the resource location, logon account name, and password (as shown in Figure 6-5). The available fields are as follows:

  • Log On To The network or Internet resource for which you are configuring the key ring entry. This can be an actual server name, such as technology.microsoft.com, or it can be an address containing a wildcard, such as *.microsoft.com. When you use a fully qualified domain name, the entry is used for accessing a specific server or service. When you use a wildcard, the entry is used for any server in the domain. For example, the entry *.microsoft.com could be used to access www.microsoft.com, ftp.microsoft.com, smtp.microsoft.com, and extranet.microsoft.com.

  • User Name The user name required by the server, including any necessary domain qualifiers. For a Windows domain, type the full domain account name such as Technology\WILLIAMS. For an Internet service, type the full service account name, such as WILLIAMS@msn.com.

  • Password The password required by the server. One of the things most users forget is that whenever they change their password on the server or service, they must also change their password on their key ring. If a user forgets to change the password on the key ring, repeated attempts to log on or connect to the server or service might result in the account being locked.

  • Credential Type Choose the appropriate credential type for the resource to which you are logging on. For a Windows domain resource, choose A Windows Logon Credential. For a Web site or Web application, choose A Web Site Or Program Credential.

Figure 6-5. Create the key ring entry by setting the necessary logon information.

5.
Click OK.

Note

Remind users that Windows Vista makes it easy to maintain service and key ring passwords. To update the key ring and the service password at the same time, use the Change feature of the Logon Information Properties dialog box. See the "Editing Key Ring Entries" section of this chapter for details.

Editing Key Ring Entries

You can edit key ring entries at any time, but keep in mind that local key ring entries are visible only on the computer on which they were created. This means that if you want to modify an entry, you must log on to the local workstation where it was created. The only exception is for users with roaming profiles. When a user has a roaming profile, key ring entries can be edited from any computer where the user is logged on.

Use the following steps to edit a user's key ring entries:

1. | Log on as the user whose key ring entries you want to manage. In Control Panel, click User Accounts and then click User Accounts again. This displays the User Accounts page.
2. | In the left pane, click Manage Your Network Passwords.
3. | In the Stored User Names And Passwords dialog box, you'll see a list of current entries. Select the entry you want to modify and then click Edit.
4. | Change the logon account name and password as necessary.
5. | Click OK.

Tip

If you want to change your password for a service and update the logon information to use the new password, click Change. Type your current password in the Old Password field. Then specify and confirm your new password using the fields provided. Complete the process by clicking OK. If there are multiple entries for this same account in the current domain, the other entries are automatically updated as well. This means you don't have to change the password associated with these entries.

Removing Key Ring Entries

When a user no longer needs a key ring entry, you should remove it. To remove a user's key ring entry, follow these steps:

1. | Log on as the user whose key ring entries you want to manage. In Control Panel, click User Accounts and then click User Accounts again. This displays the User Accounts page.
2. | In the left pane, click Manage Your Network Passwords.
3. | In the Stored User Names And Passwords dialog box, you'll see a list of current entries. Select the entry you want to delete and then click Remove. When prompted to confirm the action, click OK.

As stated previously, local key ring entries can be removed only on the computer on which they were created. When a user has a roaming profile, though, key ring entries can be deleted from any computer where the user is logged on.


Managing Local User Accounts and Groups

Local user accounts and groups are managed much like domain accounts. You can create accounts, manage their properties, reset accounts when they are locked or disabled, and so on. These and other tasks are examined in this section.

Creating Local User Accounts Using Local Users and Groups

In addition to being able to create local user accounts with Control Panel, you can create local user accounts with Local Users And Groups. You can access this utility and create an account by completing the following steps:

1.
Click Start, All Programs, Administrative Tools, Computer Management. Alternatively, access Control Panel, click System And Maintenance, click Administrative Tools, and finally double-click Computer Management.

2.
Right-click the Computer Management entry in the console tree and select Connect To Another Computer on the shortcut menu. You can now select the Windows Vista workstation whose local accounts you want to manage; domain controllers do not have local users or groups.

3.
Expand the System Tools node by clicking the plus sign (+) next to it. Then select Local Users And Groups.

4.
Right-click Users and then select New User. This opens the New User dialog box, shown in Figure 6-6. The fields in the dialog box are used as follows:

  • User Name The logon name for the user account. This name should follow the conventions for the local user name policy.

  • Full Name The full name of the user, such as William R. Stanek.

  • Description A description of the user. Normally you'd type the user's job title, such as Webmaster. You could also type the user's job title and department.

  • Password The password for the account. This password should follow the conventions of your password policy.

  • Confirm Password A field to ensure that you assign the account password correctly. Simply retype the password to confirm it.

  • User Must Change Password At Next Logon If this check box is selected, the user must change the password upon logon.

  • User Cannot Change Password If this check box is selected, the user can't change the password.

  • Password Never Expires If this check box is selected, the password for this account never expires. This setting overrides the local account policy.

  • Account Is Disabled If this check box is selected, the account is disabled and can't be used. Use this field to temporarily prevent anyone from using an account.

Figure 6-6. Configure new workstation accounts using the New User dialog box in Local Users And Groups.

5.
Click Create when you're finished configuring the new account.

Creating Local Groups for Workstations

You create local groups with Local Users And Groups. You can access this utility and create a group by completing the following steps:

1.
Click Start, All Programs, Administrative Tools, Computer Management. Alternatively, access Control Panel, click System And Maintenance, click Administrative Tools, and finally double-click Computer Management.

2.
Right-click the Computer Management entry in the console tree and select Connect To Another Computer. You can now select the computer whose local accounts you want to manage. Domain controllers don't have local users and groups.

3.
Expand the System Tools node by clicking the plus sign (+) next to it. Then select Local Users And Groups.

4.
Right-click Groups and then select New Group. This opens the New Group dialog box, shown in Figure 6-7.

Figure 6-7. The New Group dialog box enables you to add a new local group to a Windows Vista workstation.

5.
After you type a name and description for the group, use the Add button to add names to the group. This opens the Select Users dialog box.

6.
In the Select Users dialog box, click Locations to select the computer or domain in which the users you want to work with are located.

7.
Type the name of a user you want to use in the Enter The Object Names To Select field and then click Check Names. If matches are found, select the account you want to use and then click OK. If no matches are found, update the name you entered and try searching again. Repeat this step as necessary and click OK when finished.

8.
The New Group dialog box is updated to reflect your selections. If you made a mistake, select a name and remove it by clicking Remove.

9.
Click Create when you're finished adding or removing group members.

Adding and Removing Local Group Members

You use Local Users And Groups to add or remove local group members. Complete the following steps:

1. | Access Local Users And Groups in Computer Management and then select the Groups folder. Double-click the group with which you want to work.
2. | Use the Add button to add user accounts to the group. This opens the Select Users dialog box. In the Select Users dialog box, type the name of a user you want to use in the Enter The Object Names To Select field and then click Check Names. If matches are found, select the account you want to use and then click OK. If no matches are found, update the name you entered and try searching again. Repeat this step as necessary and click OK when finished.
3. | Use the Remove button to remove user accounts from the group. Simply select the user account you want to remove from the group and then click Remove.
4. | Click OK when you are finished.

Enabling Local User Accounts

Local user accounts can become disabled for several reasons. If a user forgets the password and tries to guess it, he or she might exceed the account policy for bad logon attempts. Another administrator could have disabled the account while a user was on vacation. When an account is disabled or locked out, you can enable it using the methods described here.

When an account is disabled, complete the following steps:

1. | Access Local Users And Groups in Computer Management and then select the Users folder.
2. | Double-click the user's account name and then clear the Account Is Disabled check box.
3. | Click OK.

When an account is locked out, complete the following steps:

1. | In Local Users And Groups, select the Users folder.
2. | Double-click the user's account name and then clear the Account Is Locked Out check box.
3. | Click OK.

Creating a Secure Guest Account

In some environments, you might need to set up a guest account that can be used by visitors. Most of the time, you'll want to configure the guest account for use on a specific computer or computers and carefully control how the account can be used. To create a secure guest account, I recommend that you perform the following tasks:

  • Enable the guest account for use. By default, the guest account is disabled. Therefore, you must first enable it to make it available. To do this, access Local Users And Groups in Computer Management and then select the Users folder. Double-click Guest and then clear the Account Is Disabled check box. Click OK.

  • Set a secure password on the guest account. By default, the guest account has a blank password. To improve security on the computer, you should set one. In Local Users And Groups, right-click Guest and then select Set Password. Click Proceed at the warning prompt. Type and then confirm the new password. Click OK.

  • Ensure that the guest account cannot be used over the network. The guest account shouldn't be accessible from other computers. If it is, users at another computer could log on over the network as a guest. To prevent this, start the Local Security Policy tool in the Administrative Tools menu, or type secpol.msc at the command prompt. Then under Local Policies\User Rights Assignment, ensure the Deny Access To This Computer From The Network policy lists Guest as a restricted account.

  • Prevent the guest account from shutting down the computer. When a computer is shutting down or starting up, there is a possibility that a guest user (or anyone with local access) might be able to gain unauthorized access to the computer. To help deter this, you should ensure the guest account doesn't have the Shut Down The System user right. In the Local Security Policy tool, expand Local Policies\User Rights Assignment and ensure the Shut Down The System policy doesn't list the Guest account.

  • Prevent the guest account from viewing event logs. To help maintain the security of the system, the guest account shouldn't be allowed to view the event logs. To ensure this is the case, start Registry Editor by typing regedit at an elevated command prompt and then access the HKLM\SYSTEM\CurrentControlSet\Services\Eventlog key. Here you'll find three subkeys: Application, Security, and System. Make sure each of these subkeys has a DWORD value named RestrictGuestAccess with a value of 1.

Renaming Local User Accounts and Groups

When you rename an account, you give it a new label. Because the SID for the account remains the same, the permissions and properties associated with the account don't change. To rename an account, complete the following steps:

1. | In Local Users And Groups, select the Users or Groups folder as appropriate.
2. | Right-click the account name and then select Rename. Type the new account name and then click a different entry.

Deleting Local User Accounts and Groups

Deleting an account permanently removes it. Once you delete an account, you can't create another account with the same name to automatically get the same permissions because the SID for the new account won't match the SID for the old account.

Because deleting built-in accounts can have far-reaching effects on the workstation, Windows Vista doesn't let you delete built-in user accounts or group accounts. You can remove other types of accounts by selecting them and pressing the Del key or by right-clicking and selecting Delete. When prompted, click Yes.

Note

When you delete a user account using Local Users And Groups, Windows Vista doesn't delete the user's profile, personal files, or home directory. If you want to delete these files and directories, you'll have to do it manually. See the "Removing Accounts and Denying Local Access to Workstations" section in this chapter.


Managing Remote Access to Workstations

Windows Vista has several remote connectivity features. With Remote Assistance, invitations can be sent to support technicians, enabling them to service a computer remotely. With Remote Desktop, users can connect remotely to a computer and access its resources. In this section, you learn how to configure Remote Assistance and Remote Desktop. By default, neither the Remote Assistance feature nor the Remote Desktop feature is enabled. You must enable these features manually.

In Windows Vista, Remote Assistance and Remote Desktop have been enhanced so that they are faster, use less bandwidth, and can function through Network Address Translation (NAT) firewalls. Remote Assistance also has built-in diagnostic tools. To allow for easier troubleshooting and escalation of support issues, two different support staff can connect to a remote computer simultaneously. When troubleshooting requires restarting the computer, Remote Assistance sessions are reestablished automatically after the computer being diagnosed reboots.

Configuring Remote Assistance

Remote Assistance is a useful feature for help desks, whether in-house or outsourced. A user can allow support personnel to both view and take control of his or her desktop. This feature can be used to walk users through a complex process or to manage system settings while they watch the progress of the changes. The key to Remote Assistance is in the access levels you grant.

By default, when enabled, Remote Assistance is configured to enable support personnel to view and control computers. Because users can send assistance invitations to internal and external resources, this could present a security concern for organizations. To reduce potential security problems, you might want to allow support staff to view but not control computers. A new restriction for Windows Vista is to allow only connections from computers running Windows Vista or later. This option is helpful to limit any possible compatibility issues and ensure any security enhancements in Windows Vista or later operating systems are available within Remote Assistance sessions.

Another key aspect of Remote Assistance you can control is the time limit for invitations. The default maximum time limit is 8 hours; the absolute maximum time limit you can assign is 30 days. Although the intent of a multiple-day invitation is to give support personnel a time window in which to respond to requests, it also means that they could use an invitation to access a computer over a period of 30 days. For instance, suppose you send an invitation with a 30-day time limit to a support person who resolves the problem the first day. That person would then still have access to the computer for another 29 days, which wouldn't be desirable for security reasons. To reduce the risk to your systems, you'll usually want to reduce the default maximum time limit considerablysay, to 1 hour. If the problem were not solved in the allotted time period, you could issue another invitation.

To configure Remote Assistance, follow these steps:

1.
In Control Panel, click System And Maintenance and then click System.

2.
On the System page, click Remote Settings in the left pane. This opens the System Properties dialog box to the Remote tab, as shown in Figure 6-8.

Figure 6-8. Use the Remote tab options to configure remote access to the computer.

3.
To disable Remote Assistance, clear the Remote Assistance Invitations Can Be Sent From This Computer check box, and then click OK. Skip the remaining steps.

4.
To enable Remote Assistance, select Remote Assistance Invitations Can Be Sent From This Computer. If you want users to be able to receive Remote Assistance offers from instant messaging contacts, select the Users On This Computer Can Be Offered Remote Assistance check box.

5.
Click Advanced. This displays the Remote Assistance Settings dialog box, shown in Figure 6-9.

Figure 6-9. The Remote Assistance Settings dialog box is used to set limits for Remote Assistance.

6.
The Allow This Computer To Be Controlled Remotely option sets limits for Remote Assistance. When selected, this setting allows assistants to view and control the computer. To provide view-only access to the computer, clear this check box.

7.
The Invitations options control the maximum time window for invitations. You can set a value in minutes, hours, or days, up to a maximum of 30 days. If you set a maximum limit value of 10 days, for example, a user can create an invitation with a time limit up to but not more than 10 days. The default maximum expiration limit is 6 hours.

8.
Click OK twice when you are finished configuring Remote Assistance options.

Configuring Remote Desktop Access

Unlike Remote Assistance, which provides a view of the current user's desktop, Remote Desktop provides several levels of access:

  • If a user is currently logged on to the desktop locally and then tries to log on remotely, the local desktop locks automatically and the user can access all of the currently running applications just as if he or she were sitting at the keyboard. This feature is useful for users who want to work from home or other locations outside the office, enabling them to continue to work on applications and documents that they might have been using prior to leaving the office.

  • If a user is listed on the workstation's Remote Access list and is not otherwise logged on, he or she can initiate a new Windows session. The Windows session behaves just as if the user were sitting at the keyboard. It can even be used when other users are also logged on to the computer. In this way, multiple users can share a single workstation and use its resources.

Remote Desktop is not enabled by default. You must specifically enable it, thereby allowing remote access to the workstation. When it is enabled, any members of the administrators group can connect to the workstation. Other users must be specifically placed on a remote access list to gain access to the workstation. To configure remote access, follow these steps:

1.
In Control Panel, click System And Maintenance and then click System.

2.
On the System page, click Remote Settings in the left pane. This opens the System Properties dialog box to the Remote tab.

3.
To disable Remote Desktop, select Don't Allow Connections To This Computer and then click OK. Skip the remaining steps.

4.
To enable Remote Desktop, you have two options. You can:

  • Select Allow Connections From Computers Running Any Version Of Remote Desktop to allow connections from any version of Windows.

  • Select Allow Connections Only From Computers Running Remote Desktop With Network Level Authentication to allow connections only from Windows Vista or later computers (and computers with secure network authentication).

5.
Click Select Users. This displays the Remote Desktop Users dialog box, shown in Figure 6-10.

Figure 6-10. Specify the additional users allowed to make Remote Desktop connections.

6.
To grant Remote Desktop access to a user, click Add. This opens the Select Users dialog box. In the Select Users dialog box, click Locations to select the computer or domain in which the users you want to work with are located. Type the name of a user you want to work with in the Enter The Object Names To Select field and then click Check Names. If matches are found, select the account you want to use and then click OK. If no matches are found, update the name you entered and try searching again. Repeat this step as necessary and click OK when finished.

7.
To revoke remote access permissions for a user account, select the account and then click Remove.

8.
Click OK twice when you are finished.

Making Remote Desktop Connections

As an administrator, you can make Remote Desktop connections to Windows servers and workstations. With Microsoft Windows 2000 Server, Remote Desktop connections are enabled by installing Terminal Services and then configuring Terminal Services in remote access mode. With Microsoft Windows XP Professional and later, Remote Desktop is installed automatically but not enabled until you specifically do so as discussed in the preceding section of this chapter. Once remote access is enabled on a computer, all administrators have remote access to that computer. Other users can be granted remote access as well.

To make a Remote Desktop connection to a server or workstation, follow these steps:

1.
At a command prompt, type mstsc or click Start, point to All Programs, Accessories, Remote Desktop Connection. This displays the Remote Desktop Connection dialog box, shown in Figure 6-11.

Figure 6-11. In the Remote Desktop Connection dialog box, type the name of the computer to which you want to connect and then click Connect.

2.
In the Computer field, type the name of the computer to which you want to connect. If you don't know the name of the computer, use the drop-down list provided to choose an available computer, or select Browse For More on the drop-down list to display a list of domains and computers in those domains.

3.
Click Connect. Type your credentials when prompted and then click OK. If the connection is successful, you'll see the Remote Desktop window on the selected computer and you'll be able to work with resources on the computer. In the case of a failed connection, check the information you provided and then try to connect again.

Note

Clicking Options in the Remote Desktop Connection dialog box displays additional options for creating and saving connections. These advanced options enable you to change display size for the Remote Desktop; manage connections to local resources, such as printers, serial ports, and disk drives; run programs automatically on connection; and enable or disable local caching and data compression.


Chapter 7. Managing Laptops and Traveling Users

In this chapter:
Working with Windows Mobility Center | 217
Configuring Power Management Settings | 219
Configuring Networking for Laptops | 230

In this chapter, I'll focus on management and support issues for laptop computers and traveling users. Laptop computers have a different set of core features and require different support techniques than desktop computers do. Additional features on laptops include power management extensions and mobility options accessible through Microsoft Windows Mobility Center, Windows Vista's new central console for accessing key mobility features. In addition to performing normal management tasks, administrators must perform support tasks for laptops, such as modifying a laptop's network configuration so it can be used in the office and at home or connecting a laptop to a networked projector.

Laptop administration might also extend to maintaining offline files, configuring additional network connections, wireless networking, and remote access. You'll find a discussion of offline files in Chapter 11, "Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas." You'll find coverage of Transmission Control Protocol/Internet Protocol (TCP/IP) networking in Chapter 12, "Configuring and Troubleshooting TCP/IP Networking." Wireless networking and remote access is covered in Chapter 13, "Managing Mobile Networking and Remote Access."


Working with Windows Mobility Center

Windows Mobility Center provides a single location for managing mobile PC settings. As shown in Figure 7-1, Windows Mobility Center includes a series of control tiles that provide quick access to the most commonly used mobile PC settings. On a laptop or Tablet PC, you can access Windows Mobility Center by right-clicking the Power icon in the taskbar's notification area and then selecting Mobility Center or by clicking Start, Control Panel, Mobile PC, Mobility Center.

Figure 7-1. Windows Mobility Center provides quick access to the most commonly used mobile PC settings.

[View full size image]

Windows Mobility Center's control tiles enable you to directly adjust your mobile PC settings by using available options such as sliders to adjust the brightness, a selection list to change the power plan, and a toggle button to turn presentation settings on or off. Although the exact set of control tiles available depends on the type of mobile PC and the manufacturer, following are the most common control tiles:

  • Battery Status Shows the status of the computer's battery. You can use the selection list provided to quickly change from one power plan to another. If you've created custom power plans, these are available as well.

  • Brightness Enables you to manage the brightness setting of the display. If brightness is configurable on the computer, use the slider provided to adjust the brightness.

  • External Display Enables you to connect to a secondary display, such as might be necessary to give a presentation. Click Connect Display to access a secondary display connected through a cable.

  • Presentation Settings Enables you to turn presentation mode on or off. In presentation mode, the mobile PC's display and hard disk do not go into sleep mode due to inactivity. Click Turn On to enter presentation mode.

  • Sync Center Enables you to view the status of file syncing and initiate syncing. Click Sync to start a new sync using Sync Center.

  • Tablet Display Enables you to view and change the current display orientation. Click Change Orientation to change from landscape to portrait display or vice versa.

  • Volume Enables you to manage the current volume setting. If volume is configurable on your computer, use the slider provided to adjust the volume.

  • Wireless Network Enables you to view and manage the status of your wireless network connection. Click Turn Wireless On to enable your wireless connection.


Configuring Power Management Settings

Power management settings control the behavior of a computer in different power use situations, such as when it is plugged in or running on a battery. Although all computers should be configured with power management settings to save energy, power management settings on laptops help to balance performance against energy usage. In some cases, you'll want to reduce laptop responsiveness and overall performance to increase the battery life, enabling the laptop user to run the laptop on battery for longer periods of time. In other cases, you might want to ensure moderate performance and a moderate battery life or you might want to ensure maximum performance regardless of how this impacts battery life.

In Windows Vista, the core aspects of power management are streamlined significantly and are managed using power plans. Like power schemes in earlier versions of Windows, power plans are collections of power management settings that control power usage and consumption. A laptop can have multiple power plans, but only one can be active at any given time. In addition to power plans, most laptops have preset behaviors for when the laptop is closed, for when the power button is pressed, and for when the sleep button is pressed. Typically, closing a laptop's lid puts it into sleep mode, pressing and holding the power button shuts down a laptop, and pressing the sleep button puts it into sleep mode. Through system-wide settings for power options, you can customize the power button and password protection on wake behavior to meet the needs of individual users or groups of users.

Working with Power Plans

On laptops and Tablet PCs, the notification area of the taskbar includes a Power icon. Moving the mouse pointer over this icon shows the battery state and the power plan you are using. You can right-click the Power icon to display a shortcut menu with options for quickly accessing the Power Options utility and Windows Mobility Center. Windows Vista has three default preferred power plans:

  • Balanced A power usage plan that balances energy consumption and system performance. The processor speeds up when more resources are used and slows down when less are needed. This is the default power plan. Use this plan for users who work with a wide variety of applications, including those that are moderately graphics intensive, such as Microsoft PowerPoint, and those that are not graphics intensive, such as Microsoft Word and Microsoft Outlook.

  • High Performance A high-power usage plan that optimizes the computer for performance at a direct cost to battery life. This plan ensures that you always have enough power for using graphics-intensive programs or playing multimedia games. Use this plan when performance is essential and users work primarily with graphics-intensive applications or applications that perform complex arithmetic calculations.

  • Power Saver A low-power usage plan designed to reduce power consumption. This plan slows down the processor to maximize the battery life. Use this plan for users who work primarily with nongraphics intensive applications, such as Microsoft Word and Microsoft Outlook.

Power plan settings are divided into two general categories: basic and advanced.

Basic power settings control when a computer turns off its display and when it turns off. By default, with the Balanced plan and the Power Saver plan, Windows Vista turns off the display after 20 minutes of inactivity and puts the computer in sleep mode after an hour of inactivity. With the High Performance plan, Windows Vista turns off the display after 20 minutes of inactivity but never automatically puts the computer in sleep mode.

Advanced power settings determine precisely whether and when power manageable components on a computer are shut down and how those components are configured for performance. Following are the advanced power settings you can configure:

  • Additional Settings\Require A Password On Wakeup Determines whether a password is required when a computer wakes from sleep. You can set this option to Do Not Lock Console When System Wakes or Require A Password On Wakeup.

  • Hard Disk\Turn Off Hard Disk After Determines whether and when a computer's hard disk is turned off to conserve power. Use a setting of Never to disable turning off the hard disk. Use a specific value in minutes to determine how long the computer must be inactive before the hard disk is turned off.

    Windows Vista provides a combo box for setting numeric values. Clicking and holding the up or down arrow enables you to rapidly scroll through values. If you scroll down from 1, the next value is Never. You can also type values directly. If you enter a value of 0, this is interpreted as Never.

  • Wireless Adapter Settings\Power Saving Mode Specifies the power saving mode to use with any wireless adapters connected to the computer. You can set this option to Maximum Performance, Low Power Saving, Medium Power Saving, or Maximum Power Saving.

  • Sleep\Sleep After Determines whether and when a computer enters a sleep state to conserve power. Use a setting of Never to disable this feature. Use a specific value in minutes to determine how long the computer must be inactive before the computer enters a sleep state.

  • Sleep\Allow Hybrid Sleep Specifies whether the computer uses Windows Vista's sleep mode rather than the sleep mode used in earlier versions of Windows. You can set this value to On or Off. Windows Vista's hybrid sleep mode puts the computer in a low power consumption state until the user resumes using the computer. When running on battery, laptops and Tablet PCs continue to use battery power in the sleep state, but at a very low rate. If the battery runs low on power while the computer is in the sleep state, the current working environment is saved to the hard disk and then the computer is shut down completely. This final state is similar to the hibernate state used with Windows XP.

  • Sleep\Hibernate After Determines whether and when a computer hibernates to conserve power. When a computer goes into hibernation, a snapshot of the user workspace and the current operating environment is taken by writing the current memory to disk. When a user turns the computer back on, reading the memory from disk restores the user workspace and operating environment. In Windows Vista, this setting isn't normally used because the standard configuration is to sleep after a period of inactivity. Use a setting of Never to disable this feature. Use a specific value in minutes to determine how long the computer must be inactive before the computer hibernates.

  • Sleep\Allow Programs To Prevent Sleep Determines whether programs can prevent a computer from entering sleep mode. If you set this option to Do Not Query Applications And Services, applications and services with active processes do not prevent the computer from entering sleep mode. If you set this option to Query Applications And Services, applications and services with active processes can prevent the computer from entering sleep mode.

  • Power Buttons And Lid\Power Button Action Specifies the action to take when someone pushes and holds the computer's power button. You can set this option to Sleep, Hibernate, or Shutdown.

  • Power Buttons And Lid\Start Menu Power Button Sets the default action for the Start menu's power button. Use this setting to override the computer's default action. You can set this option to Sleep, Hibernate, or Shutdown. You cannot, however, use an option that is not supported by the computer.

  • PCI Express\Link State Power Management Determines the power saving mode to use with Peripheral Component Interconnect (PCI) Express devices connected to the computer. You can set this option to Off, Moderate Power Savings, or Maximum Power Savings.

  • Processor Power Management\Minimum Processor State Sets a minimum performance state for the computer's processor. To save power and reduce energy consumption, lower the permitted minimum performance state. But you lower the performance state at a direct cost to responsiveness and computational speed. For example, a value of 5% would lengthen the time required to respond to requests and process data while offering substantial power savings. A value of 50% helps to balance responsiveness and processing performance while offering a moderate power savings. A value of 100% would maximize responsiveness and processing performance while offering no power savings.

  • Processor Power Management\Maximum Processor State Sets a maximum or peak performance state for the computer's processor. To save power and reduce energy consumption, lower the permitted maximum performance state. But you lower the performance state at a direct cost to responsiveness and computational speed. Although reducing the maximum processing power to 50 percent or below can cause a significant reduction in performance and responsiveness, it can also provide a significant power savings.

  • Display\Turn Off Display After Determines whether and when a computer's display is turned off to conserve power. Use a setting of Never to disable this feature. Use a specific value in minutes to determine how long the computer must be inactive before the display is turned off.

  • Display\Adaptive Display Specifies whether Windows Vista automatically adjusts when the display is turned off based on mouse and keyboard usage. You can set this option to On or Off.

  • Multimedia Settings\Media Sharing Action Determines whether media sharing can prevent a computer from entering sleep mode. If you set this option to Prevent My Computer From Sleeping After A Period Of Inactivity, the computer will not enter sleep mode when sharing media with other computers or devices. If you set this option to Take No Action, the computer can enter sleep mode after an appropriate period of inactivity regardless of whether media is being shared with other computers or devices.

As you can see, the advanced power settings control every facet of power management. The differences in the advanced settings are what really set the power plans apart from each other. For example, while the High Performance plan ensures performance by allowing the computer's processor to always run at 100 percent power consumption, the Power Saver plan reduces energy consumption by configuring the processor to use a minimum power consumption rate of 5 percent and a maximum rate of 50 percent. The Balanced plan, on the other hand, configures the processor to use a minimum power consumption rate of 0 percent and a maximum rate of 100 percent.

When configuring power plans, it is important to allow components to turn off after periods of inactivity. Turning off components separately enables a computer to progressively go into sleep mode. When a computer is fully in sleep mode, all power-manageable computers are switched off so that the laptop uses less power. When the computer is brought out of sleep mode, the components, such as the monitor and hard disks, are turned back on, restoring the user workspace. You should configure sleep mode so that when a laptop is running on batteries, it goes into power conservation mode when the user is away from the laptop for a relatively short period of time, such as 20 or 30 minutes.

Because a computer can have multiple power plans, each plan can be optimized for the way a laptop is used at a particular time. You can configure multiple power plans for different situations. At home or in the office, laptops might need different power management configurations than they do when users are giving presentations. In one case, you might want to configure the laptop to quickly conserve energy when running on batteries. In another case, you might want to ensure that the laptop never turns off its hard disk or wireless adapters.

Selecting and Optimizing Power Plans

Although computers can have multiple power plans, only one can be active at any given time. To select or optimize a power plan, follow these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click System And Maintenance and then click Power Options.

3.
As shown in Figure 7-2, you can specify the power plan to use by selecting it in the Preferred Plans list.

Figure 7-2. Choose a power plan.

[View full size image]

4.
Click Change Plan Settings for the plan you want to work with. This displays the Edit Plan Settings page, shown in Figure 7-3.

Figure 7-3. Configure power plan settings.

[View full size image]

5.
Use the Turn Off Display list to specify whether or when the computer's display automatically turns off. Choose Never to disable this feature.

6.
Use the Put Computer To Sleep list to specify whether or when the computer automatically enters sleep mode. Choose Never to disable this feature.

7.
If you want to configure advanced options, click Change Advanced Power Settings. Use the settings in the Power Options dialog box, shown in Figure 7-4, to configure the advanced settings. Click OK.

Figure 7-4. Use the Power Options dialog box to configure advanced power options.

8.
Click Save Changes to save any changes you've made.

Creating Power Plans

In addition to the preferred power plans included with Windows Vista, you can create power plans as needed. To create a power plan, follow these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click System And Maintenance and then click Power Options.

3.
In the left pane, click Create A Plan. This displays the Create A Power Plan page, shown in Figure 7-5.

Figure 7-5. Create a power plan.

[View full size image]

4.
To prepopulate the power plan settings, select the preferred power plan that is closest to the type of plan you want to create.

5.
In the Plan Name field, type a descriptive name for the plan and then click Next. This displays the Edit Plan Settings page.

6.
Use the Turn Off Display list to specify whether or when the computer's display automatically turns off. Choose Never to disable this feature.

7.
Use the Put Computer To Sleep list to specify whether or when the computer automatically enters sleep mode. Choose Never to disable this feature.

8.
Click Create to create the plan. The Power Options page is displayed with updates to include the plan you created as a new preferred plan that replaces the plan you selected while creating the plan. You'll find the original preferred plan under Additional Plans. Click the Expand button on the right to display the plan.

9.
The plan you created is selected by default. Click Change Plan Settings for this plan to display the Edit Plan Settings page and then click Change Advanced Power Settings to display the Power Options dialog box.

10.
After you configure the advanced power options as appropriate, click OK and then click Save Changes to save any changes you've made.

Configuring System-Wide Power Button and Password Protection on Wake Setting

System-wide settings for power options enable you to customize the way the power button and password protection on wake works. You can configure the power button so that when it is pressed, the system shuts down, hibernates, or enters sleep mode. You can configure the computer so that when it wakes from sleep, a password is either required or not required to unlock the screen.

To set system-wide power settings, follow these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, click System And Maintenance and then click Power Options.

3.
In the left pane, click Choose What The Power Button Does.

4.
Use the When I Press The Power Button list to specify whether the computer should shut down, sleep, or hibernate when the power button is pressed. (See Figure 7-6.) You cannot, however, use an option that is not supported by the computer.

Figure 7-6. Set the power button and password protection on wake behavior.

[View full size image]

5.
Use the Password Protection On Wakeup options to specify whether the computer requires a password on wakeup. It is a good idea to prompt for a password to help ensure the security of the system.

6.
Click Save Changes when you are finished making changes.

Managing Power Plans from the Command Line

Windows Vista includes the Power Configuration (Powercfg.exe) utility for managing power plans from the command line. You can view a list of options for this utility by typing powercfg /? at a command prompt. The parameters you'll work with most often include:

  • -a Lists the available sleep states on the computer

  • -d [guid] Deletes the power plan specified by the globally unique identifier (GUID)

  • -h Toggles the hibernate feature on or off

  • -l Lists the power plans configured on a computer by name and GUID

  • -q [guid] Lists the contents of the power plan specified by the GUID

  • -s [guid] Makes the power plan specified by the GUID the active power plan

  • -setabsentia [guid] Makes the power plan specified by the GUID the power plan to use when no one is logged on

Note

By default, Windows Vista computers use hybrid sleep instead of hibernate. Hibernate should not be configured without first determining compatibility.

The following is a sample listing returned by typing powercfg l at a command prompt:

Existing Power Schemes (* Active)
-----------------------------------
Power Scheme GUID: 381b4222-f694-41f0-9685-ff5bb260df2e (Balanced)
Power Scheme GUID: 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c (High performance)
Power Scheme GUID: a1841308-3541-4fab-bc81-f71556f20b4a (Power saver)
Power Scheme GUID: c1d97820-3148-42a9-a587-
75d618a9bb2b (Graphics Department Plan) *

The active plan is marked with an asterisk. From this listing, you can determine that a computer has four power plans and the active power plan is the Graphics Department Plan.

If you want to configure power plans or modify power settings using powercfg, you'll need to do this using an elevated command prompt. When a parameter requires a GUID, the easiest way to obtain this value is to type powercfg l at an elevated command prompt and then copy the value for the appropriate power plan. For example, if you wanted to make the Balanced plan the default for the computer in the previous example, you would type the following at an elevated command prompt:

powercfg s 381b4222-f694-41f0-9685-ff5bb260df2e

Managing Power Plans in Group Policy

In Group Policy, you'll find policy settings for managing power plans under Computer Configuration\Administrative Templates\System\Power Management. Under Notification Settings, you'll find policy settings that enable you to configure low battery and critical battery alarm actions. Configuring notification is covered in this chapter in the "Using Alarms and Configuring Alarm Actions" section. Under Button Settings, Hard Disk Settings, Processor Settings, Sleep Settings, and Video And Display Settings, you'll find separate policy settings for when the computer is plugged in and when the computer is running on battery power. To apply a policy setting, enable the policy and then select the appropriate action.

Through Group Policy, you can also specify an active power plan. How you work with Power Management policies depends on whether you want to use a default power plan, an updated preferred plan, or a custom power plan that you've created. If you want all computers that process a particular policy to use one of Windows Vista's default power plans, follow these steps:

1. | After you open the Group Policy object that you want to work with for editing, expand Computer Configuration\Administrative Templates\System\Power Management.
2. | Double-click Select An Active Power Plan.
3. | Select Enabled and then use the Active Power Plan list to select the plan to use. The options are High Performance, Power Saver, and Automatic. If you choose Automatic, Windows Vista uses the Balanced power plan in most cases.
4. | Click OK.

If you want all computers that process a particular policy to use an updated preferred plan or a custom power plan that you've created, follow these steps:

1. | After you open the Group Policy object that you want to work with for editing, expand Computer Configuration\Administrative Templates\System\Power Management.
2. | Double-click Select A Custom Active Power Plan.
3. | Select Enabled and then in the Custom Active Power Plan (GUID) text box, type the GUID of the power plan to use.
4. | Click OK.

Tip

To determine the GUID of a power plan, get a list of the power plans configured on a computer by typing powercfg l at an elevated command prompt.

Using Alarms and Configuring Alarm Actions

Alarms determine whether a laptop sounds an alarm or displays a warning message when its battery reaches a certain level. You can configure two levels of alarms for laptops: Low Battery Alarm and Critical Battery Alarm. The Low Battery Alarm is meant to alert the user when the battery power level is nearly depleted. The low-power state is activated by default when the battery has 10 percent or less power remaining. The Critical Battery Alarm is meant to alert the user when the battery is about to fail. The critical-power state is activated by default when the battery has 3 percent or less power remaining. On a battery with a three-hour life, 3 percentage points is about 5 minutes of usage.

An alarm action associated with each alarm enables you to dictate what specific actions the operating system should take when an alarm level is reached. You can also configure the computer to run a program when an alarm occurs. This is useful if you need to run a cleanup script or another program that helps maintain the system and the user's data. Because there are different considerations for configuring the alert levels, I'll examine each separately in the sections that follow.

Configuring Low Battery Notification and Actions

As stated previously, the low battery notification is a warning that the system is getting low on power. When entering the low-power state, the system notifies the user with either a text prompt alone or a text prompt and an audible alarm. In some cases, you might want to configure the computer to go a step further and enter standby mode in addition to or instead of giving a warning.

To configure the low battery notification and actions, follow these steps:

1. | After you open the Group Policy object that you want to work with for editing, expand Computer Configuration\Administrative Templates\System\Power Management\Notification Settings.
2. | To set the low battery notification action, double-click Low Battery Notification Action. Select Enabled and then use the Low Battery Notification Action list to select the desired action, such as Sleep. Click OK.
3. | To specify when the low battery alarm is triggered, double-click Low Battery Notification Level. Select Enabled and then use the Low Battery Notification Level combo box to set the appropriate alarm level. Click OK. Tip The default low battery alarm level is based on the total battery life and is 10 percent. On most systems, this is an appropriate value. However, I've found that on some systems, especially those with poor batteries, this isn't enough, and then I increase the level to between 12 and 15 percent. In contrast, on energy-efficient systems or those with two batteries, the default value is often too much. Here, I adjust the level so that the user is notified when about 20 minutes of battery power remains.
4. | By default, users are notified when a computer's battery runs low. If you want to disable user notification for a low battery condition, double-click Turn Off Low Battery User Notification, click Enabled, and then click OK.
Configuring Critical Battery Alarms

Critical battery alarms are designed to ensure that systems enter an appropriate mode prior to running out of power. When entering a critical-power state, the system notifies the user and then enters sleep mode. In sleep mode, the computer's power-manageable components shut off to conserve power. I often configure the low-power alarm so that the computer enters sleep mode. I then configure the critical-power alarm to have the computer enter hibernation mode or shut down. This takes power management to the next level and helps preserve the system before power is completely exhausted.

To configure the critical battery actions, follow these steps:

1. | After you open the Group Policy object that you want to work with for editing, expand Computer Configuration\Administrative Templates\System\Power Management\Notification Settings.
2. | To set the critical battery notification action, double-click Critical Battery Notification Action. Select Enabled and then use the Critical Battery Notification Action list to select the desired action, such as Hibernate or Shut Down. Click OK.
3. | To specify when the critical battery alarm is triggered, double-click Critical Battery Notification Level. Select Enabled and then use the Critical Battery Notification Level combo box to set the appropriate alarm level. Click OK.

Tip

The default critical alarm level is based on the total battery life and is 3 percent. In most cases, this value is appropriate. However, if you plan for the computer go into hibernation or shut down, you might want to reduce this value. You also want to take into account the battery life. If a computer has a long battery life, the default typically is too high, but if a computer has a short battery life, it might not be high enough. I usually set the critical power alarm so that the alarm action is triggered when there are 6 to 8 minutes of power remaining.


Configuring Networking for Laptops

Most laptops need more than one network configuration: one for the office and one for home (and maybe another for when the user is traveling). At the office, the laptop uses a dynamic Internet Protocol (IP) address and network settings that are assigned by a Dynamic Host Configuration Protocol (DHCP) server. At home, the laptop uses a static IP address and different network settings to communicate on a network and access a shared printer and broadband Internet device. In some cases, a laptop might need to be configured to make a Wi-Fi connection using a Wi-Fi adapter card with a static IP configuration when the user is away from his or her desk; and it might need a DHCP configuration when the laptop is physically connected to the network, or vice versa. When a system uses DHCP to obtain its primary network settings, you can configure alternate network settings for those times when a DHCP server isn't available, such as when the user is traveling or at home. Systems can use alternate configurations in one of two ways: either automatically or user-configured. In meeting rooms or elsewhere on the go, laptop users are also likely to need to connect to networked projectors, a task for which the Connect To A Network Projector Wizard provides an easy solution.

Configuring Dynamic IP Addresses

DHCP gives you centralized control over IP addresses and TCP/IP default settings. If the network has a DHCP server, you can assign a dynamic IP address to any of the network adapter cards on a computer. Afterward, you rely on the DHCP server to supply the basic information necessary for TCP/IP networking. To configure dynamic IP addresses, complete these steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, under the Network And Internet heading, click View Network Status And Tasks.

3.
In the left pane in Network And Sharing Center, click Manage Network Connections.

4.
Network Connections displays a list of all network connections configured for use on the computer. Right-click the connection you want to configure and then select Properties.

5.
Open the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box by double-clicking Internet Protocol Version 4 (TCP/IPv4). You can also select Internet Protocol Version 4 (TCP/IPv4) and then click Properties. This displays the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, shown in Figure 7-7.

Figure 7-7. To use DHCP, configure the computer to obtain an IP address automatically.

6.
Select Obtain An IP Address Automatically. If desired, select Obtain DNS Server Address Automatically. Alternatively, select Use The Following DNS Server Addresses and then type a preferred and alternate Domain Name System (DNS) server address in the fields provided.

7.
When you're finished, click OK.

8.
If your organization or network uses IP Version 6, open the Internet Protocol Version 6 (TCP/IPv6) Properties dialog box by double-clicking Internet Protocol Version 6 (TCP/IPv6). Select Obtain An IP Address Automatically. If desired, select Obtain DNS Server Address Automatically. Alternatively, select Use The Following DNS Server Addresses and then type a preferred and alternate Domain Name System (DNS) server address in the fields provided. Click OK.

9.
Configure alternate private IP addressing and Windows Internet Naming Service (WINS) as necessary.

Configuring Alternate Private IP Addresses

Only IP Version 4 connections have alternate configurations. When you use DHCP with an IP Version 4 connection, an automatic private IP address (APIPA) is assigned automatically when the DHCP server can't be reached during startup or when the current IP address lease expires. The automatic private IP address is in the range from 169.254.0.1 to 169.254.255.254 with a subnet mask of 255.255.0.0. Because the automatic private IP address configuration does not include a default gateway, DNS, or WINS server settings, a computer using the alternate IP addressing is isolated on a separate network segment in the APIPA range.

If you want to ensure that a computer uses specific IP address and network configuration settings when no DHCP server is available, you need to specify an alternate configuration manually. One of the key reasons for using an alternate configuration is to accommodate laptop users who take their computers home from work. In this way, the user's laptop could be configured to use a dynamically assigned IP address at work and an alternate IP address configuration at home. Before you get started, you might want to ask the users for their home networking settings, including the IP address, gateway, and DNS server addresses required by their service provider.

To configure alternate private IP addresses, complete the following steps:

1.
Click Start and then click Control Panel.

2.
In Control Panel, under the Network And Internet heading, click View Network Status And Tasks.

3.
In the left pane in Network Center, click Manage Network Connections.

4.
Network Connections displays a list of all network connections configured for use on the computer. Right-click the connection you want to configure and then select Properties.

5.
Open the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box by double-clicking Internet Protocol Version 4 (TCP/IPv4). You can also select Internet Protocol Version 4 (TCP/IPv4) and then click Properties.

6.
Provided you've already configured the adapter to obtain an IP address automatically, you should be able to click the Alternate Configuration tab, shown in Figure 7-8.

Figure 7-8. Use the Alternate Configuration tab to configure private IP addresses for the computer.

7.
On the Alternate Configuration tab, select the User Configured option. Then in the IP Address field, type the IP address you want to use. The IP address you assign to the computer should be a private IP address, and it must not be in use anywhere else at the time the settings are applied. Private IP addresses normally used by computers are in the ranges 10.0.0.1 to 10.255.255.254, 172.16.0.1 to 172.31.255.254, and 192.168.0.1 to 192.168.255.254.

8.
The Subnet Mask field ensures that the computer communicates over the network properly. Windows Vista should insert a default value into this field for the subnet mask. If the network doesn't use subnets, the default value should suffice. However, if it does use subnets, you'll need to change this value as appropriate for the target network.

9.
If the computer needs to access other TCP/IP networks, the Internet, or other subnets, you must specify a default gateway. Type the IP address of the network's default router in the Default Gateway field.

10.
DNS servers are needed for domain name resolution. Type a preferred and alternate DNS server address in the fields provided.

11.
If WINS is used on the network for backward compatibility with previous versions of Windows, configure a preferred and alternate WINS server using the fields provided.

12.
When you're finished, click OK twice and then click Close.

Connecting to Networked Projectors

Many meeting rooms and conference centers have networked projectors that are available for use during presentations. To use this type of projector, you must connect your computer to the local area network (LAN) and then access the projector over the network by using the Connect To A Network Projector Wizard. This wizard walks you through the steps of finding projectors on a network and establishing a connection.

You can start and use the Connect To A Network Projector Wizard by following these steps:

1. | Click Start, All Programs, Accessories, Connect To A Network Projector.
2. | If you haven't previously attempted to connect to a network projector and Windows Firewall is active, click Yes to allow the network projector to communicate with the computer through Windows Firewall.
3. | If you want to select from projectors found on the local network, click Choose From Available Network Projectors. The wizard searches for projectors on the network and returns its results along with a list of any projectors you've used recently. Click the projector you want to use, provide the access password for the projector if necessary, and then click Next.
4. | If you know the network address of the projector, click Enter The Projector Address. On the Enter The Network Address Of A Projector page, type the network address of the project, such as http://intranet.cpandl.local/projectors/confb-proj1. Enter any required access password and then click Next.
5. | Once you've established a connection to the projector, click Finish to exit the wizard and begin using the projector.


Chapter 8. Configuring User and Computer Policies

In this chapter:
Group Policy Essentials | 235
Configuring Policies | 242
Working with File and Data Management Policies | 245
Working with Access and Connectivity Policies | 255
Working with Computer and User Script Policies | 259
Working with Logon and Startup Policies | 264

Group Policy is a set of rules that you can apply to help manage users and computers. Two types of Group Policy are available: local group policy and Microsoft Active Directory directory service group policy. Local group policy is used to manage the settings of a local machine only. Active Directory group policy is used to manage the settings of computers throughout sites, domains, and organizational units (OUs).

Group policies simplify administration by giving administrators central control over privileges, permissions, and capabilities of both users and computers. You can think of a group policy as a set of rules that helps you manage users and computers. Group policies can be applied to multiple domains, to individual domains, to subgroups within a domain, or to individual systems. Policies that apply to individual systems are referred to as local group policies and are stored on the local system only. Other group policies are linked as objects in the Active Directory directory service.

In this chapter, you'll learn how to manage group policy settings. The chapter examines policies that you might want to configure in the domain and on local computers. These policies are organized by topic area, such as file and data management. Group policies apply only to systems running Microsoft Windows 2000, Windows XP Professional, Windows Vista, Windows Server 2003, or any combination of these.


Group Policy Essentials

Careful management of policies is essential to proper operations. Policy settings are divided into two broad categories: those that apply to computers and those that apply to users. Computer policies are normally applied during system startup, and user policies are normally applied during logon.

Understanding Policy Application

During startup and logon, policies are applied in an exact sequence, which is often important in troubleshooting system behavior.

When multiple policies are in place, they are applied in the following order:

  1. Local group policies

  2. Site group policies

  3. Domain group policies

  4. Organizational unit (OU) group policies

  5. Child OU group policies

If there are conflicts among the policy settings, settings applied later take precedence and overwrite previous policy settings. For example, OU policies take precedence over domain group policies. As you might expect, there are exceptions to the precedence rule that enable administrators to block, oversee, and disable policies.

Generally speaking, the events that take place during startup and logon are as follows:

  1. The network starts, and then Windows Vista applies computer policies. By default, the computer policies are applied one at a time in the previously specified order. No user interface is displayed while foreground computer policies are being processed. Some computer policies can be processed asynchronously in the background, allowing for faster user logon.

  2. Windows Vista runs startup scripts. By default, startup scripts are executed one at a time, with each completing or timing out before the next starts. Script execution isn't displayed to the user unless specified.

  3. A user logs on. After the user account is authenticated, Windows Vista loads the user profile.

  4. Windows Vista applies user policies. By default, the policies are applied one at a time in the previously specified order. The user interface is displayed while user policies are being processed.

  5. Windows Vista runs logon scripts. Group policy logon scripts are executed simultaneously by default. Script execution isn't displayed to the user unless specified. Scripts in the Netlogon share are run last in a normal command-shell window.

  6. Windows Vista displays the start shell interface configured in Group Policy.

Accessing and Using Local Group Policies

Each computer running Windows Vista has one local group policy stored in its %SystemRoot%\System32\GroupPolicy folder. You shouldn't edit these folders and files directly. Instead, you should use the appropriate features of the Group Policy Object Editor.

Using the Group Policy Object Editor, access and use policies on a computer by completing these steps:

1. | Click Start, type mmc and then press Enter. This opens an empty MMC console.
2. | Select Add/Remove Snap-In on the File menu.
3. | In the Add Or Remove Snap-In dialog box, select Group Policy Object Editor under Available Snap-Ins and then click Add.
4. | By default, the Group Policy Object Editor works with the local computer's Group Policy Object (GPO), so you need only click Finish to accept this as the default.
5. | Click OK. You can now manage the policy on the selected computer. For more details, see the "Configuring Policies" section of this chapter.

Tip

Another way to start the Group Policy Object Editor for the local computer is to click Start, type gpedit.msc, and then press Enter.

Accessing and Using Site, Domain, and Organizational Unit Policies

With Active Directory, each site, domain, and OU can have one or more group policies. Policies displayed higher in the Group Policy list have a higher precedence than policies lower in the list. This ensures that site policies are applied appropriately throughout the domains and OUs on the same high-speed network if sites have been configured. Site, domain, and OU group policies are stored in the %SystemRoot%\Sysvol\sysvol\DomainName\Policies folder on domain controllers, where DomainName is the Domain Name System (DNS) name of the domain. In this folder, you'll find one subfolder for each policy you've defined on the domain controller. You shouldn't edit these folders and files directly. Instead, use the appropriate features of a Group Policy console.

Two graphical user interface (GUI) tools are provided for managing Active Directory Group Policy:

  • Group Policy Object Editor

  • Group Policy Management Console

Although both are used to manage Active Directory Group Policy, you can think of Group Policy Object Editor as a basic editor and Group Policy Management Console as an advanced editor. Using Group Policy Object Editor, you can view and configure policy settings for a specific Group Policy Object. Using Group Policy Management Console, you can view, configure, and manage policy settings for group policy objects in any forest and domain to which you can connect and have appropriate administrator permissions. Management features in Group Policy Management Console enable you to import, export, back up, and restore group policy objects. You can also use Group Policy Management Console to plan Group Policy changes and to determine how Group Policy is being applied to particular computers and users.

Using Group Policy Object Editor and related features, you access and use site, domain, and OU policies by completing the following steps:

1.
For sites, open the Active Directory Sites and Services console to create a Group Policy Object that is linked to the site. For domains and OUs, open the Active Directory Users and Computers console to create a Group Policy Object that is linked to the domain or OU.

2.
In the left pane of the appropriate Active Directory window, right-click the site, domain, or OU for which you want to create or manage a Group Policy. Then select Properties on the shortcut menu, which opens the Properties dialog box.

3.
In the Properties dialog box, click the Group Policy tab. You can now:

  • Create a new policy To create a new policy, click New. Enter a name for the policy and press Enter. Then click Edit to configure the new policy.

  • Edit an existing policy To edit an existing policy, select the policy and then click Edit. Then you can edit the policy. For more details, see the "Configuring Policies" section of this chapter.

  • Change the priority of a policy To change the priority of a policy, use the Up or Down buttons to change its position in the Group Policy Object Links list.

Note

Group Policy Management Console is included with Windows Vista and later releases of the Windows operating system.

Using the Group Policy Object Editor, you access and work with site, domain, and OU policies by completing the following steps:

1.
Click Start, type mmc and then press Enter. This opens an empty MMC console.

2.
On the File menu, select Add/Remove Snap-In.

3.
In the Add Or Remove Snap-In dialog box, under Available Snap-Ins, select Group Policy Management and then click Add.

In the MMC, you'll see two top-level nodes: Group Policy Management (the label for the console root) and Forest (a node representing the current forest to which you are connected). When you expand the Forest node, you'll then see the following nodes:

  • Domains Provides access to the policy settings for domains in the related forest. By default, you are connected to your logon domain and can add connections to other domains. If you expand a domain, you'll be able to access Default Domain Policy, the Domain Controllers OU (and the related Default Domain Controllers Policy), and Group Policy Objects defined in the domain.

  • Sites Provides access to the policy settings for sites in the forest. Sites are hidden by default.

  • Group Policy Modeling Provides access to the Group Policy Modeling Wizard, which you can use to help you plan policy deployment and simulate settings for testing purposes, as well as any saved policy models.

  • Group Policy Results Provides access to the Group Policy Results Wizard. For each domain to which you are connected, you have all the related Group Policy Objects and OUs available to work with in one location.

4.
You can now perform the following tasks:

  • Create a new policy Right-click the site, domain, or OU you want to work with and then select Create And Link A GPO Here. In the New GPO dialog box, type a descriptive name for the new GPO and then click OK. The GPO is now created and linked to the site, domain, or OU. Right-click the GPO and then choose Edit. This opens the Group Policy Object Editor. For more details, see the "Configuring Policies" section of this chapter.

  • Edit an existing policy Expand the site, domain, or OU node in which the related policy is stored. Right-click the policy and then choose Edit. This opens the Group Policy Object Editor. For more details, see the "Configuring Policies" section of this chapter.

Using the Group Policy Object Editor

Once you've selected a policy for editing or created a new policy, use the Group Policy Object Editor to work with group policies. As Figure 8-1 shows, the Group Policy Object Editor has two main nodes:

  • Computer Configuration Enables you to set policies that should be applied to computers, regardless of who logs on

  • User Configuration Enables you to set policies that should be applied to users, regardless of which computer they log on to

Figure 8-1. Group Policy options depend on the type of policy you're creating and the add-ons installed.

[View full size image]

Note

Keep in mind that user configuration options set through local group policies apply only to computers on which the options are configured. If you want the options to apply to all computers that the user might use, you must use domain, site, or OU group policies.

The exact configuration of Computer Configuration and User Configuration depends on the add-ons installed and which type of policy you're creating. You'll usually find that both nodes have subnodes for the following:

  • Software Settings Sets policies for software settings and software installation. When you install software, subnodes may be added to Software Settings.

  • Windows Settings Sets policies for folder redirection, scripts, and security.

  • Administrative Templates Sets policies for the operating system, Windows components, and programs. These policies, examined later in this chapter, apply specifically to users and computers.

Updating Group Policy Objects for Windows Vista

Windows Vista supports additional group policies. Some of these additional policies can be used with other operating systems as well as with later versions of the Windows. On a Windows Vista computer, you'll see the new policies as well as the standard policies if you examine the Local Computer policy. However, if you try to use the Windows Vista policies in a domain, you're going to have problems: the new policies won't be there. Don't worry; there's an easy way to fix this, and you'll then be able to set and enforce the new policies as appropriate throughout your domain.

In Group Policy, new policies are implemented through a set of administrative templates. These templates contain the policy definitions for both the new policies and the standard policies. To push the policies out into the domain, you will need to update the appropriate GPOs in your domain. Once you make the update, compatible clients can take advantage of the enhanced policy set, and incompatible clients simply ignore the settings they don't support.

Normally, nothing else about using Group Policy would change when you make this update. However, Windows Vista supports a new file format for administrative templates called ADMX. ADMX is eXtensible Markup Language to format policies within administrative templates. Unlike ADM files, which are stored in the GPO to which they relate, ADMX files are not by default stored with the GPOs with which they are associated. Instead, ADMX files are stored centrally on a domain controller and are accessible by anyone with permissions to create or edit GPOs. Central storage of ADMX files makes them easier to work with and manage.

The ADMX file format is entirely different from the ADM format previously used. Because of this, only policy editors that are compatible with the ADMX file format can read the administrative templates that have been updated to use ADMX. Windows XP, Windows Server 2003 and earlier releases of Windows include a version of the Group Policy Object Editor, which is not compatible with the ADMX file format. Windows Vista and later versions of the Windows operating system include a version of the Group Policy Object Editor and a version of the Group Policy Management Console (GPMC), which are compatible with the ADMX file format. Any version of GPMC with Service Pack 1 or later downloaded from the Microsoft Download Web Site is also compatible with the ADMX file format.

Note

You upgrade GPOs using a computer running Windows Vista or a later version of the Windows operating system. Once you've performed the update and made any necessary changes, you can perform basic management, such as policy linking or blocking, using any computer. However, it is recommended that the actual policy editing be done on a computer running Windows Vista or later.

You update the domain GPO by following these steps:

1. | Using an account with domain administrator privileges, log on to a computer running Windows Vista or a later release of Windows.
2. | Click Start, type mmc, and then press Enter. Alternatively, you can type mmc at a command prompt. This starts the Microsoft Management Console (MMC).
3. | On the File menu, click Add/Remove Snap-In. This opens the Add/Remove Snap-In dialog box.
4. | In the Add Or Remove Snap-Ins dialog box, click Group Policy Management Console. Click Add and then click OK.
5. | In MMC, when you expand the Group Policy Management node, you'll see a Forest node representing the current forest to which you are connected. When you expand the Forest node, you'll then see Domains and Sites nodes. Use these nodes to work your way to the Group Policy Object (GPO) you want to work with.
6. | When you find the GPO you want to work with, right-click it and then select edit to open the Group Policy Object Editor.
7. | In the Group Policy Object Editor, select the Computer Configuration node by clicking it, and then select the User Configuration node by clicking it. When you select these nodes, the current administrative templates are read in, and applied to, the GPO you've selected. Once Group Policy is refreshed, you can modify policy settings as necessary, and the changes will be updated as appropriate in the selected site, domain, or OU.

Repeat this procedure to update the GPO for other sites, domains, or OUs.


Configuring Policies

To manage users and computers, you'll want to configure the administrative template policies. These policies provide easy access to registry-based policy settings that control the operating system, Windows components, and programs. Although earlier versions of Windows that support Group Policy use Administrative Template (.ADM) files with a proprietary markup language to store registry-based policy settings, Windows Vista uses a standards-based Extensible Markup Language (XML) file format called ADMX. Unlike .ADM files, which are stored in the GPO to which they relate, .ADMX files are stored in a central repository. In domains, central storage of .ADMX files makes them easier to work with and manage.

Viewing Policies and Templates

As shown in Figure 8-2, you can view the currently configured templates in the Group Policy Object Editor's Administrative Templates node, which contains policies that can be configured for local systems, OUs, domains, and sites. Different sets of templates are found under Computer Configuration and User Configuration. You can add templates containing new policies, both manually in the Group Policy console and when you install new Windows components.

Figure 8-2. Set user and computer policies through administrative templates.

[View full size image]

Any changes you make to policies available through the administrative templates are saved in the registry. Computer configurations are saved in HKEY_LOCAL_MACHINE, and user configurations are saved in HKEY_USER. Browsing the Administrative Templates node in the Group Policy Object Editor is the best way to become familiar with available administrative template policies. As you browse the templates, you'll find that policies are in one of three states:

  • Not Configured The policy isn't used, and its settings do not impact the existing configuration on the computer.

  • Enabled The policy is active, and its settings are saved in the registry.

  • Disabled The enabled behavior of the policy is not on. The policy may have a specific disabled behavior that is contrary to its enabled setting. This setting is saved in the registry.

Enabling, Disabling, and Configuring Policies

In the Group Policy Object Editor, you'll find administrative templates in two nodes: Computer Configuration and User Configuration. In most cases, the policies in these areas don't overlap or conflict with each other. If there is a conflict, however, computer policies have precedence, which means that the computer policy is the one that is enforced. Later in this chapter, you'll find details on commonly used policies and how to employ them.

You can enable, disable, and configure policies by completing the following steps:

1.
Access the Group Policy Object Editor for the resource you want to work with. Then in the Computer Configuration or User Configuration node, whichever is appropriate for the type of policy you want to set, access the Administrative Templates folder.

2.
In the left pane, click the subfolder containing the policies you want to work with. The related policies are displayed in the right pane.

3.
Double-click or right-click a policy and select Properties to display its Properties dialog box.

4.
Click the Explain tab to see a description of the policy, if one is available.

5.
To set the policy's state, click the Setting tab and then use the following buttons to change the state of the policy:

  • Not Configured The policy is not configured.

  • Enabled The policy is enabled.

  • Disabled The policy is disabled.

6.
If you enabled the policy, set any additional parameters specified on the Setting tab and then click Apply.

7.
Use the Previous Setting and Next Setting buttons to manage other policies in the current folder. Then configure them as discussed in steps 46.

8.
Click OK when you're finished managing policies.

Adding or Removing Templates

You can add or remove template folders in the Group Policy Object Editor. To do this, complete the following steps:

1.
Access the Group Policy Object Editor for the site, domain, or OU you want to work with.

2.
In the Computer Configuration or User Configuration node, whichever is appropriate for the type of template you want to add or remove, right-click the Administrative Templates folder and select Add/Remove Templates. This displays the Add/Remove Templates dialog box, shown in Figure 8-3.

Figure 8-3. Use the Add/Remove Templates dialog box to add more templates or remove existing ones.

3.
To add new templates, click Add. Then, in the Policy Templates dialog box, select the template you want to add and click Open.

4.
To remove an existing template, select the template to remove and then click Remove.

5.
When you're finished adding and removing templates, click Close.


Working with File and Data Management Policies

Every system administrator should be familiar with file and data management policies, which affect the amount of data a user can store on systems, how offline files are used, and whether the System Restore feature is enabled.

Configuring Disk Quota Policies

Policies that control disk quotas are applied at the system level. You access these policies through Computer Configuration\Administrative Templates\System\Disk Quotas. The available policies are summarized in Table 8-1.

Table 8-1. Disk Quota Policies

Policy Name

Description

Apply Policy To Removable Media

Determines whether to extend quota policies to NTFS volumes on removable media. If you do not enable this policy, quota limits only apply to fixed media drives.

Default Quota Limit And Warning Level

Sets a default quota limit and warning level for all users. This setting overrides other settings and only affects new users of a volume.

Enable Disk Quotas

Turns disk quotas on or off for all NTFS volumes of the computer and prevents users from changing the setting.

Enforce Disk Quota Limit

Specifies whether quota limits are enforced. If quotas are enforced, users are denied disk space if they exceed the quota. This overrides settings on the Quota tab on the NTFS volume.

Log Event When Quota Limit Exceeded

Determines whether an event is logged when users reach their limit and prevents users from changing their logging options.

Log Event When Quota Warning Level Exceeded

Determines whether an event is logged when users reach the warning level.

Whenever you work with quota limits, you'll want to use a standard set of policies on all systems. Typically, you won't want to enable all the policies. Instead, selectively enable policies and then use the standard NTFS features to control quotas on various volumes. If you want to enable quota limits, use the following technique:

  1. Access Group Policy for the system, site, domain, or OU you want to work with. Next, access the Disk Quotas node through Computer Configuration\Administrative Templates\System\Disk Quotas.

  2. Double-click Enable Disk Quotas. On the Setting tab, select Enabled and then click Next Setting. This displays the Enforce Disk Quota Limit Properties dialog box.

  3. If you want to enforce disk quotas on all NTFS volumes residing on this computer, select Enabled. Otherwise, select Disabled and then set specific limits on a per volume basis, as discussed in Chapter 11, "Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas." Click OK.

  4. Double-click Default Quota Limit And Warning Level. The Default Quota Limit And Warning Level Properties dialog box, shown in Figure 8-4, appears. Select Enabled.

    Figure 8-4. Use the Default Quota Limit And Warning Level Properties dialog box to establish disk quota values.

  5. Under Default Quota Limit, set a default limit that is applied to new users when they first write to the quota-enabled volume. The limit does not apply to current users and doesn't affect current limits. On a corporate share, such as a share used by all members of a team, a good limit is between 1 gigabyte (GB) and 3 GB. Of course, this depends on the size of the data files the users routinely work with. Graphic designers and data engineers, for example, might need much more disk space.

  6. Scroll down in the subwindow provided on the Setting tab to set a warning limit as well. A good warning limit is about 90 percent of the default quota limit, meaning that if you set the default quota limit to 1 GB, you'd set the warning limit to 900 MB. Click OK.

  7. Double-click Log Event When Quota Limit Exceeded. The Log Event When Quota Limit Exceeded Properties dialog box appears. Select Enabled so that limit events are recorded in the application log. Click OK.

  8. Double-click Log Event When Quota Warning Exceeded. The Log Event When Quota Warning Exceeded Properties dialog box appears. Select Enabled so that warning events are recorded in the application log. Click OK.

  9. Double-click Apply Policy To Removable Media. The Apply Policy To Removable Media Properties dialog box appears. Select Disabled so that the quota limits only apply to fixed media volumes on the computer.

  10. Click OK.

Configuring System Restore Policies

System Restore is designed to save the state of system volumes and enable users to restore a system in the event of a problem. It is a helpful feature for the average user, but it can use a tremendous amount of disk space. As you learned in Chapter 2, "Managing Windows Vista Systems," you can turn System Restore off for individual drives or for all drives on a computer.

In the Group Policy console, you'll find the System Restore policies under Computer Configuration\Administrative Templates\System\System Restore. Through System Restore policies, you can override and disable management of this feature. The following policies are available:

  • Turn Off System Restore If you enable this policy, System Restore is turned off and can't be managed using the System utility or the System Restore Wizard. If you disable this policy, System Restore is enforced and cannot be turned off.

  • Turn Off Configuration If you enable this policy, you prevent configuration of the System Restore feature. Users can't access the Settings dialog box but can still turn off System Restore. If you disable this policy, users can access the Settings dialog box but can't manipulate it, and they can still turn off System Restore.

To configure System Restore policies, follow these steps:

1. | Access Group Policy for the system, site, domain, or OU you want to work with. Next, access the System Restore node by expanding Computer Configuration\Administrative Templates\System\System Restore.
2. | To enable or disable System Restore, double-click Turn Off System Restore. On the Setting tab, select either Enabled or Disabled as appropriate. Click OK.
3. | To enable or disable configuration of System Restore, double-click Turn Off Configuration. On the Setting tab, select either Enabled or Disabled as appropriate. Click OK.

Configuring Offline File Policies

Offline file policies are set at both the computer and the user level, and there are identically named policies at each level. If you work with identically named policies at both levels, keep in mind that computer policies override user policies and that these policies may be applied at different times.

The primary policies you'll want to use are summarized in Table 8-2. As the table shows, most offline policies affect access, synchronization, caching, and encryption. You'll find Offline File policies under Computer Configuration \Administrative Templates\Network\Offline Files and User Configuration \Administrative Templates\Network\Offline Files.

Table 8-2. Offline File Policies

Policy Type

Policy Name

Description

Computer

Allow Or Disallow Use Of The Offline Files Feature

Forces enabling or disabling of the Offline Files feature and prevents overriding by users. Enables administrative control of Offline File settings for a system.

Computer

At Logoff, Delete Local Copy Of User's Offline Files

At logoff, cleans up the offline file cache on the local computer.

Computer

Configure Slow-Link Mode

Controls how slow links are used. Enabled: slow link values for each shared folder used with Offline Files are configured. Disabled: offline files will not use slow link mode.

Computer

Default Cache Size

Limits size of automatically cached offline files and prevents users from changing related options. Enabled: you can set a cache size. Disabled: the limit is 10 percent of drive space.

Computer

Encrypt The Offline Files Cache

Determines whether offline files are encrypted to improve security.

Computer

Files Not Cached

Lists types of files, by file extension, that cannot be used offline.

Computer

Subfolders Always Available Offline

Makes subfolders available offline when a parent folder is available offline.

Computer

Turn On Economical Application Of Administratively Assigned Offline Files

Determines how administratively assigned files and folders are synced at logon. Enabled: only new files and folders are synced at logon. Disabled: all files and folders are synced at logon.

Computer\User

Action On Server Disconnect

Specifies how the system responds when a server becomes unavailable. The Work Offline action ensures offline files are available.

Computer\User

Administratively Assigned Offline Files

Using Universal Naming Convention (UNC) path, specifies files and folders that are always available offline.

Computer\User

Event Logging Level

Ensures offline file events are logged in the application log.

Computer\User

Prevent Use Of Offline Files Folder

Prevents users from accessing the Offline Files folder. Users can't view or open copies of cached files, but they can work offline.

Computer\User

Prohibit "Make Available Offline" For These Files And Folders

Prohibits users from making specific files and folders available offline. Enter UNC paths to resources.

Computer\User

Prohibit User Configuration Of Offline Files

Prevents users from enabling, disabling, and configuring Offline Files. This locks down the default settings for Offline Files.

Computer\User

Remove "Make Available Offline"

Prevents users from making files available offline.

Computer\User

Synchronize All Offline Files Before Logging Off

Forces full synchronization before users log off and prevents them from changing synchronization timing.

Computer\User

Synchronize All Offline Files When Logging On

Forces full synchronization when users log on and prevents them from changing synchronization timing.

Computer\User

Synchronize Offline Files Before Suspend

Forces synchronization before a computer goes into standby or hibernate mode. You can specify quick or full synchronization.

User

Do Not Automatically Make Redirected Folders Available Offline

By default, if Folder Redirection is configured, these folders are available offline automatically. Enabled: automatic redirection turned off. Users can, however, enable offline use of the redirected folders.

Setting Offline File Configuration Policies

Offline file configuration can be easily controlled through policy. You can allow users to specify which files and folders should be available offline, prevent them from configuring offline file features on their own, and allow them to work offline but not access other cached resources. Follow these steps to set offline file configuration policies:

1. | Access Group Policy for the system, site, domain, or OU you want to work with. Most offline file policies can be configured in either computer or user policy (with user policies having precedence by default) by using the Offline Files node. You can access the policies for offline files either by expanding Computer Configuration\Administrative Templates\Network\Offline Files or User Configuration\Administrative Templates\Network\Offline Files unless specifically noted otherwise.
2. | To control the availability of offline files, in Computer Configuration\Administrative Templates\Network\Offline Files, double-click Allow Or Disallow Use Of The Offline Files Feature. On the Setting tab, select either Enabled or Disabled as appropriate. Click OK. Users can now select specific files and folders that they want to have available when working offline. To prevent this user selection of files but assign specific offline files to be used, you'll need to prohibit this feature and administratively assign offline files.
3. | To prevent users from changing offline file configuration settings, double-click Prohibit User Configuration Of Offline Files. On the Setting tab, select Enabled. Once this policy is set, users can't configure offline file options.
4. | To prevent users from accessing the offline files folder but still allow them to work offline, double-click Prevent Use Of Offline Files Folder. On the Setting tab, select Enabled. Once you select this option, users cannot view or open copies of cached files. They can, however, save current work and continue to use active files when offline.
Administratively Controlling Offline Files and Folders

You can administratively control which files and folders are available for offline use. Typically, you'll want to do this on file servers or other systems sharing resources on the network. You can use several different techniques to administratively control which resources are available offline.

You can prevent users from making files available offline and, instead, assign specific offline resources by following these steps:

1. | Access Group Policy for the system you want to work with. Next, access the Offline Files node by expanding Computer Configuration\Administrative Templates\Network\Offline Files or User Configuration\Administrative Templates\Network\Offline Files.
2. | To prevent users from making files available offline, double-click Remove "Make Available Offline." On the Setting tab, select Enabled. Click OK. Once this policy is enforced, users are unable to specify files that should be used offline.
3. | To assign resources that are automatically available offline, double-click Administratively Assigned Offline Files. On the Setting tab, select Enabled. Next, click Show. Then, in the Show Contents dialog box, specify resources according to their UNC path, such as \\corpserver\data. Figure 8-5 shows a list of resources that have been added to the Show Contents list.

Figure 8-5. Use the Show Contents dialog box to specify resources according to their UNC path.

[View full size image]

Caution

You should carefully consider which resources are automatically made available offline. The more resources you assign through this technique, the more network traffic is generated to maintain offline file caches.

You can make specific files automatically available, and prevent others from being used offline, by following these steps:

1. | Access Group Policy for the system that you want to work with. Next, access the Offline Files node by expanding Computer Configuration\Administrative Templates\Network\Offline Files or User Configuration\Administrative Templates\Network\Offline Files.
2. | To assign resources that are available offline automatically, double-click Administratively Assigned Offline Files. On the Setting tab, select Enabled. Click Show and then, in the Show Contents dialog box, specify resources according to their UNC path, such as \\corpserver\data.
3. | To specify resources that users shouldn't be able to make available offline, double-click Prohibit "Make Available Offline" For These Files And Folders. On the Setting tab, select Enabled. Click Show and then, in the Show Contents dialog box, specify resources according to their UNC path, such as \\corpserver\data. This setting doesn't prevent automatic caching of resources assigned through step 2.
4. | Click OK until all open dialog boxes are closed.
Setting Offline File Synchronization Policies

Offline file synchronization is normally controlled using the Synchronization Manager, accessed by selecting Start, All Programs or Programs, Accessories, Synchronize. However, you can set specific synchronization timing and techniques through policies. Normally, resources are either fully synchronized (meaning that all files are checked to ensure they are complete and current) or quickly synchronized (meaning files are checked to ensure they are complete, but file contents are not examined for currency).

Several events can trigger automatic synchronization, such as logon, logoff, standby, and hibernate. Again, the Synchronization Manager normally determines which events are used. Using policies, you can override this behavior. In most circumstances, you'll want to synchronize files only when a user logs on. The advantage to synchronizing when users log on is that they'll always have the freshest copies of files. The disadvantage is that the logon process might take longer. The notable exception for synchronizing at logon is for laptop users. Here, you might want to synchronize at logoff to ensure that users have the freshest copy of files when they go home and use their laptop offline.

To configure synchronization policies, follow these steps:

1. | Access Group Policy for the system you want to work with. Next, access the Offline Files node by expanding Computer Configuration\Administrative Templates\Network\Offline Files.
2. | The policies that control synchronization are Synchronize All Offline Files When Logging On, Synchronize All Offline Files Before Logging Off, and Synchronize Offline Files Before Suspend. Double-click the policy related to the synchronization technique that you want to use for this computer. On the Setting tab, select Enabled. For the Synchronize Offline Files Before Suspend policy, ensure that the appropriate Action is selected; choose either Full or Quick. Tip A full synchronization ensures the latest version of the user's offline files are stored prior to the suspend operation. A quick synchronize ensures all the offline files are available but not necessarily in the most current version.
3. | Click OK.
Setting Offline File Cache Policies

Careful configuration of the offline file cache is essential to managing the system and network overhead generated by offline file usage. You can specify a maximum file cache size, whether the cache is encrypted for security, and which file types should never be cached. To configure policies for the offline file cache, follow these steps:

1.
Access Group Policy for the system you want to work with. Next, access the Offline Files node by expanding Computer Configuration\Administrative Templates\Network\Offline Files or User Configuration\Administrative Templates\Network\Offline Files.

2.
To set the maximum cache size, double-click Default Cache Size. On the Setting tab, select Enabled. Afterward, use the Default Cache Size Properties dialog box, shown in Figure 8-6, to set the default cache size. The value entered is the percentage of disk space used times 10,000, meaning that if you enter 15,000, the cache can use up to 15 percent of the free space on the system drive.

Figure 8-6. Set a default cache size for offline files in the Default Cache Size Properties dialog box.

Note

If you don't configure the Default Cache Size policy or if you disable it, the cache size limit is 10 percent of the free space on the system drive.

3.
To specify file types that are not cached, double-click Files Not Cached and then select Enabled. Next, in the Extensions field, type a semicolon-separated list of file extensions to exclude. Each extension must be preceded by an asterisk and a period. You could enter *.wbk; *.tmp; *.lnk; *.ndx to block caching of many temporary types of files.

4.
To encrypt the cache, double-click Encrypt The Offline Files Cache and then select Enabled. Once enabled, all existing and new files in the cache are encrypted. The user can see his or her own files, but others user will not be able to use them.


Working with Access and Connectivity Policies

Access and connectivity policies control network connections, dial-up connections, and Remote Assistance configurations. These policies affect a system's connectivity to the network as well as remote access to the system.

Configuring Network Policies

Many network policies are available. Network policies that control Internet Connection Sharing, Internet Connection Firewall, Windows Firewall, and Network Bridge are configured at the computer level. Network policies that control local area network (LAN) connections, Transmission Control Protocol/Internet Protocol (TCP/IP) configuration, and remote access are configured at the user level. The primary policies that you'll want to use are summarized in Table 8-3. You'll find Network policies under Computer Configuration\Administrative Templates\Network\Network Connections and User Configuration\Administrative Templates\Network\Network Connections.

Table 8-3. Network Policies

Policy Type

Policy Name

Description

Computer

Prohibit Installation And Configuration Of Network Bridge On Your DNS Domain Network

Determines whether users can install and configure network bridges. This policy only applies to the domain in which it is assigned.

Computer

Prohibit Use Of Internet Connection Firewall On Your DNS Domain Network

Determines whether users can enable the Internet Connection Firewall. This policy only applies to the domain in which it is assigned.

Computer

Prohibit Use Of Internet Connection Sharing On Your DNS Domain Network

Determines whether administrators can enable and configure connection sharing. This policy only applies to the domain in which it is assigned.

User

Ability To Change Properties Of An All User Remote Access Connection

Determines whether users can view and modify the properties of remote access connections available to all users of the computer.

User

Ability To Delete All User Remote Access Connections

Determines whether users can delete remote access connections available to all users of the computer.

User

Ability To Enable/Disable A LAN Connection

Determines whether users can enable or disable LAN connections.

User

Prohibit Access To Properties Of A LAN Connection

Determines whether users can change the properties of LAN connections.

User

Prohibit Access To Properties Of Components Of A Remote Access Connection

Determines whether users can access and change properties of remote access connections.

User

Prohibit Deletion Of Remote Access Connections

Determines whether users can delete remote access connections.

User

Prohibit TCP/IP Advanced Configuration

Determines whether users can access advanced TCP/IP settings.

As shown in the table, network policies for computers are designed to restrict actions on the organization's network. When you enforce these restrictions, users are prohibited from using features such as Internet Connection Sharing in the applicable domain. This is designed to protect the security of corporate networks, but it doesn't prevent users with laptops, for example, from taking their computers home and using these features on their own networks. To enable or disable these restrictions, follow these steps:

1. | Access Group Policy for the resource you want to work with. Next, access the Network Connections node by expanding Computer Configuration\Administrative Templates\Network\Network Connections.
2. | Double-click the policy that you want to configure. On the Setting tab, select Enabled or Disabled as appropriate. Click OK.

User policies for network connections usually prevent access to certain configuration features, such as the advanced TCP/IP property settings. To configure these policies, follow these steps:

1. | Access Group Policy for the resource you want to work with. Next, access User Configuration\Administrative Templates\Network\Network Connections.
2. | Double-click the policy that you want to configure. On the Setting tab, select Enabled or Disabled as appropriate. Click OK.

Configuring Remote Assistance Policies

Remote Assistance policies can be used to prevent or permit use of remote assistance on computers. Typically, when you set Remote Assistance policies, you'll want to prevent unsolicited offers for remote assistance while allowing requested offers. You can also force a specific expiration time limit for invitations through policy rather than setting this through the System Properties dialog box of each computer. To improve security, you can use strong invitation encryption. This enhancement, however, limits who can answer Remote Assistance invitations to only those running Windows Vista or later releases of Windows.

To configure policy in this manner, follow these steps:

1.
Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Remote Assistance.

2.
Double-click Solicited Remote Assistance. On the Setting tab, select Enabled. When enabled, this policy allows authorized users to respond to remote assistance invitations.

3.
You can now specify the level of access for assistants. The Permit Remote Control Of This Computer selection list has two options:

Allow Helpers To Remotely Control This Computer Permits viewing and remote control of the computer.

Allow Helpers To Only View This Computer Permits only viewing; assistants cannot take control to make changes.

4.
Next, as shown in Figure 8-7, use the Maximum Ticket Time (Value) and Maximum Ticket Time (Units) fields to set the maximum time limit for remote assistance invitations. The default maximum time limit is one hour. Click OK.

Figure 8-7. Set a time expiration limit for Remote Assistance invitations.

Real World

The method for sending e-mail invitations is set to Mailto by default. This is a browser-based mail submission technique in which the invitation recipient connects through an Internet link. You can also select Simple MAPI to use Messaging Application Programming Interface (MAPI) for sending the e-mail invitation. When you do this, the invitation is sent as an attachment to the invitation e-mail message. As long as computers can establish a connection with each other over port 80 and you're using a standard e-mail program, such as Microsoft Outlook or Outlook Express, you'll probably want to use Mailto.

5.
Double-click Offer Remote Assistance. In the Offer Remote Assistance Properties dialog box, select Disabled. Disabling this policy prevents unsolicited assistance offers. Click OK.

6.
If you want to use strong invitation encryption and limit connections so they can only come from computers running Windows Vista or later releases of Windows, double-click Allow Only Vista Or Later Connections. In the Allow Only Vista Or Later Connections dialog box, select Enabled. Click OK.

To prevent remote assistance and remote control, follow these steps:

1. | Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Remote Assistance.
2. | Double-click Solicited Remote Assistance. On the Setting tab, select Disabled and then click Previous Setting or Next Setting as appropriate.
3. | In the Offer Remote Assistance dialog box, select Disabled and then click OK.


Working with Computer and User Script Policies

Script policies control the behavior and assignment of computer and user scripts. Four types of scripts can be configured:

  • Computer startup Executed during startup

  • Computer shutdown Executed prior to shutdown

  • User logon Executed when a user logs on

  • User logoff Executed when a user logs off

You can write these scripts as command-shell batch or Windows scripts. Batch scripts use the shell command language. Windows scripts use Windows Script Host (WSH) and are written in a scripting language, such as Microsoft Visual Basic, Scripting Edition (VBScript) or Microsoft JScript.

Controlling Script Behavior Through Policy

Policies that control script behavior are found under Computer Configuration\Administrative Templates\System\Scripts and User Configuration\Administrative Templates\System\Scripts. Through policy, you can control the behavior of startup, shutdown, logon, and logoff scripts. The key policies that you'll use are described in Table 8-4. As you'll see, there are numerous options for configuring script behavior.

Table 8-4. Computer and User Script Policies

Policy Type

Policy Name

Description

Computer

Maximum Wait Time For Group Policy Scripts

Sets the maximum time to wait for scripts to finish running. The default value is 600 seconds (10 minutes).

Computer

Run Shutdown Scripts Visible

Displays shutdown scripts and their instructions as they execute.

Computer

Run Startup Scripts Asynchronously

Allows the system to run startup scripts simultaneously rather than one at a time.

Computer

Run Startup Scripts Visible

Displays startup scripts and their instructions as they execute.

Computer/User

Run Logon Scripts Synchronously

Ensures the system waits for logon scripts to finish before displaying the Windows interface.

User

Run Legacy Logon Scripts Hidden

Hides logon scripts configured through System Policy Editor in Windows NT 4.

User

Run Logoff Scripts Visible

Displays logoff scripts and their instructions as they execute.

User

Run Logon Scripts Visible

Displays logon scripts and their instructions as they execute.

Although there are many ways to control script behavior, you'll usually want scripts to behave as follows:

  • Logon and startup scripts should run simultaneously (in most cases).

  • All scripts should be hidden rather than visible.

  • The system should wait no more than one minute for a script to complete (in most cases).

To enforce this behavior, follow these steps:

1.
Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Scripts.

2.
Double-click Run Logon Scripts Synchronously. On the Setting tab, select Disabled.

3.
Double-click Run Startup Scripts Asynchronously. On the Setting tab, select Enabled.

4.
Double-click Run Startup Scripts Visible. On the Setting tab, select Disabled.

5.
Double-click Run Shutdown Scripts Visible. On the Setting tab, select Disabled.

6.
Double-click Maximum Wait Time For Group Policy Scripts. On the Setting tab, select Enabled and then enter a value of 600 for the wait time in the Seconds field, as shown in Figure 8-8. Click OK.

Figure 8-8. Set the maximum wait time for scripts.

7.
Access User Configuration\Administrative Templates\System\Scripts.

8.
Double-click Run Legacy Logon Scripts Hidden. On the Setting tab, select Enabled.

9.
Double-click Run Logon Scripts Visible. On the Setting tab, select Disabled.

10.
Double-click Run Logoff Scripts Visible. On the Setting tab, select Disabled and then click OK to complete the configuration process for scripts.

Assigning Computer Startup and Shutdown Scripts

Computer startup and shutdown scripts can be assigned as part of a group policy. In this way, a computer and all its usersor all computers that are members of the site, domain, or OUexecute scripts automatically when they're started or shut down.

To assign computer scripts, follow these steps:

1.
For easy management, copy the scripts you want to use to the Scripts\Startup or Scripts\Shutdown folder for the related policy. Scripts are stored in the %SystemRoot%\Sysvol\Sysvol\%UserDnsDomain%\Policies\GUID\Machine folder on domain controllers and %SystemRoot%\System32\GroupPolicy\Machine on Windows Vista workstations.

2.
Access the Group Policy console for the resource you want to work with. Then access Computer Configuration\Windows Settings\Scripts.

3.
To work with startup scripts, right-click Startup and then select Properties. To work with shutdown scripts, right-click Shutdown and then select Properties. This opens a dialog box similar to the one shown in Figure 8-9.

Figure 8-9. Manage computer startup scripts using the Startup Properties dialog box.

4.
Click Show Files. If you copied the computer script to the correct location, you should see the script.

5.
Click Add to assign a script. This opens the Add A Script dialog box. In the Script Name field, type the name of the script you copied to the Scripts\Startup or the Scripts\Shutdown folder for the related policy. In the Script Parameters field, enter any command-line arguments to pass to the command-line script or parameters to pass to the scripting host for a WSH script. Repeat this step to add other scripts.

6.
During startup or shutdown, scripts are executed in the order in which they're listed in the Properties dialog box. Click Up or Down to reposition scripts as necessary.

7.
If you want to edit the script name or parameters later, select the script in the Script For list and then click Edit.

8.
To delete a script, select the script in the Script For list and then click Remove.

Assigning User Logon and Logoff Scripts

User scripts can be assigned as part of a group policy. In this way, all users who access a computer or are members of the site, domain, or OU execute scripts automatically when they log on or log off.

To assign user scripts, complete the following steps:

1.
For easy management, copy the scripts you want to use to the Scripts\Logon or the Scripts\Logoff folder for the related policy. User scripts are stored in the %SystemRoot%\Sysvol\Sysvol\%UserDnsDomain%\Policies\GUID\User folder on domain controllers and %WinDirSystemRoot%\System32\GroupPolicy\User on Windows Vista workstations.

2.
Access the Group Policy console for the resource you want to work with. Then access User Configuration\Windows Settings\Scripts.

3.
To work with logon scripts, right-click Logon and then select Properties. To work with logoff scripts, right-click Logoff and then select Properties. This opens a dialog box similar to the one shown in Figure 8-10.

Figure 8-10. Manage user logon scripts using the Logon Properties dialog box.

4.
Click Show Files. If you copied the user script to the correct location, you should see the script.

5.
Click Add to assign a script. This opens the Add A Script dialog box. In the Script Name field, type the name of the script you copied to the Scripts\Logon or the Scripts\Logoff folder for the related policy. In the Script Parameter field, enter any command-line arguments to pass to the command-line script or parameters to pass to the scripting host for a WSH script. Repeat this step to add other scripts.

6.
During logon or logoff, scripts are executed in the order in which they're listed in the Properties dialog box. Click Up or Down to reposition scripts as necessary.

7.
If you want to edit the script name or parameters later, select the script in the Script For list and then click Edit.

8.
To delete a script, select the script in the Script For list and then click Remove.


Working with Logon and Startup Policies

Windows Vista provides a set of policies to control the logon process, some of which allow you to configure the way programs run at logon. This makes them similar to logon scripts, in that you can execute specific tasks at logon. Other policies change the view in the welcome and logon screens. The main logon and startup policies that you'll use are available at Administrative Templates\System\Logon and are summarized in Table 8-5.

Table 8-5. Logon and Startup Policies

Policy Type

Policy Name

Description

Computer

Always Use Classic Logon

This overrides the default simple logon screen and uses the logon screen from previous versions of Windows.

Computer

Always Wait For The Network At Computer Startup And Logon

Requires the computer to wait for the network to be fully initialized. At startup, this Group Policy is fully applied rather than using a background refresh. At logon, this means the user account cannot be authenticated against cached credentials and must be authenticated against a domain controller.

Computer

Don't Display The Getting Started Welcome Screen At Logon

Hides the welcome screen that is displayed when new users log on. This only applies to Windows Vista and not to servers.

Computer/User

Do Not Process The Legacy Run List

Disables running startup applications other than those set through System Policy Editor in Windows NT 4.

Computer/User

Do Not Process The Run-Once List

Forces the system to ignore customized run-once lists.

Computer/User

Run These Programs At User Logon

Sets programs that all users should run at logon. Use the full file path (unless program is in %SystemRoot%).

Hiding the Welcome Screen

Experienced users often find the welcome screen annoying, particularly because it is displayed automatically every time they log on to a new computer. To hide the welcome screen at logon, follow these steps:

1. | Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Logon.
2. | Double-click Don't Display The Getting Started Welcome Screen At Logon. On the Setting tab, select Enabled and then click OK.

Using Classic Logon vs. Simple Logon

The simple logon window is new in Windows Vista. It is the default authentication, and although that view can be useful, some users might prefer to see only the classic logon window. To use classic logon rather than simple logon, follow these steps:

1. | Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Logon.
2. | Double-click Always Use Classic Logon. On the Setting tab, select Enabled and then click OK.

Note

For more details, see the "Controlling Logon: Welcome Screens and Classic Logons" section of Chapter 6, "Managing User Access and Security."

Setting Policy-Based Startup Programs

Although users can configure their startup applications separately, it usually makes more sense to handle this through policy, especially in an enterprise in which the same applications should be started by groups of users. To specify programs that should start at logon, follow these steps:

1. | Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Logon.
2. | Double-click Run These Programs At User Logon. On the Setting tab, select Enabled.
3. | To assign startup applications through policy, click Show. In the Show Contents dialog box, specify applications according to their full file or UNC path, such as D:\Program Files\Internet Explorer\IEXPLORE.EXE or \\DCServ01\Apps\STATS.EXE.
4. | Close all open dialog boxes.

Disabling Run Lists Through Policy

Using policy, you can disable legacy run lists as well as run-once lists. Legacy run lists are stored in the registry in

HKEY_LOCAL_MACHINE
 \SOFTWARE
  \Microsoft
   \Windows
    \CurrentVersion
     \Run

and

HKEY_CURRENT_USER
 \Software
  \Microsoft
   \Windows
    \CurrentVersion
     \Run

Run-once lists can be created by administrators to specify programs that should run the next time the system starts but not on subsequent restarts. Run-once lists are stored in the registry under

HKEY_LOCAL_MACHINE
 \SOFTWARE
  \Microsoft
   \Windows
    \CurrentVersion
     \RunOnce

To disable run lists, follow these steps:

1. | Access Group Policy for the computer you want to work with. Next, access Computer Configuration\Administrative Templates\System\Logon or User Configuration\Administrative Templates\System\Logon.
2. | Double-click Do Not Process The Run Once List. On the Setting tab, select Enabled. Click OK.
3. | Double-click Do Not Process The Legacy Run List. On the Setting tab, select Enabled and then click OK.


Chapter 9. Managing Disk Drives and File Systems

In this chapter:
Disk Management Essentials | 269
Improving Disk Performance | 275
Working with Basic and Dynamic Disks | 280
Using Basic and Dynamic Disks | 282
Working with Disks, Partitions, and Volumes | 288
Partitioning Disks and Preparing Them for Use | 290
Moving a Dynamic Disk to a New System | 303
Troubleshooting Common Disk Problems | 305

Most computers have several types of drives, including physical drives and removable media drives. A hard disk drive is the typical primary storage device. In most cases, the first hard disk drive installed is designated as Disk 0. If additional hard disk drives are installed, they are designated as Disk 1, Disk 2, and so on. This chapter discusses tools and techniques for managing disk drives and file systems. You'll learn how to partition, format, and convert disks from one disk type to another. You'll also learn about Microsoft Windows Vista features that affect how drivers are used, including Windows ReadyBoost, Windows ReadyDrive, and Windows SuperFetch.


Disk Management Essentials

Windows Vista enables you to designate a physical drive as either a basic disk or a dynamic disk.

  • Basic disks The historically available disk type, a basic disk can, on Windows Vista, be divided into one or more partitions. A partition is a logical section of a disk that operates as if it were a physically separate disk. To use a partition, you must format it for a particular file system (FAT, FAT32, or NTFS) and assign it a drive designator. The formatted partition is then referred to as a basic volume, and you can access it as a local disk on the computer. Windows Vista supports both primary and extended partitions on basic disks. A primary partition is used to start the operating system. You access a primary partition directly by its drive designator. You cannot subdivide a primary partition. An extended partition, on the other hand, is accessed indirectly. After you create an extended partition, you must divide it into one or more logical drives. You can then access the logical drives independently of each other.

  • Dynamic disks Introduced with Microsoft Windows 2000, these disks enable you to perform most common disk maintenance tasks without having to restart the computer. Like a basic disk, a dynamic disk can be divided. However, dynamic disks are divided into volumes rather than partitions. A volume is very similar to a partition. The most commonly used type of volume is a simple volume. A simple volume is a volume on a single disk, which can be used to start the operating system and for general data storage. Other types of volumes can be used as well, including those that enable you to extend a single volume across several disks (a spanned volume). As with a partition or a logical drive, you must format a volume on a dynamic disk and assign it a drive designator before you can use it. The formatted volume is referred to as a dynamic volume, and you can access it as a local disk on the computer. When a dynamic volume combines space from multiple physical drives, it will still appear as a single local disk, accessed by a single drive designator.

Windows Vista provides several tools for working with a computer's disks. The first and most often overlooked is the Computer console. Other tools include Disk Management, FSUtil, and DiskPart.

Using the Computer Console

To access the Computer console, click Start and select Computer. You can use the Computer console to quickly determine the available storage devices on a computer. As Figure 9-1 shows, the Computer console provides the following details:

  • Hard Disk Drives Lists the local disks available on the computer. Right-click a disk to display available management options, including Explore, which opens the disk in Windows Explorer with a complete Folders view. Explore is much more convenient than Open, which opens the disk in Windows Explorer but doesn't display a complete Folders view.

  • Devices With Removable Storage Lists the removable storage devices on the computer, including CD, DVD, and floppy disk drives. Right-click a device to display available management options, including Eject, which is convenient for ejecting current media so that new media can be inserted.

    Tip

    Universal serial bus (USB) flash drives and FireWire/USB-attached external hard drives are being used more and more in place of floppies and other types of removable media. If a computer has a USB or FireWire port, you can easily connect or disconnect a drive. Before you disconnect a USB or FireWire drive, you should ensure that it is in a safe state. The Safely Remove option provides one way to do this. Right-click the disk designator in Windows Explorer or any related view, such as the Devices With Removable Storage list, and then select either Eject or Safely Remove. As long as files on the drive are not in use, you should then be able to safely disconnect the drive.

  • Network Location Lists any available network drives. A network drive provides access to a shared folder or a disk on another computer. You can connect network drives by right-clicking Computer on the Start menu and choosing Map Network Drive to start the Map Network Drive Wizard. To disconnect a network drive, right-click Computer on the Start menu and choose Disconnect Network Drive to open the Disconnect Network Drive dialog box.

Figure 9-1. The Computer console provides easy access to a computer's storage devices.

[View full size image]

Using Disk Management

When you want to configure drives, the tool of choice is Disk Management. Disk Management provides the tools you need to manage disks, partitions, volumes, logical drives, and their related file systems. Disk Management is a Microsoft Management Console (MMC) snap-in that can be accessed through a preconfigured console or added to any custom console you've created. Using Disk Management, you'll be able to perform the following tasks:

  • Determine the capacity, free space, status, and other properties of disks.

  • Create partitions and logical drives on basic disks.

  • Create volumes on dynamic disks.

  • Extend volumes to increase their size or to span multiple disks.

  • Format volumes and specify the file system to use as FAT, FAT32, or NTFS.

  • Assign drive letters and paths to volumes.

  • Convert basic disks to dynamic disks and vice versa.

You can start Disk Management at an elevated command prompt by typing diskmgmt.msc. Alternatively, right-click Computer on the Start menu, choose Manage to start Computer Management, and then select Disk Management in the left pane of the Computer Management window.

When you start Disk Management, you're automatically connected to the local computer. To examine drives on another computer, right-click the Computer Management entry in the console tree and select Connect To Another Computer on the shortcut menu. You can now choose the system whose drives you want to examine. From the command line, you can connect to another computer when starting Computer Management by typing compmgmt.msc /computer=ComputerName, where ComputerName is the name of the remote computer to which you want to connect.

In the default configuration, shown in Figure 9-2, Disk Management displays the Volume List view in its upper panel and the Graphical view in its lower panel. Although only two views can be shown at any one time, three views are available.

Figure 9-2. Use Disk Management to manage disk configurations.

[View full size image]

  • Volume List view Provides a detailed summary of all the drives on the computer. Clicking a column label, such as Layout or Status, allows you to sort the disk information based on that column.

  • Graphical view Provides a graphical overview of all the physical and logical drives available. Summary information for the physical disk devices includes the disk number and device type, such as basic, removable, or CD-ROM; the disk capacity; and the status of the disk device, such as online or offline. Additional details are also provided for each local disk on the physical disk, including the drive letter and text label for the associated partition or volume; the file system type, such as FAT, FAT32, or NTFS; the size of the drive section in megabytes (MB); and the local disk status, such as healthy or unhealthy.

  • Disk List view Provides summary information about physical drives. This information includes the disk number and device type, such as basic, removable, or CD-ROM; the disk capacity; the size of unallocated space on the disk (if any); the status of the disk device, such as online or offline; and the device interface type, such as integrated device electronics (IDE), small computer system interface (SCSI), universal serial bus (USB), or FireWire (1394).

You can change the view for the top or bottom pane using options from the View menu. To change the top view, select View, choose Top, and then select the view you want to use. To change the bottom view, select View, choose Bottom, and then select the view you want to use.

As you can see, the available views provide overviews of available disks. To get more detailed information on a local disk, right-click it in any of Disk Management's views and then select Properties. When you do this, you'll see a dialog box much like the one shown in Figure 9-3. This is the same dialog box that you can access from Windows Explorer (by right-clicking the top-level icon for the drive and then choosing Properties).

Figure 9-3. Examine detailed information for a drive using its Properties dialog box.

Using FSUtil and DiskPart

Windows Vista provides several command-line tools for working with disks, including the following:

  • FSUtil Meant to be used by support professionals who need to manage disks at a fairly low level. Using FSUtil, you can examine and work with meta-information related to disks and the information they contain, including update sequence number (USN) change journals, reparse points, and hard links. You can also obtain detailed sector and cluster information, such as the number of free or reserved sectors on a disk. To learn more about FSUtil, type fsutil help at an elevated command prompt.

  • DiskPart A text-mode command interpreter that you can use to manage disks, partitions, and volumes from the command prompt. Not only can DiskPart perform many of the same operations as Disk Management, but it can also be used with scripts to automate disk management processes. You start DiskPart by typing diskpart at an elevated command prompt. You will then be at the DISKPART> prompt. If you type help and press Enter, you will see a list of available commands and a description of their usage.

    Note

    Unlike Disk Management, which provides a friendly interface and is fairly easy to use, FSUtil and DiskPart are complex tools meant for advanced administrators. Their use is covered in detail in Microsoft Windows Command-Line Administrator's Pocket Consultant (Microsoft Press, 2004). You'll find a detailed example of using DiskPart in the "Marking a Partition as Active" section of this chapter.


Improving Disk Performance

Windows Vista has several features that affect how disks are used. These include:

  • Windows ReadyBoost Boosts system performance by using USB flash devices as additional sources for caching

  • Windows ReadyDrive Boosts system performance on mobile computers equipped with hybrid drives

  • Windows SuperFetch Boosts system performance using a modified memory management algorithm

Each of these features is discussed in the sections that follow.

Understanding and Using Windows ReadyBoost

A computer's disk drives aren't just used for reading and writing application data and user documents. The operating system makes extensive use of a computer's disk drives for paging files and system cache. Because it's significantly slower to read from and write to a disk than it is to read from and write to physical memory (RAM), this can cause a bottleneck that degrades performance. Windows Vista introduces Windows ReadyBoost as a way to reduce the performance impact related to reading and writing the system cache.

With Windows ReadyBoost, USB flash devices with sufficiently fast memory are used to extend the disk caching capabilities of the computer's main memory. Using flash devices for caching allows Windows Vista to make random reads faster by caching data on the USB flash device instead of a disk drive. Because this caching is applied to all disk content, not just the page file or system dynamic-link libraries (DLLs), the computer's overall performance is boosted because flash devices can be read up to 10 times faster than physical disk drives.

USB flash devices that can be used with Windows ReadyBoost include USB 2.0 flash drives, Secure Digital (SD) cards, and CompactFlash cards. These devices must have sufficiently fast flash memory and be at least 512 MB or larger in size. If the flash device has both slow and fast flash memory, only the fast flash memory portion will be used for boosting performance. Windows Vista can use an amount of flash memory equal to twice the amount of physical memory (RAM) on the computer.

Memory on USB flash devices is primarily used for random input/output (I/O), because most flash devices are slower than a disk drive for sequential I/O. Windows ReadyBoost maximizes performance by automatically passing large, sequential read requests to the computer's disk drive for servicing. To allow a USB flash device to be removed at any time, all data writes are made to the hard disk before being copied to the flash device. This means all data stored on the flash device is duplicated on the hard disk and there is no potential for data loss when removing the flash device. Additionally, because the flash device's memory may contain sensitive information, Windows ReadyBoost encrypts the data so it can only be used with the computer on which it was originally written.

Enabling ReadyBoost

With Windows ReadyBoost, USB flash devices with sufficiently fast flash memory can be used as additional sources of system cache. The following steps detail how Windows ReadyBoost works the first time you use a USB flash device with a computer:

1.
When you insert a USB flash device into a USB 2.0 or higher port, Windows Vista analyzes the speed of the flash memory on the device. If the flash memory performs at a sufficiently high speed, the computer's physical memory can be extended to the USB flash device. In most cases, you'll want the flash memory to be at least as fast as the computer's bus speed.

2.
The AutoPlay dialog box, shown in Figure 9-4, should be displayed automatically. If you want the device to always be used with Windows ReadyBoost when inserted, select the Always Do This... check box. Because you've selected the Always Do This... option, the AutoPlay dialog box will not be displayed the next time you insert the device (unless you change the AutoPlay defaults in Control Panel).

Figure 9-4. Select the Speed Up My System Using Windows ReadyBoost option.

3.
When you click Speed Up My System Using Windows ReadyBoost, Windows Vista extends the computer's physical memory to the device. The default configuration enables Windows ReadyBoost to reserve all available space on the device for boosting system speed.

Note

Windows Vista can use an amount of flash memory equal to twice the amount of physical memory (RAM) on the computer. If a device has both fast and slow flash memory, Windows Vista only uses the fast portion of the memory.

To use Windows ReadyBoost with a USB flash device that you either already inserted or that you previously declined to use with Windows ReadyBoost, follow these steps:

1. | Click Start and then click Computer.
2. | Right-click the USB flash device in the Devices With Removable Storage list and then choose Properties.
3. | On the ReadyBoost tab, select Use This Device and then click OK.

For USB flash devices that do not support ReadyBoost, you cannot enable the device. The only option you'll have is to stop retesting the device when you plug it in. The Stop Retesting This Device When I Plug It In option is selected by default.

Configuring ReadyBoost

Windows ReadyBoost can be used in a variety of configurations. You do not have to configure the computer to use all available space on the USB flash device. You can also configure a specific amount of space to reserve. To do this, follow these steps:

1. | Click Start and then click Computer.
2. | Right-click the USB flash device in the Devices With Removable Storage list and then choose Properties.
3. | On the ReadyBoost tab, use the Space To Reserve For System Speed slider or combo box to set the amount of space to use with ReadyBoost. If you reserve less than the total amount of space available, the free space can be used for files and data.
4. | Click OK.
Ejecting a USB Flash Device That Uses ReadyBoost

You can safely remove a USB flash device that uses ReadyBoost at any time without losing data or negatively impacting the system. However, when the device is removed, the system performance returns to its normal levelthe performance level experienced without the device. To remove the device, follow these steps:

1. | Open Windows Explorer or another Explorer view, such as Computer.
2. | Right-click the device and then select Eject or Safely Remove.

Understanding and Using Windows ReadyDrive

Windows ReadyDrive improves performance on mobile computers equipped with hybrid drives. A hybrid drive is a drive that uses both flash RAM and a physical drive for storage. Because flash RAM is much faster than a physical disk, mobile computers running Windows Vista write data and changes to data to the flash memory first and periodically sync these writes and changes to the physical disk. This approach reduces the spinning of the physical drive and thus saves battery power.

The flash RAM on hybrid drives can be used to provide faster startup and resume from sleep or hibernation. In this case, the information needed for starting or resuming the operating system is written to the flash RAM prior to shutting down, entering sleep, or going into hibernation. When you start or wake the computer, this information is read from the flash RAM.

You do not need to enable ReadyDrive. ReadyDrive is enabled for use automatically on mobile computers with hybrid drives.

Understanding and Using Windows SuperFetch

Windows Vista improves performance and responsiveness by changing the way user processes and background processes are used. In Windows XP, user processes and background processes have the same memory use prioritization: User processes and background processes are both loaded into memory as they are used. Because there is no prioritization, there often is contention for memory, and there are often performance lags as well because after background processes run, they remain resident in memory. Therefore, data for user applications and processes must be loaded into memory when they are requested. Windows Vista corrects this issue by ensuring that background processes are unloaded after they run and when data for user processes is reloading into memory.

In Windows XP, user processes and background processes have the same I/O priority, which often results in conflict and poor read/write performance. Windows Vista corrects this by implementing high priority I/O and low priority I/O queues. High priority I/O is used for user process and application reads and writes to physical drives. Low priority I/O is used for background process reads and writes to physical drives.

Note

With Windows Vista, many services and routine housekeeping tasks run as background processes. For example, on Windows Vista, Disk Defragmenter is scheduled to run automatically to periodically defragment disks. When Disk Defragmenter runs, it runs as a background process and uses low priority I/O.

The key feature that makes memory and I/O prioritization work is Windows SuperFetch. Windows SuperFetch improves system performance using a modified memory management algorithm. Unlike the memory management algorithm in Windows XP and earlier versions of Windows, SuperFetch optimizes memory usage based on the way the current user is using the computer. SuperFetch does this by performing the following tasks:

  • Differentiating between user applications and background services running on the computer SuperFetch makes the computer more responsive to user requests by prioritizing the current user's processes over background tasks. Because user processes always have priority over background tasks, background tasks do not take up all the processor time and the system remains responsive to user requests.

  • Optimizing memory for users after running background tasks Housekeeping tasks on Windows Vista make better use of process idle time than earlier versions of Windows do. More system and maintenance tasks, such as Disk Defragmenter and Disk Backup, run during idle time. When the computer is idle, background processes run as they normally would. However, when background processes end, SuperFetch repopulates memory to the state it was in prior to running the background processes. This ensures memory is optimized for user processes and the computer is responsive to user requests.

  • Tracking the most frequently-used applications and anticipating user needs SuperFetch keeps track of which applications users run most frequently and also tracks when those applications typically are used. SuperFetch then uses the tracking information to preload the application and ready it for use when it expects that the user will need the application. This ensures faster startup for applications and faster user switching over time.

  • Taking advantage of Windows Vista's low priority I/O designation SuperFetch takes advantage of Windows Vista's high priority I/O and low priority I/O queues to improve read/write times for user processes and improve a computer's overall responsiveness. When multiple processes are competing for I/O, high priority processes always get more I/O time than low priority processes do. As a result, user processes and applications have better performance, and there is less contention for I/O time when both user processes and background processes are running.

As an administrator, you should understand not only how SuperFetch works but also the way it is configured. All versions of Windows Vista support SuperFetch. Some basic characteristics of SuperFetch follow.

  • Runs as a service named SuperFetch. This service runs automatically at startup and logs on using the Local System account.

  • Uses the SvcHost.exe executable, running in a network restricted mode. This means SuperFetch can only access the local computer and doesn't have access to any networks to which the computer might be connected.

  • Depends on the Filter Manager component for proper operations. Filter Manager provides file information and file system information needed by SuperFetch, and it is installed automatically with the operating system.

  • Writes prefetch data to the %SystemRoot%\prefetch folder. The prefetch data is used to quickly start applications. Within the prefetch folder, you'll also find several database files used to track application usage history and to speed up application performance. Application faults are also tracked in a database history file.


Working with Basic and Dynamic Disks

Not that long ago, all Windows computers shipped with their hard disks configured as basic disks. Now, because people want larger or more robust disks, computer manufacturers have responded by increasingly shipping computers with their hard disks configured as dynamic disks. Instead of having a single 120 gigabyte (GB) drive, a new computer might have a spanned disk with 360 GB, where three 120 GB drives act as a single local disk. In this scenario, disk spanning is used to make multiple disks appear to be a single disk, and the primary way to implement this on Windows Vista is to use dynamic disks. In other words, you can no longer take for granted that a new computer (or any computer, for that matter) has a basic disk. The only way to be sure of the disk type is to check Disk Management; all the views show the disk type.

As more and more computers are shipped with dynamic disks, you might wonder whether your computers using basic disks should be converted to dynamic disks. In some cases, the need for standardization might prompt your decision. For example, for better manageability, you might want all desktops in a particular department to have the same configuration. In other cases, IT management might direct the change, because the conversion from basic disks to dynamic disks can be considered an upgrade process. (That is, you are moving computers from an older disk type to a newer disk type.) However, before you decide to move from one disk type to another, you should understand what is involved, what features are supported, and what features are not supported.

A basic disk is a physical disk that has one or more basic volumes that can be configured as primary partitions, extended partitions, and logical drives. A primary partition is a drive section that you can access directly for file storage. Each physical drive can have up to four primary partitions. You make a primary partition accessible to users by creating a file system on it. In the place of one of the four permitted primary partitions, you can create an extended partition (meaning the basic disk could have up to three primary partitions and one extended partition). Unlike primary partitions, you can't access extended partitions directly. Instead, you can configure extended partitions with one or more logical drives that are used to store files. Being able to divide extended partitions into logical drives enables you to divide a physical drive into more than four sections. For example, you could create logical drives F, G, and H in a single extended partition.

A dynamic disk is a physical disk that has one or more dynamic volumes that can be configured as simple, spanned, or striped volumes. Unlike a basic disk, a dynamic disk can have an unlimited number of volumesany one of which can be extended or used as a system volume. Although basic disks can be used with any Windows-based operating system, dynamic disks can be used only with Windows 2000 or later and are incompatible with earlier versions of Windows. As an example, this means that if Disk 0 is a dynamic disk, you would not be able to boot that disk to Windows 98.

A key advantage of dynamic disks is the capability to combine physical disks using the spanning or striping feature of Windows Vista. When you span or stripe drives, you create a single dynamic volume that extends from one disk to other disks, using all or part of each disk in the set. The difference between spanning and striping is in how data is written. With spanning, Windows Vista recognizes spanned disks just as it would a single partition, and writes to the spanned disk are written to the entire partition randomly. With striping, Windows Vista writes a portion of the data to each of the underlying disks that make up the volume. In most cases, striping gives you faster read/write access to data because data is read from and written to multiple disks.

Caution

Technically, disk striping is redundant array of independent disks (RAID) level 0 (RAID-0). Neither disk striping nor spanning provides fault tolerance, however, and the failure of any disk in the set causes the volume to fail.

Real World

Many computer manufacturers provide two RAID options for their desktop computers: RAID-0 and RAID-1. With RAID-0, as discussed in this section, multiple drives are combined to create a single extended volume that has no fault tolerance, meaning that if any one of the drives in the extended volume fails, the entire volume fails. With RAID-1, also referred to as mirroring, two drives are combined to create a single fault tolerant volume. If any one volume fails, the other volume in the set is still available and the volume can be recovered. However, Windows Vista does not natively support RAID-1, so this level of RAID is implemented with hardware RAID controllers. You must follow the computer manufacturer's guidelines for working with the RAID controller and recovering failed drives.

You can't create spanned or striped drives using the basic disk type. You would need to upgrade to dynamic disks and then create volumes that use either spanning or striping as appropriate. These features and the ability to modify disks without having to restart the computer are the key capabilities that distinguish basic and dynamic disks. Other features available on a disk depend on the disk formatting, such as whether you are using FAT, FAT32, or NTFS.

Although you can use both basic and dynamic disks on the same computer, the disks that make up a volume must use the same disk type. For example, if you have striped Disk 0 and Disk 1, which were created under Microsoft Windows NT 4.0, you can use these drives under Windows Vista. If you want to upgrade Disk 0 to the dynamic disk type, you must also upgrade Disk 1. Converting from basic to dynamic and vice versa is covered in the "Converting a Basic Disk to a Dynamic Disk and Vice Versa" section of this chapter. It is important to note that although you can convert the disk type from basic to dynamic and preserve the data on the disk, you must delete any existing partitioning on a dynamic disk before you can convert from dynamic to basic. Deleting the partitioning destroys any data on the associated disks.

Finally, dynamic disks cannot be created on any removable-media drives (such as Zip, Jazz, or CD-ROM) or any disk on portable computers. This means laptops, tablet PCs, and other types of portable computers can have only basic disks. Although this limits your options for portable computer disk configuration, most portable computers don't have multiple internal physical disks anyway, so spanning configurations are a moot point.

Caution

Be careful when working with laptops. Some laptop configurations might make Disk Management think that you can convert a basic disk to a dynamic disk. This can occur on computers that do not support Advanced Power Management (APM) or Advanced Configuration and Power Interface (ACPI) and are not listed in the basic input/output system (BIOS) information file (%SystemRoot%\Inf\Biosinfo.inf). Although support for dynamic disks might seem to be enabled, this is an error, and trying to convert a basic disk to a dynamic disk on one of these laptops could corrupt the entire disk.

Note

External hard drives attached via FireWire or USB can in some cases be converted to dynamic disks. Microsoft Knowledge Base article 299598, "How To: Convert an IEEE 1394 Disk Drive to a Dynamic Disk Drive in Windows XP," details how this can be done. However, this article doesn't provide enough cautions. The external hard drive must only be used with a single computer. If you think you will need to move the drive to another computer in the future, you shouldn't convert it to a dynamic disk. Further, before attempting to convert any external hard drive attached via FireWire or USB, you should back up the data. If possible, perform the conversion on an identical but nonessential drive in a development or testing environment and then test the drive operation.


Using Basic and Dynamic Disks

That's it, essentially, when it comes to the hows and whys of basic and dynamic disks. When it comes to using basic and dynamic disks, you'll perform several related tasks, such as initializing new disks, setting a drive as active, or changing the drive type. Before performing these tasks, however, you should understand what the active, boot, system, and other drive designations mean.

Understanding the Active, Boot, System, and Other Drive Designations

Whether working with basic or dynamic disks, you should pay particular attention to five special types of drive sections.

  • Active The active partition or volume is the drive section from which an x86-based computer starts. When the computer uses multiple operating systems, the active drive section must contain the startup files for the operating system you want to start and it must be a primary partition on a basic disk. If you use Microsoft Windows NT, Windows 95, Windows 98, Windows Me, or MS-DOS, the active drive section should be the primary partition on Disk 0. If you use Windows 2000 or later, the active drive section can be a primary partition on a basic disk or a simple volume on a dynamic disk. The active partition is not normally marked as such in Disk Management. In most cases, it is the primary partition or the first simple volume on Disk 0. However, if you change the default configuration, you will see an Active label.

    Caution

    With removable media disks, you might see an Active status, which shouldn't be confused with the Active label associated with an active partition. Specifically, USB and FireWire card readers that use compact flash or other types of cards are displayed as having an Active status when media is inserted and the related drive is online. It is also important to note that in some cases, a removable media drive might be listed as Disk 0. In this case, you will need to look for the active partition on the first physical hard disk according to its disk number. For example, if the computer has Disk 0, Disk 1, and Disk 2, and the first physical disk in sequence is Disk 1, the active partition is most likely to be on the first primary partition on Disk 1.

  • System The system partition or volume contains the hardware-specific (bootstrap) files needed to load the operating system. The system partition or volume can't be part of a striped or spanned volume. The system partition is labeled as such in the Status field of Disk Management's Volume List and Graphical views.

  • Boot The boot partition or volume contains the operating system and its support files. On most systems, system and boot are the same partition or volume. Although it seems the boot and system partitions are named backward, this convention has been used since Windows NT was first introduced and has remained unchanged. Like the active partition, the boot partition is not normally marked as such in Disk Management. In most cases, it is the primary partition or the first simple volume on Disk 0. However, if the operating system is installed on a different partition or volume, you might see a Boot label.

  • Page file A page file partition or volume contains a paging file used by the operating system. Because a computer can page memory to multiple disks, according to the way virtual memory is configured, a computer can have multiple page file partitions or volumes. However, depending on the service packs configured, the computer may only report the primary volume being used as a paging file. See the "Configuring Virtual Memory" section in Chapter 2, "Managing Windows Vista Systems," for details on using and configuring paging files.

  • Crash dump The crash dump partition or volume is the one to which the computer attempts to write dump files in the event of a system crash. As discussed in Chapter 2 in the "Configuring System Startup and Recovery" section, dump files can be used to diagnose the causes of system failure. By default, dump files are written to the %SystemRoot% folder, but can be located on any desired partition or volume.

Each computer has one active, one system, one boot, and one crash dump partition or volume. The page file designation is the only drive designation that you might see on multiple partitions or volumes.

Installing and Initializing New Physical Disks

Windows Vista makes it much easier to add new physical disks to a computer. After you install the disks following the disk manufacturer's instructions, you need to log on and start Disk Management. If the new disks have already been initialized, meaning they already have disk signatures allowing them to be read and written to, they should be brought online automatically if you select Rescan Disks from the Action menu. If you are working with new disks that have not been initialized, meaning they don't have disk signatures, Disk Management will start the Initialize And Convert Disk Wizard as soon as it starts up and detects the new disks.

You can use the Initialize And Convert Disk Wizard to initialize the disks by completing the following steps:

1. | Click Next to exit the Welcome page. On the Select Disks To Initialize page, the disks you added are selected for initialization automatically, but if you don't want to initialize a particular disk, you can clear the related option.
2. | Click Next to display the Select Disks To Convert page. This page lists the new disks as well as any nonsystem or boot disks that can be converted to dynamic disks. The new disks aren't selected by default. If you want to convert the disks, select them and then click Next.
3. | The final page shows you the options you've selected and the actions that will be performed on each disk. If the options are correct, click Finish. The wizard then performs the designated actions. If you've elected to initialize a disk, the wizard writes a disk signature to the disk. If you've elected to convert a disk, the wizard converts the disk to a dynamic disk after writing the disk signature.

If you don't want to use the wizard, you can close it and use Disk Management instead to view and work with the disk. In the Disk List view, the disk will be marked with a red icon that has an exclamation point, and the disk's status will be listed as Not Initialized. You can then right-click the disk's icon and then select Initialize Disk. Confirm the selection (or add to the selection if more than one disk is available for initializing) and then click OK to start the initialization of the disk. Conversion to a dynamic disk would then proceed as discussed in the "Converting a Basic Disk to a Dynamic Disk and Vice Versa" section of this chapter.

Marking a Partition as Active

You don't normally need to change a partition's designation. If you are using only Windows Vista or if you are multibooting to Windows Vista and any other Windows-based operating system, you do not have to change the active partition. On an x86-based computer, the active partition typically is the primary partition or the first simple volume on Disk 0. If you install Windows Vista on drive C and Windows 2000 or later on a different partition, such as drive D, you don't need to change the active partition to boot Windows Vista or the other operating system. However, if you want to boot a non-Windows operating system, you typically must mark its operating system partition as active and then reboot to use this operating system.

Note

Only primary partitions can be marked as active. You can't mark logical drives as active. You can't mark volumes as active. When you upgrade a basic disk containing the active partition to a dynamic disk, this partition becomes a simple volume that's active automatically.

To mark a partition as active, complete the following steps:

1. | Make sure that the necessary startup files are on the primary partition that you want to make the active partition. For Windows NT, Windows 2000, and Windows XP, these files are Boot.ini, Ntdetect.com, Ntldr, and Bootsect.dos. You might also need Ntbootdd.sys.
2. | Start Disk Management by typing diskmgmt.msc at an elevated command prompt.
3. | Right-click the primary partition you want to mark as active and then select Mark Partition As Active.

Caution

If you mark a partition or volume as active, Disk Management might not let you change the designation. As a result, if you restart the computer, the operating system might fail to load. The only workaround I've found is to use DiskPart to make the appropriate changes either before rebooting or before using the startup repair tool following a failed start.

Listing 9-1 shows a sample DiskPart session for setting the active partition. As you can see, when you first start DiskPart, it shows the DiskPart program name and the version you are using, as well as the name of the computer. You then select the disk you want to work with and list its partitions. In this example, you select Disk 0 to work with, list its partitions, and then select partition 1. Once you've selected a disk and a partition on that disk, you can work with that partition. Simply typing the ACTIVE command at this point and pressing Enter sets the partition as active. When you are finished, you quit DiskPart using the EXIT command.

Note

This example uses Disk 0. On your system, Disk 0 might not be the one you want to work with. You can use the LIST DISK command to list the available disks and then use the information provided to determine which disk to work with.

Listing 9-1. Using DiskPart to Set the Active Partition

C:>diskpart

Microsoft DiskPart version 6.0.5782
Copyright (C) 1999-2007 Microsoft Corporation.
On computer: ENGPC85

DISKPART> select disk 0

Disk 0 is now the selected disk.

DISKPART> list partition

  Partition ###  Type             Size    Offset
  -------------  ---------------- ------- -------
  Partition 1    Primary          176 GB   32 KB

DISKPART> select partition 1

Partition 1 is now the selected partition.

DISKPART> active

DiskPart marked the current partition as active.

DISKPART> exit

Converting a Basic Disk to a Dynamic Disk and Vice Versa

The easiest way to convert a basic disk to a dynamic disk and vice versa is to use Disk Management. When you upgrade to a dynamic disk, partitions are automatically changed to volumes of the appropriate type. Any volume sets created under Windows NT are created as spanned or striped volumes as appropriate. Any primary partitions will become simple volumes. Any logical drives in an extended partition will become simple volumes. Any unused (free) space in an extended partition will be marked as Unallocated. You can't change these volumes back to partitions. Instead, you must delete the volumes on the dynamic disk and then change the disk back to a basic disk. Deleting the volumes destroys all the information on the disk.

Before you convert a basic disk to a dynamic disk, there are several important considerations. You should ensure that you don't need to boot the computer to a previous version of Windows. You should also ensure that the disk has 1 MB of free space at the end of the disk. Although Disk Management reserves this free space when creating partitions and volumes, disk management tools on other operating systems might not; as a result, the conversion will fail. It is also important to note the following restrictions:

  • You can't convert drives that use sector sizes larger than 512 bytes. If the drive has large sector sizes, you'll need to reformat before upgrading.

  • You can't convert removable media to dynamic disks. You can configure removable media drives only as basic drives with primary partitions.

  • You can't convert a disk if the system or the boot partition is part of a spanned or striped volume. You'll need to stop the spanning or striping before you perform the conversion.

Note

You can convert disks with other types of partitions that are part of spanned or striped volumes. These volumes become dynamic volumes of the same type. However, you must convert all drives in the set together.

To convert a basic disk to a dynamic disk, complete the following steps:

1.
In Disk Management, right-click a basic disk that you want to convert, either in the Disk List view or in the left pane of the Graphical view. Then select Convert To Dynamic Disk.

2.
In the Convert To Dynamic Disk dialog box, select the check boxes for the disks you want to convert, as shown in Figure 9-5. If you're upgrading a striped volume originally created on Windows NT, be sure to select all the basic disks in this set. You must convert the set together.

Figure 9-5. Select the basic disk to convert.

3.
If the disk you are converting has no formatted volumes, clicking OK converts the disk, and you do not need to follow the remaining steps. If the disk you are converting has formatted volumes, clicking OK displays the Disks To Convert dialog box, and you need to follow the remaining steps to complete the conversion.

4.
The Disks To Convert dialog box shows the disks you're converting so you can confirm the conversion. Notice the value in the Will Convert column, which should be Yes as long as the disk meets the conversion criteria, and then click Details to see the volumes on the selected drive. When you are ready to continue, click OK to close the Convert Details dialog box.

5.
To begin the conversion, click Convert. Disk Management warns you that once you convert the disk, you won't be able to boot previous versions of Windows from volumes on the selected disks. Click Yes to continue.

6.
Next you are warned that file systems on the disks to be converted will be dismounted, meaning they will be taken offline and be inaccessible temporarily. Click Yes to continue. If a selected drive contains the boot partition, the system partition, or a partition in use, Disk Management will need to restart the computer and you will see another prompt.

To convert a dynamic disk to a basic disk, complete the following steps:

1. | Before you can change a dynamic disk to a basic disk, you must delete all dynamic volumes on the disk. Because this destroys all the data on the volumes, you should back up the volumes and then verify the backups before making the change.
2. | When you are ready to start the conversion process, start Disk Management. In Disk Management, right-click the disk you want to convert and select Convert To Basic Disk. This changes the dynamic disk to a basic disk, and you can then create new partitions and logical drives on the disk.


Working with Disks, Partitions, and Volumes

Before you can store data on a physical disk, you must prepare the disk for use by partitioning its space, assigning a drive designator, and formatting the resulting partitions or volumes. Although basic disks can have up to four primary partitionsor three primary partitions and one extended partition, with one or more logical drives in the extended partitiondynamic disks can have an unlimited number of volumes.

After partitioning a disk, you must assign each partition or volume a drive designator. The drive designator can be a letter or a path. You use drive letters to access file systems in various partitions on physical drives. Generally speaking, the drive letters A through Z are available. However, the drive letter A is usually assigned to the system's floppy drive. If the system has a second floppy drive or another removable media drive, such as a Zip drive, the letter B is usually assigned to it (or unassigned otherwise). The drive letter C is usually assigned to the first partition or volume created on Disk 0. The drive letter D is usually assigned to the first CD-ROM or DVD-ROM. Thus, on most systems, the drive letters E through Z are available. If you need additional volumes, you can create them using drive paths.

A drive path is set as a folder location on an existing local disk. For example, you could mount additional drives as C:\Docs1, C:\Docs2, and C:\Docs3. Drive paths can be used with basic and dynamic disks. The only restriction for drive paths is that you mount them on empty folders that are on NTFS-formatted local disks.

Formatting a partition or a volume sets the file system that will be used and creates the necessary file structures. Generally speaking, you can format a partition or a volume as FAT, FAT32, or NTFS. There are restrictions and requirements for the use of each, however.

FAT is a 16-bit file system designed to be used with volume sizes of up to 4 GB and is also referred to as FAT16. FAT uses a boot sector that stores information about the disk type, the starting and ending sectors, and the active partition. FAT gets its name from the file allocation table it uses to track the cluster locations of files and folders. There is a primary table and a duplicate table. The duplicate is used to restore the primary table if it becomes corrupted. FAT also has the capability to mark clusters (sections of disk containing data) as unused, in use, bad, or reserved. This helps to make FAT a fairly robust file system. FAT is best with volumes of 2 GB or less, and it has a maximum file size of 2 GB. FAT can be used with floppy disks and removable disks.

FAT32 is a 32-bit version of FAT16, with some additional features and capabilities. Like FAT16, FAT32 uses a primary and a duplicate file allocation table. FAT32 can also mark clusters as unused, in use, bad, or reserved. FAT32 can also be used with floppy disks and removable disks. Unlike FAT16, FAT32 has a minimum volume size of 33 MB, a maximum volume size of 32 GB, and a maximum file size of 4 GB. This means FAT32 can be used with considerably larger partitions and volumes than FAT16.

Note

It is important to note that the 4-GB maximum file size limitation for FAT32 is specific to Windows 2000 and later versions of Windows. Using FAT32, some earlier versions of Windows can create volumes of larger size, as can other operating systems.

NTFS is very different from FAT16 and FAT32. Instead of using a file allocation table, NTFS uses a relational database to store information about files and folders. This database is called the Master File Table (MFT), and it stores a record of each file and folder on a volume as well as additional information that helps to maintain the volume. Overall, the MFT makes NTFS much more reliable and recoverable than either FAT16 or FAT32. This means that NTFS can recover from disk errors more readily than FAT16 and FAT32 can, and that NTFS generally has fewer disk problems.

NTFS has a maximum volume size of 2 TB (terabytes, or trillion bytes) or higher (depending on disk configuration) and a maximum file size that is limited only by the volume size. Although you can't use NTFS with floppy disks, you can use NTFS with removable disks. Additionally, unlike FAT16 and FAT32, which have limited security features (namely that you can mark a file only as read-only, hidden, or system), NTFS has advanced security (meaning that you can use permissions to set very specific file and folder access). NTFS supports many other advanced features as well, including compression, encryption, and disk quotas.

Note

Several versions of NTFS have been implemented. NTFS 4 was first available with Windows NT. NTFS 5 was first available with Windows 2000. NTFS 5.1 was first available with Windows XP. Because most current computers have NTFS 5 or later, I focus on NTFS 5 and later in this book. It is also worth noting that if you upgrade a system with a version older than the current version, you are given the opportunity to convert existing NTFS volumes to the latest version during installation. In most cases, you want to do this because it ensures support for the latest NTFS features.


Partitioning Disks and Preparing Them for Use

Disk Management is the primary tool that you'll use to partition disks and prepare them for use. Using Disk Management, you can partition, assign drive designators to, and format both partitions and volumes. Disk Management's command-line counterparts include DiskPart for partitioning and drive designator assignment and Format for formatting.

Creating Partitions, Logical Drives, and Simple Volumes

Windows Vista simplifies the Disk Management user interface by using one set of dialog boxes and wizards for both partitions and volumes. The first three volumes on a basic drive are created automatically as primary partitions. If you try to create a fourth volume on a basic drive, the remaining free space on the drive is converted automatically to an extended partition with a logical drive of the size you designate. You designate the size by using the new volume feature it created in the extended partition. Any subsequent volumes are created in the extended partitions and logical drives automatically.

In Disk Management, you create partitions, logical drives, and simple volumes by completing the following steps:

1.
In Disk Management's Graphical view, right-click an unallocated or free area and then choose New Simple Volume. This starts the New Simple Volume Wizard. Read the Welcome page and then click Next.

2.
The Specify Volume Size page, shown in Figure 9-6, specifies the minimum and maximum size for the volume in MB and lets you size the volume within these limits. Size the partition in MB using the Simple Volume Size field and then click Next.

Figure 9-6. Set the size of the volume.

[View full size image]

3.
On the Assign Drive Letter Or Path page, shown in Figure 9-7, specify whether you want to assign a drive letter or path and then click Next. The available options are used as follows:

  • Assign The Following Drive Letter Choose this option to assign a drive letter. Then select an available drive letter in the selection list provided. By default, Windows Vista selects the lowest available drive letter and excludes reserved drive letters as well as those assigned to local disks or network drives.

  • Mount In The Following Empty NTFS Folder Choose this option to mount the partition in an empty NTFS folder. You must then type the path to an existing folder or click Browse to search for or create a folder to use.

  • Do Not Assign A Drive Letter Or Drive Path Choose this option if you want to create the partition without assigning a drive letter or path. If you later want the partition to be available for storage, you can assign a drive letter or path at that time.

Figure 9-7. Assign the drive designator or choose to wait until later.

[View full size image]

Note

Volumes don't have to be assigned a drive letter or a path. A volume with no designators is considered to be unmounted and is for the most part unusable. An unmounted volume can be mounted by assigning a drive letter or a path at a later date. See the "Assigning, Changing, or Removing Drive Letters and Paths" section later in this chapter.

4.
Use the Format Partition page, shown in Figure 9-8, to determine whether and how the volume should be formatted. If you want to format the volume, choose Format This Volume With The Following Settings and then configure the following options:

  • File System Sets the file system type as FAT, FAT32, or NTFS. NTFS is selected by default in most cases. If you create a file system as FAT or FAT32, you can later convert it to NTFS by using the Convert utility. You can't, however, convert NTFS partitions to FAT or FAT32.

  • Allocation Unit Size Sets the cluster size for the file system. This is the basic unit in which disk space is allocated. The default allocation unit size is based on the size of the volume and, by default, is set dynamically prior to formatting. To override this feature, you can set the allocation unit size to a specific value. If you use many small files, you might want to use a smaller cluster size, such as 512 or 1024 bytes. With these settings, small files use less disk space.

  • Volume Label Sets a text label for the partition. This label is the partition's volume name and by default is set to New Volume. You can change the volume label at any time by right-clicking the volume in Windows Explorer, choosing Properties, and typing a new value in the Label field provided on the General tab.

  • Perform A Quick Format Tells Windows Vista to format without checking the partition for errors. With large partitions, this option can save you a few minutes. However, it's usually better to check for errors, which enables Disk Management to mark bad sectors on the disk and lock them out.

  • Enable File And Folder Compression Turns on compression for the disk. Built-in compression is available only for NTFS. Under NTFS, compression is transparent to users and compressed files can be accessed just like regular files. If you select this option, files and directories on this drive are compressed automatically. For more information on compressing drives, files, and directories, see the "Compressing Drives and Data" section in Chapter 15, "Optimizing Windows Vista."

Figure 9-8. Set the formatting options for the partition.

[View full size image]

5.
Click Next, confirm your options, and then click Finish.

Creating Spanned and Striped Volumes on Dynamic Disks

With spanning and striping, you create a single dynamic volume that extends across multiple disks. When working with spanning and striping, keep the following in mind:

  • A spanned volume uses free space on multiple dynamic disks. If you have unallocated space on two or more dynamic disks, you can combine this space to create a spanned volume. A spanned volume has no fault tolerance and has average read/write performance. Files are written to the entire spanned volume randomly. If any of the disks fail, the entire volume will fail as well, and all data will be lost.

  • A striped volume uses free space on multiple disks and stripes the data as it is written. Striping gives you faster read/write access to data because data is read from and written to multiple disks. For example, with a three-disk striped volume, data from a file will be written to Disk 1, then to Disk 2, and then to Disk 3 in 64-KB blocks. Like a spanned volume, a striped volume has no fault tolerance, so if any of the disks fail, the entire volume will fail as well, and all data will be lost.

Note

If you have only one dynamic disk available, you will not be able to create a spanned or striped volume. Also note that simple and spanned volumes can be extended to increase their volume size. Striped volumes, however, cannot be extended. So when you create a striped volume, you should be very certain that the volume size is what you want to use. Otherwise, you might have to delete and then re-create the striped volume.

In Disk Management, you create spanned or striped volumes on dynamic disks by completing the following steps:

1.
In Disk Management's Graphical view, right-click an unallocated area and then choose New Spanned Volume or New Striped Volume as appropriate. Read the Welcome page and then click Next.

2.
On the Select Disks page, shown in Figure 9-9, select the dynamic disks that are to be a part of the volume and size the volume segments on those disks. Then click Next.

Figure 9-9. Specify the amount of space to use for each volume.

[View full size image]

Available dynamic disks are shown in the Available list box. Select a disk in this list box and then click Add to add the disk to the Selected list box. If you make a mistake, you can remove disks from the Selected list box by selecting the disk and then clicking Remove.

Specify the space that you want to use on each disk by selecting each disk in the Selected list box and then using the Select The Amount Of Space In MB list box to specify the amount of space to use on the selected disk. Keep in mind that the Maximum field shows you the largest area of free space available on the selected disk and the Total Volume Size field shows you the total disk space currently allocated to the volume.

Tip

There's a quick way to use the same amount of space on all selected disks. To do this, highlight each disk by pressing Shift and then clicking the first disk and the last disk in the Selected list box. Now when you set the amount of space to use, you'll set the amount for all selected disks.

3.
Follow steps 35 in the previous section, "Creating Partitions, Logical Drives, and Simple Volumes."

Shrinking or Extending Volumes

As discussed in Chapter 2, Windows Vista doesn't user Ntldr and Boot.ini to load the operating system. Instead, Windows Vista has a pre-boot environment in which Windows Boot Manager is used to control startup and load the boot application you've selected. The Windows Boot Manager also finally frees the Windows operating system from its reliance on MS-DOS, enabling you to use drives in new ways. Windows Vista enables you to extend and shrink both basic and dynamic disks. You can use either Disk Management or DiskPart to extend and shrink volumes. You cannot shrink or extend striped volumes.

In extending a volume, you convert areas of unallocated space and add them to the existing volume. For spanned volumes on dynamic disks, the space can come from any available dynamic disk, not only those on which the volume was originally created, enabling you to combine areas of free space on multiple dynamic disks and use those areas to increase the size of an existing volume.

Caution

Before you try to extend a volume, you should know about several limitations. First, simple and spanned volumes can be extended only if they are formatted and the file system is NTFS. You can't extend striped volumes. You can't extend volumes that aren't formatted or that are formatted with FAT or FAT32. Additionally, you can't extend a system or boot volume, regardless of its configuration.

You can shrink a simple volume or a spanned volume by completing the following steps:

1.
In Disk Management, right-click the volume that you want to shrink and then select Shrink Volume. This option is available only if the volume meets the previously discussed criteria.

2.
In the field provided in the Shrink dialog box, shown in Figure 9-10, enter the amount of space to shrink. The Shrink dialog box provides the following information:

  • Total Size Before Shrink In MB Lists the total capacity of the volume in MB. This is the formatted size of the volume.

  • Size Of Available Shrink Space In MB Lists the maximum amount by which the volume can be shrunk. This doesn't represent the total amount of free space on the volume; rather, it represents the amount of space that can be removed, not inclusive of any data reserved for the master file table, volume snapshots, page files, and temporary files.

  • Amount of Space To Shrink In MB Lists the total amount of space that will be removed from the volume. The initial value defaults to the maximum amount of space that can be removed from the volume. For optimal drive performance, you'll want to ensure the drive has at least 10 percent of free space after the shrink operation.

  • Total Size After Shrink In MB Lists what the total capacity of the volume in MB will be after the shrink. This is the new formatted size of the volume.

Figure 9-10. Specify the amount of space to shrink from the volume.

3.
Click Shrink to shrink the volume.

You can extend a simple volume or a spanned volume by completing the following steps:

1.
In Disk Management, right-click the volume that you want to extend and then select Extend Volume. This option is available only if the volume meets the previously discussed criteria and free space is available on one or more of the system's dynamic disks.

2.
In the Extend Volume Wizard, read the introductory message and then click Next.

3.
On the Select Disks page, shown previously in Figure 9-9, select the disk or disks from which you want to allocate free space. Any disks currently being used by the volume will automatically be selected. By default, all remaining free space on those disks will be selected for use.

4.
With dynamic disks, you can specify the additional space that you want to use on other disks by performing the following tasks:

  • Click the disk and then click Add > to add the disk to the Selected list box.

  • Select each disk in the Selected list box and then use the Select The Amount Of Space In MB list box to specify the amount of unallocated space to use on the selected disk.

5.
Click Next, confirm your options, and then click Finish.

Formatting Partitions and Volumes

When you format a partition or a volume, you create a file system that can be used to store data and that permanently deletes any existing data in the associated section of the physical disk. This is high-level formatting that creates the file system structure rather than low-level formatting that initializes a drive for use. To format a partition or a volume, right-click it in Disk Management and then choose Format. This opens the Format dialog box, shown in Figure 9-11. If you compare Figure 9-8 and Figure 9-11, you'll see that the available fields are essentially the same.

Figure 9-11. Use the Format dialog box to format a partition or a volume by specifying its file system type and volume label.

After selecting the appropriate options, click OK to proceed. Because formatting a partition destroys any existing data, Disk Management gives you one last chance to abort the procedure. Click OK to start formatting the partition. Disk Management then changes the status of the drive to reflect the formatting and, unless you are using the Perform A Quick Format option, the percentage of completion. When formatting is complete, the drive status will change to reflect this.

Assigning, Changing, or Removing Drive Letters and Paths

Each primary partition, logical drive, or volume on a computer can be assigned one driver letter and one or more drive paths, provided the drive paths are mounted on empty NTFS folders. Once assigned, the drive letter or path remains constant every time you start the computer. Except on partitions or volumes that are designated as system or boot, you can change the drive letter or path assignment at any time. You can also remove a drive letter or path assignment except on partitions or volumes that are designated as system or boot.

Note

The drive letter or path assignment for the system or boot volume can be changed only by editing the registry. The procedure for making the change for Windows 2000 is described in Microsoft Knowledge Base article 223188. The procedure for making the change for Windows Vista is the same. However, it is important to be aware that if anything goes wrong during this procedure, you will likely be unable to boot the system and might have to recover the computer from backups.

To manage a partition's or a volume's drive letters or paths, go to Disk Management and right-click the partition or volume you want to configure. Then choose Change Drive Letter And Paths. This opens a dialog box, shown in Figure 9-12. You can now perform the following actions:

  • Add a drive path Click Add, select Mount In The Following Empty NTFS Folder, and then type the path to an existing folder, or click Browse to search for or create a folder.

  • Remove a drive path Select the drive path to remove, click Remove, and then click Yes.

  • Assign a drive letter Click Add, select Assign The Following Drive Letter, and then choose an available letter to assign to the drive.

  • Change the drive letter Select the current drive letter and then click Change. Select Assign The Following Drive Letter and then choose a different letter to assign to the drive.

  • Remove a drive letter Select the current drive letter, click Remove, and then click Yes.

Figure 9-12. Use this dialog box to change or remove the drive letter and path assignment.

Note

If you try to change the letter of a drive that's in use, Windows Vista displays a warning. You'll need to exit programs that are using the drive and try again, or allow Disk Management to force the change by clicking Yes when prompted.

Real World

If the drive letter you want to use isn't available, it means it is in use or reserved for another purpose. Sometimes you can resolve this problem by swapping drive letters. For example, if drive D is being used by the CD-ROM and drive E is a local disk, you might want to swap these letters so that D is used by the local disk and E is used by the CD-ROM. To do this, you must remove the drive letter assigned to the CD-ROM and free drive letter D for use. Next change the driver letter assignment for the local disk so that it is set to D. This frees up E, which you can assign to the CD-ROM. Keep in mind that changing the letter of a drive can have unintended consequences. For example, the path to an application might be stored in the registry with the drive letter. This path would no longer be valid if you change the drive letter. Shortcuts to files or programs on the drive would be affected by the drive letter change as well and would need to be modified or re-created.

Assigning, Changing, or Deleting a Volume Label

A volume label is a text descriptor for a partition or a volume. The volume label is displayed when the drive is accessed in various Windows Vista utilities, such as Windows Explorer and Computer, and it is designed to provide additional descriptive information about the contents of a drive.

Note

With FAT and FAT32, the volume label can be up to 11 characters in length and can include spaces. With NTFS, the volume label can be up to 32 characters in length. Additionally, although FAT and FAT32 don't allow you to use some special characters, including * / \ [ ] : ; | = , . + " ? < >, NTFS does allow you to use these special characters.

You can assign, change, or delete a volume label using either Disk Management or Windows Explorer. In Disk Management, you can assign, change, or delete a label by completing the following steps:

1. | Right-click the partition or volume you want to work with and then choose Properties.
2. | On the General tab of the Properties dialog box, use the Label field to type a new label or to delete the existing label. Click OK.

In Windows Explorer, you can assign, change, or delete a label by completing these steps:

1. | Click Start and then click Computer.
2. | Right-click the drive icon and then choose Properties.
3. | On the General tab of the Properties dialog box, use the Label field to type a new label for the volume or to delete the existing label. Click OK.

Deleting Partitions, Volumes, and Logical Drives

To change the configuration of an existing drive that's fully allocated, you might need to delete existing partitions, logical drives, or volumes. Because this deletion is irreversible, you should always back up and verify any important files and folders before deleting a partition, a logical drive, or a volume. If a computer has spanned or striped volumes, be careful when deleting volumes. Deleting any volume in a set erases the entire volume set, meaning the entire volume and all its data will be lost.

Caution

Deleting a partition, a logical drive, or a volume is a drastic step that cannot be reversed. It removes the associated file system, and all data in the file system is lost.

Note

To protect the integrity of the system, you can't delete the system or boot partition. However, Windows Vista will let you delete the active partition or volume if it is not designated as boot or system. Always check to ensure the partition or volume that you are deleting doesn't contain important data or files.

You can delete a primary partition, a volume, or a logical drive by completing the following steps:

1. | In Disk Management, right-click the partition, volume, or drive you want to delete. Then choose Explore. Using Windows Explorer, move all the data to another volume or verify an existing backup to ensure the data was properly saved.
2. | In Disk Management, right-click the partition, volume, or drive again and select Delete Partition, Delete Volume, or Delete Logical Drive as appropriate.
3. | Confirm that you want to delete the selected item by clicking Yes.

Deleting an extended partition differs slightly from deleting a primary partition or a logical drive. To delete an extended partition, you must first delete all the logical drives on the partition by following the steps in the preceding list. You will then be able to select the extended partition area itself and delete it.

Converting a Volume to NTFS

Windows Vista provides a command-line utility for converting FAT or FAT32 volumes to NTFS. This utility, named Convert (Convert.exe), is located in the %SystemRoot%\System32 folder. When you convert a volume using this tool, the file and directory structure is preserved and no data is lost.

Caution

Windows Vista doesn't provide a utility for converting NTFS to FAT or FAT32. The only way to go from NTFS to FAT or FAT32 is to delete the partition by following the steps outlined in the previous section and then to re-create the partition as a FAT or FAT32 volume.

If you want to convert a drive, use the following syntax at an elevated command prompt:

convert volume /FS:NTFS

where volume is the drive letter followed by a colon (:), a drive path, or a volume name. For example, if you wanted to convert drive D to NTFS, you would use the following command:

convert D: /FS:NTFS

The complete syntax for the CONVERT command is:

CONVERT volume /FS:NTFS [/V] [/X] [/CvtArea:filename] [/NoSecurity]

These options and switches are used as follows:

  • volume Sets the volume to work with and must include the full drive designator (the drive letter followed by a colon).

  • /FS:NTFS Converts the designated volume to NTFS. This is the only file system option.

  • /V Sets verbose mode, which provides more detail in the output.

  • /X Forces the volume to dismount before the conversion (if necessary).

  • /CvtArea:filename Specifies a contiguous file in the root directory to be the placeholder for the NTFS system files stored on the MFT. If you omit a file name, Convert uses the default configuration and reserves 12.5 percent of the partition or volume size. This helps to prevent fragmentation of the MFT.

  • /NoSecurity Sets the NTFS security settings on all files and folders so that the everyone group can access them. This effectively makes the entire file system accessible to anyone that can access the system locally or remotely.

Before starting the conversion, the CONVERT command checks whether the drive has enough free space to perform the conversion. Generally, Convert needs a block of free space that's roughly equal to 25 percent of the total space used on the drive. For example, if the drive stores 100 MB of data, Convert needs about 25 MB of free space. If there isn't enough free space, Convert aborts and tells you that you need to free up some space. On the other hand, if there is enough free space, Convert initiates the conversion. Be patient. The conversion process takes several minutes (longer for large drives). Don't access files or applications on the drive while the conversion is in progress.

Note

Before using the Convert utility, double-check whether the partition is being used as the active boot partition or a system partition containing the operating system. With Intel x86 systems, you can convert the active boot partition to NTFS. Doing so requires that the system gain exclusive access to this partition, which can be obtained only during startup. Thus, if you try to convert the active boot partition to NTFS, Windows Vista displays a prompt asking if you want to schedule the drive to be converted the next time the system starts. If you click Yes, you can restart the system to begin the conversion process. Often it will take several restarts of a system to completely convert the active boot partition. Don't panic. Let the system proceed with the conversion.

Real World

You can improve performance on the volume using the /CvtArea option so that space for the MFT is reserved. This option helps to prevent fragmentation of the MFT. How? Over time, the MFT might grow larger than the space allocated to it. The operating system must then expand the MFT into other areas of the disk. Although the Windows Vista Disk Defragmenter utility can defragment the MFT, it cannot move the first section of the MFT, and it is very unlikely there will be space after the MFT because this will be filled by file data.

To help prevent fragmentation in some cases, you might want to reserve more space than the default (12.5 percent of the partition or volume size). For example, you might want to increase the MFT size if the volume will have many small or average-sized files rather than a few large files. To specify the amount of space to reserve, you can use FSUtil to create a placeholder file equal in size to that of the MFT you want to create. You can then convert the volume to NTFS and specify the name of the placeholder file to use with the /CvtArea option.

In this example, you use FSUtil to create a 1.5 GB (1,500,000,000 bytes) placeholder file named Temp.Txt:

fsutil file createnew c:\temp.txt 1500000000

To use this placeholder file for the MFT when converting drive C to NTFS, you would then type the following command:

convert c: /fs:ntfs /cvtarea:temp.txt

Notice that the placeholder file is created on the partition or volume that is being converted. During the conversion process, the file will be overwritten with NTFS metadata and any unused space in the file will be reserved for future use by the MFT.

Recovering a Failed Simple, Spanned, or Striped Disk

Simple disks are fairly easy to troubleshoot and recover because there is only one disk involved. Spanned or striped disks, on the other hand, might have multiple disks, and the failure of any one disk makes the entire volume unusable. The drive status might show it is Missing, Failed, Online (Errors), Offline, or Unreadable.

You might see the Missing (and sometimes Offline) status if drives have been disconnected or turned off. If the drives are part of an external storage device, check the storage device to ensure it is connected properly and has power. Reconnecting the storage device or turning on the power should make the drives accessible. You then must start Disk Management and rescan the missing drive. Right-click the missing drive and choose Rescan Disks. When Disk Management finishes, right-click the drive and then choose Reactivate.

You might see the Failed, Online (Errors), and Unreadable statuses if a drive has I/O problems. As before, try rescanning the drive and then try to reactivate the drive. If the drive doesn't come back to the Healthy state, you might need to replace it.

Tip

Sometimes you might need to reboot the computer to get a disk back online. If this still doesn't resolve the problem, check for problems with the drive, its controller, and the cables. Also make sure that the drive has power and is connected properly.


Moving a Dynamic Disk to a New System

An important advantage of dynamic disks over basic disks is that you can easily move them from one computer to another. For example, if after setting up a computer, you decide that you don't really need an additional hard disk, you can move it to another computer where it can be better used. Before moving disks, you should complete the following steps:

1. | Access Disk Management on the computer where the dynamic disks are currently installed and check their status. The status should be Healthy. If it isn't, you should fix any problems before moving the disks. Caution Drives with Bit Locker Drive encryption cannot be moved using this technique. Windows Vista Enterprise and Ultimate editions include Bit Locker Driver Encryption that wraps drives in a protected seal so that any offline tampering is detected and results in the disk being unavailable until an administrator unlocks it.
2. | Check the hard disk subsystems on the original computer and the computer to which you want to transfer the disk. Both computers should have identical hard disk subsystems. If they don't, the Plug and Play ID on the system disk from the original computer won't match what the destination computer is expecting. As a result, the destination computer won't be able to load the right drivers, and boot might fail.
3. | Check whether any dynamic disks that you want to move are part of a spanned, extended, or striped set. If they are, you should make a note of which disks are part of which set and plan on moving all disks in a set together. If you are moving only part of a disk set, you should be aware of the consequences. For spanned, extended, or striped volumes, moving only part of the set will make the related volumes unusable on the current computer and on the computer to which you are planning to move the disks.

When you are ready to move the disks, complete the following tasks:

1. | On the original computer, start Computer Management. Then, in the left pane, select Device Manager. In the Device list, expand Disk Drives. This shows a list of all the physical disk drives on the computer. Right-click each disk that you want to move and then select Uninstall. If you are unsure which disks to uninstall, right-click each disk and select Properties. In the Properties dialog box, select the Volumes tab and then choose Populate. This shows you the volumes on the selected disk.
2. | Next, select the Disk Management node in Computer Management on the original computer. Right-click each disk that you want to move and then select Remove Disk.
3. | Once you perform these procedures, you can move the dynamic disks. If the disks are hot swappable and this feature is supported on both computers, remove the disks from the original computer and then install them on the destination computer. Otherwise, turn off both computers, remove the drives from the original computer, and then install them on the destination computer. When you're finished, restart the computers.
4. | On the destination computer, access Disk Management and then select Rescan Disks from the Action menu. When Disk Management finishes scanning the disks, right-click any disk marked Foreign and click Import. You should now be able to access the disks and their volumes on the destination computer.

Note

The volumes on the dynamic disks should retain the drive letters that they had on the original computer. If a drive letter is already used on the destination computer, a volume receives the next available drive letter. If a dynamic volume previously did not have a drive letter, it does not receive a drive letter when moved to another computer. Additionally, if automounting is disabled, the volumes aren't automatically mounted and you must manually mount volumes and assign drive letters.


Troubleshooting Common Disk Problems

Using Disk Management, you can determine the status of disks and the volumes they contain. Disk status is displayed in Graphical view below the physical disk number and in the Disk List view in the Status field. Volume status is displayed as part of the volume information in Graphical view and in the Status column in Volume List view.

Table 9-1 lists status message you might see for disks. You'll also find a diagnosis and suggested corrective action in the Resolution column.

Table 9-1. Understanding and Resolving Disk Status Issues

Status

Description

Resolution

Online

The normal disk status. It means the disk is accessible and doesn't have problems. Both dynamic disks and basic disks display this status.

The drive doesn't have any known problems. You don't need to take any corrective action.

Online (Errors)

I/O errors have been detected on a dynamic disk.

You can try to correct temporary errors by right-clicking the disk and choosing Reactivate Disk. If this doesn't work, the disk might have physical damage or you might need to run a thorough check of the disk.

Offline

The disk isn't accessible and might be corrupted or temporarily unavailable. If the disk name changes to Missing, the disk can no longer be located or identified on the system.

Check for problems with the drive, its controller, and cables. Make sure that the drive has power and is connected properly. Use the REACTIVATE DISK command to bring the disk back online (if possible).

Foreign

The disk has been moved to your computer but hasn't been imported for use. A failed drive brought back online might sometimes be listed as Foreign.

Right-click the disk and choose Import Foreign Disks to add the disk to the system.

Unreadable

The disk isn't accessible currently, which can occur when disks are being rescanned. Both dynamic and basic disks display this status.

With FireWire/USB card readers, you might see this status if the card is unformatted or improperly formatted. You might also see this status after the card is removed from the reader. Otherwise, if the drives aren't being scanned, the drive might be corrupted or have I/O errors. Right-click the disk and choose Rescan Disk (on the Action menu) to try to correct the problem. You might also want to reboot the system.

Unrecognized

The disk is of an unknown type and can't be used on the system. A drive from a non-Windows system might display this status.

If the disk is from another operating system, don't do anything. You can't use the drive on the computer, so try a different drive.

Not Initialized

The disk doesn't have a valid signature. A drive from a non-Windows system might display this status.

If the disk is from another operating system, don't do anything. You can't use the drive on the computer, so try a different drive. To prepare the disk for use on Windows Vista, right-click the disk and choose Initialize Disk.

No Media

No media has been inserted into the CD-ROM or removable drive, or the media has been removed. Only CD-ROM and removable disk types display this status.

Insert a CD-ROM, a floppy disk, or a removable disk to bring the disk online. With FireWire/USB card readers, this status is usually but not always displayed when the card is removed.

Table 9-2 lists status messages you might see for volumes. You'll also find a diagnosis and suggested corrective action in the Resolution column.

Table 9-2. Understanding and Resolving Volume Status Issues

Status

Description

Resolution

Failed

An error disk status. The disk is inaccessible or damaged.

Ensure that the related dynamic disk is online, and, as necessary, right-click the disk and choose Reactivate Disk. Right-click the volume and choose Reactivate Volume. For a basic disk, you might need to check the disk for a faulty connection.

Formatting

A temporary status that indicates the volume is being formatted.

The progress of the formatting is indicated as the percent complete, unless the Perform A Quick Format option was chosen.

Healthy

The normal volume status.

The volume doesn't have any known problems. You don't need to take any corrective action.

Healthy (At Risk)

Windows had problems reading from or writing to the physical disk on which the dynamic volume is located. This status appears when Windows encounters errors.

Right-click the disk and choose Reactivate Disk. If the disk continues to have this status or has this status periodically, the disk might be failing and you should back up all data on the disk.

Healthy (Unknown Partition)

Windows does not recognize the partition. This can occur because the partition is from a different operating system or is a manufacturer-created partition used to store system files.

No corrective action is necessary.

Initializing

A temporary status that indicates the disk is being initialized.

The drive status should change after a few seconds.

Unknown

The volume cannot be accessed. It might have a corrupted boot sector.

The volume might have a boot sector virus. Check it with an up-to-date antivirus program. If no virus is found, boot from the Windows Vista CD-ROM and use the Recovery Console FIXMBR command to fix the master boot record.


Chapter 10. Managing File Security and Resource Sharing

In this chapter:
File Security and Sharing Options | 309
Controlling Access to Files and Folders with NTFS Permissions | 312
Sharing Files and Folders Over the Network | 327
Using and Configuring Public Folder Sharing | 336

Whether you are using Microsoft Windows Vista in a domain or a workgroup, few aspects of the operating system are more important than file security and sharing. File security and file sharing are so interconnected that it is hard to talk about one without talking about the other. File security protects important data on your systems by restricting access as appropriate. File sharing enables you to share data so that it can be accessed by other users.


File Security and Sharing Options

For all computers running Windows Vista, two factors control your file security and sharing options: disk format and computer settings. The format of the local disk that you are working with determines the file security options that are available. Local disks can be formatted as file allocation (FAT; FAT16/FAT32) or NT file system (NTFS). The security options on FAT and NTFS volumes differ greatly.

  • FAT With FAT, you have very limited control over file access. Files can be marked only as read-only, hidden, or system. Although these flags can be set on files and folders, anyone with access to the FAT volume can override or change these settings. This means there are no safeguards for file access or deletion. Any user can access or delete any file without restriction.

  • NTFS With NTFS, you can control access to files and folders by assigning permissions that specifically allow or deny access. Permissions can be set for individual users and for groups of users. This gives you very granular control over file and folder access. For example, you could specify that users in the Sales Managers group have full control over a folder and its files, but users in the Sales Reps group have no access to the folder whatsoever.

Unlike earlier Windows releases, Windows Vista enables you to share individual files as well as folders and all their contents. The settings on a computer determine the way files can be shared. Windows Vista supports two file-sharing models:

  • Standard (in-place) file sharing Enables you to share files from any folder on your computer. Two sets of permissions are used to determine who has access to shared files: access permissions (discussed in the "Controlling Access to Files and Folders with NTFS Permissions" section of this chapter) and share permissions (discussed in the "Sharing Files and Folders over the Network" section of this chapter). Share permissions and access permissions together enable you to control who has access to shared files and the level of access assigned. You do not need to move the files you are sharing.

  • Public folder sharing Enables you to share files from a computer's %SystemDrive%\Users\Public folder. Access permissions on the Public folder determine which users and groups have access to publicly shared files as well as what level of access those users and groups have. When you copy or move files to the Public folder, access permissions are changed to match that of the Public folder. Some additional permissions are added as well. For more information, see the "Using and Configuring Public Folder Sharing" section in this chapter.

Security

With standard file sharing, local users don't have automatic access to any data stored on a computer. Local access to files and folders is fully controlled by the security settings on the local disk. If a local disk is formatted with FAT, you can use the read-only, system, or hidden flags to help protect files and folders, but you cannot restrict access. If a local disk is formatted with NTFS, you can control access by allowing or denying access to individual users and groups of users.

With public file sharing, files copied or moved to the Public folder are available to anyone who logs on locally regardless of whether he or she has a standard user account or an administrator user account on the computer. Network access can be granted to the Public folder. Doing so, however, makes the Public folder and its contents open to everyone who can access the computer over the network.

Unlike Windows XP, where only one sharing model can be used at a time, Windows Vista computers can use either or both sharing models at any time. The key restriction on how sharing can be used comes from the Prevent Users From Sharing Files Within Their Profiles setting in Group Policy. This setting, found under User Configuration\Administrative Templates\Windows Components\Network Sharing, controls whether sharing is allowed within any folders associated with user profiles and primarily the %SystemDrive%\Users folder. Keep the following in mind when working with the Prevent Users From Sharing Files Within Their Profiles setting:

  • When this setting is Not Configured, the default state, users are allowed to share files within their profile with other users on their network, provided that a user with administrator privileges on the computer opts in for file sharing. To opt in for file sharing, all an administrator has to do is share a file within his or her profile.

  • When this setting is Enabled, users cannot share files within their profile using the Sharing Wizard, and the Sharing Wizard will not create shares within the %SystemDrive%\Users folder.

  • When this setting is Disabled, as might be necessary to override an inherited Enabled setting, users are allowed to share files within their profile with other users on their network, provided that a user with administrator privileges on the computer opts in for file sharing. To opt in for file sharing, all an administrator has to do is share a file within his or her profile.

To configure the Prevent Users From Sharing Files Within Their Profiles setting in Group Policy, follow these steps:

1.
Access Group Policy for the system, site, domain, or organizational unit (OU) you want to work with. Next, access the Network Sharing node through User Configuration\Administrative Templates\Windows Components\Network Sharing.

2.
Double-click Prevent Users From Sharing Files Within Their Profiles. This opens a Properties dialog box, as shown in Figure 10-1.

Figure 10-1. Use Group Policy to configure file sharing from within user profiles.

3.
On the Setting tab, select Not Configured, Enabled, or Disabled as appropriate and then click OK.

Although it is tempting to use public file sharing, most organizationseven small businessesshould encourage the use of standard file sharing for all company files and data. Simply put, standard file sharing offers more security and better protection, and, rather than opening the floodgates to data, closes the doors and blocks access appropriately. Increasing security is essential to protecting one of the most valuable assets of any organizationits data.

Share permissions are only used when a user attempts to access a file or folder from a different computer on the network, whereas access permissions are always used whether the user is logged on to the console or using a remote system to access the file or folder over the network. When data is accessed remotely, first the share permissions are applied, and then the access permissions are applied.

In many ways, this means file access permissions and standard file sharing permissions are like wrappers around your data. File access permissions, the first wrapper, protect your data with regard to local access. If a user logs on to a system locally, file access permissions can allow or deny access to files and folders. File sharing permissions, the second wrapper, are used when you want to allow remote access. If a user accesses data remotely, file sharing permissions allow or deny initial access, but because your data is also wrapped in a file security blanket, the user must also successfully pass the file access permissions before working with files and folders.


Controlling Access to Files and Folders with NTFS Permissions

NTFS permissions are always evaluated when a file is accessed. NTFS permissions are fairly complex, and to understand their management, you need to understand the following:

  • Basic permissions What the basic permissions are and how they are used

  • Special permissions What the special permissions are and how they are used

  • Ownership What is meant by file ownership and how file ownership is used

  • Inheritance What is meant by inheritance and how inheritance is used

  • Effective permissions How to determine the effective permissions on files

Understanding and Using the Basic Permissions

In Windows Vista, the owner of a file or a folder has the right to allow or deny access to that resource, as do members of the Administrators group and other authorized users. Using Windows Explorer, you can view the currently assigned basic permissions by right-clicking a file or a folder, selecting Properties on the shortcut menu, and then selecting the Security tab in the Properties dialog box.

As shown in Figure 10-2, the Group Or User Names list shows all the users and groups with permissions set for the selected resource. If you select a user or a group in this list, the assigned permissions are shown in the Permissions For list. If permissions are shaded (unavailable), as shown in the figure, it means they have been inherited from a parent folder. Inheritance is covered in detail in the "Applying Permissions Through Inheritance" section of this chapter.

Figure 10-2. The Security tab shows the currently assigned basic permissions.

Working with and Setting Basic Permissions

All permissions are stored in the file system as part of the access control list (ACL) assigned to a file or a folder. As described in Table 10-1, six basic permissions are used with folders and five are also used with files. Although some permissions are inherited based on permissions of a parent folder, all permissions are defined explicitly at some level of the file system hierarchy.

Table 10-1. Basic File and Folder Permissions

Permission

Description

Full Control

Grants the user or group full control over the selected file or folder and permits reading, writing, changing, and deleting files and subfolders. A user with Full Control over a folder can change permissions, delete files in the folder regardless of the permission on the files, and can also take ownership of a folder or a file. Selecting this permission selects all the other permissions as well.

Modify

Allows the user or group to read, write, change, and delete files. A user with Modify permission can also create files and subfolders but cannot take ownership of files. Selecting this permission selects all the permissions below it.

Read & Execute

Permits viewing and listing files and subfolders as well as executing files. If applied to a folder, this permission is inherited by all files and subfolders within the folder. Selecting this permission selects the List Folder Contents and Read permissions as well.

List Folder Contents (folders only)

Similar to the Read & Execute permission but available only for folders. Permits viewing and listing files and subfolders as well as executing files. Unlike Read & Execute, this permission is inherited only by subfolders but not by files within the folder or subfolders.

Read

Allows the user or group to view and list the contents of a folder. A user with this permission can view file attributes, read permissions, and synchronize files. Read is the only permission needed to run scripts. Read access is required to access a shortcut and its target.

Write

Allows the user or group to create new files and write data to existing files. A user with this permission can also view file attributes, read permissions, and synchronize files. Giving a user permission to write to but not delete a file or a folder doesn't prevent the user from deleting the folder or file's contents.

Equally as important as the basic permissions are the users and groups to which you assign those permissions. If a user or a group whose permissions you want to assign is already selected in the Group Or User Names list on the Security tab, you can modify the assigned permissions using the Allow and Deny columns in the Permissions For list. Select check boxes in the Allow column to add permissions, or clear check boxes to remove permissions.

To expressly forbid a user or a group from using a permission, select the appropriate check boxes in the Deny column. Because denied permissions have precedence over other permissions, Deny is useful in two specific scenarios:

  • If a user is a member of a group that has been granted a permission, you don't want the user to have the permission, and you don't want to or can't remove the user from the group, you can override the inherited permission by denying that specific user the right to use the permission.

  • If a permission is inherited from a parent folder and you'd rather a user or a group not have the inherited permission, you can override the allowed permissions (in most cases) by expressly denying the user or group the use of the permissions.

If users or groups whose permissions you want to assign aren't already available in the Group Or User Names list on the Security tab, you can easily add them. To set basic permissions for users or groups not already listed on a file or a folder's Security tab, follow these steps:

1.
On the Security tab, click Edit. This displays the Permissions For ... dialog box.

2.
In the Permissions For ... dialog box, click Add to display the Select Users Or Groups dialog box, shown in Figure 10-3.

Figure 10-3. Use Select Users, Computers, or Groups to specify the groups whose permissions you want to configure.

Tip

Always double-check the value of the From This Location field. In workgroups, computers will always only show local accounts and groups. In domains, this field is changeable and set initially to the default (logon) domain of the currently logged on user. If this isn't the location you want to use for selecting user and group accounts to work with, click Locations to see a list of locations you can search, including the current domain, trusted domains, and other resources that you can access.

3.
Type the name of a user or a group account in the selected or default domain. Be sure to reference the user account name rather than a user's full name. When entering multiple names, separate them with semicolons.

4.
Click Check Names. If a single match is found for each entry, the dialog box is automatically updated as appropriate and the entry is underlined. Otherwise, you'll see an additional dialog box. If no matches are found, you've either entered an incorrect name part or you're working with an incorrect location. Modify the name in the Name Not Found dialog box and try again, or click Locations to select a new location. When multiple matches are found, select the name(s) you want to use in the Multiple Names Found dialog box and then click OK. The users and groups are added to the Name list.

5.
You can now configure permissions for each user and group you added by selecting an account name and then allowing or denying access permissions as appropriate.

Special Identities and Best Practices for Assigning Permissions

When you work with basic permissions, it is important to understand not only how the permissions are used but also how special identities can be used to help you assign permissions. The special identities you'll see the most are Creator Owner and Users, but others are also used occasionally, as described in Table 10-2.

Table 10-2. Special Identities Used When Setting Permissions

Special Identity

Description

Anonymous Logon

Includes any network logons for which credentials are not provided. This special identity is used to allow anonymous access to resources, such as those available on a Web server.

Authenticated Users

Includes users and computers who log on with a user name and password; does not include users who log on as Guest, even if the Guest account is assigned a password.

Creator/Owner

The special identity for the account that created a file or a folder. Windows Vista uses this group to identify the account that has ultimate authority over the file or folder.

Dialup

Includes any user who accesses the computer with a dial-up connection. This identity is used to distinguish dial-up users from other types of users.

Everyone

Includes all interactive, dial-up, and authenticated users. Although this group includes guests, it does not include anonymous users.

Interactive

Includes any user logged on locally or through a remote desktop connection.

Network

Includes any user who logs on over the network. This identity is used to allow remote users to access a resource and does not include interactive logons that use remote desktop connections.

Users

Includes authenticated users and domain users only. In Windows Vista, the built-in users group is preferred over everyone.

A solid understanding of these special identities can help you more effectively configure permissions on NTFS volumes. Additionally, whenever you work with permissions, you should keep the following guidelines in mind:

  • Follow the file system hierarchy Inheritance plays a big part in how permissions are set. By default, permissions you set on a folder apply to all files and subfolders within that folder. With this in mind, start at the root folder of a local disk or a user's profile folder (both of which act as top-level folders) when you start configuring permissions.

  • Have a plan Don't set permissions without a clear plan. If permissions get out of sync on folders, and you are looking for a way to start over so that you have some continuity, you might want to configure the permissions as they should be in a parent folder and then reset the permissions on all subfolders and files in that folder using the technique discussed in the "Restoring Inherited Permissions" section of this chapter.

  • Grant access only as necessary An important aspect of the file access controls built into NTFS is that permissions must be explicitly assigned. If you don't grant a permission to a user and that user isn't a member of a group that has a permission, the user doesn't have that permissionit's that simple. When assigning permissions, it is especially important to keep this rule in mind because it's tempting just to give users full control rather than the specific permissions they really need. Granting only the specific permissions users need to do their job is known as the principle of least privilege.

  • Use groups to manage permissions more efficiently Whenever possible, you should make users members of the appropriate groups and then assign permissions to those groups rather than assigning permissions to individual users. In this way, you can grant permissions to new users by making them members of the appropriate groups, and then, when a user leaves or goes to another group, you can change the group membership as appropriate. For example, when Sarah joins the sales team, you can add her to the SalesUS and SalesCan groups so that she can access those groups' shared data. If she later leaves the sales team and joins the marketing team, you can remove her from the SalesUS and SalesCan groups and add her to the MarketingUS and MarketingCan groups. This is much more efficient than editing the properties for every folder Sarah will need access to and assigning permissions.

Assigning Special Permissions

Windows Vista uses special permissions to carefully control the permissions of users and groups. Behind the scenes, whenever you work with basic permissions, Windows Vista manages a set of related special permissions that specify exactly the permitted actions. The special permissions that are applied for each of the basic permissions are as follows:

  • Read

    • List Folder/Read Data

    • Read Attributes

    • Read Extended Attributes

    • Read Permissions

  • Read & Execute or List Folder Contents

    • All special permissions for Read listed previously

    • Traverse Folder/Execute File

  • Write

    • Create Files/Write Data

    • Create Folders/Append Data

    • Write Attributes

    • Write Extended Attributes

  • Modify

    • All special permissions for Read listed previously

    • All special permissions for Write listed previously

    • Delete

  • Full Control

    • All special permissions listed previously

    • Delete Subfolders And Files

    • Change Permissions

    • Take Ownership

Table 10-3 describes how Windows Vista uses each special permission.

Table 10-3. Special Permissions for Files and Folders

Special Permission

Description

Traverse Folder/Execute File

Traverse Folder allows direct access to a folder in order to reach subfolders, even if you don't have explicit access to read the data it contains. Execute File allows you to run an executable file.

List Folder/Read Data

List Folder lets you view file and folder names. Read Data allows you to view the contents of a file.

Read Attributes

Allows you to read the basic attributes of a file or a folder. These attributes include Read-Only, Hidden, System, and Archive.

Read Extended Attributes

Allows you to view the extended attributes (named data streams) associated with a file.

Create Files/Write Data

Create Files allows you to put new files in a folder. Write Data allows you to overwrite existing data in a file (but not add new data to an existing file, because this is covered by Append Data).

Create Folders/Append Data

Create Folders allows you to create subfolders within folders. Append Data allows you to add data to the end of an existing file (but not to overwrite existing data, because this is covered by Write Data).

Write Attributes

Allows you to change the basic attributes of a file or a folder. These attributes include Read-Only, Hidden, System, and Archive.

Write Extended Attributes

Allows you to change the extended attributes (named data streams) associated with a file.

Delete Subfolders and Files

Allows you to delete the contents of a folder. If you have this permission, you can delete the subfolders and files in a folder even if you don't specifically have Delete permission on the subfolder or the file.

Delete

Allows you to delete a file or a folder. If a folder isn't empty and you don't have Delete permission for one of its files or subfolders, you won't be able to delete it. You can delete a folder that contains other items only if you have Delete Subfolders And Files permission.

Read Permissions

Allows you to read all basic and special permissions assigned to a file or a folder.

Change Permissions

Allows you to change basic and special permissions assigned to a file or a folder.

Take Ownership

Allows you to take ownership of a file or a folder. By default, administrators can always take ownership of a file or a folder and can also grant this permission to others.

In Windows Explorer, you can view special permissions for a file or a folder by right-clicking the file or the folder you want to work with and then selecting Properties. In the Properties dialog box, select the Security tab and then click Advanced to display the Advanced Security Settings dialog box, as shown in Figure 10-4. In this dialog box, the permissions are presented much as they are on the Security tab. The key differences are that you see individual allow or deny permission sets along with whether and how the permissions are inherited, as well as the resources to which the permissions will apply.

Figure 10-4. Use the Advanced Security Settings dialog box to configure special permissions.

[View full size image]

Once you've accessed the Advanced Security Settings dialog box, you can set special permissions using the Add, Edit, and Remove buttons. To add a user or a group and then set special permissions for that user or group, follow these steps:

1.
On the Security tab, click Advanced to display the Advanced Security Settings dialog box.

2.
On the Permissions tab, click Edit. This opens the Advanced Security Settings dialog box for editing.

3.
Click Add. This displays the Select User Or Group dialog box.

4.
Type the name of a user or a group account in the selected or default domain. Be sure to reference the user account name rather than a user's full name. Only one name can be entered at a time.

5.
When you click OK, the Permission Entry For ... dialog box, shown in Figure 10-5, is displayed.

Figure 10-5. Configure the special permissions that should be allowed or denied.

6.
Allow or deny special permissions as appropriate. If any permissions are shaded (unavailable), they are being inherited from a parent folder. You can override the inherited permission if necessary by selecting the opposite permission, such as Deny rather than Allow.

7.
If the options on the Apply Onto list are available, choose the appropriate options to ensure the permissions are properly inherited. The options include the following:

  • This Folder Only The permissions will apply only to the currently selected folder.

  • This Folder, Subfolders And Files The permissions will apply to this folder, any subfolders of this folder, and any files in any of these folders.

  • This Folder And Subfolders The permissions will apply to this folder and any subfolders of this folder. They will not apply to any files in any of these folders.

  • This Folder And Files The permissions will apply to this folder and any files in this folder. They will not apply to any subfolders of this folder.

  • Subfolders And Files Only The permissions will apply to any subfolders of this folder and any files in any of these folders. They will not apply to this folder itself.

  • Subfolders Only The permissions will apply to any subfolders of this folder but will not apply to the folder itself or any files in any of these folders.

  • Files Only The permissions will apply to any files in any of these folders and any files in subfolders of this folder. They will not apply to this folder itself or to subfolders.

8.
When you are finished configuring permissions, click OK.

File Ownership and Permission Assignment

The owner of a file or a folder has the right to allow or deny access to that resource. Although members of the Administrators group and other authorized users also have the right to allow or deny access, the owner has the authority to lock out non-administrator users and then the only way to regain access to the resource is for an administrator or restore operator to take ownership of it. This makes the file or folder owner important in terms of what permissions are allowed or denied with respect to a given resource.

The default owner of a file or a folder is the person who created the resource. Ownership can be taken or transferred in several different ways. A current owner of a file or a folder can transfer ownership to another user or group at any time. A member of the Administrators group can take ownership of a file or a folder or transfer ownership to another user or group at any timeeven if they are locked out of the resource according to the permissions. Any user with the Take Ownership permission on the file or the folder can take ownership, as can any member of the Backup Operators group (or anyone else with the Restore Files And Directories user right, for that matter).

Taking Ownership of Files and Folders

If you are an administrator, an authorized user, or a backup operator, you can take ownership of a file or a folder by completing the following steps:

1.
In Windows Explorer, access the file or folder's Properties dialog box by right-clicking the file or folder and then selecting Properties.

2.
On the Security tab, click Advanced to display the Advanced Security Settings dialog box.

3.
On the Owner tab, click Edit. This opens the Advanced Security Settings dialog box for editing, as shown in Figure 10-6.

Figure 10-6. Use the Owner tab to take ownership of a file or a folder.

[View full size image]

4.
In the Change Owner To list box, select the new owner. If you're taking ownership of a folder, you can take ownership of all subfolders and files within the folder by selecting the Replace Owner On Subcontainers And Objects option.

5.
Click OK twice when you are finished.

Assigning Ownership

If you are an administrator or the current owner of a file, you can assign ownership of a file or a folder to another user or group by completing these steps:

1. | In Windows Explorer, access the file or folder's Properties dialog box by right-clicking the file or folder and then selecting Properties.
2. | On the Security tab, click Advanced to display the Advanced Security Settings dialog box.
3. | On the Owner tab, click Edit. This opens the Advanced Security Settings dialog box for editing.
4. | Click Other Users Or Groups to display the Select User Or Group dialog box.
5. | Type the name of a user or a group and click Check Names. If multiple names match the value you entered, you'll see a list of names and will be able to choose the one you want to use. Otherwise, the name will be filled in for you, and you can click OK to close the Select User Or Group dialog box.
6. | In the Change Owner To list box, select the new owner. If you're assigning ownership of a folder, you can assign ownership of all subfolders and files within the folder by selecting the Replace Owner On Subcontainers And Objects option.
7. | Click OK twice when you are finished.

Applying Permissions Through Inheritance

In the file and folder hierarchy used by Windows Vista, the root folder of a local disk and the %UserProfile% folder are the parent folders of all the files and folders they contain by default. Any time you add a resource, it inherits the permissions of the local disk's root folder or the user's profile folder. You can change this behavior by modifying a folder's inheritance settings so that it no longer inherits permissions from its parent folder. This would create a new parent folder, and any subfolders or files you added would then inherit the permissions of this folder.

Inheritance Essentials

Inheritance is automatic, and inherited permissions are assigned when a file or a folder is created. If you do not want a file or a folder to have the same permissions as a parent, you have several choices:

  • Stop inheriting permissions from the parent folder and then copy or remove existing permissions as appropriate.

  • Access the parent folder and configure the permissions you want all included files and folders to have.

  • Try to override an inherited permission by selecting the opposite permission. In most cases, Deny overrides Allow.

Inherited permissions are shaded (unavailable) on the Security tab of a file or a folder's properties dialog box. It is also important to note that when you assign new permissions to a folder, the permissions propagate down to the subfolders and files contained in that folder and either supplement or replace existing permissions. This propagation lets you allow additional users and groups to access a folder's resources or to further restrict access to a folder's resources independently of a parent folder.

To better understand inheritance, consider the following examples:

  • On drive C, you create a folder named Data and then create a subfolder named CurrentProjects. By default, Data inherits the permissions of the C:\ folder, and these permissions are in turn inherited by the CurrentProjects folder. Any files you add to the C:\, C:\Data, and C:\Data\CurrentProjects folders will have the same permissionsthose inherited from the C:\ folder.

  • On drive C, you create a folder named Docs and then create a subfolder named Working. You stop inheritance on the Working folder by removing the inherited permissions of the parent. Any files you add to the C:\Docs\Working folder inherit the permissions of the C:\Docs folder and no other.

  • On drive C, you create a folder named Backup and then create a subfolder named Sales. You add permissions to the Sales folder that grant access to members of the Sales group. Any files added to the C:\Backup\Sales folder inherit the permissions of the C:\ folder and also have additional access permissions for members of the Sales group.

Real World

Many new administrators wonder what the advantage of inheritance is and why it is used. Although it occasionally seems inheritance is more trouble than it's worth, inheritance enables you to very efficiently manage permissions. Without inheritance, you'd have to configure permissions on every file and folder you created. If you wanted to change permissions later, you'd have to go through all your files and folders again. With inheritance, all new files and folders automatically inherit a set of permissions. If you need to change permissions, you can make the changes in a top-level or parent folder and the changes can be automatically applied to all subfolders and files in that folder. In this way, a single permission set can be applied to many files and folders without editing the security of individual files and folders.

Viewing Inherited Permissions

To view the inherited permissions on a file or a folder, right-click the file or folder in Windows Explorer and then select Properties. On the Security tab of the Properties dialog box, click Advanced to display the Advanced Security Settings dialog box, shown previously in Figure 10-4. The Permission column lists the current permissions assigned to the resource. If the permission is inherited, the Inherited From column shows the parent folder from which the permission has been inherited. If the permission will be in turn inherited by other resources, the Apply To column shows the types of resources that will inherit the permission.

Stopping Inheritance

If you want a file or a folder to stop inheriting permissions from a parent folder, follow these steps:

1.
In Windows Explorer, right-click the file or folder and then select Properties. On the Security tab, click Advanced.

2.
On the Permissions tab, click Edit. This opens the Advanced Security Settings dialog box for editing.

3.
Clear Include Inheritable Permissions From This Object's Parent.

4.
As shown in Figure 10-7, you now have the opportunity to copy over the permissions that were previously applied or remove the inherited permissions and apply only the permissions that you explicitly set on the folder or file. Click Copy or Remove as appropriate. Assign additional permissions as necessary.

Figure 10-7. Copy or remove the inherited permissions.

Tip

If you remove the inherited permissions and there are no other permissions assigned, everyone but the owner of the resource will be denied access. This effectively locks everyone except the owner out of a folder or file. However, administrators still have the right to take ownership of the resource regardless of the permissions. Thus, if an administrator was locked out of a file or a folder and truly needed access, she could take ownership and then have unrestricted access.

Restoring Inherited Permissions

Over time, the permissions on files and subfolders can become so dramatically different from those of a parent folder that it is nearly impossible to effectively manage access. To make it easier to manage file and folder access, you might want to take the drastic step of restoring the inherited permissions to all resources contained in a parent folder. In this way, subfolders and files get all inheritable permissions from the parent folder, and all other explicitly defined permissions on the individual subfolders and files are removed.

To restore the inherited permissions of a parent folder, follow these steps:

1.
In Windows Explorer, right-click the file or folder and then select Properties. On the Security tab, click Advanced.

2.
On the Permissions tab, click Edit. This opens the Advanced Security Settings dialog box for editing.

3.
Select Replace All Existing Inheritable Permissions and click OK.

4.
As shown in Figure 10-8, you will see a prompt explaining that this action will replace all explicitly defined permissions and enable propagation of inheritable permissions. Click Yes.

Figure 10-8. Click Yes to confirm that you want to replace the existing permissions.

Determining the Effective Permissions and Troubleshooting

NTFS permissions are complex and can be difficult to manage. Sometimes a changeeven a very minor onecan have unintended consequences. Users might suddenly find they are denied access to files they could previously access, or they might suddenly find they have access to files to which access should never have been granted. In either scenario, something has gone wrong with permissions. You have a problem, and you need to fix it.

You should start troubleshooting these or other problems with permissions by determining the effective permissions for the files or the folders in question. As the name implies, the effective permissions tell you exactly which permissions are in effect with regard to a particular user or group. The effective permissions are important because they enable you to quickly determine the cumulative set of permissions that apply.

For a user, the effective permissions are based on all the permissions the user has been granted or denied, no matter whether they were applied explicitly or obtained from groups of which the user is a member. For example, if JimB is a member of the Users, Sales, Marketing, SpecTeam, and Managers groups, the effective permissions on a file or a folder would be the cumulative set of permissions that JimB has been explicitly assigned and those permissions assigned to the Users, Sales, Marketing, SpecTeam, and Managers groups.

To determine the effective permissions for a user or a group with regard to a file or a folder, complete the following steps:

1.
In Windows Explorer, right-click the file or folder you want to work with and then select Properties. In the Properties dialog box, select the Security tab and then click Advanced to display the Advanced Security Settings dialog box.

2.
To determine effective permissions that are applied to a user or a group, click the Effective Permissions tab, click Select, type the name of the user or group, and then click OK.

3.
The Effective Permissions for the specified user or group are displayed using the complete set of special permissions. If a user has full control over the selected resource, he or she will have the permissions, as shown in Figure 10-9. Otherwise, you'll see a subset of permissions selected and you'll have to carefully consider whether the user or group has the appropriate permissions. Use Table 10-3 to help you interpret the permissions.

Figure 10-9. Any checked permissions have been granted to the specified user or group.

[View full size image]

Note

You must have appropriate permissions to view the effective permissions of any user or group. It is also important to remember that you cannot determine the effective permissions for implicit groups or special identities, such as Authenticated Users or Everyone. Furthermore, the effective permissions do not take into account those permissions granted to a user because he or she is the Creator Owner.


Sharing Files and Folders Over the Network

Windows Vista supports two file sharing models: public file sharing and standard file sharing. Although either or both techniques can be used in both workgroups and domains, standard file sharing is preferred because it is more secure than public file sharing. Standard file sharing enables you to use a standard set of permissions to allow or deny initial access to files and folders over the network. Standard file sharing settings are enabled or disabled on a per-computer basis. Click Start and then click Network. On the Explorer toolbar, click Network And Sharing Center. Expand the File Sharing Panel by clicking the related Expand button. To enable file sharing, select Turn On File Sharing. To disable file sharing, select Turn Off File Sharing. Click Apply.

Controlling Access to Network Shares

When a user accesses a file or folder over the network and standard file sharing is enabled, two levels of permissions are used, and together they determine the actions a user can perform with regard to a particular shared file or folder. The first level of permissions comprises those set on the share itself. They define the maximum level of access. A user or a group can never have more permissions than those granted by the share. The second level of permissions are those permissions set on the files and folders. These permissions serve to further restrict the permitted actions.

Three share permissions are available.

  • Owner/Co-owner Users allowed this permission have Read and Change permissions, as well as the additional capabilities to change file and folder permissions and take ownership of files and folders. If you have Owner/Co-owner permissions on a shared resource, you have full access to the shared resource.

  • Contributor Users allowed this permission have Read permissions and the additional capability to create files and subfolders, modify files, change attributes on files and subfolders, and delete files and subfolders. If you have Contributor permissions on a shared resource, the most you can do is perform read operations and change operations.

  • Reader Users with this permission can view file and subfolder names, access the subfolders of the share, read file data and attributes, and run program files. If you have Reader permissions on a shared resource, the most you can do is perform read operations.

Permissions assigned to groups work like this: If a user is a member of a group that is granted share permissions, the user also has those permissions. If a user is a member of multiple groups, the permissions are cumulative. For example, if one group of which the user is a member has Reader access and another has Contributor access, the user will have Contributor access. If one group of which the user is a member has Reader access and another has Owner/Co-owner access, the user will have Owner/Co-owner access.

You can override this behavior by specifically denying an access permission. Denying permission takes precedence and overrides permissions that have been granted. If you don't want a user or a group to have a permission, configure the share permissions so the user or the group is denied that permission. For example, if a user is a member of a group that has been granted Owner/Co-owner permissions for a share, but the user should only have Contributor permissions, configure the share to deny Owner/Co-owner permissions to that user.

Creating a Shared Resource

Files and folders can be shared in both workgroups and domains. To share the first resource on a computer, you must be a local administrator. Sharing the first resource opts in the computer for sharing other resources and allows any user to share resources they own or to which they have appropriate access permissions.

You can create shares using several different tools, including the following:

  • Windows Explorer Use Windows Explorer when you want to share files and folders on the computer to which you are logged on.

  • Computer Management Use Computer Management when you want to share folders on any computer to which you can connect.

  • NET SHARE Use NET SHARE from the command line when you want to use a script to share folders. Type net share /? at the command prompt for the syntax of the command.

Creating a shared resource is a multipart process. First, you share the file so that it can be accessed, then you set the share permissions. Afterward, you should check and modify as necessary the file-system permissions. This section examines sharing a resource and setting its permissions using Windows Explorer and Computer Management. For details on working with file system permissions, see the "Controlling Access to Files and Folders with NTFS Permissions" section of this chapter.

Sharing a Resource and Setting Share Permissions in Windows Explorer

To share a file or folder and set its permissions using Windows Explorer, follow these steps:

1.
In Windows Explorer, right-click the file or folder you want to share and select Share. This opens the File Sharing dialog box, shown in Figure 10-10.

Figure 10-10. Use the File Sharing dialog box to configure sharing of the selected file or folder.

[View full size image]

2.
Click the selection button (the down arrow) to the right of the text entry field provided and then select Find. This opens the Select Users Or Groups dialog box.

Tip

Be sure to check the value of the From This Location field. In workgroups, computers will always only show local accounts and groups. In domains, this field is changeable and set initially to the default (logon) domain of the currently logged on user. If this isn't the location you want to use for selecting user and group accounts to work with, click Locations to see a list of locations you can search, including the current domain, trusted domains, and other resources that you can access.

3.
In the Enter The Object Names To Select field, type the name of a user or a group account previously defined in the selected or default domain. Be sure to reference the user account name rather than a user's full name. When entering multiple names, separate them with semicolons.

4.
Click Check Names. If a single match is found for each of your entries, the dialog box is automatically updated as appropriate and the entry is underlined. Otherwise, you'll see an additional dialog box. When no matches are found, you've either entered an incorrect name part or you're working with an incorrect location. Modify the name in the Name Not Found dialog box and try again, or click Locations to select a new location. When multiple matches are found, select the name(s) you want to use in the Multiple Names Found dialog box and then click OK.

5.
When you click OK, the users and groups are added to the Name list. You can then configure permissions for each user and group added by clicking an account name to display the Permission Level options and then choosing the appropriate permission level. The options for permission levels are Reader, Contributor, and Co-owner.

6.
Finally, click Share to create the share. After Windows Vista creates the share and makes it available for use, note the share name. This is the name by which the shared resource can be accessed. If you want to e-mail a link to the shared resource to someone, click E-mail These Links. If you want to copy a link to the shared resource to the Windows clipboard, click Copy The Links. Click Done when you are finished.

Changing or Stopping Sharing

If you right-click a file or folder that is shared and select Share, you'll see a different view of the File Sharing dialog box. This view enables you to:

  • Change sharing permissions Clicking Change Sharing Permissions displays the original view of the File Sharing dialog box. You can grant access to additional users and groups as discussed previously. To remove access for a user or group, click the user or group in the Name list and then select Remove. When you are finished making changes, click Share to reconfigure the sharing options and then click Done.

  • Stop Sharing Clicking Stop Sharing removes the share configuration. After Windows Vista removes sharing, click Done to close the File Sharing dialog box.

Sharing a Folder and Setting Share Permissions in Computer Management

Using Computer Management, you can share a folder on any computer to which you have administrator access. By connecting remotely to the computer rather than logging on locally, you typically save time because you don't need to access the computer or leave your desk. Follow these steps to use Computer Management to share a folder:

1.
To start Computer Management, click Start, right-click Computer, and choose Manage. By default, Computer Management connects to the local computer, and the root node of the console tree has the Computer Management (Local) label.

Tip

If you want to use the Create A Shared Folder Wizard to share a folder on a local computer, start the wizard directly and skip steps 14. Simply type shrpubw at an elevated command prompt and then click Next when the wizard starts.

2.
Right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, the Another Computer option is selected by default. Type the fully qualified domain name of the computer you want to work with, such as engpc08.microsoft.com, where engpc08 is the computer name and microsoft.com is the domain name. If you don't know the computer name, click Browse to search for the computer with which you want to work.

3.
Expand System Tools and Shared Folders and then select Shares to display the current shared folders on the system you are working with, as shown in Figure 10-11.

Figure 10-11. All available shared folders on the computer are listed on the Shares node.

[View full size image]

4.
To start the Create A Shared Folder Wizard, right-click Shares and then select New Share. Click Next to display the Folder Path page.

5.
In the Folder Path field, type the full path to the folder that you want to share, such as C:\Data. If you don't know the full path, click Browse and then use the Browse For Folder dialog box to find the folder you want to share. The Browse For Folder dialog box will also let you create a new folder that you can then share. Click Next to display the Name, Description, And Settings page.

6.
In the Share Name field, type a name for the share. Share names must be unique for each system. They can be up to 80 characters in length and can contain spaces. If you want to provide support for Windows 98, Windows Me, or Windows NT, you should limit the share name to 12 characters or fewer.

7.
Type a description of the share's contents in the Share Description field.

Tip

By default, only files and programs that users specify are available for offline use. Click Change if you want to modify the default offline files settings. You can then either make all files and programs available for offline use by selecting All Files And Programs or make no files and programs available for offline use by selecting Files Or Programs For The Share Will Not Be Available Offline. Click OK.

8.
When you are ready to continue, click Next to display the Shared Folder Permissions page. The available options are as follows:

  • All Users Have Read-Only Access Default option. Gives users the right to view files and read data but restricts them from creating, modifying, or deleting files and folders.

  • Administrators Have Full Access; Other Users Have Read-Only Access Gives administrators full access to the share and gives other users read-only access. Administrators can create, modify, and delete files and folders. On NTFS, it also gives administrators the right to change permissions and to take ownership of files and folders. Other users can only view files and read data. They can't create, modify, or delete files and folders.

  • Administrators Have Full Access; Other Users Have No Access Gives only administrators full access to the share.

  • Customize Permissions Enables you to configure access for specific users and groups, which is usually the best technique to use. To use this option, select Customize Permissions, click Custom, and then follow set permissions as appropriate for the share.

9.
After you set up permissions on the share, click Next and then click Finish to share the folder. Click Finish again to exit the wizard.

If you later want to stop sharing the folder, you can do this in Computer Management by right-clicking the shared folder and selecting Stop Sharing. When prompted to confirm the action, click Yes.

Using and Accessing Shared Resources

Once you share a file or folder, users can connect to it as a network resource or map to it by using a driver letter on their machines. Once a network drive is mapped, users can access it just as they would a local drive on their computer.

You can map a network drive to a shared file or folder by completing the following steps:

1.
Click Start and then click Computer. In Windows Explorer, click the Map Network Drive button on the toolbar. This displays the Map Network Drive dialog box, shown in Figure 10-12.

Figure 10-12. Map the share you want to use to a network drive.

[View full size image]

Tip

The Tools menu is only available when classic menus are displayed in Windows Explorer. If the classic menus are not shown, click Organize, click Layout, and then click Classic Menus.

2.
Use the Drive field to select a free drive letter to use and then click the Browse button to the right of the Folder field. In the Browse For Folder dialog box, expand the Network folders until you can select the name of the workgroup or the domain with which you want to work.

3.
When you expand the name of a computer in a workgroup or a domain, you'll see a list of shared folders. Select the shared folder you want to work with and then click OK.

4.
Select Reconnect At Logon if you want Windows Vista to connect to the shared folder automatically at the start of each session.

5.
If your current logon doesn't have appropriate access permissions for the share, click the Different User Name link. You can then enter the user name and password of the account with which you want to connect to the shared folder. Typically, this feature is used by administrators who log on to their computers with a limited account and also have an administrator account for managing the network.

6.
Click Finish.

If you later decide you don't want to map the network drive, click Start and then click Computer. In Windows Explorer, under Network Location, right-click the network drive icon and choose Disconnect.

Using and Accessing Shared Folders for Administration

In Windows Vista, you'll find several special shares are created automatically and are intended for use by administrators or the operating system. Most of the special shares are hidden from users because of a dollar sign ($) that has been added to the end of the share name. As an administrator, you occasionally might need to create your own hidden shares or work with the already available special shares.

Creating a hidden share is fairly easy. All you need to do is add a dollar sign ($) to the end of the share name. For example, if you want to share the C:\Reports folder but don't want it to be displayed in the normal file share lists, naming it Reports$ rather than Reports is all it would take to hide the share. Hiding a share doesn't control access to the share, however. Access to shares is controlled using permissions, regardless of whether a share is normal or hidden.

Which special shares are available on a system depends on the system's configuration. This means some computers might have more special shares than others. The most commonly found special and administrative shares are listed in Table 10-4.

Table 10-4. Special and Administrative Shares

Share Name

Description

C$, D$, E$, and Other Local Disk Shares

A special share to the root of a drive. All local disks, including CD/DVD-ROM drives and their shares, are known as C$, D$, E$, and so on. These shares allow members of the Administrators and Backup Operators groups to connect to the root folder of a local disk and perform administrative tasks. For example, if you map to C$, you are connecting to C:\ and have full access to this local disk.

ADMIN$

An administrative share for accessing the %SystemRoot% folder in which the operating system files reside. This share is meant to be used for remote administration. For administrators working remotely with systems, ADMIN$ provides a convenient shortcut for directly accessing the operating system folder.

IPC$

An administrative share used to support named pipes that programs use for interprocess (or process-to-process) communications. Because named pipes can be redirected over the network to connect local and remote systems, they also enable remote administration.

PRINT$

Supports printer sharing by providing access to printer drivers. Whenever you share a printer, the system puts the printer drivers in this share so that other computers can access them as needed.

The best tools to use when you want to work with any special or otherwise hidden shares are the NET SHARE command and Computer Management. To see a list of all shares on the local computer, including special shares for administrators, simply type net share at a command prompt. To see a list of all shares available on any computer on the network, complete the following steps:

1. | To start Computer Management, click Start, right-click Computer, and choose Manage. By default, Computer Management connects to the local computer, and the root node of the console tree has the Computer Management (Local) label.
2. | Right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, the Another Computer option is selected by default. Type the fully qualified domain name of the computer you want to work with, such as engpc08.microsoft.com, where engpc08 is the computer name and microsoft.com is the domain name. If you don't know the computer name, click Browse to search for the computer you want to work with.
3. | Expand System Tools and Shared Folders and then select Shares to display a list of the shares on the system you are working with.

Sometimes when you are managing folders or files, you might not want users to be connected to a shared folder. For example, if you need to move files to a new location, before you move the files, you might want to ensure no one is using them. One way to see who is working with shared folders and their related files is to examine user sessions and open files.

Every user who connects to a shared folder creates a user session. To determine who is currently connected, click Sessions under Shared Folders in the console tree. The current users are listed in the right pane. To disconnect a user and end his or her session, right-click the session entry in the right pane, select Close Session, and then click OK to confirm the action. To disconnect all user sessions, right-click Sessions in the console tree, select Disconnect All Sessions, and then click OK to confirm the action.

Every shared file that is being accessed is listed as an open file. To determine which files are open, click Open Files under Shared Folders in the console tree. The currently open files are listed in the right pane. To close an open file, right-click the related entry in the right pane, select Close Open File, and then click OK to confirm the action. To close all open files, right-click Open Files in the console tree, select Disconnect All Open Files, and then click OK to confirm the action.


Using and Configuring Public Folder Sharing

Public folder sharing is designed to enable users to share files and folders from a single location. It enables users to quickly determine everything they've publicly shared with others and organize publicly shared files by type. In this section, I'll examine how public folder sharing works and how public folder sharing can be configured.

Using Public Folder Sharing

You can access public folders in Windows Explorer by clicking Start and then clicking Computer. In Windows Explorer, click the leftmost option button in the address list and then click Public. With public folder sharing, you copy or move files that you want to share to a computer's %SystemDrive%\Users\Public folder.

The Public folder has several subfolders that can be used to help organize public files, including:

  • Public Desktop Used for shared desktop items. Any files and program shortcuts placed in the Public Desktop folder appear on the desktop of all users who log on to the computer (and to all network users if network access has been granted to the Public folder).

  • Public Documents, Public Music, Public Pictures, Public Videos Used for shared document and media files. Any files placed in one of these subfolders are available to all users who log on to the computer (and to all network users if network access has been granted to the Public folder).

  • Public Downloads Used for shared downloads. Any downloads placed in the Public Downloads subfolder are available to all users who log on to the computer (and to all network users if network access has been granted to the Public folder).

By default, everyone with a user account and password on a computer can access that computer's Public folder. When you copy or move files to the Public folder, access permissions are changed to match that of the Public folder, and some additional permissions are added as well.

Table 10-5 lists the typical default permissions for files and folders placed in the Public folder. As you can see, the default permissions allow local computer users to read, write, change, and delete any public files. In the Public Music, Public Pictures, and Public Videos folders, %ComputerName%\Users are granted Read & Execute and Read permissions.

Table 10-5. Default Permissions for Publicly Shared Folders and Files

Group or User

Default Permissions for Files

Default Permissions for Folders

%ComputerName%\Administrators

Full Control

Full Control

Batch

Modify, Read & Execute, Read, and Write

Read & Execute, List Folder Contents, and Read

Creator Owner

Special

Special

Interactive

Modify, Read & Execute, Read, and Write

Read & Execute, List Folder Contents, and Read

Service

Modify, Read & Execute, Read, and Write

Read & Execute, List Folder Contents, and Read

System

Full Control

Full Control

The default Public folder sharing configuration can be changed in two key ways:

  • Allow users with network access to view and open public files but restrict them from changing, creating, or deleting public files. When you configure this option, the implicit group Everyone is granted Read & Execute and Read permissions to public files, and Read & Execute, List Folder Contents, and Read permissions on public folders.

  • Allow users with network access to view and manage public files. This allows network users to open, change, create, and delete public files. When you configure this option, the implicit group Everyone is granted Full Control permissions to public files and public folder.

Configuring Public Folder Sharing

Public folder sharing settings are set on a per-computer basis. The same public folder setting is used for the Public folder and all its subfolders. You can configure public folder sharing by following these steps:

1.
Click Start and then click Computer. In Windows Explorer, click the leftmost option button in the address list and then click Public.

2.
On the Windows Explorer toolbar, click Sharing Settings. This opens the Network And Sharing Center. Expand the Public Folder Sharing Panel by clicking the Expand button, as shown in Figure 10-13.

Figure 10-13. Use the Network File And Printer Sharing page to configure public folder sharing.

[View full size image]

3.
Under Public Folder Sharing, select the public folder sharing option you want to use. The options available are:

  • Turn On Sharing So Anyone With Network Access Can Open Files Select this option to grant Reader permission to the Public folder and all public data to anyone who can access the computer over the network. Windows Firewall settings might prevent external access.

  • Turn On Sharing So Anyone With Network Access Can Open, Change, And Create Files Select this option to grant Co-owner access to the Public folder and all public data to anyone who can access the computer over the network. Windows Firewall settings might prevent external access.

  • Turn Off Sharing Select this option to turn off network access to the Public folder and only allow locally (console) logged on users access to public data.

4.
Click Apply to save the changes.


Chapter 11. Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas

In this chapter:
Configuring Advanced Windows Explorer Options | 339
Managing Offline Files | 345
Configuring Disk Quotas | 355

Folder management is a key part of user and system administration. Beyond standard file and folder management, the key tasks you'll perform frequently include configuring Microsoft Windows Explorer options, managing offline file settings, and working with disk quotas. Windows Explorer options control the available file and folder management features as well as the available file types. Offline file settings control the availability of files and folders when users are working offline. Quotas help limit the amount of disk space available to users.


Configuring Advanced Windows Explorer Options

Both users and administrators spend a lot of time working with Windows Explorer or one of the related views, such as Computer. As an administrator, you'll often want to be able to do more with Windows Explorer. You might want to perform one of the following tasks:

  • Deploy computers that have certain Windows Explorer features blocked out. For example, you might want to block users' access to the Hardware tab, preventing them from viewing or changing hardware on a computer.

  • Hide or restrict access to local disks. For example, you might not want users to be able to access the floppy disk drives on the computers that you deploy.

  • Configure file type associations so that a specific program is started when a file is opened. For example, Windows Photo Gallery Viewer might be the default program for .jpg files, and you might want files of this type to open in Adobe Photoshop instead.

These and other advanced configuration options for computers are discussed in this section.

Setting Group Policy for Windows Explorer and Folder Views

As with many other Windows Vista features, Group Policy can be used to control the options available in Windows Explorer. Because many of these options extend to folder views and settings, they are useful to examine. Table 11-1 provides an overview of policies that you might want to implement and how these policies are used when they are enabled. These policies are located in User Configuration\Administrative Templates\Windows Components\Windows Explorer.

Table 11-1. Policies for Windows Explorer

Policy Name

Policy Description

Allow Only Per User Or Approved Shell Extensions

Shell extensions extend the feature set available in Windows Explorer. This setting permits a computer to run only shell extensions that have been approved by an administrator or that don't affect other users on that computer. Approved shell extensions must have a registry entry in HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\Shell Extensions\Approved.

Turn Off The Display Of Thumbnails And Only Display Icons On Network Folders

Disables the display of thumbnails so only icons are displayed when accessing network folders.

Turn Off The Display Of Thumbnails And Only Display Icons

Disables the display of thumbnails so only icons are displayed when accessing local folders.

Display Confirmation Dialog When Deleting Files

Displays a confirmation dialog box whenever you delete files or move files to the Recycle Bin.

Display The Menu Bar In Windows Explorer

Overrides the default configuration and displays the classic menu bar in Windows Explorer.

Hide These Specified Drives In My Computer

In Windows Explorer views, hides icons representing selected hard drives. Users can still gain access to drives through other methods.

Hide The Manage Item On The Windows Explorer Context Menu

Removes the Manage item on the shortcut menu in Windows Explorer views and the Start menu. This shortcut-menu option is used to open Computer Management.

Maximum Number Of Recent Documents

Specifies the maximum number of document shortcuts that My Recent Documents displays. The default is 15. Note that for this list to be available, you must select List My Recently Opened Documents on the Advanced tab of the Customize Start Menu dialog box.

Prevent Access To Drives From My Computer

Prevents users from accessing files on selected drives in Windows Explorer views. Users also can't use Run or Map Network Drive to access files on these drives.

Remove "Map Network Drive" And "Disconnect Network Drive"

Prevents users from mapping or disconnecting network drives using Windows Explorer or My Network Places. This doesn't prevent use of other techniques, such as using the command prompt.

Remove CD Burning Features

Removes CD creation and modification features from Windows Explorer. Users are not prevented from using other CD burning programs.

Remove DFS Tab

Removes the DFS tab from Windows Explorer and Windows Explorerbased windows, preventing users from using the tab to view or change distributed file system (DFS) settings. Note that the DFS tab is only available when DFS is configured in the workgroup or domain.

Remove File Menu From Windows Explorer

Removes the File menu from Windows Explorer views, but doesn't prevent users from using other means to perform tasks that are available on this menu.

Remove Hardware Tab

Removes the Hardware tab from all dialog boxes, preventing users from using the tab to view, change, or troubleshoot hardware devices.

Remove Security Tab

Removes the Security tab in the Properties dialog boxes of files, folders, shortcuts, and drives. This prevents users from changing or viewing the related file and folder permissions.

Remove Windows Explorer's Default Context Menu

Prevents users from right-clicking and displaying shortcut menus on the desktop and in Windows Explorer.

Remove The Folder Options Menu Item From The Tools Menu

Prevents users from accessing the Folder Options dialog box, and as a result, users can't change folder views, file types, or offline file settings.

Request Credentials For Network Installations

Requires user to enter a user name and a password prior to installing applications over the network. If this policy is not enabled, users are only prompted for credentials when installing applications from local disks.

Turn On Classic Shell

Removes Active Desktop and related views, including Web and thumbnail views. This also prevents opening items by single-clicking.

As detailed in Table 11-1, many Windows Explorer policies control the availability of options such as menu items and tabs in dialog boxes. To configure these options for all users of a computer, follow these steps:

1.
Access Group Policy for the system you want to work with. Next access the Windows Explorer node by expanding User Configuration \Administrative Templates\Windows Components\Windows Explorer.

2.
Double-click the policy you want to configure. This displays the Properties dialog box, as shown in Figure 11-1. Select one of the following options:

  • Not Configured Specifies that no changes will be made to the registry for this policy

  • Enabled Enables the policy and updates the registry

  • Disabled Disables the policy and updates the registry

Figure 11-1. Configure Windows Explorer options by enabling or disabling the related policies.

3.
Click OK.

Note

You'll find detailed coverage of some of these policies in later sections of this chapter. In particular, be sure to read the next section, "Managing Drive Access in Windows Explorer," which covers hiding or preventing access to drives in Windows Explorer.

As you work with policy settings related to Windows Explorer, it is important to point out that the following settings do not apply to Windows Vista:

  • Maximum Allowed Recycle Bin Size On Windows Vista, each computer has a recycle bin for each configured drive and each user who logs on locally has a separate private copy of these recycle bins. You can modify the recycle bin settings for the current user by right-clicking Recycle Bin and selecting Properties. On the General tab, select the recycle bin location that you want to work with, set the desired maximum allowed size, and then click OK.

  • No "Computers Near Me" In My Network Places/No "Entire Network" In My Network Places On Windows Vista, the capability to determine network topology is a built-in feature of Network And Sharing Center. The People Near Me feature, used with Windows Collaboration, identifies people using computers on the same network segment, and you can sign in automatically when Windows starts or sign in manually when you want to use Windows Collaboration.

  • Remove Search Button From Windows Explorer Because search features are more tightly integrated in Windows Vista, they are controlled in different ways. You'll find some related settings under User Configuration\Administrative Templates\Windows Components\Instant Search. Options for controlling indexing of files and folders are under Computer Configuration\Administrative Templates\Windows Components\Search.

Managing Drive Access in Windows Explorer

You might want to block access to files on certain drives or even hide certain drives on a system. You manage this through Group Policy. The policies you use are Hide These Specified Drives In My Computer and Prevent Access To Drives From My Computer.

Hiding drives prevents users from accessing them in Windows Explorer views, but it doesn't prevent them from using other techniques to access the drives. In contrast, blocking access to drives prevents users from accessing any files on them and ensures that these files cannot be accessed using Windows Explorer, Run, or Map Network Drive. It doesn't, however, hide drive icons or the folder structure in Windows Explorer.

To hide selected drives or to prevent access to files on selected drives, follow these steps:

1.
Access Group Policy for the system you want to work with. Next access the Windows Explorer node by expanding User Configuration\Administrative Templates\Windows Components\Windows Explorer.

2.
To hide drives, double-click Hide These Specified Drives In My Computer and then select Enabled. Next specify which drives you are hiding and then click OK. Key options are the following:

  • Select Restrict All Drives to restrict access to all internal hard drives and floppy drives.

  • Select Restrict A And B Drives Only to restrict access to floppy drives. Select Restrict A, B And C Drives Only to restrict access to floppy drives and drive C.

  • Select Do Not Restrict Drives to remove additional restrictions that would otherwise apply.

3.
Click OK.

4.
To block access to files on specific drives, double-click Prevent Access To Drives From My Computer and select Enabled. Next select the drives to which you want to restrict access.

5.
Click OK.

Note

The List Folder Contents permission controls whether a user can see files in a folder. If you want to ensure that users cannot view the names of folders on drives, you'll also want to hide the drives.

Managing File Type Associations

A file type association determines which default application will handle a particular type of file, according to the file extension as well as the associated default action. As an example, if the .doc extension is associated with Microsoft Word and has a default action of Open, double-clicking a .doc file opens the file in Microsoft Word. You can view and change file type associations using the Default Programs utility in Control Panel.

Viewing File Type Associations

When programs are installed, they often create file type associations for specific types of files. For example, when you install a drawing application, image file types such as .gif and .jpg might be associated with the program. You can view the file associations for a program by following these steps:

1.
Click Start, Control Panel. In Control Panel, click Programs.

2.
Click Default Programs and then Associate A File Type Or Protocol With A Program. This displays the Set Associations dialog box, shown in Figure 11-2.

Figure 11-2. View and change file type associations using the Set Associations dialog box.

[View full size image]

3.
The Set Associations dialog box provides a list of file extensions, the associated file types, and the current default program for a particular file type. If you click the heading for the Description column, you can sort entries so that files of the same type are listed together. This can often help you find multiple file types associated with the same program.

Changing File Type Associations

Sometimes, you'll find that programs have file types associated with them that users would rather have associated with other files. If this happens, you can change the file type association by completing these steps:

1. | Click Start, Control Panel. In Control Panel, click Programs.
2. | Click Default Programs and then Associate A File Type Or Protocol With A Program.
3. | You must change each file extension associated with the file type you want to modify. Select the first file extension that you want to reconfigure and then click Change Program. This displays the Open With dialog box.
4. | Under Recommended Programs and Other Programs, you'll see a list of recommended programs and other programs that might be able to use this file extension. Select the program to use and then click OK.
5. | As necessary, repeat steps 2 and 3 for other file extensions associated with this file type.


Managing Offline Files

Configuring offline files is a multistep process that begins with setting appropriate group policies, continues through configuration of specific offline folders, and ends with setting user options for working offline. Although the primary users who work offline use laptops, which they take home or to other locations, all users can benefit from offline file configurations. Configuring Group Policy for offline files was discussed in Chapter 8, "Configuring User and Computer Policies." This section provides more details about offline files and provides specific steps for their configuration.

Understanding Offline Files

Offline files enable users to store network files on their computer so that they are available when the users are not connected to the network or there is a network outage. Once configured, Windows Vista automatically uses offline files whenever the network files are not available. This enables users to continue working on network files without interruption. When the connection to the network is reestablished, Windows Vista automatically synchronizes the files on the user's computer with the files in the network folder.

The way changes are applied depends on how they were made. If multiple users make changes to a particular offline file, they can use conflict resolution features to save their version of the file over the existing version, keep the other version, or save both versions on the network. If a user deletes an offline file, the file is also deleted on the network, except when someone modifies the file on the network so that it has a more recent date and time stamp. In this case, the file is deleted from the user's computer and not from the network. If users change an offline file that someone else deletes from the network, they can choose to save their version to the network or delete it from their computer.

Windows Vista provides two key enhancements to the way offline files are used:

  • Change-only syncing Windows Vista allows for faster synchronization by syncing only the changed blocks of files. Thus, unlike Windows XP, where the entire contents of a changed file are written back to the server during synchronization, with Windows Vista only the changed blocks are written back to the server during synchronization.

  • Unavailable file and folder ghosting When partial contents of a folder are made available offline, Windows Vista creates ghosted entries of other files and folders to preserve the online context. Because of this, when you are not connected to a remote location, you'll see ghost entries for online items as well as normal entries for offline items.

Both users and administrators have control over when offline files are synchronized. Automatic synchronization can be triggered by user logon and logoff and by computers entering the standby or hibernate modes. The exact settings for automatic synchronization depend on Group Policy and user settings. For details on configuring offline files through Group Policy, see the section of Chapter 8 entitled "Configuring Offline File Policies."

Manual synchronization is controlled through Sync Center. You can access Sync Center by following these steps:

1. | Click Start, Control Panel. In Control Panel, click Network And Internet.
2. | On the Network And Internet Page, click Sync Center.

Making Files or Folders Available Offline

Shared network folders can be made available for use offline. By default, all subfolders and files within the shared folders are also available offline. If necessary, you can change the availability of individual files and subfolders. To do this, you'll need to change the availability of each individual file or subfolder. Keep in mind that new files added to a shared folder that is designated for offline use are not automatically distributed to users working offline. The offline folder must be synchronized to obtain the updates.

You can configure offline files using Windows Explorer or the Computer Management console. Because Computer Management enables you to work with and manage offline files on any of your network computers, it's usually the best tool to use. To configure offline files on a server running Microsoft Windows 2000 or Windows Server 2003, you must be a member of the Administrators or the Server Operators group. To configure offline files on a Windows Vista workstation, you must be a member of the Administrators or the Power Users group.

Making files or folders available offline is a three step process. First you share folders. Then you make those folders available for offline use. Finally, you have the users specify the files and folders they want to use offline.

Step 1: Share Folders

In the Computer Management console, you make a folder available for sharing by completing the following steps:

1. | Right-click Computer Management in the console tree and then select Connect To Another Computer. Use the Select Computer dialog box to choose the computer you want to work with.
2. | In the console tree, expand System Tools and Shared Folders and then select Shares. The current shares on the system are displayed in the details pane.
3. | Right-click Shares and then select New File Share. This starts the Create A Shared Folder Wizard, which can be used to share folders as discussed in Chapter 10, "Managing File Security and Folder Sharing," in the "Sharing a Folder and Setting Share Permissions in Computer Management" section.
Step 2: Make Folders Available for Offline Use

In the Computer Management console, you make a shared folder available for offline use by completing these steps:

1.
Right-click Computer Management in the console tree and then select Connect To Another Computer. Use the Select Computer dialog box to choose the computer you want to work with.

2.
In the console tree, expand System Tools and Shared Folders and then select Shares.

3.
Current shared folders are displayed in the details pane. Double-click the share you want to configure for offline use. On the General tab, click Offline Settings.

4.
In the Offline Settings dialog box, shown in Figure 11-3, select one of the following options:

  • Only The Files And Programs That Users Specify Will Be Available Offline Use this setting when you want users to manually specify any files that they want available when working offline. This is the default option and is best used when multiple users want to modify the same files within a folder. Once configured for manual caching, files are automatically downloaded and made available for offline use. If an older version of a document was cached previously, the older version is deleted. When using a file online, the server version always reflects that the file is in use.

  • All Files And Programs That Users Open From The Share Will Be Automatically Available Offline Use this setting for folders containing user data and programs. Opened files and program executables are automatically downloaded and made available for offline use. If an older version of a document was cached previously, the older version is deleted from the local cache. When using a file online, the server version always reflects that the file is in use. Prompts are displayed if version conflicts occur.

    With this option, you can also select Optimized For Performance to enable expanded caching of programs. This expanded caching enables programs shared over the network to be cached so they can be run locally, which improves performance.

Figure 11-3. Configure caching options for offline files in the Offline Settings dialog box.

5.
Click OK twice.

Step 3: Specify the Offline Files and Folders to Use

Once you've created the shares and configured offline use of those shares as appropriate, you can specify the files and folders to use offline by following these steps:

1.
Map a network drive to a shared file or folder as discussed in Chapter 10 in the "Using and Accessing Shared Resources" section.

2.
Click Start, Computer. This opens the Computer Console.

3.
Create the offline file cache by doing one of the following:

  • To copy the entire contents of a shared folder to the user's computer and make it available for offline use, under Network Location, right-click the shared location and then select Always Available Offline.

  • To copy only a selected folder (and its contents) or a selected file to the user's computer and make it available offline, use the Computer console to locate the network file or folder, and then right-click the file or folder and select Always Available Offline.

Designating files and folders for offline use creates a local cache of the contents of the files and folders on the user's computer. It also either establishes a sync partnership between the local computer and the sharing computer or extends an existing sync partnership to incorporate the additional shared files and folders. Sync partnerships can be managed using Sync Center as discussed in the "Managing Offline File Synchronization" section later in this chapter.

Working Offline

You are considered to be working offline whenever your computer is not connected to the local area network. When working offline, you can work with network files in the same way that you do when you are connected to the network. You have the same permissions when working offline. Therefore, if you only have read access to a file when you're connected to the network, then when you're working offline, you'll still only be able to read and not modify the file. You know you are working offline when you see a red X over Network Drives or in the notification area of the taskbar.

You can also specify that you want to work offline. To work with offline files stored on your computer rather than on the network, follow these steps:

1. | In Windows Explorer, open the network folder that contains the files you want to work with offline and then click Work Offline on the toolbar.
2. | When you are finished working offline and want to begin working online again, click Work Online on the toolbar. This will sync any changes you've made offline with the files on the network.

Managing Offline File Synchronization

Sync Center, shown in Figure 11-4, simplifies the management of cached offline files and folders. In Sync Center, a sync partnership is established for every shared folder that has locally cached contents. Each sync partnership established has a set of properties that enables you to control whether and how syncing occurs.

Figure 11-4. Use Sync Center to view and manage synchronization.

[View full size image]

Viewing Current Sync Partnerships

You can view current sync partnerships in Sync Center by following these steps:

1. | Click Start, Control Panel. In Control Panel, click Network And Internet.
2. | On the Network And Internet page, click Sync Center.
3. | In Sync Center, currently defined sync partnerships are listed according to name, status, progress, conflict count, error count, and category.

Once you've accessed Sync Center, you can easily check for synchronization problems, start or stop syncing, and configure syncing.

Syncing Offline Files Manually

You can manually start syncing of offline files using either of the following techniques:

  • Sync all offline files and folders When multiple sync partnerships have been established, you can sync all offline files and folders by opening Sync Center and then clicking Sync All. Sync All is only available when no individual sync partnerships are selected.

  • Sync a specific network share When you want to sync the offline files and folders for a particular shared network folder, you can sync a specific network share by opening Sync Center, clicking the sync partnership that you want to work with, and then clicking Sync.

Syncing Offline Files Automatically

Group Policy settings control exactly how offline file syncing works. Generally, offline files are automatically synchronized when a user reconnects to the network after being disconnected from the network or electing to work offline. You can also configure synchronization so that it occurs at one of the following times:

  • At a specific scheduled time

  • When the user logs on

  • When the computer is idle

  • When the user locks or unlocks Windows

Scheduling Syncing

You can create and manage scheduled synchronization by following these steps:

1.
In Sync Center, click the sync partnership you want to work with and then click Schedule.

2.
If you've previously scheduled synchronization for this resource, you can:

  • Create a new schedule Click Create A New Sync Schedule and then follow steps 37.

  • View or edit an existing schedule Click View Or Edit An Existing Sync Schedule, click the schedule to change, click Next, and then follow steps 37.

  • Delete an existing schedule Click Delete An Existing Sync Schedule, click the schedule to delete, and then click Delete. Click OK and then skip the remaining steps.

3.
Review the items you are configuring and clear the check boxes for any items you don't want to configure. Then click Next. Click At A Scheduled Time.

4.
The Start On and At options are configured so scheduled syncing will start immediately. (See Figure 11-5.) If you want to start scheduled syncing on a different date and time, use the options provided to change the start date and time. You can use the left and right arrow keys to navigate the fields and the up and down arrows to change the values.

Figure 11-5. Create a sync schedule.

[View full size image]

5.
The Repeat Every option sets the sync interval. The default repeat interval is once every day. You can set the repeat interval to a value in minutes, hours, days, weeks, or months. Because only changes are synced, you might want to sync more frequently than you would with Windows XP. For example, with important files, you might want to sync every three to four hours.

6.
Click Next.

7.
Type a descriptive name for the scheduled sync and then click Save Schedule.

Syncing on an Event or Action

You can create and manage synchronization based on events or actions by following these steps:

1.
In Sync Center, click the sync partnership you want to work with and then click Schedule.

2.
If you've previously scheduled synchronization for this resource, you can:

  • Create a new schedule Click Create A New Sync Schedule and then follow steps 36.

  • View or edit an existing schedule Click View Or Edit An Existing Sync Schedule, click the schedule to change, click Next, and then follow steps 36.

  • Delete an existing schedule Click Delete An Existing Sync Schedule, click the schedule to delete, and then click Delete. Click OK and then skip the remaining steps.

3.
Review the items you are configuring, clear the check boxes for any items you don't want to configure, and then click Next. Click On An Event Or Action.

4.
As shown in Figure 11-6, use the check boxes provided to specify the events and actions that start automatic syncing.

Figure 11-6. Sync based on events and actions.

[View full size image]

5.
Click Next.

6.
Type a descriptive name for the scheduled sync and then click Save Schedule.

Determining Synchronization Details, Errors, and Warnings

Synchronization results provide details, errors, and warnings. To view current sync results, open Sync Center and click View Sync Results under Tasks. You can use the sync details to determine when syncing was started, stopped, or completed. You can use errors and warnings to determine whether there are problems with the synchronization configuration.

Resolving Synchronization Conflicts

Synchronization conflicts occur if a user makes changes to a file offline that is updated online by another user. You can view and resolve synchronization conflicts by following these steps:

1.
In Sync Center, click View Sync Conflicts under Tasks.

2.
Any existing conflicts are listed in the main pane, as shown in Figure 11-7.

Figure 11-7. Conflicts are listed according to document name, file type, time, partnership, and conflict type.

[View full size image]

3.
To display the Resolve Conflict dialog box, shown in Figure 11-8, double-click a conflict you want to resolve.

Figure 11-8. Use the Resolve Conflict dialog box to resolve synchronization conflicts.

4.
You can now:

  • Click the version you want to keep. If you want to keep the local version and overwrite the network version, click the version listed as On This Computer. If you want to keep the network version and overwrite the local version, click the version listed as being on the shared network location.

  • Click Keep Both Versions to write the local version to the shared network location with a new file name. Generally, the new file name will be the same as the old file name, but with a numeric suffix, indicating the version increment. If you are at all unsure about which version of a file to keep, keep both versions and then compare the two versions carefully for changes that should either be merged or discarded.

Making Offline Files Unavailable

As an administrator, you can specify files that should not be available for offline use. Typically, you'll do this when a shared folder contains specific files that users shouldn't manipulate. To make a file unavailable for offline use, you should set a specific exclusion policy as described in Chapter 8 in the "Administratively Controlling Offline Files and Subfolders" section.

In the Computer Management console, you make a shared folder unavailable for offline use by completing these steps:

1. | Right-click Computer Management in the console tree and then select Connect To Another Computer. Use the Select Computer dialog box to choose the computer you want to work with.
2. | In the console tree, expand System Tools and Shared Folders and then select Shares. Current shared folders are displayed in the details pane.
3. | Double-click the share you want to configure for offline use. On the General tab, click Offline Settings.
4. | In the Offline Settings dialog box, select Files Or Programs From The Share Will Not Be Available Offline.
5. | Click OK.


Configuring Disk Quotas

The following sections discuss how to use and manage disk quotas. Disk quotas enable you to manage disk space usage, and they are configured on a per volume basis. Only NTFS file system (NTFS) volumes can have quotas, so you can't create them for file allocation table (FAT16 or FAT32) volumes. The first step in configuring quotas is to enable disk quota policies as described in Chapter 8 in the "Configuring Disk Quota Policies" section. Once you configure the necessary policies, you can set up quotas for specific volumes on a system.

Using Disk Quotas

Administrators use disk quotas to manage disk space usage for critical volumes, such as those that provide corporate or user data shares. When you enable disk quotas, you set a disk quota limit and a disk quota warning. The disk quota limit sets the maximum space usage (which prevents users from writing additional information to a volume), logs events regarding the user exceeding the limit, or both. You use the disk quota warning to warn users and to log warning events when users approach their disk quota limits.

Real World

Although most administrators configure quotas that are enforced, you can set disk quotas that are not enforced. You might wonder why you would do this. Sometimes you might want to track disk space usage on a per user basis and know when users have exceeded some predefined limit. Instead of denying the users additional disk space, however, you can track the overage by recording an event in the application log.

Disk quotas apply only to end users, not to administrators. Administrators can't be denied disk space even if they exceed enforced disk quota limits. Disk quota limits and warnings can be set in kilobytes (KB), megabytes (MB), gigabytes (GB), terabytes (TB), petabytes (PB), and exabytes (EB). In a typical environment, you'll restrict disk space usage in megabytes or gigabytes. For example, on a corporate data share that is used by multiple users in a department, you might want to limit disk space usage to 20 to 100 GB. For a user data share, you might want to set the level much lower, such as 5 to 20 GB, restricting the user from creating large amounts of personal data. Often you'll set the disk quota warning as a percentage of the disk quota limit. For example, you could set the warning at 90 to 95 percent of the disk quota limit.

Because disk quotas are tracked on a per volume, per user basis, disk space used by one user does not affect the disk quotas for other users. Thus, if one user exceeds his limit, any restrictions applied to this user don't apply to other users. For example, if a user exceeds a 5 GB disk quota limit and the volume is configured to prevent writing over the limit, the user can no longer write data to the volume. However, he can remove files and folders from the volume to free up disk space. The user could also move files and folders to a compressed area on the volume, which can free up space, or the user could elect to compress the files. Moving files to a different location on the volume doesn't affect the quota restriction. The amount of file space is the same unless the user is moving uncompressed files and folders to a folder with compression. In any case, the restriction on a single user does not affect other users' ability to write to the volume (as long as the volume has free space).

You can enable disk quotas on local volumes and on remote volumes. To manage disk quotas on local volumes, you work with the local disk itself. To manage disk quotas on remote volumes, you must share the root directory for the volume and then set the disk quota on the volume. Keep in mind that when you enable disk quotas on a local volume, operating system and application program files are not included in the volume usage for the user who installed those files. Generally, system files are owned by TrustedInstaller and program files are owned by the system account.

Only members of the domain administrators group or the local system administrators group can configure disk quotas. Through local group policy, you can enable disk quotas for an individual computer. Through site, domain, or organizational unit policies, you can enable disk quotas for groups of users and computers. Keeping track of disk quotas does cause some overhead on computers, which is a function of the number of disk quotas being enforced, the total size of volumes and their data, and the number of users to which the disk quotas apply.

Although it appears that disk quotas are tracked per user, behind the scenes, Windows Vista manages disk quotas according to security identifiers (SIDs). Because disk quotas are tracked by SIDs, you can safely modify user names without affecting the disk quota configuration. Tracking by SIDs causes some additional overhead when viewing disk quota statistics for users because Windows Vista must correlate SIDs to user account names so that the account names can be displayed in dialog boxes. This means contacting the local user manager or the Microsoft Active Directory directory service domain controller as necessary. Once names are looked up, they are cached to a local file so that they are available immediately the next time they are needed. The query cache is infrequently updated, so if you notice a discrepancy between what is displayed and what is configured, you'll need to refresh the information. Usually, this means selecting Refresh or pressing F5 in the current window.

Enabling Disk Quotas on NTFS Volumes

Disk quotas are set on a per volume basis, and only NTFS volumes can have disk quotas. Disk quotas must first be configured through Group Policy as discussed in Chapter 9. Once the appropriate group policies are configured, you can use the Computer Management console to set disk quotas for local and remote volumes.

To enable disk quotas on an NTFS volume, follow these steps:

1.
Start Computer Management. You are connected to the local computer by default. If you want to configure disk quotas on a remote computer, right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, select the computer you want to work with.

2.
In the console tree, expand Storage and then select Disk Management. The volumes configured on the selected computer are displayed in the details pane.

3.
Using the Volume List or Graphical view, right-click the volume you want to work with and then select Properties.

4.
Click the Quota tab, shown in Figure 11-9, and then select the Enable Quota Management check box.

Figure 11-9. Once you enable quota management, you can configure a quota limit and quota warning for all users.

5.
To set a default disk quota limit for all users, select Limit Disk Space To and then use the fields provided to set a limit in KB, MB, GB, TB, PB, or EB. Next use the Set Warning Level To fields to set the default warning limit. You'll usually want the disk quota warning limit to be 90 to 95 percent of the disk quota limit.

Tip

Although the default quota limit and warning apply to all users, you can use the Quota Entries dialog box to configure different levels for individual users. If you create many unique quota entries and don't want to re-create them on a volume with similar characteristics and usage, you can export the quota entries and import them on a different volume.

6.
To enforce the disk quota limit and prevent users from going over the limit, select the Deny Disk Space To Users Exceeding Quota Limit check box. Keep in mind that this creates an actual physical limitation for users, but not for administrators.

7.
To configure logging when users exceed a warning limit or the quota limit, use the Log Event check boxes.

8.
If the quota system isn't currently enabled, you'll see a prompt asking you to enable the quota system. Click OK to allow Windows Vista to rescan the volume and update disk usage statistics. Actions can be taken against users that exceed the current limit or warning levels, which can include preventing additional writing to the volume, notifying users the next time they access the volume, and logging applicable events in the application log.

Viewing Disk Quota Entries

Disk space usage is tracked on a per user basis. When disk quotas are enabled, each user storing data on a volume has an entry in the disk quota file. This entry is updated periodically to show the current disk space used, the applicable quota limit, the applicable warning level, and the percentage of allowable space being used. As an administrator, you can modify disk quota entries to set different limits and warning levels for particular users. You can also create disk quota entries for users who have not yet saved data on a volume. By creating entries, you ensure that when a user does make use of a volume, she has an appropriate limit and warning level.

To view the current disk quota entries for a volume, follow these steps:

1.
Start Computer Management. You are connected to the local computer by default. If you want to view disk quotas on a remote computer, right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, select the computer you want to work with.

2.
In the console tree, expand Storage and then select Disk Management. The volumes configured on the selected computer are displayed in the details pane.

3.
Using the Volume List or Graphical view, right-click the volume you want to work with and then select Properties.

4.
On the Quota tab, click Quota Entries. This displays the Quota Entries dialog box, shown in Figure 11-10. As you can see from the figure, each quota entry is listed according to a status. The status is meant to quickly depict whether a user has gone over her limit. A status of OK means the user is working within the quota boundaries. Any other status usually means the user has reached the warning level or the quota limit.

Figure 11-10. Disk quota entries show current disk space usage on a particular volume as well as applicable quota limits and warning levels.

[View full size image]

Creating Disk Quota Entries

You can create disk quota entries for users who have not yet saved data on a volume as well as for users who have already saved data on a volume. This enables you to set custom limits and warning levels for any user as necessary. Usually you'll use this feature when one user frequently stores more information than others do. For example, a graphic designer might have much higher storage needs than a customer-support person does. The good news about custom quota entries is that you can export them to other volumes, which enables you to quickly apply the same set of rules to multiple volumes.

To create a quota entry on a volume, follow these steps:

1. | In Computer Management, expand Storage and then select Disk Management. Using the Volume List or Graphical view, right-click the volume you want to work with and then select Properties.
2. | On the Quota tab, click Quota Entries. Current quota entries for all users are listed. To refresh the listing, press F5 or select Refresh from the View menu.
3. | If the user doesn't have an existing entry on the volume, you can create one from the Quota menu by selecting New Quota Entry. This opens the Select Users dialog box.
4. | In the Select Users dialog box, type the name of a user in the Enter The Object Names To Select field and then click Check Names. If multiple matches are found, select the desired account and then click OK. If no matches are found, update the name you entered and try again. Repeat this step as necessary and click OK when finished.
5. | Once you've selected a name, the Add New Quota Entry dialog box is displayed. You have several options. You can remove all quota restrictions for this user by selecting Do Not Limit Disk Usage. In addition, you can set a specific limit and warning level by selecting Limit Disk Space To and then entering the appropriate values in the fields provided.
6. | Click OK. Close the Quota Entries dialog box. Click OK on the Properties dialog box.

Updating and Customizing Disk Quota Entries

You can modify and customize disk quota entries for individual users at any time by following these steps:

1. | In Computer Management, expand Storage and then select Disk Management. Using the Volume List or Graphical view, right-click the volume you want to work with and then select Properties.
2. | On the Quota tab, click Quota Entries. Current quota entries for all users are listed. To refresh the listing, press F5 or select Refresh from the View menu.
3. | Double-click the quota entry for the user. This displays the Quota Settings For dialog box, which is similar to the dialog box shown in Figure 11-10.
4. | To remove all quota restrictions for this user, select Do Not Limit Disk Usage.
5. | To modify the current limit and warning level, select Limit Disk Space To and then enter the appropriate values in the fields provided.
6. | Click OK.

Deleting Disk Quota Entries

When you've created disk quota entries on a volume and a user no longer needs to use the volume, you can delete the associated disk quota entry. When you delete a disk quota entry, all files owned by the user are collected and displayed in a dialog box so that you can permanently delete the files, take ownership of the files, or move the files to a folder on a different volume.

To delete a disk quota entry for a user and manage the remaining files on the volume, follow these steps:

1.
In Computer Management, expand Storage and then select Disk Management. Using the Volume List or Graphical view, right-click the volume you want to work with and then select Properties.

2.
On the Quota tab, click Quota Entries. Current quota entries for all users are listed. To refresh the listing, press F5 or select Refresh from the View menu.

3.
Select the disk quota entry that you want to delete and then press Del or select Delete Quota Entry from the Quota menu. You can select multiple entries using the Shift or Ctrl key.

4.
When prompted to confirm the action, click Yes. This displays the Disk Quota dialog box with a list of current files owned by the selected user or users.

5.
Use the List Files Owned By selection list to display files for the user whose quota entry you are deleting. You must then specify how the files for the user will be handled. You can handle each file separately by selecting individual files and then choosing an appropriate option. Select multiple files by using the Shift or Ctrl key. The following options are available:

  • Show Folders Only Changes the view to show only folders in which the user has files. In this way, you can delete, move, or take ownership of all the user's files in a particular folder.

  • Show Files Only Shows all files that the user owns according to the folder in which they were created. This is the default view.

  • Permanently Delete Files Select the files to delete and then press Del. When prompted to confirm the action, click Yes.

  • Take Ownership Of Files Select the files that you want to take ownership of and then click Take Ownership.

  • Move Files To Select the files that you want to move and then, in the field provided, enter the path to a folder on a different volume. If you don't know the path that you want to use, click Browse to display the Browse For Folder dialog box, which you can use to find the folder. Once you find the folder, click Move.

6.
Click Close when you are finished managing the files. Provided that you've appropriately handled all user files, the disk quota entries are deleted.

Exporting and Importing Disk Quota Settings

Rather than re-creating custom disk quota entries on individual volumes, you can export the settings from a source volume and import them to another volume. Both volumes must be formatted using NTFS. To export and then import disk quota entries, perform the following steps:

1. | Start Computer Management. You are connected to the local computer by default. If you want to work with disk quotas on a remote computer, right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, select the computer you want to work with.
2. | In the console tree, expand Storage and then select Disk Management. The volumes configured on the selected computer are displayed in the details pane.
3. | Using the Volume List or Graphical view, right-click the source volume and then select Properties.
4. | On the Quota tab, click Quota Entries. This displays the Quota Entries dialog box.
5. | From the Quota menu, select Export. This displays the Export Quota Settings dialog box. Use the Save In selection list to choose the location to which to save the file containing the quota settings, and then set a name for the file using the File Name field. Next click Save. Tip If you save the settings file to a mapped drive on the target volume, you'll have an easier time importing the settings. Quota files are usually fairly small, so you won't need to worry about disk space usage.
6. | From the Quota menu, select Close to exit the Quota Entries dialog box. Click OK to close the Properties dialog box.
7. | Right-click Computer Management in the console tree. From the shortcut menu, select Connect To Another Computer. In the Select Computer dialog box, select the computer containing the target volume on which you want to use the exported settings.
8. | Expand Storage and then select Disk Management. Using the Volume List or Graphical view, right-click the target volume and then select Properties.
9. | Click the Quota tab, ensure that Enable Quota Management is selected, and then click Quota Entries. This displays the Quota Entries dialog box for the target volume.
10. | From the Quota menu, select Import. In the Import Quota Settings dialog box, select the quota settings file that you saved previously. Click Open.
11. | If the volume had previous quota entries, you'll have the opportunity to replace or keep existing entries. When prompted about a conflict, click Yes to replace an existing entry, or click No to keep the existing entry. The option to replace or keep existing entries can be applied to all entries on the volume by selecting Do This For All Quota Entries prior to clicking Yes or No.

Disabling Disk Quotas

You can disable quotas for individual users or all users on a volume. When you disable quotas for a particular user, that user is no longer subject to the quota restrictions, but disk quotas are still tracked for other users. When you disable quotas on a volume, quota tracking and management are completely removed. To disable quotas for a particular user, follow the technique outlined in the "Updating and Customizing Disk Quota Entries" section of this chapter. To disable quota tracking and management on a volume, follow these steps:

1. | Start Computer Management. You are connected to the local computer by default. If you want to disable disk quotas on a remote computer, right-click Computer Management in the console tree and then select Connect To Another Computer. In the Select Computer dialog box, select the computer you want to work with.
2. | In the console tree, expand Storage and then select Disk Management. The volumes configured on the selected computer are displayed in the details pane.
3. | Using the Volume List or Graphical view, right-click the volume and then select Properties.
4. | On the Quota tab, clear the Enable Quota Management check box. Click OK. When prompted to confirm, click OK.


Chapter 12. Configuring and Troubleshooting TCP/IP Networking

In this chapter:
Navigating Windows Vista Networking Features | 365
Installing Networking Components | 371
Configuring Local Area Connections | 375
Managing Local Area Connections | 385
Troubleshooting and Testing Network Settings | 389

This chapter focuses on managing local area connections, which are used to communicate on a network. For local area networking to work properly, you must install networking components and configure network communications using Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and Windows Internet Naming Service (WINS). DHCP is used for dynamic configuration of networking and Internet Protocol (IP) address settings. Both DNS and WINS provide name resolution services, with DNS being the preferred service and WINS being maintained for backward compatibility with earlier releases of the Microsoft Windows operating system.


Navigating Windows Vista Networking Features

The networking features in Microsoft Windows Vista are different from those in earlier releases of Windows. Windows Vista has a new suite of networking tools, including:

  • Network Explorer Provides a central console for browsing computers and devices on the network

  • Network And Sharing Center Provides a central console for viewing and managing a computer's networking and sharing configuration

  • Network Map Provides a visual map of the network that depicts how computers and devices are connected

  • Network Diagnostics Provides automated diagnostics to help diagnose and resolve networking problems

Before discussing how these networking tools are used, we must first look at the Windows Vista features on which these tools rely, including:

  • Network Discovery A feature of Windows Vista that controls the ability to see other computers and devices

  • Network Awareness A feature of Windows Vista that reports changes in network connectivity and configuration

Understanding Network Discovery and Network Categories

The network discovery settings of the computer you are working with determine the computers and devices you can browse or view in Windows Vista networking tools. Discovery settings work in conjunction with a computer's Windows Firewall to either block or allow:

  • Discovery of network computers and devices

  • Discovery of your computer by others

Network discovery settings are meant to provide the appropriate level of security for each of the various categories of networks to which a computer can connect. Three categories of networks are defined:

  • Domain Network Intended as a designation for a network in which computers are connected to the corporate domain to which they are joined. By default, discovery and file sharing are allowed on a domain network, which reduces restrictions and permits computers on the domain network to discover other computers and devices on that network and share files.

  • Private Network Intended as a designation for a network in which computers are configured as members of a workgroup and are not connected directly to the public Internet. By default, discovery and file sharing are allowed on a private network, which reduces restrictions and permits computers on the private network to discover other computers and devices on that network and to share files.

  • Public Network Intended as a designation for a network in a public place, such as a coffee shop or airport, rather than for an internal network. By default, discovery and file sharing are blocked on a public network, which enhances security by preventing computers on the public network from discovering other computers and devices on that network. Files and printers that you have shared from this computer cannot be accessed from the network. Additionally, some programs might not be able to access the network.

Because a computer saves settings separately for each category of network, different block and allow settings can be used for each network category. The first time you connect your computer to a network, you'll see a dialog box that allows you to specify whether you are at home, at work, or in a public location. Your selection sets the network category. After that, if you change your network connection or connect to a new network, Windows Vista will try to determine the network category automatically. If Windows Vista is unable to determine the network category, it uses the public network category. If you join a computer to a domain, the private network to which the computer is connected changes to a domain network.

Based on the network category, Windows Vista automatically configures settings that either turn discovery on or off. The On (Enabled) state means:

  • The computer can discover other computers and devices on the network.

  • Other computers on the network can discover the computer.

The Off (Disabled) state means:

  • The computer cannot discover other computers and devices on the network.

  • Other computers on the network cannot discover the computer.

Working with Network Explorer

Network Explorer displays a list of discovered computers and devices on the network. You can access Network Explorer by clicking Start and then clicking Network. The computers and devices listed in Network Explorer depend on the network discovery settings of the computer.

If discovery is blocked, you'll see a note about this in Network Explorer's notification area, as shown in Figure 12-1. Clicking the warning message and then selecting Turn On Network Discovery enables network discovery and opens the appropriate Windows Firewall ports so that network discovery is allowed. If no other changes have been made with regard to network discovery, the computer will be in the discovery-only state. Sharing of printers, files, and media would need to be configured manually as discussed in Chapter 10, "Managing File Security and Resource Sharing."

Figure 12-1. Use Network Explorer to allow network discovery and to browse resources as permitted by the current configuration.

[View full size image]

Providing you have appropriate permissions, you can browse any computer or device listed in Network Explorer. Double-click the icon for the computer to access its shared resources. Double-click the icon for a device to access its management interface or browse its resources.

Network Explorer's toolbar provides four options:

  • Search Active Directory When you have access to a corporate domain, you can click Search Active Directory to display the Find Users, Contacts, And Groups dialog box and then use this dialog box to search Active Directory for users, contacts, groups, computers, printers, shared folders, and other objects. Use the Find selection list to choose the type of resource to search for. Use the In selection list to choose where in the directory to search.

  • Network And Sharing Center When you want to view network status or manage network settings, click Network And Sharing Center to open Network And Sharing Center. You can work with Network And Sharing Center as discussed in the "Working with Network And Sharing Center" section of this chapter.

  • Add A Printer Starts the Add Printer Wizard so you can add a local, network, wireless, or Bluetooth printer.

  • Add A Wireless Device Starts the Add A Wireless Device To The Network Wizard so you can add wireless devices that were detected but not configured.

Working with Network And Sharing Center

Network And Sharing Center, shown in Figure 12-2, provides the current network status as well as an overview of the current network configuration. You can access Network And Sharing Center by following these steps:

1.
Click Start and then click Network.

2.
In Network Explorer, click Network And Sharing Center on the toolbar.

Figure 12-2. Use Network And Sharing Center to view the network status and details.

[View full size image]

Network And Sharing Center has three main areas:

  • Summary network map Provides a graphical depiction of the network configuration and connections. A normal status is indicated by a line connecting the various network segments. Any problems with the network configuration or connections are depicted with warning icons. A yellow warning icon indicates a possible configuration issue. A red X indicates a lack of a connection for a particular network segment. In Figure 12-2, the computer has a connection to the network but doesn't have a connection to the Internet. Clicking View Full Map opens Network Map, which displays an expanded network view as discussed in the "Working with Network Map" section of this chapter.

  • Network details Lists the current network by name and provides an overview of the network. The value in parentheses following the network name shows the category of the current network as Domain Network, Private Network, or Public Network. The Access field specifies whether and how the computer is connected to its current network as Local only, Local And Internet, or Internet only. The Connection field shows the name of the local area connection being used to connect to the current network. If you click Customize, you can change the network name, network category (for a private or public network only), and network icon. If you click View Status, you can display the Status dialog box for the local area connection.

  • Sharing and discovery Provides the options for configuring the computer's sharing and discovery settings and lists the current state of each option. To manage an option, expand the option's view panel by clicking the Expand button (showing a down arrow), clicking the desired setting, and then clicking Apply. To turn on or turn off network discovery, expand Network Discovery, click Turn On Network Discovery or Turn Off Network Discovery as appropriate, and then click Apply.

From Network And Sharing Center, you can attempt to diagnose a warning status. To do this, click the warning icon to start Windows Network Diagnostics. Windows Network Diagnostics will then attempt to identify the network problem and provide a possible solution.

Working with Network Map

When mapping is permitted by Group Policy and discovery is enabled, Network Map, shown in Figure 12-3, provides an expanded graphical depiction of the network configuration and connections. You can access Network Map by following these steps:

1. | Click Start and then click Network.
2. | In Network Explorer, click Network And Sharing Center on the toolbar.
3. | In Network And Sharing Center, click View Full Map.

Figure 12-3. Use Network Map to get an expanded view of the network.

[View full size image]

Note

In a standard configuration, computers running Windows Vista can create a summary network map like the one available in Network And Sharing Center. Any more detailed network mapping, however, is only permitted when network discovery is enabled and when allowed by Group Policy.

When you click View Full Map in Network And Sharing Center (and both discovery and policy settings allow it), Windows Vista generates a map of the current network. Computers and devices that are discovered and can be placed on the map are shown with lines that depict how they are connected. Computers and devices that are discovered but cannot be placed on the map are listed at the bottom of the page.

On the network map, any problems with the network configuration or connections are depicted with warning icons. A yellow warning icon indicates a possible configuration issue. A red X indicates a lack of a connection for a particular network segment. Clicking a warning icon starts Windows Network Diagnostics, which tries to identify the network problem and provide a possible solution.

Several helpful links are provided. You can open Windows Help And Support by clicking the Why Are Some Computers And Devices Missing link. You can open Network Explorer by clicking the View Computers And Devices link.

Real World

Network Map can be useful in some situations. However, because it allows discovery of an organization's internal network, which can put the network at risk, network mapping is disabled in Group Policy by default. Group Policy settings for controlling network mapping are found under Computer Policy\Administrative Templates\Network\Link-Layer Topology Discovery. For a computer to discover other computers for mapping, Turn On Mapper I/O (LLTDIO) Driver must be enabled in a Group Policy Object being applied to the computer. For a computer to be discovered by other computers, Turn On Responder (RSPNDR) Driver must be enabled in a Group Policy Object being applied to the computer.

When you enable either or both of these settings, you can also specify how this feature should work. In most cases, if you allow mapping, you'll want to configure the settings to allow operation while in the domain and prohibit operation while in a private network. Only allow operation on a public network when there is a specific requirement to do so and then only allow it for the individual computer or computers that require mapping.


Installing Networking Components

If you want to install networking on a computer, you must install Transmission Control Protocol/Internet Protocol (TCP/IP) networking and a network adapter. Windows Vista uses TCP/IP as the default wide area network (WAN) protocol. Networking is normally installed during Windows Vista installation. You can also install TCP/IP networking through local area connection properties.

Working with TCP/IP and the Dual IP Stack

The TCP and IP protocols make it possible for computers to communicate across various networks and the Internet using network adapters, whether network interface cards, USB-attachable network adapters, PC Card network adapters, or built-in adapters on the motherboard. Windows Vista has a dual IP layer architecture in which both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) are implemented and share common Transport and Frame layers.

IPv4 and IPv6 are used in very different ways. IPv4 has 32-bit addresses and is the primary version of IP used on most networks, including the Internet. IPv6 has 128-bit addresses and is the next generation version of IP.

IPv4's 32-bit addresses commonly are expressed as four separate decimal values, such as 127.0.0.1 or 192.168.1.20. The four decimal values are referred to as octets because each represents 8 bits of the 32-bit number. With standard unicast IPv4 addresses, a variable part of the IP address represents the network ID and a variable part of the IP address represents the host ID. There is no correlation between a host's IPv4 address and the internal machine (MAC) address used by the host's network adapter.

IPv6's 128-bit addresses are divided into eight 16-bit blocks delimited by colons. Each 16-bit block is expressed in hexadecimal form. With standard unicast IPv6 addresses, the first 64 bits represent the network ID and the last 64 bits represent the network interface. An example of an IPv6 address follows:

FEC0:0:0:02BC:FF:BECB:FE4F:961D

Because many IPv6 address blocks are set to 0, a contiguous set of 0 blocks can be expressed as "::", a notation referred to as the double-colon notation. Using double-colon notation, the two 0 blocks in the previous address are compressed as follows:

FEC0::02BC:FF:BECB:FE4F:961D

If there were three or more 0 blocks, they would be compressed in the same way. For example, FFE8:0:0:0:0:0:0:1 becomes FFE8::1.

When networking hardware is detected during installation of the operating system, both IPv4 and IPv6 are enabled by default and there is no need to install a separate component to enable support for IPv6. Windows Vista's modified IP architecture is referred to as the Next Generation TCP/IP stack. Table 12-1 summarizes the key TCP/IP enhancements implemented in the Next Generation TCP/IP stack. Table 12-2 summarizes the key TCP/IP enhancements that are specific to IPv6.

Table 12-1. Key TCP/IP Enhancements in the Next Generation TCP/IP Stack

Features Supported

Description

Automatic Black Hole Router Detection

Prevents TCP connections from terminating due to intermediate routers silently discarding large TCP segments, retransmissions, or error messages.

Automatic Dead Gateway Retry

Ensures that an unreachable gateway is checked periodically to determine whether it has become available.

Compound TCP

Optimizes TCP transfers for the sending host by increasing the amount of data sent in a connection while ensuring other TCP connections are not impacted.

Extended Selective Acknowledgments

Extends the way Selective Acknowledgments (SACKs) are used, enabling a receiver to indicate up to four noncontiguous blocks of received data and to acknowledge duplicate packets. This helps the receiver determine when it has retransmitted a segment unnecessarily and adjust its behavior to prevent future retransmissions.

Modified Fast Recovery Algorithm

Provides faster throughput by altering the way that a sender can increase the sending rate if multiple segments in a window of data are lost and the sender receives an acknowledgment stating only part of the data has been successfully received.

Neighbor Unreachability Detection for IPv4

Determines when neighboring nodes and routers are no longer reachable and reports the condition.

Network Diagnostics Framework

Provides an extensible framework that helps users recover from and troubleshoot problems with network connections.

Receive Window Auto Tuning

Optimizes TCP transfers for the host receiving data by automatically managing the size of the memory buffer (the receive windows) to use for storing incoming data based on the current network conditions.

Routing Compartments

Prevents unwanted forwarding of traffic between interfaces by associating an interface or a set of interfaces with a login session that has its own routing tables.

SACK-based Loss Recovery

Makes it possible to use SACK information to perform loss recovery when duplicate acknowledgments have been received and to more quickly recover when multiple segments are not received at the destination.

Spurious Retransmission Timeout Detection

Provides correction for sudden, temporary increases in retransmission timeouts and prevents unnecessary retransmission of segments.

TCP Extended Statistics

Helps determine whether a performance bottleneck for a connection is the sending application, the receiving application, or the network.

Windows Filtering Platform

Provides application programming interfaces (APIs) for extending the TCP/IP filtering architecture so that it can support additional features.

Table 12-2. Key TCP/IP Enhancements for IPv6

Feature Supported

Description

DHCPv6-capable DHCP client

Extends the DHCP client to support IPv6 and allows stateful address autoconfiguration with a DHCPv6 server.

IP Security

Allows use of Internet Key Exchange (IKE) and data encryption for IPv6.

IPv6 over Point-to-Point Protocol (PPPv6)

Allows native IPv6 traffic to be sent over PPP-based connections, which in turn allows remote access clients to connect with an IPv6-based Internet service provider (ISP) through dial-up or PPP over Ethernet (PPPoE)-based connections.

Link-Local Multicast Name Resolution (LLMNR)

Allows IPv6 hosts on a single subnet without a DNS server to resolve each other's names.

Multicast Listener Discovery version 2 (MLDv2)

Provides support for source-specific multicast traffic and is equivalent to Internet Group Management Protocol version 3 (IGMPv3) for IPv4.

Random Interface IDs

Prevents address scanning of IPv6 addresses based on the known company IDs of network adapter manufacturers. By default, Windows Vista generates random interface IDs for nontemporary autoconfigured IPv6 addresses, including public and link-local addresses.

Symmetric Network Address Translators

Maps the internal (private) address and port number to different external (public) addresses and ports, depending on the external destination address.

Installing Network Adapters

Network adapters are hardware devices that are used to communicate on networks. You can install and configure network adapters by completing the following steps:

1. | Configure the network adapter following the manufacturer's instructions. For example, you might need to use the software provided by the manufacturer to modify the Interrupt setting or the Port setting of the adapter.
2. | If installing an internal network interface card, shut down the computer, unplug it, and install the adapter card in the appropriate slot on the computer. When you're finished, plug in and start the computer.
3. | Windows Vista should detect the new adapter during startup. If you have a separate driver disk for the adapter, you should insert it now. Otherwise, you might be prompted to insert a driver disk.
4. | If Windows Vista doesn't detect the adapter automatically, follow the installation instructions in the "Working with Device Drivers" and "Managing Hardware" sections of Chapter 3, "Configuring Systems, Hardware Devices, and Drivers."
5. | If networking services aren't installed on the system, install them as described in the next section.

Installing Networking Services (TCP/IP)

If you're installing TCP/IP after installing Windows Vista, log on to the computer using an account with Administrator privileges and then follow these steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Manage Network Connections.

3.
In Network Connections, right-click the connection you want to work with and then select Properties.

4.
In the Local Area Connection Status dialog box, click Properties. This displays the Local Area Connection Properties dialog box, shown in Figure 12-4.

Figure 12-4. Use the Local Area Connection Properties dialog box to install and configure TCP/IP.

5.
If Internet Protocol Version 6 (TCP/IPv6), Internet Protocol Version 4 (TCP/IPv4), or both aren't shown in the list of installed components, you'll need to install them. Click Install. Then click Protocol, Add. In the Select Network Protocol dialog box, select the protocol to install and then click OK. If you are installing both TCP/IPv6 and TCP/IPv4, repeat this procedure.

6.
In the Local Area Connection Properties dialog box, make sure that the following are selected as appropriate: Internet Protocol Version 6 (TCP/IPv6), Internet Protocol Version 4 (TCP/IPv4), or both. Then click OK.

7.
As necessary, follow the instructions in the next section for configuring local area connections for the computer.


Configuring Local Area Connections

A local area connection is created automatically if a computer has a network adapter and is connected to a network. If a computer has multiple network adapters and is connected to a network, you'll have one local area connection for each adapter. If no network connection is available, you should connect the computer to the network or create a different type of connection, as explained in the "Managing Local Area Connections" section of this chapter.

Computers use IP addresses to communicate over TCP/IP. Windows Vista provides the following ways to configure IP addressing:

  • Manually IP addresses that are assigned manually are called static IP addresses.

    Static IP addresses are fixed and don't change unless you change them. You'll usually assign static IP addresses to Windows servers, and when you do this, you'll need to configure additional information to help the server navigate the network.

  • Dynamically A DHCP server (if one is installed on the network) assigns dynamic IP addresses at startup, and the addresses might change over time. Dynamic IP addressing is the default configuration.

  • Alternatively (IPv4 only) When a computer is configured to use DHCPv4 and no DHCPv4 server is available, Windows Vista assigns an alternate private IP address automatically. By default, the alternate IPv4 address is in the range from 169.254.0.1 to 169.254.255.254 with a subnet mask of 255.255.0.0. You can also specify a user-configured alternate IPv4 address, which is particularly useful for laptop users.

Configuring Static IP Addresses

When you assign a static IP address, you need to tell the computer the IP address you want to use, the subnet mask for this IP address, and, if necessary, the default gateway to use for internetwork communications. An IP address is a numeric identifier for a computer. IP addressing schemes vary according to how your network is configured, but they're normally assigned based on a particular network segment.

IPv6 addresses and IPv4 addresses are very different, as discussed in the "Working with TCP/IP and the Dual IP Stack" section of this chapter. With IPv6, the first 64 bits represent the network ID and the remaining 64 bits represent the network interface. With IPv4, a variable number of the initial bits represent the network ID and the rest of the bits represent the host ID. For example, if you're working with IPv4 and a computer on the network segment 10.0.10.0 with a subnet mask of 255.255.255.0, the first three bits represent the network ID, and the address range you have available for computer hosts is from 10.0.10.1 to 10.0.10.254. In this range, the address 10.0.10.255 is reserved for network broadcasts.

If you're on a private network that is indirectly connected to the Internet, you should use private IPv4 addresses. Private network IPv4 addresses are summarized in Table 12-3.

Table 12-3. Private IPv4 Network Addressing

Private Network ID

Subnet Mask

Network Address Range

10.0.0.0

255.0.0.0

10.0.0.010.255.255.255

172.16.0.0

255.240.0.0

172.16.0.0172.31.255.255

192.168.0.0

255.255.0.0

192.168.0.0192.168.255.255

All other IPv4 network addresses are public and must be leased or purchased. If the network is connected directly to the Internet and you've obtained a range of IPv4 addresses from your Internet service provider, you can use the IPv4 addresses you've been assigned.

Using the PING Command to Check an Address

Before you assign a static IP address, you should make sure that the address isn't already in use or reserved for use with DHCP. You can use the PING command to see whether an address is in use. Open a command prompt and type ping, followed by the IP address you want to check.

To test the IPv4 address 10.0.10.12, you would use the following command:

ping 10.0.10.12

To test the IPv6 address FEC0::02BC:FF:BECB:FE4F:961D, you would use the following command:

ping FEC0::02BC:FF:BECB:FE4F:961D

If you receive a successful reply from the PING test, the IP address is in use and you should try another one. If the request times out for all four PING attempts, the IP address isn't active on the network at this time and probably isn't in use. However, a firewall could be blocking your PING request. Your company's network administrator would also be able to confirm whether an IP address is in use.

Configuring a Static IPv4 or IPv6 Address

One local area network (LAN) connection is available for each network adapter installed. These connections are created automatically. To configure static IP addresses for a particular connection, complete the following steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Manage Network Connections.

3.
In Network Connections, right-click the connection you want to work with and then select Properties.

4.
In the Local Area Connection Status dialog box, click Properties. This displays the Local Area Connection Properties dialog box.

5.
Double-click Internet Protocol Version 6 (TCP/IPv6) or Internet Protocol Version 4 (TCP/IPv4) as appropriate for the type of IP address you are configuring.

6.
For an IPv6 address, do the following:

  • Click Use The Following IPv6 Address and then type the IPv6 address in the IPv6 Address text box. The IPv6 address you assign to the computer must not be used anywhere else on the network.

  • Press the Tab key. The Subnet Prefix Length field ensures that the computer communicates over the network properly. Windows Vista should insert a default value for the subnet prefix into the Subnet Prefix Length text box. If the network doesn't use variable-length subnetting, the default value should suffice, but if it does use variable-length subnets, you'll need to change this value as appropriate for your network.

7.
For an IPv4 address, do the following:

  • Click Use The Following IP Address and then type the IPv4 address in the IP Address text box. The IPv4 address you assign to the computer must not be used anywhere else on the network.

  • Press the Tab key. The Subnet Mask field ensures that the computer communicates over the network properly. Windows Vista should insert a default value for the subnet prefix into the Subnet Mask text box. If the network doesn't use variable-length subnetting, the default value should suffice, but if it does use variable-length subnets, you'll need to change this value as appropriate for your network.

8.
If the computer needs to access other TCP/IP networks, the Internet, or other subnets, you must specify a default gateway. Type the IP address of the network's default router in the Default Gateway text box.

9.
DNS is needed for domain name resolution. Type a preferred address and an alternate DNS server address in the text boxes provided.

10.
When you're finished, click OK twice and then click Close. Repeat this process for other network adapters and IP protocols you want to configure.

11.
With IPv4 addressing, configure WINS as necessary, following the technique outlined in the "Configuring WINS Resolution" section of this chapter.

Configuring Dynamic IP Addresses and Alternate IP Addressing

Although static IP addresses can be used with workstations, most workstations use dynamic or alternative IP addressing, or both. You configure dynamic and alternative addressing by completing the following steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection you want to work with and then select Properties.
4. | In the Local Area Connection Status dialog box, click Properties. This displays the Local Area Connection Properties dialog box, shown in Figure 12-4. Note In the Local Area Connection Status dialog box, one LAN connection is shown for each network adapter installed. These connections are created automatically. If you don't see a LAN connection for an installed adapter, check the driver for the adapter. It might be installed incorrectly.
5. | Double-click Internet Protocol Version 6 (TCP/IPv6) or Internet Protocol Version 4 (TCP/IPv4) as appropriate for the type of IP address you are configuring.
6. | Select Obtain An IPv6 Address Automatically or Obtain An IP Address Automatically as appropriate for the type of IP address you are configuring. If desired, select Obtain DNS Server Address Automatically. Or select Use The Following DNS Server Addresses and then type a preferred and alternate DNS server address in the text boxes provided.
7. | When you use dynamic IPv4 addressing with desktop computers, you should configure an automatic alternative address. To use this configuration, on the Alternate Configuration tab, select Automatic Private IP Address. Click OK twice, click Close, and then skip the remaining steps.
8. | When you use dynamic IPv4 addressing with mobile computers, you'll usually want to configure the alternative address manually. To use this configuration, on the Alternate Configuration tab, select User Configured. Then in the IP Address text box, type the IP address you want to use. The IP address that you assign to the computer should be a private IP address, as shown in Table 12-3, and it must not be in use anywhere else when the settings are applied.
9. | With dynamic IPv4 addressing, complete the alternate configuration by entering a subnet mask, default gateway, DNS, and WINS settings. When you're finished, click OK twice and then click Close. Note You'll find more detailed information on configuring laptops in the "Configuring Networking for Laptops" section of Chapter 7, "Managing Laptops and Traveling Users."

Configuring Multiple Gateways

To provide fault tolerance in case of a router outage, you can choose to configure Windows Vista computers so that they use multiple default gateways. When multiple gateways are assigned, Windows Vista uses the gateway metric to determine which gateway is used and at what time. The gateway metric indicates the routing cost of using a gateway. The gateway with the lowest routing cost, or metric, is used first. If the computer can't communicate with this gateway, Windows Vista tries to use the gateway with the next lowest metric.

The best way to configure multiple gateways depends on the configuration of your network. If computers use DHCP, you'll probably want to configure the additional gateways through settings on the DHCP server. If computers use static IP addresses or you want to set gateways specifically, assign them by completing the following steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Manage Network Connections.

3.
In Network Connections, right-click the connection you want to work with and then select Properties.

4.
In the Local Area Connection Status dialog box, click Properties. This displays the Local Area Connection Properties dialog box, shown in Figure 12-4.

5.
Double-click Internet Protocol Version 6 (TCP/IPv6) or Internet Protocol Version 4 (TCP/IPv4) as appropriate for the type of IP address you are configuring.

6.
Click Advanced to open the Advanced TCP/IP Settings dialog box, shown in Figure 12-5.

Figure 12-5. Use the Advanced TCP/IP Settings dialog box to configure multiple IP addresses and gateways.

7.
The Default Gateways panel shows the current gateways that have been manually configured (if any). You can enter additional default gateways as necessary. Click Add and then type the gateway address in the Gateway text box.

8.
By default, Windows Vista automatically assigns a metric to the gateway. You can also assign the metric manually. To do this, clear the Automatic Metric check box and then enter a metric in the text box provided.

9.
Click Add and then repeat steps 68 for each gateway you want to add.

10.
Click OK three times and then click Close.

Configuring DNS Resolution

DNS is a host name resolution service that you can use to determine the IP address of a computer from its host name. This enables users to work with host names, such as http://www.msn.com or http://www.microsoft.com, rather than an IP address, such as 192.168.5.102 or 192.168.12.68. DNS is the primary name service for Windows Vista and the Internet.

As with gateways, the best way to configure DNS depends on the configuration of your network. If computers use DHCP, you'll probably want to configure DNS through settings on the DHCP server. If computers use static IP addresses or you want to specifically configure DNS for an individual user or system, you'll want to configure DNS manually.

Basic DNS Settings

You can configure basic DNS settings by completing the following steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection you want to work with and then select Properties.
4. | In the Local Area Connection Status dialog box, click Properties. This displays the Local Area Connection Properties dialog box, shown in Figure 12-4.
5. | Double-click Internet Protocol Version 6 (TCP/IPv6) or Internet Protocol Version 4 (TCP/IPv4) as appropriate for the type of IP address you are configuring.
6. | If the computer is using DHCP and you want DHCP to specify the DNS server address, select Obtain DNS Server Address Automatically. Otherwise, select Use The Following DNS Server Addresses and then type primary and alternate DNS server addresses in the text boxes provided.
7. | Click OK twice and then click Close.
Advanced DNS Settings

You configure advanced DNS settings using the DNS tab of the Advanced TCP/IP Settings dialog box, shown in Figure 12-6. You use the fields of the DNS tab as follows:

  • DNS Server Addresses, In Order Of Use Use this area to specify the IP address of each DNS server that is used for domain name resolution. Click Add if you wish to add a server IP address to the list. Click Remove to remove a selected server address from the list. Click Edit to edit the selected entry. You can specify multiple servers for DNS resolution. Their priority is determined by the order. If the first server isn't available to respond to a host name resolution request, the next DNS server on the list is accessed, and so on. To change the position of a server in the list box, select it and then use the Up or Down arrow button.

  • Append Primary And Connection Specific DNS Suffixes Normally, this option is selected by default. Select this option to resolve unqualified computer names in the primary domain. For example, if the computer name Gandolf is used and the parent domain is microsoft.com, the computer name would resolve to gandolf.microsoft.com. If the fully qualified computer name doesn't exist in the parent domain, the query fails. The parent domain used is the one set in the System Properties dialog box on the Computer Name tab. (Double-click System in Control Panel and then click the Computer Name tab to check the settings.)

  • Append Parent Suffixes Of The Primary DNS Suffix This option is selected by default. Select this option to resolve unqualified computer names using the parent/child domain hierarchy. If a query fails in the immediate parent domain, the suffix for the parent of the parent domain is used to try to resolve the query. This process continues until the top of the DNS domain hierarchy is reached. For example, if the computer name Gandolf is used in the dev.microsoft.com domain, DNS would attempt to resolve the computer name to gandolf.dev.microsoft.com. If this didn't work, DNS would attempt to resolve the computer name to gandolf.microsoft.com.

  • Append These DNS Suffixes (In Order) Select this option to set specific DNS suffixes to use rather than resolving through the parent domain. Click Add if you want to add a domain suffix to the list. Click Remove to remove a selected domain suffix from the list. Click Edit to edit the selected entry. You can specify multiple domain suffixes, which are used in order. If the first suffix doesn't resolve properly, DNS attempts to use the next suffix in the list. If this fails, the next suffix is used, and so on. To change the order of the domain suffixes, select the suffix and then use the Up or Down arrow button to change its position.

  • DNS Suffix For This Connection This option sets a specific DNS suffix for the connection that overrides DNS names already configured for use on this connection. Instead, you'll usually set the DNS domain name through the System Properties dialog box on the Computer Name tab.

  • Register This Connection's Addresses In DNS Select this option if you want all IP addresses for this connection to be registered in DNS under the computer's fully qualified domain name. This option is selected by default.

    Dynamic DNS updates are used in conjunction with DHCP to enable a client to update its A (Host Address) record if its IP address changes, and to enable the DHCP server to update the PTR (Pointer) record for the client on the DNS server. DHCP servers can also be configured to update both the A and PTR records on the client's behalf. Dynamic DNS updates are only supported by BIND 5.1 or higher DNS servers as well as Microsoft Windows 2000 Server, Microsoft Windows Server 2003, and later server versions of Windows. Microsoft Windows NT Server 4 doesn't support this feature.

  • Use This Connection's DNS Suffix In DNS Registration Select this option if you want all IP addresses for this connection to be registered in DNS under the parent domain.

Figure 12-6. Use the DNS tab of the Advanced TCP/IP Settings dialog box to configure advanced DNS settings.

Configuring WINS Resolution

You use WINS to resolve network basic input/output system (NetBIOS) computer names to IPv4 addresses. You can use WINS to help computers on a network determine the address of other computers on the network. If a WINS server is installed on the network, you can use the server to resolve computer names. Although WINS is supported on all versions of Windows, Windows Vista primarily uses WINS for backward compatibility.

You can also configure Windows Vista computers to use the local file LMHOSTS to resolve NetBIOS computer names. However, LMHOSTS is consulted only if normal name resolution methods fail. In a properly configured network, these files are rarely used. Thus, the preferred method of NetBIOS computer name resolution is WINS in conjunction with a WINS server.

As with gateways and DNS, the best way to configure WINS depends on the configuration of your network. If computers use DHCP, you'll probably want to configure WINS through settings on the DHCP server. If computers use static IPv4 addresses or you want to configure WINS specifically for an individual user or system, you'll want to configure WINS manually.

You can manually configure WINS by completing the following steps:

1.
Access the Advanced TCP/IP Settings dialog box and click the WINS tab. This displays the WINS Address, In Order of Use window, shown in Figure 12-7.

Figure 12-7. Use the WINS tab of the Advanced TCP/IP Settings dialog box to configure WINS resolution for NetBIOS computer names.

2.
The WINS Addresses, In Order Of Use panel enables you to specify the IPv4 addresses of each WINS server that is used for NetBIOS name resolution. Click Add if you want to add a server IPv4 address to the list. Click Remove to remove a selected server from the list. Click Edit to edit the selected entry.

3.
You can specify multiple servers, which are used in order, for WINS resolution. If the first server isn't available to respond to a NetBIOS name resolution request, the next WINS server on the list is accessed, and so on. To change the position of a server in the list box, select it and then use the Up or Down arrow button.

4.
To enable LMHOSTS lookups, select the Enable LMHOSTS Lookup check box. If you want the computer to use an existing LMHOSTS file defined somewhere on the network, retrieve this file by clicking Import LMHOSTS. You generally will use LMHOSTS only when other name resolution methods fail.

5.
WINS name resolution requires NetBIOS Over TCP/IP services. Select one of the following options to configure WINS name resolution using NetBIOS:

  • If you use DHCP and dynamic addressing, you can get the NetBIOS setting from the DHCP server. Select Default: Use NetBIOS Setting From The DHCP Server.

  • If you use a static IP address or the DHCP server does not provide NetBIOS settings, select Enable NetBIOS Over TCP/IP.

  • If WINS and NetBIOS are not used on the network, select Disable NetBIOS Over TCP/IP. This eliminates the NetBIOS broadcasts that would otherwise be sent by the computer.

6.
Click OK three times and then click Close. As necessary, repeat this process for other network adapters.

Tip

LMHOSTS files are maintained locally on a computer-by-computer basis, which can eventually make them unreliable. Rather than relying on LMHOSTS, ensure that your DNS and WINS servers are configured properly and are accessible to the network for centralized administration of name resolution services.


Managing Local Area Connections

Local area connections make it possible for computers to access resources on the network and the Internet. One local area connection is created automatically for each network adapter installed on a computer. This section examines techniques you can use to manage these connections.

Enabling and Disabling Local Area Connections

Local area connections are created and connected automatically. If you want to disable a connection so that it cannot be used, complete the following steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection and select Disable to deactivate the connection and disable it.
4. | Later, if you want to enable the connection, right-click the connection in Network Connections and select Enable.

If you want to disconnect from a network or start another connection, complete the following steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection and select Disconnect. Typically, only remote access connections have a Disconnect option.
4. | Later, if you want to activate the connection, right-click the connection in Network Connections and select Connect.

Checking the Status, Speed, and Activity for Local Area Connections

To check the status of a local area connection, follow these steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection you want to work with and then click Status.
4. | This displays the Local Area Connection Status dialog box. If the connection is disabled or the media is unplugged, you won't be able to access this dialog box. Enable the connection or connect the network cable to resolve the problem and then try to display the status dialog box again.

The General tab of the Local Area Connection Status dialog box, shown in Figure 12-8, provides useful information regarding the following:

  • IPv4 Connectivity The current IPv4 connection state and type. You'll typically see the status as Local when connected to an internal network or Not Connected when not connected to a network.

  • IPv6 Connectivity The current IPv6 connection state and type. You'll typically see the status as Local when connected to an internal network or Not Connected when not connected to a network.

  • Media State The state of the media. Because the Status dialog box is only available when the connection is enabled, you'll typically see this as Enabled.

  • Duration The amount of time the connection has been established. If the duration is fairly short, the user either recently connected to the network or the connection was recently reset.

  • Speed The speed of the connection. This should read 10.0 Mbps for 10 Mbps connections and 100.0 Mbps for 100 Mbps connections. An incorrect setting can affect the computer's performance.

  • Bytes The number of bytes sent and the number received by the connection. As the computer sends or receives packets, you'll see the computer icons light up to indicate the flow of traffic.

Figure 12-8. The General tab of the Local Area Connection Status dialog box provides access to summary information regarding connections, properties, and support.

Viewing Network Configuration Information

In Windows Vista, you can view the current configuration for network adapters in several ways. To view configuration settings using the Local Area Connection Status dialog box, follow these steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Manage Network Connections.

3.
In Network Connections, right-click the connection you want to work with and then click Status. This displays the Local Area Connection Status dialog box. If the connection is disabled or the media is unplugged, you won't be able to access this dialog box. Enable the connection or connect the network cable to resolve the problem and then try to display the status dialog box again.

4.
Click Details to view detailed information about the IP address configuration, including:

  • Physical Address The machine or media access control (MAC) address of the network adapter. This address is unique for each network adapter.

  • IPv4 IP Address The IPv4 address assigned for IPv4 networking.

  • IPv4 Subnet Mask The subnet mask used for IPv4 networking.

  • IPv4 Default Gateways The IPv4 address of the default gateways used for IPv4 networking.

  • IPv4 DNS Servers IP addresses for DNS servers used with IPv4 networking.

  • IPv4 WINS Servers IP addresses for WINS servers used with IPv4 networking.

  • IPv4 DHCP Server The IP address of the DHCPv4 server from which the current lease was obtained (DHCPv4 only).

  • Lease Obtained A date and time stamp for when the DHCPv4 lease was obtained (DHCPv4 only).

  • Lease Expires A date and time stamp for when the DHCPv4 lease expires (DHCPv4 only).

You can also use the IPCONFIG command to view advanced configuration settings. To do so, follow these steps:

1. | Click Start and type cmd in the Search field.
2. | Press Enter.
3. | At the command line, type ipconfig/all to see detailed configuration information for all network adapters configured on the computer. Note The command prompt is started in standard user mode. This is not an elevated command prompt.

Renaming Local Area Connections

Windows Vista initially assigns default names for local area connections. In Network Connections, you can rename the connections at any time by right-clicking the connection, selecting Rename, and then typing a new connection name. If a computer has multiple local area connections, proper naming can help you and others better understand the uses of a particular connection.


Troubleshooting and Testing Network Settings

Windows Vista includes many tools for troubleshooting and testing TCP/IP connectivity. This section looks at automated diagnostics, basic tests that you should perform whenever you install or modify a computer's network settings, and techniques for resolving difficult networking problems involving DHCP and DNS. The final section shows you how to perform detailed network diagnostics testing.

Diagnosing and Resolving Local Area Connection Problems

Occasionally network cables can get unplugged or the network adapter might experience a problem that temporarily prevents it from working. After you plug the cable back in, or solve the adapter problem, the connection should automatically reconnect. You can diagnose local area connection problems by performing the following steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | Right-click the connection you want to work with and select Diagnose.

Windows Network Diagnostics will then try to identify the problem. As shown in Figure 12-9, a list of possible solutions is provided if there are identifiable configuration problems. Some solutions provide automated fixes that can be executed by clicking the solution. Other solutions require manual fixes, such as might be required if you need to reset a network router or broadband modem. If your actions don't fix the problem, refer to other appropriate parts of this troubleshooting section.

Figure 12-9. Resolve the problem by making a selection or performing a required action.

[View full size image]

Diagnosing and Resolving Internet Connection Problems

Because there are so many interdependencies between services, protocols, and configuration settings, troubleshooting network problems can be difficult. Fortunately, Windows Vista includes a powerful network diagnostics tool for pinpointing problems that relate to the following:

  • General network connectivity problems

  • Internet service settings for e-mail, newsgroups, and proxies

  • Settings for modems, network clients, and network adapters

  • DNS, DHCP, and WINS configuration

  • Default gateways and IP addresses

To diagnose Internet connection problems, follow these steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | Click Diagnose And Repair.

Windows Network Diagnostics will then try to identify the problem. If identifiable configuration problems exist, a list of possible solutions is provided. Some solutions provide automated fixes that can be executed by clicking the solution. Other solutions require manual fixes, such as might be required if you need to reset a network router or broadband modem. If your actions don't fix the problem, refer to other appropriate parts of this troubleshooting section.

Performing Basic Network Tests

Whenever you install a new computer or make configuration changes to the computer's network settings, you should test the configuration. The most basic TCP/IP test is to use the PING command to test the computer's connection to the network. PING is a command-line command. To use it, type ping <host> at the command prompt, where <host> is either the computer name or the IP address of the host computer you're trying to reach.

With Windows Vista, you can use the following methods to test the configuration using PING:

  • Try to PING IP addresses If the computer is configured correctly and the host you're trying to reach is accessible to the network, PING should receive a reply, as long as pinging is allowed by the computer's firewall. If PING can't reach the host or is blocked by a firewall, PING times out.

  • On domains that use WINS, try to PING NetBIOS computer names If NetBIOS computer names are resolved correctly by PING, the NetBIOS facilities, such as WINS, are correctly configured for the computer.

  • On domains that use DNS, try to PING DNS host names If fully qualified DNS host names are resolved correctly by PING, DNS name resolution is configured properly.

You might also want to test network browsing for the computer. If the computer is a member of a Windows Vista domain and computer browsing is enabled throughout the domain, log on to the computer and then use Windows Explorer or Network Explorer to browse other computers in the domain. Afterward, log on to a different computer in the domain and try to browse the computer you just configured. These tests tell you if the DNS resolution is being handled properly in the local environment. If you can't browse, check the configuration of the DNS services and protocols.

Real World

Access to network resources in Network Explorer is dependent on the Computer Browser service and the network discovery settings. The Computer Browser service is responsible for maintaining a list of computers on a network. If the service is stopped or isn't working properly, a computer won't see available resources in Network Explorer. You can check the status of the Computer Browser service in Computer Management. Expand Services And Applications and then select Services in the left pane. The status of the Computer Browser service should be Started. If the status is blank, the service isn't running and should be started.

In some cases, the Computer Browser service might be running normally, but there might not be an updated list of resources in Network Explorer. This can happen because the service performs periodic updates of the resource list rather than checking continuously for updates. If a resource you want to use isn't listed, you can either wait for it to become available (which should take less than 15 minutes in most cases), or you can connect to the resource directly using the Universal Naming Convention (UNC) name or IP address of the resource as discussed in the "Using and Accessing Shared Resources" section of Chapter 10, "Managing File Security and Resource Sharing."

In some cases, discovering and sharing might be set to block discovery. You'll need to allow discovery to resolve this by following these steps:

1. | Click Start and then click Network.
2. | In Network Explorer, click Network And Sharing Center on the toolbar.
3. | If network discovery is turned off, expand the Network And Discovery panel and then click Turn On Network Discovery.

Resolving IP Addressing Problems

The current IP address settings of a computer can be obtained as discussed in the "Viewing Network Configuration Information" section of this chapter. If a computer is having problems accessing network resources or communicating with other computers, an IP addressing problem might exist. Take a close look at the IP address currently assigned, as well as other IP address settings, and use these pointers to help in your troubleshooting:

  • If the IPv4 address currently assigned to the computer is in the range 169.254.0.1 to 169.254.255.254, the computer is using Automatic Private IP Addressing (APIPA). An automatic private IP address is assigned to a computer when it is configured to use DHCP and its DHCP client cannot reach a DHCP server. When using APIPA, Windows Vista will automatically periodically check for a DHCP server to become available. If a computer doesn't eventually obtain a dynamic IP address, it usually means the network connection has a problem. Check the network cable, and if necessary trace the cable back to the switch or hub into which it connects.

  • If the IPv4 address and the subnet mask of the computer are currently set as 0.0.0.0, the network is either disconnected or someone attempted to use a static IP address that duplicated another IP address already in use on the network. In this case, you should access Network Connections and determine the state of the connection. If the connection is disabled or disconnected, this should be shown. Right-click the connection and select Enable or Repair as appropriate. If the connection is already enabled, you will need to modify the IP address settings for the connection.

  • If the IP address is dynamically assigned, check to make sure that another computer on the network isn't using the same IP address. You can do this by disconnecting the network cable for the computer that you are working with and pinging the IP address in question. If you receive a response from the PING test, you know that another computer is using the IP address. This computer probably has an improper static IP address or a reservation that isn't set up properly.

  • If the IP address appears to be set correctly, check the network mask, gateway DNS, and WINS settings by comparing the network settings of the computer you are troubleshooting with those of a computer that is known to have a good network configuration. One of the biggest problem areas is the network mask. When subnetting is used, the network mask used in one area of the network might look very similar to that of another area of the network. For example, the network mask in one IPv4 area might be 255.255.255.240, and it might be 255.255.255.248 in another IPv4 area.

Releasing and Renewing DHCP Settings

DHCP servers can assign many network configuration settings automatically. These include IP addresses, default gateways, primary and secondary DNS servers, primary and secondary WINS servers, and more. When computers use dynamic addressing, they are assigned a lease on a specific IP address. This lease is good for a specific time period and must be renewed periodically. When the lease needs to be renewed, the computer contacts the DHCP server that provided the lease. If the server is available, the lease is renewed and a new lease period is granted. You can also renew leases manually as necessary on individual computers or by using the DHCP server itself.

Problems can occur during the lease assignment and renewal process that prevent network communications. If the server isn't available and cannot be reached before a lease expires, the IP address can become invalid. If this happens, the computer might use the alternate IP address configuration to set an alternate address, which in most cases has settings that are inappropriate and prevent proper communications. To resolve this problem, you'll need to release and then renew the DHCP lease.

Another type of problem occurs when users move around to various offices and subnets within the organization. Although moving from location to location, their computers might obtain DHCP settings from the wrong server. When the users return to their offices, the computers might seem sluggish or perform incorrectly due to the settings assigned by the DHCP server at another location. If this happens, you'll need to release and then renew the DHCP lease.

You can use the graphical interface to release and renew DHCP leases by completing the following tasks:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Network Connections.
3. | In Network Connections, right-click the connection you want to work with and then click Diagnose.
4. | After Windows Network Diagnostics tries to identify the problem, a list of possible solutions is provided. If the computer has one or more dynamically assigned IP addresses, one of the solutions should be Automatically Get New IP Settings. Click this option.

You can also follow these steps to use the IPCONFIG command to renew and release settings:

1. | Start an elevated command prompt.
2. | To release the current settings for all network adapters, type ipconfig/release at the command line. Then renew the lease by typing ipconfig/renew.
3. | To only renew a DHCP lease for all network adapters, type ipconfig/renew at the command line.
4. | You can check the updated settings by typing ipconfig/all at the command line. Real World If a computer has multiple network adapters and you only want to work with one or a subset of the adapters, you can do this by specifying all or part of the connection name after the ipconfig/renew or ipconfig/release command. Use the asterisk as a wildcard character to match any characters in a connection's name. For example, if you wanted to renew the lease for all connections with names starting with Loc, you could type the command ipconfig/renew Loc*. If you wanted to release the settings for all connections containing the word Network, you could type the command ipconfig/release *Network*.

Registering and Flushing DNS

The DNS resolver cache maintains a history of DNS lookups that have been performed when a user accesses network resources using TCP/IP. This cache contains forward lookups, which provide host name to IP address resolution, and reverse lookups, which provide IP address to host name resolution. Once a DNS entry is stored in the resolver cache for a particular DNS host, the local computer no longer has to query external servers for DNS information on that host. This enables the computer to resolve DNS requests locally, which provides a quicker response.

How long entries are stored in the resolver cache depends on the Time to Live (TTL) value assigned to the record by the originating server. To view current records and see the remaining TTL value for each record, in an elevated command prompt, type ipconfig/displaydns. These values are given as the number of seconds that a particular record can remain in the cache before it expires. These values are continually being counted down by the local computer. When the TTL value reaches zero, the record expires and is removed from the resolver cache.

Occasionally, you'll find that the resolver cache needs to be cleared out to remove old entries and enable computers to check for updated DNS entries before the normal expiration and purging process takes place. Typically, this happens because server IP addresses have changed and the current entries in the resolver cache point to the old addresses rather than the new ones. Sometimes the resolver cache itself can get out of sync, particularly when DHCP has been misconfigured.

Real World

Skilled administrators know that several weeks in advance of the actual change, they should start to decrease the TTL values for DNS records that are going to be changed. Typically, this means reducing the TTL from a number of days (or weeks) to a number of hours, which allows for quicker propagation of the changes to computers that have cached the related DNS records. Once the change is completed, administrators should restore the original TTL value to reduce renewal requests.

In most cases, you can resolve problems with the DNS resolver cache by either flushing the cache or reregistering DNS. When you flush the resolver cache, all DNS entries are cleared out of the cache and new entries are not created until the next time the computer performs a DNS lookup on a particular host or IP address. When you reregister DNS, Windows Vista attempts to refresh all current DHCP leases and then performs a lookup on each DNS entry in the resolver cache. By looking up each host or IP address again, the entries are renewed and reregistered in the resolver cache. You'll generally want to flush the cache completely and allow the computer to perform lookups as needed. Reregister DNS only when you suspect that there are problems with DHCP and the DNS resolver cache.

You can use the IPCONFIG command to flush and reregister entries in the DNS resolver cache by following these steps:

1. | Start an elevated command prompt.
2. | To clear out the resolver cache, type ipconfig/flushdns at the command line.
3. | To renew DHCP leases and reregister DNS entries, type ipconfig/registerdns at the command line.
4. | When the tasks are complete, you can check your work by typing ipconfig/displaydns at the command line.


Chapter 13. Managing Mobile Networking and Remote Access

In this chapter:
Understanding Mobile Networking and Remote Access | 397
Creating Connections for Remote Access | 399
Configuring Connection Properties | 407
Establishing Connections | 421
Wireless Networking | 425

Users often want to connect to their organization's network from an off-site computer. To do so, they need a dialup, broadband, or virtual private network (VPN) connection. Dial-up networking enables users to connect off-site computers to their organization's network using a modem and a standard telephone line. Broadband enables users to connect off-site computers to their organization's network using high-speed Digital Subscriber Line (DSL) routers or cable modems. VPN uses encryption to provide secure connectivity over an existing connection, which can be a local area, dial-up, or broadband connection. Increasingly, wireless connections are being used as well. With a wireless connection, computers establish connections using a network adapter that has an antenna that enables it to communicate with similar wireless devices.


Understanding Mobile Networking and Remote Access

Although the underlying technologies are fundamentally different, direct dial, broadband, and dial-up connections make it possible for users to access your organization's network remotely. With a typical direct dial network configuration, off-site users utilize their computer's modem and a standard telephone line to connect to a modem pool located at the office. A Microsoft Windows Server managing the modem pool and running Routing And Remote Access authenticates the logon ID and password and authorizes the user to connect to the internal network. The user can then access network resources just as she does when working on-site.

Figure 13-1 shows direct dial connections using modem pools. Analog modems use dedicated telephone lines to connect users to the internal network at speeds up to 33.6 kilobits per second (Kbps). Digital modems use channels of a T1 line to connect users to the internal network at speeds up to 56 Kbps. In a standard configuration, you might have 8, 12, or 16 modems configured in the pool, each with its own line (or channel). Typically, the modem pool has a lead number that users can call. This number connects to the first modem in the pool. When the lead number is busy, the line rolls over to the next number, which connects to the next modem in the pool, and so on, enabling users to dial a single number to gain access to all modems in the pool.

Figure 13-1. Use a dial-up connection to access an office network through a modem pool.

Unlike direct dial connections, which can be made directly to the office network, broadband connections are made through an Internet service provider's (ISP's) network. The user's DSL router or cable modem establishes a connection to the ISP, which in turn connects the user to the public Internet. To connect to the office network, broadband users must establish a VPN between the user's computer and the office network. Figure 13-2 shows how VPN works.

Figure 13-2. Use broadband and VPN to access an office network.

A VPN is an extension of a private network across the public Internet. Once a user is connected, it appears to him that he is directly connected to the office network and can access network resources just as he does when working on-site. These seamless connections are possible because a virtual tunnel is established between the user's computer and the office network, where the VPN technology takes care of routing information over the public Internet. One of two VPN technologies is typically used: Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP). Both L2TP and PPTP offer encryption and protection from attacks, but only L2TP uses IP Security (IPSec) for advanced encryption, making it the more secure of the two technologies. Unfortunately, L2TP is more difficult to configure. When you use L2TP, you'll need to use Microsoft Certificate Services or a third party certificate server to issue individual certificates for each system that will connect to the network using L2TP.

In addition to using VPN with broadband connections, you can also use VPN with dialup connections. In this configuration, as shown in Figure 13-2, users go through their ISP to establish a connection to the public Internet and later establish a private connection to the office network. When this configuration becomes standard procedure for dial-up users, your organization won't need dedicated private lines like those reserved for a modem pool.


Creating Connections for Remote Access

As discussed previously, you can create both dial-up and broadband connections for remote access. If you want additional security, you can also configure these connections to use VPN. Microsoft Windows Vista provides a wizard for creating these connections. In most cases, you'll want to access this wizard through Network And Sharing Center. Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar. In Network And Sharing Center, click Set Up A Connection Or Network. You can then create dial-up, broadband, and VPN connections.

Real World

Consider whether Group Policy can help you reduce your workload. If you want to use the same connection settings on multiple computers, you could import the settings into Group Policy, and they would then be available to all computers in the related Group Policy object. You can use this technique to deploy new connection configurations, to update existing configurations when you need to make changes, and to delete existing configurations and replace them with new ones. See the "Managing Connection and Proxy Settings" section of Chapter 14, "Managing Advanced Internet Options and Security," for more information.

Creating a Dial-Up Connection

Windows Vista provides two options for making dial-up connections. You can create a dial-up connection to an ISP or a dial-up connection to the workplace. Although the connections are created using slightly different techniques, the settings for the connection options are the same, with the following exceptions:

  • A dial-up connection to an ISP does not use the Client For Microsoft Networks component, and it redials if the line is dropped by default.

  • A dial-up connection to the workplace does use the Client For Microsoft Networks component, and it does not redial if the line is dropped by default.

The networking component Client For Microsoft Networks enables Windows Vista systems to communicate in a Windows domain or workgroup. Because most workplaces use Windows domains or workgroups and some ISPs don't, the component is configured for workplace environments and not for ISPs.

Creating dial-up connections is a two-part process. Before you create a dial-up connection, you should check the current phone and modem options, which set dialing rules. Once the dialing rules are configured, you can create the dial-up connection.

Working with Dialing Rules and Locations

Dialing rules are used with modems to determine how phone lines are accessed, what the caller's area code is, and what additional features should be used when dialing connections. Sets of dialing rules are saved as dialing locations in the Phone And Modem Options tool.

Viewing and Setting the Default Dialing Location

To view and set the default dialing location, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Hardware And Sound.

2.
In Hardware And Sound, click Set Up Dialing Rules under Phone And Modem Options. The first time you start this tool, you'll see the Location Information dialog box, as shown in Figure 13-3.

Figure 13-3. The first time you use Phone And Modem Options, you must configure the initial location.

3.
Answer the following questions to configure the default location (My Location):

  • What Country/Region Are You In Now? Select the country or region you are in, such as United States.

  • What Area Code (Or City Code) Are You In Now? Type the area or city code as appropriate, such as 212.

  • If You Need To Specify A Carrier Code, What Is It? You can specify the telephone carrier to use when dialing and establishing connections by entering its carrier code. A carrier code might be necessary if you are making long-distance or international calls.

  • If You Dial A Number To Access An Outside Line, What Is It? Type the number you need to access an outside line, if any. An access code might be necessary to bypass a switch panel within a company or when dialing from a hotel.

  • The Phone System At This Location Uses Select either Tone Dialing or Pulse Dialing, as appropriate. Most areas of the United States and Canada use tone dialing.

4.
Once you configure an initial location and click OK, you'll see the Phone And Modem Options dialog box, shown in Figure 13-4. From then on, you will no longer need to set up an initial location.

Figure 13-4. Check dialing rules to ensure they are configured properly.

5.
Locations configured for the computer are shown in the Locations list by name and area code. The location from which you are currently dialing is selected and highlighted in bold.

6.
Initially, the default location is set as My Location. By selecting a different location, you can make it the current or default location. I recommend editing the default location (My Location) and renaming it so that the name used includes the city or office location. To view the configuration of a selected location, click Edit. Then, to rename the location, type a new value in the Location Name field on the General tab and then click OK.

Note

Of all the available dialing rules, the area code is the one you'll work with most often. During installation of the operating system, a default location might have been created with the area code set by the person who installed the computer. In many cases, the default area code is not the one the user needs to use when dialing another location from home.

Creating Dialing Locations

You can create dialing locations to set unique rules for each area code from which the user will make dial-up connections. To create a dialing location, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Hardware And Sound.

2.
In Hardware And Sound, click Phone And Modem Options. In the Phone And Modem Options dialog box, click New on the Dialing Rules tab. This displays the New Location dialog box, shown previously in Figure 13-3.

3.
The New Location dialog box has three tabs:

  • General Sets the location name, country/region, and area code. On this tab, you can also set access numbers for outside lines when dialing local or long-distance calls, disable call waiting, and specify whether tone or pulse dialing is used. Be sure to use an appropriate location name. Typically, this is the name of the city or metro area from which the user is dialing.

  • Area Code Rules Sets rules that determine how phone numbers are dialed from the location's area code to other area codes and within the location's area code. These rules are useful when multiple area codes that are not long distance are used in the same location. They are also useful when calls within the area code might be local or long-distance based on number prefixes.

  • Calling Card Sets a calling card to use when dialing from this location. Calling card information for major carriers is provided and you can also create calling card records.

4.
When you are finished creating the location, check that the default location in the Phone And Modem Options dialog box is correct. You might need to select a different entry. Click OK when you are finished.

Deleting Dialing Locations

To delete a dialing location, follow these steps:

1. | Access Phone And Modem Options in Control Panel.
2. | In the Phone And Modem Options dialog box, select the location you want to permanently remove and then click Delete. If prompted to confirm the action, click Yes.
3. | Select the dialing location that you want to use as the default and then click OK.
Creating a Dial-Up Internet Connection to an ISP

You can create dial-up connections in the following ways:

  • If users are dialing up through an ISP that has point of presence (POP) locations throughout the United States and the world, you'll usually want to configure dialing rules and connections for specific locations. Here, you could create a dialup location called Seattle and a dial-up connection called Connect To ISP In Seattle. In this configuration, you would set the area code for Seattle as well as any special dialing rules and then configure the connection to use the ISP's access numbers for Seattle. You'd also need to show users how to change their current locations when they travel from place to place.

  • If users are dialing an 800 number or long distance to access the office modem pool or a special out-of-area access number for an ISP, you'll usually want to configure separate connections rather than separate locations. Here, you would create a connection that dials long distance to establish the connection and a connection that is used when the user is in the local area. You would then need only one dialing location.

To create a dial-up Internet connection, follow these steps:

1. | Before you create a dial-up connection, you should check the current phone and modem options as discussed in the "Working with Dialing Rules and Locations" section of this chapter. Note If you use dialing rules with a connection and then set area and country codes, you are making it possible for the connection to be used for long-distance calls, which can sometimes be very expensive. If this isn't what you want, you might want to reconsider these selections.
2. | Click Start and then click Connect To. In Connect To A Network, click Set Up A Connection Or Network. This starts the Set Up A Connection Or Network Wizard.
3. | To make a dial-up connection to an ISP, select Set Up A Dial-Up Connection and then click Next.
4. | Set the phone number to dial for this connection using the Dial-Up Phone Number text box.
5. | Set account information for the connection. Enter the user name in the field provided and then enter the password. Although you can ensure the password is remembered by selecting Remember This Password, it is a poor security practice because it enables anyone with access to the computer to use the connection.
6. | In the Connection Name field, enter the name for the connection, such as Service Provider. Keep in mind that the name should be short (50 or fewer characters) but descriptive.
7. | If you want the connection to be available to all users of the computer, select Allow Other People To Use This Connection. This option is best when you plan to assign the connection through Group Policy and have not provided user logon information.
8. | Click Create to create the dial-up connection and then click Close. To test the connection settings, follow the steps outlined in the "Establishing Connections" section of this chapter.

Real World

Most organizations use digital phone systems, which don't allow you to make an analog connection to an outside line. If this is the case at your office, you'll need to access an analog line before you can test the connection. Some digital phones can be equipped with digital-to-analog converters that you can use for testing dial-up connections. You might find these converters used with conference phones or fax machines, or you might find that conference phones or fax machines are already connected to analog phone lines.

Creating a Broadband Connection to the Internet or a Dial-Up Connection to the Workplace

In many respects, broadband connections are much easier to configure than dial-up connections are. When you work with broadband, you don't need to set up dial-up rules or locations. You don't need to worry about calling cards, ISP access numbers, or redialing preferences either, all of which make broadband much easier to work with.

Most broadband providers give users a router or modem, which users need to connect to the service provider. Each user must also have a network adapter on her computer, connected to a DSL router or cable modem. In this configuration, the necessary connection is established over the local area network (LAN) rather than a specific broadband connection. Therefore, it is the local area connection that must be properly configured to gain access to the Internet. You won't need to create a broadband connection.

You can, however, create a specific broadband connection if needed. In some cases, you need to do this to set specific configuration options required by the ISP, such as secure authentication, or you might want to use this technique to set the user name and password required by the broadband provider.

You create a broadband connection to the Internet or a dial-up connection to a workplace by following these steps:

1.
Click Start and then click Connect To. In Connect To A Network, click Set Up A Connection Or Network. This starts the Set Up A Connection Or Network Wizard.

2.
Select one of the following options as appropriate and then click Next:

  • Connect To A Workplace to create a dial-up connection to a workplace

  • Connect To The Internet to create a broadband connection to the Internet

3.
If you have an existing connection, you'll be able to reconfigure this connection for use or create a new connection. Typically, you'll want to create a new connection, so click No, Create A New Connection and then click Next.

4.
On the How Do You Want To Connect page, click Dial Directly when you are creating a dial-up connection to a workplace or click Broadband (PPPoE) when creating a broadband connection to the Internet.

5.
For a dial-up connection to a workplace, do the following and then click Next:

  • Set the phone number to dial for this connection using the Telephone Number text box.

  • In the Destination Name field, type the name for the connection, such as Corporate Office or Seattle Office. Keep in mind that the name should be short (50 or fewer characters) but descriptive.

  • If the computer is configured to use a smart card for authentication, select Use A Smart Card.

  • If you want the connection to be available to all users of the computer, select Allow Other People To Use This Connection. This option is best when you plan to assign the connection through Group Policy and have not provided user logon information.

6.
A user is prompted by default for her name and password when she makes a connection. If you are creating a connection for an individual user and don't want the user to be prompted for logon information, you can enter the user name and password in the fields provided.

7.
Although you can ensure the password is remembered by selecting Remember This Password, it is a poor security practice because it enables anyone with access to the computer to use the connection. If you don't select Remember This Password, the user is prompted for the password.

8.
For a dial-up connection to a workplace, you should specify the logon domain in the Domain field and then click Create to create the dial-up connection. Then click Close. To test the connection settings, follow the steps outlined in the "Establishing Connections" section of this chapter.

9.
For a broadband connection to the Internet, click Connect to create and connect the connection. In most cases, the connection will fail because you are setting up a broadband connection for an alternate location, such as the user's home Internet connection, and these settings won't work through the organization's network. Because of this, you'll have an option to click Skip to bypass the connection activation. After you do this, click Set Up The Connection Anyway and then click Close.

Tip

With a broadband connection, you need a DSL router or cable modem to test the connection. Be sure to configure any special settings required by the ISP, as detailed in the "Configuring Connection Properties" section of this chapter.

Creating a VPN Connection

VPNs are used to establish secure communications channels over an existing dial-up or broadband connection. You must know the IP address or fully qualified domain name of the remote access server to which you are connecting. If the necessary connection is available and you know the host information, you can create the connection by following these steps:

1. | Click Start and then click Connect To. In Connect To A Network, click Set Up A Connection Or Network. This starts the Set Up A Connection Or Network Wizard.
2. | To make a VPN connection, scroll down, select Connect To A Workplace, and then click Next.
3. | Select No, Create A New Connection and then click Next. The user will need to establish a connection to the Internetvia either dial-up or broadbandbefore attempting to use the VPN anyway.
4. | Click Use My Internet Connection (VPN). On the Before You Connect page, select the previously created connection to use and then click Next. This connection can be a dial-up or broadband connection.
5. | Type the IP address or fully qualified domain name of the computer to which you are connecting, such as 192.168.10.50 or external.microsoft.com. In most cases, this is the remote access server you've configured for the office network.
6. | Type a name for the connection in the Destination Name field. If the computer is configured to use a smart card for authentication, select Use A Smart Card.
7. | If you want the connection to be available to all users of the computer, select Allow Other People To Use This Connection. This option is best when you plan to assign the connection through Group Policy and have not provided user logon information.
8. | Click Next. A user is prompted by default for her name and password when she makes a connection. If you're creating a connection for an individual user and don't want the user to be prompted for logon information, you can enter the user name and password in the fields provided.
9. | Although you can ensure the password is remembered by selecting Remember This Password, it is a poor security practice because it enables anyone with access to the computer to use the connection. If you don't select Remember This Password, the user is prompted for the password.
10. | Specify the logon domain in the Domain field and then click Connect. To connect to a VPN connection, you must first be connected to the dial-up or broadband connection specified previously. In most cases, the connection will fail because you are setting up a VPN connection for an alternate location, such as the user's home Internet connection, and these settings won't work through the organization's network. Because of this, you'll have an option to click Skip to bypass the connection activation. After you do this, click Set Up The Connection Anyway and then click Close.


Configuring Connection Properties

Whether you are working with dial-up, broadband, or VPN, you'll often need to set additional properties after creating a connection. The key properties that you'll work with are examined in this section.

Note

As you work with connection properties, keep in mind that VPN connections are on top of existing connections and that the configuration of each connection is separate. With VPN, the primary connection is established first using the settings assigned to this connection and then the VPN connection is attempted using the VPN connection settings. With this in mind, you should configure the primary connection first and then configure the options for VPN. You should change this approach only when you are troubleshooting problems with VPN. In this case, you should start with the VPN configuration and work your way back to the settings for the primary connection.

Configuring Automatic or Manual Connections

Windows Vista can be configured to establish dial-up, broadband, or VPN connections automatically when users access programs that need to connect to the Internet, such as Windows Internet Explorer 7 in Windows Vista. Automatic connections work in ways that depend on settings in the Internet Options tool. The options include the following:

  • Never Dial A Connection Users must manually establish connections.

  • Dial Whenever A Network Connection Is Not Present The connection is established automatically when needed but only when the local area connection isn't working.

  • Always Dial My Default Connection The default connection is always established when an Internet connection is needed (even if other connections are already established).

    Tip

    The way you configure automatic connections really depends on the way your organization works. Contrary to what many administrators think, laptop users are usually less frustrated when their computers are set to never dial a connection. This is because laptop users might not have access to a dial-up connection while out of the office, and having the computer attempt to dial a connection when visiting customers or giving a presentation can be disruptive. On the other hand, if you are configuring dial-up networking for users with desktops at a remote or home office, they'll probably want to use automatic connections.

To configure computers to connect manually, follow these steps:

1. | Click Start and then click Control Panel. In Control Panel, click Network And Internet.
2. | In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab, shown in Figure 13-5.
3. | Select Never Dial A Connection and then click OK.

Figure 13-5. Configure manual or automatic connections by using the Connections tab.

You can configure automatic connections by following these steps:

1. | Click Start and then click Control Panel. In Control Panel, click Network And Internet.
2. | In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.
3. | Select Dial Whenever A Network Connection Is Not Present to establish connections automatically if a local area connection isn't working. Select Always Dial My Default Connection to always attempt to establish connections.
4. | The Dial-Up And Virtual Private Network Settings list shows the dial-up, broadband, and VPN connections that are currently configured. Select the connection you want to use as the default when establishing connections and then click Set Default.
5. | Click OK twice.

Configuring Proxy Settings for Mobile Connections

As with the connections themselves, proxy server settings can be set manually or automatically. With manual configuration, you'll need to configure each property, step by step. With automatic configuration, the computer can attempt to detect proxy server settings and then configure the appropriate options, or the computer can read a configuration script to use in configuring the proxy.

Note

Proxy settings can be configured for multiple systems through Group Policy as discussed in the "Managing Connection and Proxy Settings" section of Chapter 14. If you elect not to configure proxy settings through Group Policy, you can configure them on a per-connection basis as discussed in this section.

Configuration scripts can be stored in a file on the local computer or at an Internet address. Using configuration scripts can save a lot of time, especially when you consider that each connection you create is configured separately. Further, because VPN connections are established on top of an existing setting, the proxy settings for the VPN can be different from those set in the original connection.

To use automatic proxy configuration for a connection, complete the following steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
In the Dial-Up And Virtual Private Network Settings list box, select the connection that you want to configure and then click Settings. This displays a Dial-Up Connection Settings dialog box similar to the one shown in Figure 13-6.

Figure 13-6. Proxy settings can be automatically configured through detection or scripts.

4.
To attempt to automatically detect proxy settings when establishing the connection, select Automatically Detect Settings.

5.
To use a configuration script, select Use Automatic Configuration Script and then type the file path or Uniform Resource Locator (URL) of the script. With file paths, you can use environment variables, such as %UserProfile%\PROXY.VBS. With URLs, be sure to type the computer URL, such as http://proxy.microsoft.com/proxy.vbs.

6.
To ensure that only automatic settings are used, clear the Use A Proxy Server For This Connection check box.

7.
Click OK twice.

To use manual proxy configuration, complete the following steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
Clear the Automatically Detect Settings and Use Automatic Configuration Script check boxes if they were selected.

5.
Select Use A Proxy Server. The Bypass Proxy Server For Local Addresses check box is not selected by default. In most cases, however, you won't want to use a proxy for requests made to servers on the same network segment, so you'll want to select Bypass Proxy Server For Local Addresses as well. It is important to note that if Bypass Proxy Server For Local Addresses is not selected, users might need additional permissions to access intranet servers through your proxy servers.

6.
Click Advanced to display the Proxy Settings dialog box, shown in Figure 13-7.

Figure 13-7. You can use the same proxy for all services, or you can configure multiple proxies.

7.
Using the text boxes in the Servers panel, set the IP address for proxies. You'll find the following two columns of text boxes:

  • Proxy Address To Use Sets the IP address of the related proxy server or servers. Enter the IP address for each service. If multiple proxies are configured for a particular service, type the IP addresses for each proxy server in the order in which you want the Web client to attempt to use them. Each address must be separated by a semicolon. If a proxy isn't configured for a service, do not fill in the related text box.

  • Port Sets the port number on which the proxy server responds to requests. Most proxies respond to port 80 for all requests. That said, however, the standard ports are port 80 for Hypertext Transfer Protocol (HTTP), port 443 for Secure Sockets Layer (SSL; listed as Secure), port 21 for File Transfer Protocol (FTP), port 70 for Gopher, and port 1081 for Socks. Check with your organization's Web administrator for the proper settings.

8.
By default, the Use The Same Proxy Server For All Protocols check box is selected. This setting enables you to use the same IP address and port settings for the HTTP, SSL, FTP, Gopher, and Socks services. You have the following options:

  • If your organization has proxy servers that handle all requests, type the IP address or addresses that you want to use and the port number on which the server or servers respond.

  • If you want to use a unique proxy server or servers for each type of service, clear the Use The Same Proxy Server For All Protocols check box and then enter the necessary IP addresses and port numbers in the text boxes provided.

9.
If your network has multiple segments or there are specific servers that shouldn't use proxies, enter the appropriate IP addresses or IP address ranges in the Exceptions list. Each entry must be separated with a semicolon. The asterisk (*) character can be used as a wildcard character to specify an address range of 0 through 255, such as 192.*.*.*, 192.168.*.*, or 192.168.10.*.

10.
Click OK three times.

Configuring Connection Logon Information

Each connection you create has separate settings for logon information. You can set a user name, password, and domain by performing the following steps:

1. | Click Start and then click Control Panel. In Control Panel, click Network And Internet.
2. | In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.
3. | Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.
4. | Type the user name and password for the connection in the User Name and Password text boxes, respectively.
5. | If a domain name is required, enter the domain name in the Domain text box.
6. | Click OK twice.

Setting a connection to use the appropriate logon information isn't the last step in ensuring a proper configuration. You should also set options that determine whether users are prompted for logon information or a phone number. If a logon domain is required to establish a connection, you should ensure that the logon domain is passed with the other logon information. By default, the domain name is not included.

To configure additional options, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
In the Settings dialog box, click Properties. This displays a properties dialog box.

5.
Click the Options tab. You can now configure the following additional options:

  • To display status messages while connecting, select Display Progress While Connecting.

  • To ensure users are prompted for logon information if necessary, select Prompt For Name And Password, Certificate, Etc.

  • To ensure the logon domain is included when requested, select Include Windows Logon Domain.

  • To prompt for a phone number when needed, select Prompt For Phone Number.

6.
Click OK three times.

Configuring Connection Attempts and Automatic Disconnection

By default, Windows Vista attempts to make a connection 10 times before giving up, and it won't disconnect idle connections automatically. You can use advanced options to change the way connection attempts and disconnection are handled by following these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
In the Settings dialog box, click Advanced. This displays the Advanced Dial-Up dialog box.

5.
You can now configure the following options:

  • Try To Connect ... Times Sets the number of times Windows Vista attempts to make a connection. The minimum value is 1.

  • Wait ... Seconds Between Attempts Sets the number of seconds to wait between connection attempts. The minimum value is 5.

  • Disconnect If Idle For ... Minutes Specifies whether Windows Vista disconnects connections that haven't been actively used for the specified time. The minimum value is 3 minutes. Typically, you should set this value to between 20 and 30 minutes, or longer if the user transfers large files using protocols that might not update their state during the transfer, such as FTP.

  • Disconnect When Connection May No Longer Be Needed Specifies whether Windows Vista disconnects when a user quits all Internet programs that would otherwise use the connection.

6.
Click OK three times when you are finished.

Tip

If users complain about getting disconnected during dial-up sessions, the Disconnect settings can be the problem. Talk with the users about how they use the Internet and then determine whether you should change the settings to better meet their needs. Another reason for disconnection is if the Idle Time Before Hanging Up option is used with redialing settings.

Configuring Redialing Options

With dial-up connections, you can set dialing options that enable connections to be automatically redialed when lines are busy and when the connection is dropped. To configure redialing options, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
In the Settings dialog box, click Properties. This displays a properties dialog box.

5.
Click the Options tab. Use the following settings in the Redialing Options panel to configure redialing:

  • Redial Attempts Sets the number of times to redial the phone number automatically. To disable redialing, enter 0 as the redial value.

  • Time Between Redial Attempts Sets the time to wait before redial attempts. The available values are 1 second, 3 seconds, 5 seconds, 10 seconds, 30 seconds, 1 minute, 2 minutes, 5 minutes, and 10 minutes.

  • Idle Time Before Hanging Up Specifies whether Windows Vista disconnects the phone line when the connection hasn't been actively used for a specified time. The available values are Never (the standard default), 1 minute, 5 minutes, 10 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours, and 24 hours.

  • Redial If Line Is Dropped Specifies whether Windows Vista attempts to redial the connection if the line is dropped. With connections to the workplace, this option is usually cleared by default. In most cases, however, you'll want to select it.

6.
Click OK three times.

Setting a Connection to Use Dialing Rules

Dial-up connections can be configured with or without dialing rules. If you don't use dialing rules with a connection, the seven-digit phone number assigned to the connection is dialed at all times. When you assign dialing rules, the current dialing location determines whether the connection is attempted as a local or long-distance phone call.

To view or set the dialing rules for a connection, follow these steps:

1. | Click Start and then click Control Panel. In Control Panel, click Network And Internet.
2. | In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.
3. | Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.
4. | In the Settings dialog box, click Properties. This displays a properties dialog box.
5. | To ensure the connection uses the appropriate dialog rules, on the General tab, select Use Dialing Rules and then type an area code and select a country/region code.
6. | If you don't want to use dialing rules, clear the Use Dialing Rules check box.
7. | Click OK three times.

Configuring Primary and Alternate Phone Numbers

With dial-up connections, you can configure two types of phone numbers: the primary number to dial whenever a connection is attempted, and alternate phone numbers to try if a primary number fails. To configure phone numbers, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
In the Settings dialog box, click Properties. This displays a properties dialog box.

5.
The primary phone number is listed in the Phone Number text box. Type a new number as necessary.

6.
Click Alternates. This displays the Alternate Phone Numbers dialog box. You can now manage primary and alternate phone numbers using the following techniques:

  • To add a phone number, click Add to display the Add Alternate Phone Number dialog box. Next enter the seven-digit number used to dial the alternate number locally in the Phone Number text box. You can use a dash if desired, such as 555-1234. If you want to set dialing rules, select Use Dialing Rules and then type an area code and select a country/region code. Click OK.

  • To change the order in which numbers are dialed, select a number and then use the up or down arrow to change its position in the Phone Numbers list. The top number in the list becomes the primary number.

  • To edit existing numbers, select the number in the Phone Numbers list and then click Edit. Then use the Edit Alternate Phone Number dialog box to change the number settings.

  • To remove a number, select the number in the Phone Numbers list and then click Delete.

7.
If you want to automatically use alternate numbers, select If Number Fails, Try Next Number. You can also move a successful number to the top of the list (making it the primary number) if Windows Vista is able to successfully dial it after a previous number fails. To do this, select Move Successful Number To Top Of List.

8.
Click OK four times.

Configuring Identity Validation

Proper identity validation is essential to maintaining the integrity of your network. When users dial in to the office, you should ensure that identities are validated securely if at all possible. This isn't the default setting for standard dial-up connections, however. With most connections, the user's logon information for connections can be validated using the following options:

  • Allow Unsecured Password Allows the user logon information to be passed in clear text over the connection.

  • Require Secured Password Forces Windows Vista to attempt to pass logon information using a secure technique, such as MSCHAP Version 2 or Challenge Handshake Authentication Protocol (CHAP), rather than clear text. You can also configure connections to use Extensible Authentication Protocol (EAP).

  • Use Smart Card Tells Windows Vista to validate the logon using a smart card.

With dial-up and broadband connections, you can use any of these options. With VPN, you can only use the secure techniques. When you require a secured password, you can also automatically pass the Windows logon name, password, and domain specified in the configuration. Passing the Windows logon information automatically is useful when users connect to the office and must be authenticated in the Windows domain. With both secure validation techniques, you can require data encryption and force Windows Vista to disconnect if encryption cannot be used. Data encryption is automatically used with Windows Authentication for both secured passwords and smart cards.

To configure identity validation, follow these steps:

1. | Click Start and then click Control Panel. In Control Panel, click Network And Internet.
2. | In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.
3. | Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.
4. | In the Settings dialog box, click Properties. This displays a properties dialog box.
5. | Click the Security tab.
6. | In the Security Options panel, you can select Typical (Recommended Settings) or Advanced (Custom Settings). The Typical options are Allow Unsecured Password, Require Secure Password, and Use Smart Card.
7. | If you require secure passwords, you can also set automatic logon and require data encryption. Both options are useful when logging on to a Windows domain. The settings must be supported, however; if they aren't, users won't be able to validate their logons and connections won't be completed.
8. | If you use smart cards, you should also require data encryption. Data encryption is essential to ensuring the integrity and security of the data passed between the originating computer and the authenticating computer. If you select Require Data Encryption and the connection is not secured with encryption, the client computer will drop the connection.
9. | Click OK three times. Note By default, all connections to a Microsoft Routing And Remote Access Server use PPTP Version 2 to encrypt the data channel. Although a PPP connection to a third party remote access server may use CHAP for authentication, the server might need to be specially configured to encrypt the data channel.

Configuring Networking Protocols and Components

The way in which networking protocols and components are configured depends on the type of connection. As Table 13-1 describes, dial-up connections can use either Point-to-Point Protocol (PPP) or Serial Line Internet Protocol (SLIP) as the connection protocol. Broadband connections use Point-to-Point Protocol over Ethernet (PPPoE). VPN connection use either PPTP or L2TP.

Table 13-1. Connection Protocol Availability by Connection Type

Connection Type

Connection Protocol

Description

Dial-up

PPP

Used to establish connections to Windows servers over dial-up.

Dial-up

SLIP

Used to establish connections to UNIX servers over dial-up; available if you've installed third-party software.

Broadband

PPPoE

Used to establish a point-to-point broadband connection over Ethernet.

VPN

Automatic

Used to automatically detect which VPN protocol is available and establish a virtual tunnel using this protocol.

VPN

PPTP VPN

Sets the PPTP for VPN. PPTP is an extension of PPP.

VPN

L2TP IPSec VPN

Sets the L2TP for VPN. L2TP uses IPSec to enhance security.

Four network components are used with mobile networking: Transmission Control Protocol/Internet Protocol (TCP/IP), QoS Packet Scheduler, File And Printer Sharing For Microsoft Networks, and Client For Microsoft Networks. As Table 13-2 shows, the way these components are configured by default depends on the type of connection that was created originally. You can change these settings to suit your needs. If necessary, you can also install additional networking components.

Table 13-2. Default Component Configuration by Connection Type

Dial-Up Component

Description

Broadband

Standard Dial-Up

Dial-Up to Office

VPN

Transmission Control Protocol/Internet Protocol (TCP/IP)

Required for network communications. By default, Dynamic Host Configuration Protocol (DHCP) is used with connections unless overridden in the property settings.

Y

Y

Y

Y

QoS Packet Scheduler

Manages quality of service for packets and packet scheduling according to priority.

Y

Y

Y

Y

File And Printer Sharing For Microsoft Networks

Enables the sharing of printers and files over the network connection; allows for mapping printers and drives.

N

N

N

Y

Client For Microsoft Networks

Enables Windows Authentication and Windows domain; enables the computer to act as domain client.

N

N

Y

Y

To view or change the networking options for a connection, follow these steps:

1.
Click Start and then click Control Panel. In Control Panel, click Network And Internet.

2.
In Network And Internet, click Internet Options. In the Internet Properties dialog box, click the Connections tab.

3.
Select the connection you want to configure in the Dial-Up And Virtual Private Network Settings list box and then click Settings.

4.
In the Settings dialog box, click Properties. This displays a properties dialog box.

5.
Click the Networking tab. You can now do the following:

  • Configure the protocol used by the connection by using the Type Of DialUp Server I Am Calling list, Type of VPN list, or Type Of Broadband Connection To Make list, as appropriate.

  • Enable network components by selecting the related check box in the This Connection Uses The Following Items list.

  • Disable network components by clearing the related check box in the This Connection Uses The Following Items list.

Tip

If any of the network components shown in Table 13-2 are not available and are necessary for the connection, you can install them by clicking Install on the Networking tab. Afterward, select the component type, click Add, and then select the component to use in the list provided.

6.
By default, connections use DHCP to configure network settings, including the IP address to use, subnet mask, default gateway, Domain Name System (DNS) servers, and Windows Internet Naming Service (WINS) servers. If you want to assign a static IP address or override other default settings, select Transmission Control Protocol/Internet Protocol (TCP/IP) and then click Properties. This displays the Transmission Control Protocol/Internet Protocol (TCP/IP) Properties dialog box, which can be configured as discussed in Chapter 12, "Configuring and Troubleshooting TCP/IP Networking."

7.
Click OK three times.

Enabling and Disabling the Windows Firewall for Network Connections

With dial-up, broadband, and VPN connections, you might want to give the computer added protection against attacks by using the Windows Firewall. This built-in firewall protects Windows Vista systems by restricting the types of information that can be communicated. By enforcing the appropriate restrictions, you reduce the possibility that malicious individuals can break into a systemand reducing security risks is extremely important when users are accessing the organization's network from outside your protective firewalls and proxy servers.

The Windows Firewall is enabled by default for all connections and can be enabled or disabled on a per-connection basis. To enable or disable Windows Firewall on a per-connection basis, follow these steps:

1. | Click Start and then click Control Panel. In Control Panel, click Security.
2. | Click Windows Firewall. In the Windows Firewall dialog box, click Change Settings.
3. | In the Windows Firewall Settings dialog box, click the Advanced tab.
4. | Each network connection configured on the computer is listed in the Network Connection Settings panel. Clear the check box for a connection to disable Windows Firewall for that connection. Select the check box for a connection to enable Windows Firewall for that connection.
5. | Click OK when you are finished.


Establishing Connections

As discussed in the "Configuring Automatic or Manual Connections" section of this chapter, dial-up, broadband, and VPN connections can be established manually or automatically. The manual method lets users choose when to connect. The automatic method connects when users start a program that requires network access, such as Internet Explorer.

Connecting with Dial-Up

Dial-up uses a telephone line to establish connections between two modems. To establish a dial-up connection, follow these steps:

1. | Click Start and then click Connect To. In Connect To A Network, click the dialup connection you want to use and then click Connect.
2. | Confirm that the user name is correct and enter the password for the account if it doesn't already appear.
3. | To use the user name and password whenever you attempt to establish this connection, select Save This User Name And Password For The Following Users and then select Me Only.
4. | To use the user name and password when any user attempts to establish this connection, select Save This User Name And Password For The Following Users and then select Anyone Who Uses This Computer. Don't use this option if you plan to distribute this connection through Group Policy because you don't want to give out your connection password.
5. | The Dial drop-down list shows the number that will be dialed. The primary number is selected by default. To choose an alternate number, click the drop-down list and then select the number you want to use.
6. | Click Dial. When the modem connects to the ISP or office network, you'll see a connection speed. The connection speed is negotiated on a per call basis and depends on the maximum speed of the calling modem and the modem being called, the compression algorithms available, and the quality of the connection.

If you have problems connecting with dial-up, use these tips to help you troubleshoot:

  • Problem: Modem dials and reaches the other modem but cannot connect. It continues to make connection noises until you cancel the operation.

    Resolution: The phone lines are usually the source of the problem. Static or noise on the line can cause connection failures. Check your connections between the modem and the wall. Check with the phone company to see whether they can test the line and resolve the problem.

  • Problem: Modem dials and seems to connect; then the service provider or office network connection is dropped unexpectedly. The connection doesn't seem to complete successfully.

    Resolution: Check your networking protocols and components as discussed in the "Configuring Networking Protocols and Components" section of this chapter. If this seems to be okay, determine whether you are passing Windows logon and domain information, because this might be required. See the "Configuring Connection Logon Information" section of this chapter.

  • Problem: Cannot access resources in the Windows domain.

    Resolution: Client For Microsoft Networks might be required to access resources on the office network. Enable this component and ensure that the domain information is being passed as necessary.

  • Problem: User can never get through. The modem seems to be dialing the number incorrectly. You can hear it dialing too many or too few numbers.

    Resolution: Check the dialing rules for the connection as well as the currently selected dialing location. Make sure these are configured properly for the user's current location.

  • Problem: A No Dial Tone message is displayed but the modem is installed correctly and seems to be okay.

    Resolution: Check the phone cord and ensure that it is connected properly. Some modems have two line jacks, one labeled Phone/In and one labeled Line/Out. The phone cord from the wall jack should be plugged into the Line/Out jack. Some phone jacks are configured for data only, indicating a plug-in for a high-speed line rather than a phone or modem. Try a different plug.

  • Problem: The computer freezes when the user tries to use the modem.

    Resolution: This is most likely caused by a device conflict. Follow the techniques discussed in Chapter 3, "Configuring Hardware Devices and Drivers," for configuring and troubleshooting devices.

  • Problem: Some services freeze or don't work.

    Resolution: Check the proxy and firewall settings. These settings can restrict the services that are available.

Connecting with Broadband

Broadband connections are established using a cable modem and a cable line, or a DSL router and a telephone line. To establish a broadband connection, follow these steps:

1. | Click Start and then click Connect To. In Connect To A Network, click the broadband connection you want to use and then click Connect.
2. | Confirm that the user name is correct and enter the password for the account if it doesn't already appear.
3. | To use the user name and password whenever you attempt to establish this connection, select Save This User Name And Password For The Following Users and then select Me Only.
4. | To use the user name and password when any user attempts to establish this connection, select Save This User Name And Password For The Following Users and then select Anyone Who Uses This Computer.
5. | Click Connect.

If you have problems connecting with broadband, use these tips to help you troubleshoot:

  • Problem: Cannot connect. Connection doesn't seem to work at all.

    Resolution: Check your network connections. Ensure that the lines connecting the DSL router or cable modem and the computer are plugged in properly.

  • Problem: Connection is dropped unexpectedly. The connection doesn't seem to complete successfully.

    Resolution: Check your networking protocols and components as discussed in the "Configuring Networking Protocols and Components" section of this chapter. If this seems to be okay, determine whether you are passing Windows logon and domain information, as this might be required. See the "Configuring Connection Logon Information" section of this chapter.

  • Problem: Some services freeze or don't work.

    Resolution: Check the proxy and firewall settings. These settings can restrict the services that are available.

  • Problem: Cannot access resources in the Windows domain.

    Resolution: Client For Microsoft Networks might be required to access resources on the office network. Enable this component and ensure that the domain information is being passed as necessary.

Connecting with VPN

A VPN connection is made over an existing local area connection, dial-up connection, or broadband connection.

VPN connections are displayed separately from dial-up, broadband, and local area network (LAN) connections. To establish a VPN connection, follow these steps:

1. | Click Start and then click Connect To. In Connect To A Network, click the VPN connection you want to use and then click Connect.
2. | If the connection is configured to first dial another type of connection, Windows Vista tries to establish this connection before attempting the VPN connection. If prompted to establish this connection, click Yes. Then dial the connection as discussed in the "Connecting with Dial-Up" section of this chapter.
3. | Once the necessary connection is established, you'll see the Connect dialog box. After you confirm that the user name is correct and enter the password for the account if it doesn't already appear, click Connect.

If you have problems establishing the connection, use these tips to help you troubleshoot:

  • Problem: Cannot connect. Connection doesn't seem to work at all.

    Resolution: Check your network connections. Ensure that the lines connecting the DSL router or cable modem and the computer are plugged in properly.

  • Problem: Returns error message regarding the host name.

    Resolution: The host name might be incorrectly specified. Check the settings to ensure the host name is fully expressed, such as external01.microsoft.com rather than simply external01. DNS resolutions might not be working properly either. If this is the case, enter the IP address for the host rather than the host name.

  • Problem: Returns error message regarding a bad IP address.

    Resolution: Check or reenter the IP address. If the IP address was correct, TCP/IP networking might be improperly configured. Check your networking protocols and components as discussed in the "Configuring Networking Protocols and Components" section of this chapter. You might need to set a default gateway and a static IP address for the connection.

  • Problem: Message stating that the protocol isn't supported is displayed, and the connection doesn't seem to complete successfully.

    Resolution: Set the protocol to automatic rather than to a specific setting of either PPTP or L2TP. Check the secure logon settings. They might be set to require a secure password instead of smart card or vice versa. If this seems to be okay, determine whether you are passing Windows logon and domain information, as this might be required. See the "Configuring Connection Logon Information" section of this chapter.

  • Problem: Cannot map network drives or access printers.

    Resolution: File And Printer Sharing For Microsoft Networks is required to map drives and printers. Enable this component as discussed in the "Configuring Networking Protocols and Components" section of this chapter.

  • Problem: Some services freeze or don't work.

    Resolution: Check the proxy and firewall settings. These settings can restrict the services that are available.


Wireless Networking

To make it easier for users to take their laptops with them to meetings and to other locations in the office, many organizations are implementing wireless networks. Wireless networks can be deployed and used in many different configurations. This section examines the most common configurations.

Wireless Network Devices and Technologies

When you are working with wireless networks, the most common terms you'll run across are wireless network adapter and wireless access point. Wireless adapters include PC cards for notebooks, Peripheral Component Interconnect (PCI) cards for desktops, and universal serial bus (USB) devices (which can be used with notebooks or desktops). A wireless adapter uses a built-in antenna to communicate with an access point. Typically, an access point is directly connected to the organization's physical network and might also function as a network switch or hub itself, meaning it has physical ports that allow direct cable connections as well as wireless connections. Other names for access points include wireless base stations and wireless gateways.

The most widely used wireless network adapters and access points are based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 specification. Wireless devices that are based on this specification can be Wi-Fi Certified to show they have been thoroughly tested for performance and compatibility. Table 13-3 provides a feature comparison of the most-used wireless technologies based on IEEE 802.11. As the table describes, there are four standards, and each has benefits and drawbacks. It should be noted that although 802.11a wireless devices cannot interoperate with 802.11b or 802.11g devices, fewer devices use the 5-gigahertz (GHz) range, making it less likely that there will be interference with other types of wireless devices (the majority of which use the 2.4-GHz range). For added security, IEEE has defined the newer 802.11i standard.

Table 13-3. Wireless Networking Technologies

Wireless Standard

802.11a

802.11b

802.11g

Speed

Up to 54 Mbps

Up to 11 Mbps

Up to 54 Mbps

Transmission frequency

5 GHz

2.4 GHz

2.4 GHz

Effective indoor range

Approximately 25 to 75 feet

Approximately 100 to 150 feet

Approximately 100 to 150 feet

Compatibility

Incompatible with 802.11b and 802.11g

802.11b wireless devices can interoperate with 802.11g devices (at 11 Mbps); 802.11g wireless adapters can operate with 802.11b access points (at 11 Mbps)

802.11g wireless devices can operate with 802.11b devices (at 11 Mbps)

Unlike the 802.11a, 802.11b, and 802.11g standards, the 802.11i standard isn't about transmission speeds and frequencies. 802.11i is a security standard that you can add to the existing standards. More specifically, it adds security functionality to the radio specifications of 802.11a, 802.11b, and 802.11g. This means 802.11a network adapters and access points can include the 802.11i security functionality, as can 802.11b and 802.11g wireless products.

Note

Keep in mind that some computers (particularly laptops) contain integrated chip sets that support multiple wireless networking technologies. Wi-Fi Protected Access Version 2 (WPA2) is the approved Wi-Fi Alliance implementation of 802.11i. WPA2 implements all mandatory elements of the 802.11i standard.

Real World

Take a close look at compatibility issues before you deploy wireless devices that aren't IEEE 802.11 based. Increasingly, you'll see devices that achieve speeds higher than 54 Mbps. Some of these devices achieve speed boosts through compression and other similar techniques while staying within the guidelines of the IEEE 802.11 specification. Others might use network technologies that are proprietary, requiring you to use that company's wireless adapters and access points to achieve the transmission improvements. For more information on wireless standards and certified devices, go to http://www.wi-fi.org.

Wireless Security

Securing a wireless network is very different from securing a wired network. With a wired network, a cable is used to connect a computer to the network. A user must use a cable to be physically connected to the network and must have access to one of your internal switches or hubs. If an unauthorized person connects a machine to the network, it is fairly easy to determine this and trace the physical cable to the intruder's computer.

When you install wireless networking, anyone within range of one of your wireless access points has access to your network. Not only can they intercept the wireless signals that are being broadcast, they can also try to crack into the network. The bad news is that it is difficult to locate the intruder because there's no physical wire to trace. The really bad news is that if intruders can gain access to a wireless access point, they are usually inside your organization's firewall. To protect the network, you should configure its firewall if one is available and configure the wireless devices to encode all wireless transmissions.

The most basic wireless encryption scheme is Wireless Equivalency Protection (WEP). With WEP, you encrypt data using 40-bit, 128-bit, 152-bit, or higher private key encryption. With WEP, all data is encrypted using a symmetric key derived from the WEP key or password before it is transmitted, and any computer that wants to read the data must be able to decrypt it using the key. In a typical wired environment, the shared key encryption alone is sufficient to safeguard your data. In a wireless environment, with high traffic volume, it is possible that someone could successfully break the shared key, and because the shared key doesn't change automatically over time, the intruder would then have access to your organization's internal network.

Because WEP provides only the most basic security, its use is strongly discouraged, except in cases where no alternative exists. The preferred alternatives to WEP are Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access Version 2 (WPA2). WPA was adopted by the Wi-Fi Alliance as an interim standard prior to the ratification of 802.11i. WPA2 is based on the official 802.11i standard and is fully backwards compatible with WPA.

WPA and WPA2 are able to rotate keys for added security and to change the way keys are derived. By changing the encryption keys over time and ensuring they aren't derived in one specific way, WPA and WPA2 can improve security significantly over WEP. WPA-compatible and WPA2-compatible devices can operate in enterprise mode or in a personal, home/small office configuration, as explained in the following points:

  • Enterprise mode provides authentication using IEEE 802.1X and EAP. In the enterprise mode, wireless devices have two sets of keys: session keys and group keys. Session keys are unique to each association between an access point and a wireless client. They are used to create a private virtual port between the access point and the client. Group keys are shared among all clients connected to the same access point. Both sets of keys are generated dynamically and are rotated to help safeguard the integrity of keys over time.

  • Personal mode provides authentication via a preshared key or password. In a personal, home/small office configuration, WPA uses a preshared encryption key rather than a changing encryption key. Here, the user enters a master key (the group key) into the access point and then configures all the other wireless devices to use this master key. A wireless device uses the master key as a starting point to mathematically generate the session key. It then regularly changes the session key so that the same session key is never used twice. Because the key rotation is automatic, key management is handled in the background.

WPA and WPA2 are fully compatible with 802.11a, 802.11b, and 802.11g. Many wireless devices shipped before WPA and WPA2 became available can be made fully compatible with WPA and WPA2 through a software upgrade. With WPA, no additional modifications are necessary. The same is not necessarily true with WPA2 because some wireless devices may require processor or other hardware upgrades to be able to perform the computationally intensive Advanced Encryption Standard (AES) encryption.

When working with WPA and WPA2, keep the following in mind:

  • All products Wi-Fi certified for WPA2 are interoperable with products that are Wi-Fi certified for WPA.

  • Both WPA and WPA2 have personal and enterprise modes of operation.

  • Both WPA and WPA2 use 802.1X and EAP for authentication.

  • WPA provides strong data encryption via Temporal Key Integrity Protocol (TKIP).

  • WPA2 provides enhanced data encryption via AES, which allows WPA2 to meet the Federal Information Processing Standard (FIPS) 140-2 requirement of some government agencies.

    Note

    Both WPA and WPA2 offer a high level of security to help ensure private data remains private and access to wireless networks is restricted to authorized users. Only WPA2 provides strong encryption through AES, which is a requirement for some corporate and government users.

Another advanced wireless security technology is Robust Security Network (RSN), which is supported by 802.11i-compatible devices. RSN enables wireless devices to dynamically negotiate their authentication and encryption algorithms. This means the authentication and encryption algorithms used by RSN-compatible devices can be changed. New authentication techniques and algorithms can be added to address security issues. RSN is based on the EAP and the AES.

Installing and Configuring a Wireless Adapter

The two main types of wireless adapters you'll use are PC cards for notebooks and PCI cards for desktops. These adapters are the easiest to configureand I've found them to be the most reliable. The other type of wireless adapter that you might see is a device that connects to a notebook or desktop computer with a USB cable. When using USB wireless devices, keep in mind there are two USB specifications: USB 1.0, the original specification, and USB 2.0, the faster, newer specification. A wireless device that is USB 2.0compliant must be connected to a USB 2.0 port to function properly and at the speeds you expect.

Note

Wireless technology is changing so quickly that Windows Vista won't recognize most wireless devices. This can make installation more difficult because you typically cannot rely on Plug and Play. In fact, with many of the wireless adapters I've worked with, you need to run the installation CD prior to installing the wireless devices. This is particularly true with USB devices. Be sure to read the documentation closely.

As part of the installation process, most installation software will help you configure the wireless device. In the process, you typically will need to specify the name of the wireless network to which you want to connect (the network name) and the mode in which the wireless device will run. Wireless adapters can run in one of two operating modes:

  • Ad hoc In ad hoc mode, you configure the wireless adapter to connect directly to other computers with wireless adapters.

  • Infrastructure In infrastructure mode, you configure the wireless adapter for use on a wireless network. In this configuration, the adapter expects to connect to an access point rather than to another computer directly.

After you specify the adapter mode, you might need to specify the encryption key that will be used. If your organization uses WEP security, you will in most cases have to type in the required encryption key, which is usually referred to as the network key. With WPA/WPA2 security, you will most likely use a certificate or a smart card to supply the required encryption key.

Working with Wireless Networks and Wireless Connections

Once you've completed the installation of the device, you should be able to connect over the wireless network. Much like a wired network card, which has a local area connection, wireless network cards have a wireless network connection that is in turn connected to a specific network that is designated as a public network, private network, or domain network. If a computer has both a wired and a wireless connection, it may have two active connections: one to a wired network and one to a wireless network.

As Figure 13-8 shows, wireless network connections provide the following additional details about the network and the connection:

  • The name of the wireless network in parentheses after the connection type designator.

  • The current signal strength. A signal strength of one bar is poor; a signal strength of five bars is excellent.

  • A Disconnect link for disconnecting the wireless connection.

Figure 13-8. Manage wireless network connections using Network And Sharing Center.

[View full size image]

If you click View Status for the wireless connection, you'll see a status dialog box similar to the one shown in Figure 13-9. You can use the Wireless Network Connection Status dialog box to check the status of the connection and to maintain the connection, in much the same way as you can for other types of connections, as I discussed previously. You'll also see the duration and speed of the connection.

Figure 13-9. Determine the status and signal strength of a wireless network connection.

As with Local Area Connections, Wireless Network Connections have configurable properties. This means that every discussion about configuring local area connection properties in Chapter 12 also applies to wireless network connections. You can do the following:

  • Install and uninstall networking features for clients, services, and protocols. In the Status dialog box, click Properties and then click Install or Uninstall as appropriate.

  • Set TCP/IPv6 and TCP/IPv4 settings for DHCP, static IP, and dynamic IP addressing. In the Status dialog box, click Properties and then double-click Internet Protocol Version 6 (TCP/IPv6) or Internet Protocol Version 4 (TCP/IPv4).

  • Disable or diagnose wireless connections. In the Status dialog box, click Disable or Diagnose as appropriate.

If you have problems establishing a wireless connection and automated diagnostics can't resolve the problem, use these tips to help you troubleshoot:

  • Problem: Limited or no connectivity to the wireless network.

    Resolution: Check the signal strength. If the signal strength is low (poor) you will need to either move closer to the access point or redirect your antenna. For a built-in antenna, you might need to change the position of the laptop relative to the access point. The problem could also be that the network did not assign your computer a network address. To check your IP address assignment, double-click the wireless connection in the Network Connections dialog box and then select the Support tab. If the IP address is 0.0.0.0, your computer was not assigned an IP address, and you need to click Repair. If the IP address currently assigned to the computer is in the range of 169.254.0.1 to 169.254.255.254, then the computer is using Automatic Private IP Addressing (APIPA). Try clicking Repair to resolve the problem.

  • Problem: Not connected or unable to connect to the wireless network.

    Resolution: If you are out of the broadcast area, your computer will not be able to connect to the wireless network. Double-click on the connection. The computer will display the Wireless Network Connection dialog box, and in the right pane you will see the message "No wireless networks were found in range." If you think this is an error, click Refresh Network List under Network Tasks. Otherwise, try moving closer to the access point or changing the position of your antenna/computer relative to the access point. The computer also might not be configured properly for establishing a wireless connection on this network.

Tip

You'll have better connection speedsup to the maximum possible with the wireless technology you are usingwhen you have a stronger signal. If the signal strength is weak, the connection speed might be reduced considerably. To improve the signal strength, try moving the adapter's antenna if one is available or try changing the position of the computer relative to the access point.

Connecting to Wireless Networks

Any wireless access point broadcasting within range should be available to a computer with a wireless adapter. By default, Windows Vista is set to allow you to configure the network settings that should be used. This enables you to configure different authentication, encryption, and communication options as necessary.

If you haven't previously connected to a wireless network, you can create a connection for the network by completing the following steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Set Up A Connection Or Network. This starts the Set Up A Connection Or Network Wizard.

3.
Select Manually Connect To A Wireless Network and then click Next.

4.
As shown in Figure 13-10, you now need to enter information about the wireless network to which you want to connect. Your network administrator should have this information.

Figure 13-10. Enter the information for connecting to the wireless network.

[View full size image]

5.
In the Network Name box, enter the network name (also referred to as the network's secure identifier SSID).

6.
Use the Security Type selection list to select the type of security being used. The encryption type is then filled in automatically for you.

7.
With WEP and WPA-Personal, you must enter the required security key or password phrase in the Security Key/Passphrase box. For example, A WEP key typically is one of the following:

  • 5 case-sensitive characters

  • 13 case-sensitive characters

  • 10 hexadecimal case-insensitive characters

  • 26 hexadecimal case-insensitive characters

8.
By default, the connection is started automatically whenever the user logs on. If you also want the computer to connect to the network regardless of whether it can be reached, such as when the computer is out of range of the wireless base, select Connect Even If The Network Is Not Broadcasting.

9.
Click Next to connect to the wireless network using the settings you've entered.

If you're previously connected to a wireless network, you can easily connect to it or disconnect from it by completing the following steps:

1.
Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.

2.
In Network And Sharing Center, click Connect To A Network. By default, all available networks are listed by name, status, and signal strength. If a network that should be available isn't listed, try clicking the Refresh button.

3.
Moving the pointer over a wireless network entry displays a message box that provides the network name, signal strength, security type, radio type (the wireless standard supported), and the link's security ID.

4.
You can now connect to or disconnect from wireless networks:

  • To connect to a wireless network, click the network and then click Connect.

  • To disconnect from a wireless network, click the network and then click Disconnect. Confirm the action by clicking Disconnect again.

Managing Wireless Networks

You can manage wireless networks using Manage Wireless Networks, shown in Figure 13-11. To access Manage Wireless Networks, follow these steps:

1. | Click Start and then click Network. In Network Explorer, click Network And Sharing Center on the toolbar.
2. | In Network And Sharing Center, click Manage Wireless Networks.

Figure 13-11. Manage wireless network connections.

[View full size image]

Manage Wireless Networks lists wireless networks in the order in which the computer should try to use the available networks. The network listed at the top of the list is tried before any others. If the computer fails to establish a connection over this network, the next network in the list is tried, and so on.

To change the preference order of a network, click it and then use the Move Up or Move Down buttons to set the order in which the computer should try to use the network. As necessary, click Add to create a new wireless network that will be added to the wireless networks list, or select an existing network and click Remove to delete a listed wireless network.


Chapter 14. Managing Advanced Internet Options and Security

In this chapter:
Customizing URLs | 437
Customizing the Browser User Interface | 441
Setting Default Internet Programs | 446
Managing Connection and Proxy Settings | 448
Managing Browser Cookies and Other Temporary Internet Files | 452
Secure Browsing and Local Machine Lockdown | 454
Managing Internet Explorer Security Zones | 461
Additional Policies That Might Be Useful for Managing Internet Options | 467

Microsoft Windows Vista includes Windows Internet Explorer 7 in Windows Vista, a feature-rich Web browser that can be used to access information published on the Internet and corporate networks. You can customize the configuration of Internet Explorer in many areas, including Internet file caching, Internet security zones, Internet privacy preferences, default Internet programs, and other advanced options that control browser features.

Internet Explorer settings can be managed in several ways. When you want to manage Internet Explorer settings for individual users, you'll use the Internet Properties dialog box. Access the Internet Properties dialog box in Control Panel by clicking Network And Internet and then clicking Internet Options. When you want to manage settings for multiple users, you'll use Group Policy. The focus of this chapter is on managing Internet Explorer settings through Group Policy. Many policies can be implemented to make your job easier while improving the user experience and getting better control over security and privacy.


Customizing URLs

Internet Explorer is configured with many default Uniform Resource Locators (URLs), which are used for everything from the default home page to favorite lists. Through Group Policy, you can customize the URLs so that the browser interface meets the needs of your organization.

Setting Home Page, Search, and Support URLs

Custom home page, search, and support URLs provide users with quick access to important resources that can make their lives (and yours) a bit easier. To configure these options through Group Policy, follow these steps:

1.
Access Group Policy for the system with which you want to work. Next, access User Configuration\Windows Settings\Internet Explorer Maintenance\URLs.

2.
In the right pane, double-click Important URLs. As shown in Figure 14-1, you can now specify a custom home page, search bar page, and online support page.

Figure 14-1. Use the Important URLs dialog box to set custom URLs for a home page, search bar page, and online support page.

[View full size image]

3.
Select Customize Home Page URL and then in the Home Page URL text box, type the URL of the home page you want to use, such as http://intranet.cpandl.com/. The home page URL is opened whenever the browser is started or the user clicks the Home button on the Internet Explorer toolbar.

Tip

Typically, you'll want to set the home page URL to the home page of your organization's intranet. If you don't have an intranet, you might want to set this to the home page of your company's external Web site.

4.
Select Customize Search Bar URL and then in the Search Bar URL text box, type the URL to the search page you want to use, such as http://intranet.cpandl.com/search.asp. The search page is opened in a side frame of the Internet Explorer window whenever a user clicks the Search button.

Caution

Getting the search page to work correctly is tricky. Test your implementation locally before rolling it out to multiple users. The search page must be formatted as Hypertext Markup Language (HTML) and should include links targeted at the main frame. Because the search page is opened in a side frame of the browser, you'll need to create a separate version, modified to work as a side frame, of any existing search page on your organization's intranet or external Web site.

5.
Select Customize Online Support Page URL and then in the Online Support Page URL text box, type the URL to the support page you want to use, such as http://intranet.cpandl.com/helpdesk/. The support page is opened when a user selects Online Support from the Internet Explorer Help menu.

6.
Click OK.

Customizing Favorites and Links

The Favorites and Links lists are designed to provide quick access to commonly used resources. In Internet Explorer, you access Favorites and Links through the Favorites menu. When you click Favorites on the menu bar, you see a list of options that enable you to add, organize, and access favorites. Through Group Policy, you can add favorites and links that make it easier for users to access commonly used online resources, such as expense forms, corporate phone directories, and product specifications. This makes users more efficient and saves time, and it might also increase use of these important resources.

Using Group Policy, you can add favorites and links in two ways. You can add items individually or you can import a folder containing the items you want to use. To create favorites and links one by one, follow these steps:

1.
Access Group Policy for the resource you want to work with. Next, access User Configuration\Windows Settings\Internet Explorer Maintenance\URLs.

2.
In the right pane, double-click Favorites And Links. This displays the Favorites And Links dialog box, shown in Figure 14-2. You can now add submenus and individual options to the Favorites menu in Internet Explorer. These items are available to all users subject to the policy.

Figure 14-2. Use the Favorites And Links dialog box to configure quick access links to important online resources.

[View full size image]

3.
When you plan to add several favorites or links, you can create a folder to hold the options. The folder you create appears as a submenu under the Favorites menu in Internet Explorer. To create a submenu, select Favorites and then click Add Folder. This displays the Details dialog box. Enter a name for the submenu in the Name text box and then click OK.

4.
To add individual menu options, select Favorites, Links, or a folder entry and then click Add URL. This again displays the Details dialog box. Type the name of the menu option, such as Expense Forms, and then type the URL to the resource, such as http://intranet.cpandl.com/exp_forms/. Next, click OK. The entry is then added to the menu or submenu you have chosen.

Tip

After you add a menu option, you can verify that you've correctly entered the URL by selecting the option and then clicking Test URL. This action loads the selected item in Internet Explorer. If the related page appears in Internet Explorer, you've entered the URL correctly. Otherwise, you've probably made a mistake and should edit the URL.

5.
Once you are finished adding submenus and creating menu options, you can specify additional preferences for adding the items to the Favorites menu. These additional preferences include the following:

  • Place Favorites And Links At The Top Of The List In The Order Specified Below Places favorites and links at the top of the menu and in the order in which you entered them in the list box. If you select this option, you can also use the Up and Down buttons to change the order of submenus and menu items in the list box.

  • Delete Existing Favorites And Links, If Present Removes any existing favorites and links, replacing them with the items you created. Using this option alone removes existing items created by both users and administrators.

  • Only Delete The Favorites Created By The Administrator Removes previous favorites and links created by the administrator but doesn't remove those created by users. This is a good option to use if you previously configured favorites and links and now want to replace those entries with your current items.

6.
Click OK when you are finished.

You can also create favorites and links using a folder and its contents as the basis for a submenu. To do this, follow these steps:

1. | Create a folder on a network or local drive that you can easily access. In the folder, add URL shortcuts that point to the locations you want to be able to access. These shortcuts will become the items in the submenu you are creating. Be sure to use descriptive names for the folder and its shortcuts, which will appear in the Internet Explorer Favorites menu.
2. | When you are ready to continue, access User Configuration\Windows Settings\Internet Explorer Maintenance\URLs in Group Policy and double-click Favorites And Links in the right pane.
3. | In the Favorites And Links dialog box, shown previously in Figure 14-2, select Favorites, Links, or a folder entry and then click Import. This displays the Browse For Folder dialog box. Use this dialog box to select the folder you created in step 1 and then click OK. The folder and its contents are added as a submenu of the selected item. Note Only properly formatted URL shortcuts are imported. If the folder contains other types of files or shortcuts, the folder doesn't appear as a submenu and the additional items aren't imported.
4. | Follow steps 5 and 6 of the previous procedure to complete the process.


Customizing the Browser User Interface

The Internet Explorer user interface can be customized for your organization using the Browser User Interface policies in Group Policy. These policies enable you to add custom titles to the title bar, custom logos that replace the Internet Explorer logo, and custom toolbars that add to or replace the existing toolbar.

Creating Custom Titles

Using the Browser Title policy, you can customize the text that appears in the title bar of Internet Explorer. By default, the title bar displays the title of the current page followed by the text "Microsoft Internet Explorer," such as "My Home Page Microsoft Internet Explorer." When you add a custom title, the default title is updated so that your string is added to the text "Microsoft Internet Explorer provided by," such as "My Home Page Microsoft Internet Explorer provided by ABC Publishing."

To add a custom title to Internet Explorer, follow these steps:

1.
Access User Configuration\Windows Settings\Internet Explorer Maintenance\Browser User Interface in Group Policy and then double-click Browser Title. This displays the Browser Title dialog box, shown in Figure 14-3.

Figure 14-3. Use the Browser Title dialog box to add custom titles to Internet Explorer.

[View full size image]

2.
Select Customize Title Bars and then type the custom title in the Title Bar Text box.

3.
Click OK.

Note

The custom title also appears in Microsoft Outlook Express if this is installed and used on the affected computer or computers.

Creating Custom Logos

Internet Explorer displays two standard logos in the upper right corner of the Internet Explorer window: a static logo and an animated logo. The static logo is displayed when the browser isn't performing an action. The animated logo is displayed when the browser is downloading pages or performing other actions. These logos are produced in one of two sizes, 22 x 22 pixels or 38 x 38 pixels, and they are formatted as bitmap images.

Using the Custom Logo policy, you can replace the standard logos with logos specifically created for your organization. If you want to use custom logos, you can work with your organization's design or art department to create the necessary image files. Images in 256 colors should be indexed to the Windows halftone palette; 15-color images should be indexed to the 15-color Windows palette. The animated bitmap should consist of numbered bitmaps that are vertically stacked into one bitmap. The first bitmap appears static when no action is taking place and the remaining bitmaps appear in sequence when the browser is in use, producing the animation effect. You'll find two tools, the Animated Bitmap Creator (MakeBMP.exe) and the Animated Bitmap Previewer (AnimBMP.exe), in the Internet Explorer Administration Kit (IEAK), available for download from http://www.microsoft.com/technet/prodtechnol/ie/ieak/downloads/default.mspx. These tools will help you create and preview animated logos.

Once you finish creating the image files, test the files on your local system before using Group Policy to update other computers in the organization. The logo files become part of Group Policy and are stored with the Group Policy files. Because the files are imported before use, they don't need to reside on the local computer initially. In fact, it might be best to put the logos on a network drive so that you can test them locally and then incorporate them into Group Policy using the same file paths.

To add custom logos to Internet Explorer, follow these steps:

1.
Access User Configuration\Windows Settings\Internet Explorer Maintenance\Browser User Interface in Group Policy and then double-click Custom Logo. This displays the Custom Logo dialog box, shown in Figure 14-4.

Figure 14-4. Once you create custom logos for Internet Explorer, you can use the Custom Logo dialog box to configure them to be used through Group Policy.

[View full size image]

2.
If you want to set a static logo and have created static logos that are 22 x 22 pixels and 38 x 38 pixels, select Customize The Static Logo Bitmaps. Then perform the following tasks, in any order:

  • In the Small (22 x 22) Bitmap text box, type the path to the small logo that you want to use or click Browse to use the Browse dialog box to find the image that you want to use.

  • In the Large (38 x 38) Bitmap text box, type the path to the large logo that you want to use or click Browse to use the Browse dialog box to find the image that you want to use.

    Note

    In all cases, the images must be the appropriate size or they won't be imported and set as the default logos. If you see a warning message that says the specified bitmap is too large, you'll need to select a different logo file to continue.

3.
If you want to set an animated logo and have created animated bitmap images that are 22 x 22 pixels and 38 x 38 pixels, select Customize The Animated Bitmaps. Then perform the following tasks, in any order:

  • In the Small (22 x 22) Bitmap text box, type the path to the small animated logo that you want to use or click Browse to use the Browse dialog box to find the image that you want to use.

  • In the Large (38 x 38) Bitmap text box, type the path to the large animated logo that you want to use or click Browse to use the Browse dialog box to find the image that you want to use.

4.
Click OK. The logo files are then imported and stored in Group Policy.

Creating Custom Buttons for Internet Explorer

Just as you can customize the title bar and logos in Internet Explorer, you can also customize the toolbar. The most common task you'll need to perform is adding a custom button that performs a specific task, such as launching a custom application. Before you can use a custom button, you'll need to do the following:

  • Create a script file containing the commands that you want to run, or know the path to an executable file that you want to use. The script file can be a batch file (.cmd or .bat) or a Windows Script Host (WSH) file (.js, .vbs, and so on).

  • Create (or work with your design or art department to create) a color icon file for the button. The color icon file, saved with an .ico extension, contains images for when the toolbar button is active. The icon file must contain three separate bitmaps: one 20 x 20 256-color, one 20 x 20 15-color, and one 15 x 15 15-color. The bitmaps must be indexed to either the 256-color Windows halftone palette or the 15-color Windows palette as appropriate.

  • Create (or work with your design or art department to create) a grayscale icon file for the button. The grayscale icon file, saved with an .ico extension, contains images for when the toolbar button is in the default or inactive state. The icon file must contain three separate bitmaps: one 20 x 20 grayscale image using the 256-color Windows halftone palette, one 20 x 20 grayscale image using the 15-color Windows palette, and one 15 x 15 grayscale image using the 15-color Windows palette.

When you are ready to proceed, you can add a custom button to the Internet Explorer toolbar by following these steps:

1.
Access User Configuration\Windows Settings\Internet Explorer Maintenance\Browser User Interface in Group Policy and then double-click Browser Toolbar Customizations. This displays the Browser Toolbar Customizations dialog box.

2.
On the Buttons panel, click Add to display the Browser Toolbar Button Information dialog box, shown in Figure 14-5.

Figure 14-5. Use the Browser Toolbar Button Information dialog box to add custom buttons to the toolbar.

3.
In the Toolbar Caption (Required) text box, type the button caption, which should be shortno more than one or two words. The button caption appears to the right or below the button when users display both the text and the icon on toolbar buttons.

4.
In the Toolbar Action, As Script File Or Executable (Required) text box, type the path to the script or executable file that you want to run when the button is clicked. If you don't know the file path, click Browse and use the Browse dialog box to find the file.

Tip

When setting the toolbar action, think carefully about the file path you use. It should be accessible to all users who will be affected by the policy you are creating. If necessary, you can use environment variables, such as %SystemDrive%, to ensure file paths are consistent for different users. You can also use network file paths, provided they are automatically mapped for users.

5.
In the Toolbar Color Icon (Required) text box, enter the path to the color icon file that you created for the button or click Browse to locate the file using the Browse dialog box.

6.
In the Toolbar Grayscale Icon (Required) text box, enter the path to the grayscale icon file that you created for the button or click Browse to locate the file using the Browse dialog box.

7.
If you want the custom button to be displayed on the toolbar by default, select This Button Should Be Shown On the Toolbar By Default. If you don't select this check box, users will need to display the button manually using the Customize Toolbar dialog box. This dialog box is accessed in Internet Explorer by selecting View, pointing to Toolbars, and selecting Customize.

8.
Click OK. If you later decide not to use the button, you can remove it by selecting the button on the Buttons list and then clicking Remove.


Setting Default Internet Programs

You can set default Internet programs using the Programs tab of the Internet Properties dialog box or through Group Policy. The procedures are very similar. To set default programs through Group Policy, follow these steps:

1.
Access User Configuration\Windows Settings\Internet Explorer Maintenance\Programs in Group Policy and then double-click Programs in the right pane. The Programs dialog box is displayed.

2.
If you want to stop using custom program settings, select Do Not Customize Program Settings and then click OK. Skip the remaining steps.

3.
If you want to start using custom program settings, select Import The Current Program Settings and then click Modify Settings. This displays the Internet Properties dialog box, shown in Figure 14-6.

Figure 14-6. In the Internet Properties dialog box, specify the default programs to use.

4.
Default Web Browser options are used to provide notification if Internet Explorer isn't the default Web browser or to make Internet Explorer the default browser. When you install additional browser software, the software might be set as the default Internet browser during installation. To have Internet Explorer check to make sure that it is still registered as the default Internet browser when Internet Explorer is started, select Tell Me If Internet Explorer Is Not The Default Web Browser. If your organization uses a Web browser other than Internet Explorer as the default browser, clear Tell Me If Internet Explorer Is Not The Default Web Browser.

5.
HTML Editing options are used to set the default program for editing HTML files. Select Microsoft Notepad as the default if other HTML editors, such as Microsoft FrontPage, are not routinely configured.

Note

Additional options might be available if other applications are installed on a system. Furthermore, in some cases (such as with the default HTML editor), you can select a blank value to specify that you don't want to use a default program for this service.

6.
If you want to configure other default program options, click Set Programs. You can then configure other default programs as discussed in the "Designating Default Programs" section of Chapter 5, "Installing and Maintaining Programs."

7.
When you install additional browser software, the software might be set as the default Internet browser during installation. To have Internet Explorer check to make sure that it is still registered as the default Internet browser when Internet Explorer is started, select Internet Explorer Should Check To See Whether It Is The Default Browser.

8.
Click OK twice when you are finished.


Managing Connection and Proxy Settings

Internet connection settings and proxies can be two of the biggest problems for administrators. When you deploy new computers, you must configure the connection and proxy settings manually or rely on an image build of a machine that might not be up to date. When you make changes to the network, you might need to update the connection settings as well. Performing these procedures manually takes a lot of time that can be better spent performing other tasks. Fortunately, Group Policy provides a better way to manage connection and proxy settings, and the related techniques are examined in this section.

Managing Connection Settings Through Group Policy

Connection settings for dial-up, broadband, and virtual private network (VPN) access can be managed through Group Policy. You can use Group Policy to deploy new configurations, to update existing configurations when you need to make changes, and to delete existing configurations and replace them with new ones. Local area network (LAN) settings for automatic detection and proxy servers are also imported with the connection configuration settings. The address for automatic configuration scripts is not imported, however. These settings are managed with the Automatic Browser Configuration policy.

Real World

Whenever you manage connection settings through Group Policy, you should create the necessary connections on a test system following the techniques discussed in Chapter 13, "Managing Mobile Networking and Remote Access," and then check the connections by dialing in to the network, connecting through broadband, or using VPN as necessary. Then import the settings into the Connection Settings policy from the test system. Be sure to import settings at the appropriate level in Group Policy. In most cases, you won't want to roll these settings out to the entire domain and instead will want to apply these settings only to the appropriate Microsoft Active Directory directory service organizational units.

To import connection settings into Group Policy, follow these steps:

1. | Log on to the system where you created the connection settings that you want to use.
2. | Access the Group Policy object you want to work with following the techniques discussed in the "Group Policy Essentials" section of Chapter 8, "Configuring User and Computer Policies," and then access User Configuration\Windows Settings\Internet Explorer Maintenance\Connection in Group Policy.
3. | Double-click Connection Settings in the right pane. This displays the Connection Settings dialog box.
4. | Select Import The Current Connection Settings From This Machine. To view or modify the settings that will be imported, click Modify Settings and then use the Connections tab of the Internet Properties dialog box to work with the settings as necessary. The options available are the same as those for the Connections tab of the Internet Properties dialog box. Note Existing connections with the same names as the imported connections are updated with the new settings, so you don't need to delete the existing settings to make these updates. You need to delete existing settings only if you are concerned that users or other administrators have created connections that might no longer be valid and you want to ensure they are removed to prevent connectivity problems.
5. | If you are replacing previously configured connections, you might want to specify that existing connections should be deleted. To do this, in the Connection Settings dialog box, select Delete Existing Dial-Up Connection Settings. Caution All previously configured connections are deleted if you elect to delete existing connection settings. This means that previous connections created by both administrators and users are permanently removed.
6. | Click OK.

Enabling and Configuring Proxy Settings

When you enable proxy settings, Internet Explorer acts as a Web proxy client. In this configuration, Internet Explorer requests can be directed to a proxy service to determine whether access to this protocol is allowed. If the protocol is allowed, the proxy server sends the request on behalf of the client and returns the results to the client securely. Because the proxy server uses network address translation (NAT) or a similar protocol, the actual Internet Protocol (IP) address of the client making the request isn't revealed to the target server. You can configure proxy servers for Hypertext Transfer Protocol (HTTP), Secure Sockets Layer (SSL), File Transfer Protocol (FTP), Gopher, and Socks (the Microsoft proxy service protocol).

You can manage settings for proxy servers in several different ways. One of those ways is to use the Local Area Network (LAN) Settings dialog box, which is accessible in the Internet Properties dialog box. On the Connections tab, click LAN Settings to access the dialog box. When you want to use Group Policy, the preferred technique is to configure standard proxy servers using the Proxy Settings policy. Using this policy, you can configure unique proxy servers for each Web service (HTTP, SSL, FTP, Gopher, and Socks) or you can use one or more proxy servers to handle all types of requests. You can also configure exceptions so that a proxy isn't used for specific servers, IP address ranges, and the local network.

To configure proxy settings through Group Policy, follow these steps:

1.
Access User Configuration\Windows Settings\Internet Explorer Maintenance\Connection in Group Policy and then double-click Proxy Settings in the right pane.

2.
In the Proxy Settings dialog box, shown in Figure 14-7, select Enable Proxy Settings.

Figure 14-7. If your organization has proxy servers, you can configure Internet Explorer proxy settings using the Proxy Settings policy.

[View full size image]

3.
Set the IP address for proxies using the text boxes on the Proxy Servers panel. You'll find two columns of text boxes:

  • Address Of Proxy Sets the IP address of the related proxy server or servers. Type the IP address for each service. If multiple proxies are configured for a particular service, type the IP addresses for each proxy server in the order in which you want the Web client to attempt to use them. Each address must be separated by a semicolon. If a proxy isn't configured for a service, don't fill in the related field.

  • Port Sets the port number on which the proxy server responds to requests. Most proxies respond to port 80 for all requests. That said, however, the standard ports are port 80 for HTTP, port 443 for SSL (listed as Secure), port 21 for FTP, port 70 for Gopher, and port 1081 for Socks. Check with your organization's Web administrator for the proper settings.

4.
The Use The Same Proxy Server For All Addresses check box is selected by default. This setting enables you to use the same IP address and port settings for the HTTP, SSL, FTP, Gopher, and Socks services. You have two options:

  • If your organization has proxy servers that handle all requests, select Use The Same Proxy Server For All Addresses and then type the IP address or addresses that you want to use as well as the port number on which the server or servers respond.

  • If you want to use a unique proxy server or servers for each type of service, clear the Use The Same Proxy Server For All Addresses check box and type the necessary IP addresses and port numbers in the text boxes provided.

5.
The Do Not Use Proxy Server For Local (Intranet) Addresses check box is selected by default. The default value is a good setting, in most cases, because you won't want to use a proxy for requests made to servers on the same network segment. However, this setting doesn't work well when your internal network uses multiple network segments. In this case, you'll need to specify the IP address range for each network segment on the exception list. An example is shown in Figure 14-7. Here you don't want a proxy to be used when accessing servers on the same network segments as the proxy servers, so you configure the IP addresses on these network segments as exceptions.

6.
If your network has multiple segments or if specific address ranges shouldn't be proxied when accessed, enter the appropriate IP addresses or IP address ranges in the Exceptions list. Each entry must be separated with a semicolon. The asterisk (*) character can be used as a wildcard character to specify an address range of 0 through 255, such as 192.*.*.*, 192.158.*.*, or 192.158.10.*.

7.
Click OK.

To ensure that proxy settings are applied uniformly to all users of a particular computer, you can set an additional policy that assigns proxy settings per machine rather than per user. When you enable this policy, proxy settings apply to all users of the same computer and users cannot set their own proxy settings. This prevents users from overriding the standard proxy settings for the organization. You can make proxy settings per machine by following these steps:

1. | Access Computer Configuration\Administrative Templates\Windows Components\Internet Explorer in Group Policy and then double-click Make Proxy Settings Per-Machine (Rather Than Per-User) in the right pane.
2. | Select Enabled and then click OK. The affected computer or computers need to be rebooted for this policy to be applied. Note If you disable or do not configure this policy, users of the same computer can set their own proxy settings. These settings might override those set through Group Policy.


Managing Browser Cookies and Other Temporary Internet Files

Whenever users browse the Web, many types of temporary Internet files are stored on their computers, including:

  • Standard temporary Internet files Copies of Web pages, images, and media from sites users have visited

  • Browser cookies Used to store information about preferences, log-ins, etc.

  • Browser history Lists of Web sites users have visited

  • Form data Saved information typed into forms

  • Passwords Passwords saved from users previously signing in to Web sites that use forms-based authentication

The most misunderstood temporary Internet file is the browser cookie. Browser cookies are used to store information on client computers so that it can be retrieved in other pages or in other browser sessions. Cookies are commonly used to store sign-in information for protected Web sites, user preferences, and shopping cart items. Internet Explorer browsers save cookies in domain-specific text files. Cookies are read from and written to cookie files as records. Fields in a cookie record detail the domain of the server that created the cookie, the name of the cookie, the string of data being stored in the cookie, the expiration date for the cookie, a Boolean value indicating whether you need a secure HTTP connection to access the cookie, and a path designator indicating the URL path(s) that can access the cookie.

You can manage browser cookies and other types of temporary Internet files using the Internet Properties dialog box. If users spend a lot of time on the Internet and you have disk space limitations, you might need to more closely manage the space used by temporary Internet files. Access the Internet Properties dialog box in Control Panel by clicking Network And Internet and then clicking Internet Options. Afterward, use the following procedures as necessary to recover and restrict disk space usage:

Clear out temporary Internet files

1. | On the General tab, click Delete under Browsing History.
2. | Delete individual types of temporary Internet files by clicking the related buttons. When prompted, click Yes to confirm the action.
3. | Click Delete All to delete all types of temporary Internet files. When prompted, select Also Delete Files And Settings Stored By Add-Ons to delete temporary files and settings created by browser add-ons. Click Yes to confirm the action.

Set disk space usage for temporary Internet files

1. | On the General tab, click Settings under Browsing History.
2. | Use the Disk Space To Use combo box to specify how much disk space can be used by temporary Internet files.
3. | By default, temporary Internet files are stored in a folder under %UserProfile%. If you want to move this folder to a drive with more space, click Move Folder and then use the Browse For Folder dialog box to select the new save location.
4. | Click OK twice.

Internet Explorer relies on a Web site's compact privacy policy to determine how the site uses cookies. The World Wide Web Consortium (W3C) has defined an official recommendation regarding Web privacy called the Platform for Privacy Preferences Project (P3P). P3P enables Web sites to report their privacy practices in a standard format that can be retrieved automatically and interpreted by user agents, such as Web browsers. User agents rely on what is reported in the compact privacy policy, and generally cannot determine whether cookies are used as reported.

You can use the Privacy tab of the Internet Properties dialog box to configure the way browser cookies are used. You can then use the Settings slider to specify how cookies should be used. Privacy settings available include: Block All Cookies, High, Medium High, Medium, Low, and Allow All Cookies. When you are using a privacy setting ranging from High to Low, you might want to make an exception for a site rather than raise or lower your privacy setting. To do this, click the Sites button on the Privacy tab. Type the address of the Web site in the field provided and then click Allow or Block as appropriate. If you click Allow, cookies for the site will then be accepted. If you click Block, cookies for the site will then be blocked. Keep in mind that you cannot make exceptions when you use the Block All Cookies or Allow All Cookies setting. With these settings, all cookies are always either blocked or allowedthere is no in between or exception.

The privacy setting options are used as follows:

  • Block All Cookies Blocks all new cookies and ensures any existing cookies cannot be read by Web sites. Many Web sites won't function properly if you use a setting of High or Block All Cookies. It is also important to point out that any sites you've configured as Allow exceptions are blocked as well. This means the Allow exception is ignored while this setting is selected.

  • High Blocks all cookies from sites that do not have a declared privacy policy indicating the source, purpose, and lifetime of cookies used by those particular sites. It also blocks all cookies with a declared privacy policy stating that those cookies gather information that could be used to contact you (such as your name, e-mail address, home address, and logon information) without your explicit consent.

    Note

    Browsers determine whether and how cookies gather personal information based on the site's declared compact privacy policy. Browsers rely on the policy itself and generally cannot determine whether personal information is collected as stated.

  • Medium High Blocks cookies from sites other than the one you are viewing (such as an advertiser who advertises at the current site) that do not have a declared privacy policy statement indicating the source, purpose, and lifetime of cookies used by that particular site. It also blocks cookies from other sites (such as advertisers) with a declared privacy policy stating that cookies gather personal identification information without your explicit consent. Further, it blocks cookies from the current site if there is a declared privacy policy statement that specifies that cookies gather information without implied consent.

    Note

    Implied consent is granted automatically. Basically, it means you haven't opted out or told the site you don't want personal information to be collected, so the information can be collected.

  • Medium The default privacy setting. Blocks cookies from sites other than the one you are viewing (such as an advertiser at the current site) that do not have a declared privacy policy indicating the source, purpose, and lifetime of cookies used by that particular site. It restricts cookies from the current site and blocks cookies from other sites (such as advertisers) that have a declared privacy policy stating that cookies gather personal identification information without implied consent.

  • Low Blocks cookies from sites other than the one you are viewing (such as an advertiser at the current site) that do not have a declared privacy policy indicating the source, purpose, and lifetime of cookies used by that particular site. It restricts cookies from other sites (such as advertisers) that have a declared privacy policy stating that cookies gather personal identification information without implied consent.

  • Accept All Cookies Accepts all new cookies and allows Web sites to read existing cookies. It is important to point out that any sites you've configured as Block exceptions are allowed as well, meaning the Block doesn't apply while this setting is used.


Secure Browsing and Local Machine Lockdown

To help make the operating system more secure, Internet Explorer security was revised greatly starting with Windows XP Service Pack 2, and these same changes are in Windows Vista. These security changes affect many areas of the browser and introduce several new features, including:

  • Browser Information Bar and general security

  • Add-On Manager

  • Pop-Up Blocker

The sections that follow examine each of these features.

Understanding Dynamic Security Protection, the Browser Information Bar, and Other Browser Security Enhancements

Dynamic Security Protection in Internet Explorer is a comprehensive safety and security framework designed to safeguard the integrity of your organization's computers while also helping to protect an individual's personal information. The main features of Dynamic Security Protection are Protected Mode, privacy reporting, and phishing filter.

Protected Mode isolates Internet Explorer from other applications running on the computer and restricts how adds-ons are used. Because of Protected Mode, add-ons can only write information to temporary Internet folders and must have explicit consent from the user to write to any other location. Additionally, preinstalled Microsoft ActiveX controls are disabled by default, and you can start Internet Explorer with all add-ons disabled if desired. To start Internet Explorer in Add-On Disabled mode, click Start, All Programs, Accessories, Internet Explorer (No Add-Ons), or right-click the Internet Explorer shortcut on the desktop and select Internet Explorer (No Add-Ons).

As part of the Protected Mode enhancements, the URL handler in Internet Explorer has been redesigned as well. The updated URL handler has a new parser, which protects the computer from possible URL parsing exploitations, such as URLs that attempt to run commands. This new parser also features international domain name anti-spoofing, which is designed to warn users if malicious individuals use the new international domain name support to create look-alike domain names.

Privacy reporting provides quick access to privacy information that includes whether cookies were restricted or blocked based on privacy settings; which Web sites have content on the page; and the accepted, restricted, or blocked status of cookies from those sites. In Internet Explorer, you can view a privacy report for the open page by clicking Page and then clicking Web Page Privacy Policy.

Phishing is a technique whereby a site attempts to collect personal information without a person's consent. Internet Explorer's phishing filter warns you about sites known to collect personal information without consent and also displays a warning when a site attempts to collect personal information without your consent. Related warning icons are displayed on the browser's status bar. With the status bar warnings, however, it is important to keep in mind that the warning doesn't necessarily mean a site conducts or is conducting phishing. Instead, it might only mean that the site isn't a large, well-known, commercial site.

The Phishing Filter is always on by default. In Internet Explorer, you can manage the phishing filter by clicking Tools and then clicking Phishing Filter. If you select Turn Off Automatic Website Checking, you can manually check sites if desired using the Check This Website option.

In Windows Vista, the Browser Information Bar is used in place of many of the common Internet Explorer dialog boxes and prompts. The information bar is designed to help users navigate the many security enhancements for pop-up windows, add-ons, and active content. When the information bar is displayed, it appears just below the address bar. Whenever this bar is displayed, you can click or right-click it to display a shortcut menu with additional options that allow you to enable or disable the related feature and perform other related tasks.

Table 14-1 provides a summary of the most common messages you'll see and the related options in the Internet Properties dialog box.

Table 14-1. Understanding Secure Browsing and Lockdown

Information Bar Message

Description

Action/Resolution

Active Content Blocked. To help protect your security, Internet Explorer has restricted this file from showing active content that could access your computer.

This message is displayed for any pages that contain scripts or other types of active content that access information on the local computer. Active Content is blocked by default to ensure malicious files can't be run by accident.

You can configure active content blocking by selecting or clearing Allow Active Content To Run In Files On My Computer on the Advanced tab of the Internet Properties dialog box. To allow only this particular page to execute active content, click the information bar. Active content on CD AutoRun pages can be controlled using Allow Active Content From CDs To Run On My Computer.

File Download Blocked. To help protect your security, Internet Explorer blocked this site from downloading files to your computer.

This message is displayed any time an automatic download or installation is prevented. Downloads are blocked by default to prevent sites from overwhelming users with download prompts and to help resolve problems with accidentally installing unwanted software.

You can configure automatic prompting through the Web zone security settings. On the Security tab of the Internet Properties dialog box, select a Web zone by clicking it and then clicking Custom Level. In the Security Settings dialog box, select the appropriate option for Automatic Prompting For File Downloads. To allow only the blocked file to download, right-click the information bar and select Download Software.

Pop-up Blocked. To see this pop-up or additional options, click here...

This message is displayed whenever a page contains a link that opens a new window or a script calls a method, such as window.open(), that opens a new window, and the Pop-up Blocker is in effect.

You can configure the blocking of pop-ups by selecting or clearing Block Pop-Ups on the Privacy tab of the Internet Properties dialog box. To configure pop-up blocking exceptions, click Settings on the Privacy tab and set a specific exception. You can also configure an exception for the current site by right-clicking the information bar and selecting Allow Pop-Ups For This Site.

Software Install Blocked. To help protect your security, Internet Explorer stopped this site from installing software on your computer.

As with drivers, digital signatures are checked before downloading and installing ActiveX controls and other executables. This message is displayed whenever you attempt to install an ActiveX control or other executable with a missing or invalid signature. In general, it is a good idea to block these downloads because they are typically from untrusted publishers and might also represent malicious or undesirable types of files, such as adware.

You can configure the blocking of executables by selecting or clearing Allow Software To Run Or Install Even If The Signature Is Invalid on the Advanced tab of the Internet Properties dialog box. To allow only this executable to install, right-click the information bar and select Install Software.

Software Blocked. Your security settings do not allow ActiveX controls to run on this page. This page might not display correctly.

This message is displayed if running of ActiveX controls and plug-ins is disabled or blocked by an administrator.

You can configure the way ActiveX controls and plug-ins run by setting Web zone security settings. On the Security tab of the Internet Properties dialog box, select a Web zone by clicking it and then clicking Custom Level. In the Security Settings dialog box, select the appropriate option for Run ActiveX Controls And Plug-Ins. To allow ActiveX controls and plug-ins only for the current site, right-click the Information Bar and select Allow This Site To Run ActiveX Controls.

Using the Add-On Manager for Internet Explorer

Internet Explorer functionality can be extended and enhanced through add-ons. Many types of add-ons are available, including the following:

  • Browser helper objects that add help dialog boxes and other help information

  • Browser extensions that add functionality or enhance browser features

  • Toolbar options that add menu items and buttons to the browser toolbar

  • ActiveX controls that provide additional functionality and allow execution of additional types of media such as Shockwave Flash files

As Figure 14-8 shows, these and other types of add-ons can be controlled through the Manage Add-Ons dialog box. To access this dialog box, access the Internet Properties dialog box and then click Manage Add-Ons on the Programs tab. You can then use the following options:

  • Enable add-ons To enable an add-on that has been disabled previously, select it and then click Enable. If the option is unavailable (dimmed), the Do Not Allow Users To Enable Or Disable Add-Ons policy might be enabled in Group Policy under User Configuration\Administrative Templates\Windows Components\Internet Explorer.

  • Disable add-ons To disable an add-on, select it and then click Disable. Internet Explorer Crash Detection enables users to disable add-ons that cause problems with the browser. You can control Crash Detection using the Turn Off Crash Detection policy under User Configuration\Administrative Templates\Windows Components\Internet Explorer.

  • Update add-ons If an ActiveX control is known to have an update available (as determined by Automatic Updates), you can select the add-on and click Update ActiveX to update the add-on.

    Real World

    Because Windows Vista includes a built-in pop-up blocker, pay particular attention to any browser add-ons that act as pop-up blockers. Many Internet service providers (ISPs), Earthlink included, provide pop-up blockers to their customers. Some firewall and antivirus software includes pop-up blockers as well. Running a third party pop-up blocker in addition to the Windows pop-up blocker can lead to results that can be very confusing. Typically, you'll want to use only the Windows pop-up blocker and disable any other pop-up blockers running on the computer. In most cases, you'll find the Windows pop-up blocker is more configurable than other pop-up blockers, and it's easier to work with as well.

Figure 14-8. ActiveX controls and other browser add-ons can be enabled, disabled, or updated using the Manage Add-Ons dialog box.

[View full size image]

Configuring the Pop-Up Blocker

Many Web pages contain pop-ups, which are subwindows typically displayed by a call to the window.open() method in a script. Some examples of how pop-ups are created include the following:

  • A hypertext link contains a command that opens a window when it is clicked.

  • A page element contains a command that opens a window when it finishes loading.

  • A script in a page opens a window after a function call.

Because many pop-ups are ads or are otherwise unwanted, Windows Vista includes the Pop-Up Blocker feature. By default, Windows Vista is configured to block most types of automatic pop-ups and display the Information Bar whenever pop-ups are blocked. A user could then right-click the Information Bar and select Allow Pop-Up to display the pop-up or right-click the Information Bar and select Allow All Pop-Ups For This Site to configure the site as an Allowed Site automatically, which unblocks (or allows) pop-ups from this site.

You can configure pop-up blocking by completing the following steps:

1.
Access the Internet Properties dialog box in Control Panel by clicking Network And Internet and then clicking Internet Options. Then select the Privacy tab.

2.
To disable pop-up blocking, clear Turn On Pop-Up Blocker and then click OK. Skip the remaining steps.

3.
To enable pop-up blocking, select Turn On Pop-Up Blocker and then click Settings. This displays the Pop-Up Blocker Settings dialog box, shown in Figure 14-9.

Figure 14-9. Use the Pop-Up Blocker Settings dialog box to configure the way pop-ups are blocked.

4.
To allow a site's pop-ups to be displayed, type the address of the site in the field provided, such as www.msn.com, and then click Add. This site is then permitted to use pop-ups regardless of Internet Explorer settings.

Tip

By default, Pop-Up Blocker is disabled for sites in the Local Intranet zone. That said, you still might want to configure exceptions for internal sites if these sites call the window.open() method in scripts or use similar methods to open windows. In this way, you ensure pop-ups for internal sites aren't blocked, regardless of the browser settings. You can also configure exceptions through the Pop-Up Allow List policy under User Configuration\Administrative Templates\Windows Components\Internet Explorer.

5.
To stop displaying an information message in the browser when pop-ups are blocked, clear Show Information Bar When A Pop-up Is Blocked.

6.
By default, most types of automatic pop-ups are blocked when the Pop-Up Blocker is enabled. You can use the following options of the Filter Level selection menu to control the types of pop-ups that are blocked:

  • High: Block All Pop-Ups (Ctrl+Alt To Override) Pop-up blocker attempts to block all pop-ups. If you click a link that would normally open a pop-up and you want to see the pop-up, press Ctrl+Alt while clicking to open the pop-up.

  • Medium: Block Most Automatic Pop-Ups Pop-up blocker attempts to block the types of pop-ups most commonly used to display ads or other unwanted content. Some types of new windows are allowed. Again, you can press Ctrl+Alt to override blocking while clicking a link.

  • Low: Allow Pop-Ups From Secure Sites With standard (HTTP) connections, Pop-Up Blocker attempts to block the types of pop-ups most commonly used to display ads or other unwanted content. However, Pop-Up Blocker allows pop-ups when you are accessing a site using a secure (HTTPS) connection.

7.
Click Close and then click OK.


Managing Internet Explorer Security Zones

Internet Explorer security zones play an important role in ensuring the security of Windows Vista systems. You can use security zones to restrict or permit access to specific types of Web content, including ActiveX controls and plug-ins, file and font downloads, Java applets, and scripts. You can also use security zones to control the types of actions users can perform while viewing Web content. For example, you can enable launching of programs within an internal browser frame, known as an IFRAME, but disable installation of desktop items.

Group Policy can be used to manage security zones in several ways. You can set policies that control the user actions with regard to security zones and customize the settings for each security zone. Before exploring how these procedures are implemented, let's look at what security zones are and how they are used.

Understanding Security Zones

Security zones are used to control Web content permissions for various content servers based on where they are located and what is known about them. Each security zone is assigned a default security level, which ranges from low to high. Low security means that most actions are permitted and the security restrictions are very relaxed. High security means that most actions are disabled and the security restrictions are very stringent. You can override the security level by assigning a new security level or setting a custom level. Either way, the security level consists of dozens of parameters that typically are enabled, disabled, or set to prompt a user before the related feature can be invoked. The security zones to which the parameters apply are as follows:

  • Restricted Sites Controls user access to Web content on sites that could potentially damage a computer or its data. Default security level is High.

    Security

    With Windows Vista, the Binary And Script Behaviors security setting is disabled by default in the Restricted Sites zone. This important security change is designed to prevent the execution of scripts and other components that encapsulate functionality for HTML elements. In other zones, Binary And Script Behaviors is enabled by default, which could allow the execution of malicious scripts.

  • Trusted Sites Controls user access to Web content on sites that are explicitly trusted and are considered to be free of content that could damage or harm the computer and its data. Default security level is a slightly modified version of Low, which allows downloading of unsigned ActiveX controls and sets Java permissions to Medium security.

  • Local Intranet Controls user access to Web content on the local network, which can include local (intranet) sites, sites bypassed by the proxy server, and all network paths, such as Universal Naming Conventions (UNCs). Default security level is Medium-Low.

  • Internet Controls users' access to Web content on all sites not placed in other zones. Default security level is Medium-High.

Obvious security risks result from the enabling of ActiveX controls, plug-ins, Java applets, scripts, and downloads. A not-so-obvious risk results from the Logon parameter, which determines whether user name and password information is sent automatically to content servers when a logon is needed. Of all the available parameters, Logon is the one that most people overlook. The key risk from the Logon parameter is that computers outside the network can gain access to logon names for your network and unauthorized external users could use the logon names to stage attacks on your system.

With the Logon parameter, all security levels except High present a potential security risk:

  • With High security, content servers prompt for a user name and password when a logon is needed, and information is never passed automatically.

  • With Medium-High, Medium, or Medium-Low security, the current user name and password are automatically returned for logon requests to resources in the Intranet zone. Unlike earlier versions of Windows, Windows Vista uses automatic intranet network detection by default so the current user name and password are only returned for resources on the intranet network. If Windows Vista is unable to detect the intranet network automatically, you may need to manually configure the intranet zone settings. In this case, intranet sites, network paths (UNCs), and sites bypassed by the proxy server could all be considered as being in the intranet zone. And it is the bypassed sites that are easy to forget when you're considering possible security issues. See the "Configuring the Local Intranet Zone" section in this chapter for more information.

  • With Low security, logon information is returned for logon requests from content servers in any zone. This is a dangerous setting when used with external content servers.

Controlling Security Zone Usage Through Group Policy

As you set out to better manage security zone usage, you might want to implement restrictions on who can change security zone settings and how settings are applied. Several policies control security zone modification and usage:

  • Security Zones: Use Only Machine Settings Enabling this policy sets security zone settings by machine rather than by user. The policy is intended to ensure that security zones are consistently applied to all users of a computer. Unfortunately, if you enable this policy without also preventing users from changing security zones, any user could make changes to security zones that affect all other users of the computer. This policy is located under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer.

  • Security Zones: Do Not Allow Users To Change Policies Enabling this policy prevents users from changing security zone settings. If you enable this policy, the Custom Level and Default Level buttons are disabled on the Security tab of the Internet Properties dialog box. This prevents users from changing the security zone settings established by the administrator. This policy is located under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer.

  • Security Zones: Do Not Allow Users To Add/Delete Sites Enabling this policy disables the Sites button on the Security tab of the Internet Properties dialog box. This prevents users from modifying the site management settings for the Local Intranet, Trusted Sites, and Restricted Sites zones, which means users cannot add sites, remove sites, or change the Include settings for the Local Intranet zone. This policy is located under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer.

  • Disable The Security Page Enabling this policy removes the Security tab in the Internet Properties dialog box. This prevents users from making any changes to security zones. This policy takes precedence and overrides Security Zones: Do Not Allow Users To Change Policies and Security Zones: Do Not Allow Users To Add/Delete Sites. This policy is located under User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel.

Enable one or more of these policies to enforce restrictions on changing security zone settings. Double-click the policy, select Enabled, and then click OK.

Windows Vista includes policies for locking down the local machine security zone. This special security zone applies only to the security of the local computer and is designed to prevent users from making changes that could materially affect the security of their computers. Any policies set under User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone are locked out in the local machine zone and set according to their policy configuration. Rather than setting each policy individually, you can use the Locked-Down Local Machine Zone Template policy under User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page to set the local machine zone security so that it is consistent with a specific security level.

Configuring Security Zones Through Group Policy

Through Group Policy, you can implement standard settings for each security zone and deploy these settings to users of one or more computers. Before doing this, you'll need to configure the security settings for each of the four security zones, starting with the Internet security zone. Once you configure the zones, you can import the settings into the Security Zones And Content Ratings policy by following this procedure:

1. | Configure each of the four security zones as discussed in this chapter. When you are finished, access User Configuration\Windows Settings\Internet Explorer Maintenance\Security in Group Policy and then double-click Security Zones And Content Ratings.
2. | Select Import The Current Security Zone Settings And Privacy Settings and then click Modify Settings. You can now check the security zone settings you defined previously.
3. | When you are finished, click OK twice to apply the policy.

Configuring the Internet Security Zone

The Internet security zone sets Web content permissions for all sites not placed in other zones. The default security level for the Internet Security zone is Medium-High. Follow these steps to configure the Internet security zone:

1. | Access the Internet Properties dialog box and then select the Security tab.
2. | Select Internet from the zone list.
3. | To restore the default level if it was changed, click Default Level. Then click OK and skip the remaining steps.
4. | To set a different or custom level, click Custom Level. You can use the Security Settings dialog box to set a custom level for individual parameters or reset the zone to a preset security level.
5. | If you want to use a custom level, use the buttons provided to set individual parameters and then click OK.
6. | If you want to reset the zone to a particular security level, select the level using the Reset To drop-down list, click Reset, and then click OK. The standard security levels that can be used for this zone are Medium, Medium-High, and High.

Configuring the Local Intranet Zone

The Local Intranet security zone sets Web content permissions on the local network. The default security level is Medium-Low. You can configure this zone by completing these steps:

1.
In the Internet Properties dialog box, click the Security tab and then click Local Intranet in the zone list. Set the security level as discussed in the "Configuring the Internet Security Zone" section earlier in this chapter.

2.
Next define which sites are included in the Local Intranet zone by clicking Sites. This displays the Local Intranet dialog box, shown in Figure 14-10.

Figure 14-10. If automatic detection doesn't work, optimize the Local Intranet settings for your environment by including or excluding various options.

3.
By default, Internet Explorer attempts to automatically detect whether the user is on the intranet network and if so, sets address checking appropriately. If Windows Vista is unable to detect the intranet network automatically, you may need to manually configure the intranet zone settings. To do this, clear Automatically Detect Intranet Network and then include or exclude local (intranet) sites not listed in other zones, sites that bypass the proxy server, and network paths (UNCs). To include a resource, select the related check box. To exclude a resource, clear the related check box.

4.
If you want to specify additional sites for the Local Intranet zone or require secure verification using Hypertext Transfer Protocol Secure (HTTPS) for all servers in the Local Intranet zone, click Advanced. This displays a new Local Intranet dialog box, in which you can do the following:

  • Add a site by typing its IP address in the Add This Web Site To The Zone text box and then clicking Add.

  • Remove previously defined sites by selecting the site in the Web Sites list box and then clicking Remove.

  • Require secure verification using HTTPS by selecting Require Server Verification (HTTPS:) For All Sites In This Zone.

5.
Click OK twice to close the Local Intranet dialog boxes.

Configuring the Trusted Sites Security Zone

The Trusted Sites security zone sets Web content permissions for sites that are explicitly trusted and are considered to be free of potentially offensive or unauthorized content and content that could damage or harm the computer. By default, the security level for this zone is set to Low. You can configure this zone by completing these steps:

1. | In the Internet Properties dialog box, click the Security tab and then click Trusted Sites in the zone list. Set the security level as discussed in the "Configuring the Internet Security Zone" section earlier in this chapter.
2. | Click Sites to define which sites are included in the Trusted Sites zone. This displays the Trusted Sites dialog box.
3. | You can now add and remove trusted sites from this zone. All Web sites in this zone will use the zone's security settings. To add a site, type its IP address in the Add This Web Site To The Zone text box and then click Add. To remove a site, select the site in the Web Sites list box and then click Remove.
4. | You can also require secure verification using HTTPS. Select Require Server Verification (HTTPS:) For All Sites In This Zone to enable this feature, or clear the related check box to disable this feature.
5. | Click OK.

Configuring the Restricted Sites Security Zone

The Restricted Sites security zone sets permissions for sites with potentially offensive or unauthorized content and content that could damage or harm the computer. By default, the security level for this zone is set to High. You can place sites on the restricted list by completing the following steps:

1. | In the Internet Properties dialog box, click the Security tab and then click Restricted Sites in the zone list. Set the security level as discussed in the "Configuring the Internet Security Zone" section earlier in this chapter.
2. | Click Sites to define which sites are included in the Restricted Sites zone. This displays the Restricted Sites dialog box.
3. | To add a restricted site, type its IP address in the Add This Web Site To The Zone text box and then click Add.
4. | To remove a site, select the site in the Web Sites list box and then click Remove.
5. | Click OK twice to close the Restricted Sites and Internet Properties dialog boxes. Note Site restrictions don't prevent users from accessing unauthorized sites; they merely establish a different security level for these sites. To prevent users from accessing restricted sites, you need to configure a proxy server or firewall.


Additional Policies That Might Be Useful for Managing Internet Options

You'll find many policies for managing Internet Options under User Configuration\Administrative Templates\Windows Components\Internet Explorer. Key policies are summarized in Table 14-2. As you'll see when you examine the table, many of these policies are useful in preventing users from performing specific actions in Internet Explorer and for controlling Internet Explorer behavior.

Table 14-2. Additional Policies for Managing Internet Explorer

Policy Node

Policy Name

Description

Disable Internet Connection Wizard

Prevents users from running the New Connection Wizard.

Disable Changing Connection Settings

Prevents users from changing dial-up settings.

Disable Changing Proxy Settings

Prevents users from changing proxy server settings.

Turn Off Pop-Up Management

Prevents users from configuring pop-up options and hides related dialog boxes. This means pop-up manager controls, notifications, and dialog boxes do not appear when this option is enabled.

Pop-Up Allow List

When enabled, permits administrators to specify a list of sites that are permitted to use pop-ups regardless of Internet Explorer settings. Enabling this option and adding internal sites to the list is useful if these sites call the window.open() method in JavaScript or use similar methods to open windows.

Turn Off Crash Detection

Crash detection allows the browser to track add-ons that cause problems with browser stability. The user can then elect to disable unstable add-ons. By enabling this option, you turn off this browser feature.

Turn On Menu Bar By Default

Controls the display of the classic menu bar. By enabling this option, you turn on the menu bar by default.

Turn Off Managing Pop-Up Filter Level

Controls whether users can change the pop-up filter levels. By enabling this option, you prevent users from changing the pop-up filter level.

Do Not Allow Users To Enable Or Disable Add-Ons

Add-on management allows users to control whether browser add-ons are enabled or disabled. By enabling this option, you disable add-on management and prevent users from configuring the related settings.

Browser Menus

Hide Favorites Menu

Removes the Favorites menu from Internet Explorer, preventing users from accessing lists of favorites.

Internet Control Panel

Disable The Connections Page

Removes the Connections tab in the Internet Properties dialog box, preventing users from changing connection settings, proxy settings, and automatic configuration settings. Also prevents users from accessing the New Connection Wizard.

Internet Control Panel

Disable The Security Page

Removes the Security tab in the Internet Properties dialog box, preventing users from changing security settings.

Internet Control Panel

Disable The Programs Page

Removes the Programs tab in the Internet Properties dialog box, preventing users from changing the default Internet programs.

Internet Control Panel

Disable The Advanced Page

Removes the Advanced tab in the Internet Properties dialog box, preventing users from enabling advanced features.

Internet Control Panel

Prevent Ignoring Certificate Errors

Prevents users from browsing a site with an expired, revoked, or mismatched name certificate.

Internet Control Panel\Advanced Page

Allow Software To Run Or Install Even If The Signature Is Invalid

By default, downloaded files and other executables are prevented from running and installing if they have invalid signatures. By enabling this policy, you override the default setting and allow files with invalid signatures to be installed.

Internet Control Panel\Advanced Page

Allow Active Content From CDs To Run On User Machines

By default, users see a prompt that allows them to continue or cancel the running of the active content from a CD. By enabling this policy, you override the default setting and allow active content from CDs to run without prompting.

Persistence Behavior

File Size Limits For

Allows you to set size limits for cached dynamic files from each of the security zones. You can set per domain and per document limits.

Toolbars

Configure Toolbar Buttons

Specifies which buttons are enabled on the standard toolbar in Internet Explorer. If you enable this policy, you can specify whether a particular button is displayed by default or hidden.

Note

An en dash () in the policy node column indicates the policy is under User Configuration\Administrative Templates\Windows Components\Internet Explorer. A named entry in this column means the policy is located in a subnode of User Configuration\Administrative Templates\Windows Components\Internet Explorer.

You can easily enable one or more of these policies by double-clicking the policy, selecting Enabled, and then clicking OK. In some cases, you'll need to specify additional parameters, such as a file size limit or whether a button is active or inactive.


Chapter 15. Optimizing Windows Vista

In this chapter:
Optimizing and Safeguarding Disk Drives | 471
Enhancing Computer Security | 485

Many different aspects of Microsoft Windows Vista can be optimized. In this chapter, I'll focus on improving drive performance, enhancing data security, and improving computer security. You can improve drive performance by cleaning up temporary files, checking for disk errors, and defragmenting disks. You can enhance security by encrypting disks and their contents. You can also improve security by using Security Center, Windows Firewall, and Windows Defender.

Many other optimization techniques were discussed in previous chapters. As discussed in the "The Advanced Tab" section of Chapter 2, "Managing Windows Vista Systems," you can improve the performance of the operating system by optimizing processor scheduling, appropriately configuring memory management, and removing graphics-intensive features from the menu system. You can also improve Windows Vista performance by reducing the number of operating system components, processes, and services running on the computer as discussed in the "Adding and Removing Windows Features" section of Chapter 5, "Installing and Maintaining Programs." When you remove unneeded system components, processes and services used by those services are also removed.

Applications running at startup can also use system resources. Startup applications that aren't required should be disabled or removed as discussed in the "Managing Startup and Running Programs with Software Explorer" section of Chapter 5. Removing or disabling unneeded startup applications can speed up startup and logon, and it can also free system memory so it can be used for other applications and operating system components.


Optimizing and Safeguarding Disk Drives

Windows Vista makes extensive use of disk drives during startup and normal operations. You can often dramatically improve operating system and application performance by optimizing a computer's disk drives. You should focus on disk space usage, disk errors, and disk fragmentation. You might also want to compress data to reduce the space used by data files, freeing up space for additional files.

Data security is also an important aspect to consider when optimizing disk drives. The organization's data should be protected and stored in the most secure form possible. With this in mind, you might want to consider converting file allocation table (FAT16 or FAT32) drives to NTFS file system (NTFS) as discussed in the "Converting a Volume to NTFS" section in Chapter 9, "Managing Disk Drives and File Systems." Such a conversion enables you to take advantage of the Windows Vista user and group security features and then encrypt drive data once you do this. Data encryption prevents unauthorized users from accessing important files.

Note

Disk maintenance tools, such as Disk Cleanup, Check Disk, and Disk Defragmenter, take advantage of new resource prioritization features in Windows Vista, as discussed in the "Understanding and Using Windows SuperFetch" section of Chapter 9. These changes enable these tools to run in the background and to take advantage of system idle time while running. As a result, users get a consistently good performance level even when background maintenance tasks are running.

Reducing Disk Space Usage

You should closely monitor disk space usage on all system drives. As drives begin to fill up, their performance and the performance of the operating system as a whole can be reduced, particularly if the system runs low on space for storing virtual memory or temporary files. One way to reduce disk space usage is to use the Disk Cleanup tool to remove unnecessary files and compress old files. For details on using this tool, see the "Working with Disk Cleanup" section in Chapter 2. To eliminate the need to remind users to run Disk Cleanup, you can schedule Disk Cleanup to run regularly as discussed in the "Scheduling Maintenance Tasks" section of Chapter 16, "Supporting and Troubleshooting Windows Vista."

Checking for Disk Errors

You should periodically use the Check Disk tool to check the integrity of disks. Check Disk examines disks and can correct many types of common errors on FAT16, FAT32, and NTFS drives. One of the ways Check Disk locates errors is by comparing the volume bitmap with the disk sectors assigned to files in the file system. Check Disk can't repair corrupted data within files that appear to be structurally intact, however. You can run Check Disk from the command line or through a graphical interface.

Running Check Disk from the Command Line

You can run Check Disk from an elevated command prompt or within other tools. At the elevated command prompt, you can test the integrity of drive C by typing the following command:

chkdsk C:

Check Disk then performs an analysis of the disk and returns a status message regarding any problems it encounters. Without specifying further options, Check Disk won't repair problems, however. To find and repair errors on drive C, use this command:

chkdsk /f C:

When you use this command, Check Disk performs an analysis of the disk and then repairs any errors found, provided that the disk isn't in use. If the disk is in use, Check Disk displays a prompt that asks whether you want to schedule the disk to be checked the next time you restart the system. Click Yes to schedule this check.

The complete syntax for Check Disk is as follows:

CHKDSK [volume[[path]filename]] [/F] [/V] [/R] [/X] [/I] [/C]
  [/L[:size]]

The options and switches for Check Disk are used as follows:

  • Volume Sets the volume to work with

  • filename (FAT16 and FAT32 only) Specifies files to check for fragmentation

  • /F Fixes errors on the disk

  • /V (FAT16 and FAT32) Displays the full path and name of every file on the disk (NTFS); displays cleanup messages if any

  • /R Locates bad sectors and recovers readable information (implies /F)

  • /L:size (NTFS only) Sets the log file size

  • /X Forces the volume to dismount first if necessary (implies /F)

  • /I (NTFS only) Performs a minimum check of index entries

  • /C (NTFS only) Skips checking of cycles within the folder structure

Running Check Disk Interactively

You can also run Check Disk interactively using Windows Explorer. To use Windows Explorer to check disk drives on the local computer, follow these steps:

1.
Click Start and then click Computer. Under Hard Disk Drives, right-click a drive and then select Properties.

2.
On the Tools tab, click Check Now. This displays the Check Disk dialog box, shown in Figure 15-1.

Figure 15-1. Check Disk is available by clicking Check Now in the Properties dialog box. Use it to check a disk for errors and repair them.

3.
To check for errors without repairing them, click Start without selecting either of the check boxes in the Check Disk dialog box.

4.
To check for errors and attempt to resolve them, select either or both of the following options and then click Start.

  • Automatically Fix File System Errors Determines whether Windows Vista repairs file system errors it finds

  • Scan For And Attempt Recovery Of Bad Sectors Determines whether Windows Vista checks for bad sectors and attempts to recover readable information from them

5.
If the disk is in use, Check Disk displays a prompt that asks whether you want to schedule the disk to be checked the next time you restart the system. Click Yes to schedule this check.

6.
When Check Disk finishes analyzing and repairing the disk, click OK.

Defragmenting Disks

Whenever you add files to or remove files from a drive, the data on the drive can become fragmented. When a drive is fragmented, large files can't be written to a single contiguous area on the disk, and the operating system often must write a single large file to several smaller areas on the disk. This can increase the write time as well as the read time for files. To reduce fragmentation, Windows Vista automatically defragments disks periodically using Disk Defragmenter. You can modify the automatic defragmentation schedule or defragment disks manually as discussed in the sections that follow.

Modifying or Cancelling Automated Defragmentation

By default, Windows Vista runs disk defragmenter automatically at 4:00 A.M. every Sunday. As long as the computer is on at the scheduled run time, automatic defragmentation will occur. You can cancel automated defragementation or modify the defragmentation schedule by following these steps:

1.
Click Start and then click Computer. Under Hard Disk Drives, right-click a drive and then select Properties.

2.
On the Tools tab, click Defragment Now. This displays the Disk Defragmenter dialog box, shown in Figure 15-2.

Figure 15-2. Disk Defragmenter analyzes and defragments disks efficiently. The more frequently data is updated on drives, the more often you should run this tool.

[View full size image]

3.
To cancel automated defragmentation, clear Run Automatically and then click OK twice. Skip the remaining steps.

4.
To modify the defragmentation schedule, click Modify Schedule. Use the Modify Schedule dialog box, shown in Figure 15-3, to set the desired run schedule.

Figure 15-3. Set the desired run schedule for automated defragmentation.

5.
Use the options provided to set the desired run schedule for automated defragmentation. The How Often selection list enables you to choose Daily, Weekly, or Monthly as the run schedule. If you choose a weekly or monthly run schedule, you'll need to set the run day of the week or month using the What Day selection list. Finally, the What Time selection list lets you set the time of the day that automated defragmentation should occur.

6.
Click OK twice to save your settings.

Performing Defragmentation Manually

You can manually defragment a disk by completing the following steps:

1. | Click Start and then click Computer. Under Hard Disk Drives, right-click a drive and then select Properties.
2. | On the Tools tab, click Defragment Now.
3. | In the Disk Defragmenter dialog box, click Defragment Now. Note Depending on the size of the disk, defragmentation can take several hours. You can click Cancel Defragmentation at any time to stop defragmentation.

Compressing Drives and Data

When you format a drive for NTFS, Windows Vista allows you to turn on the built-in compression feature. With compression, all files and folders stored on a drive are automatically compressed when created. Because this compression is transparent to users, compressed data can be accessed just like regular data can. The difference is that you can store more information on a compressed drive than you can on an uncompressed driveat a slight cost to performance, because compressing and decompressing data requires processing power and memory.

Note

You cannot compress encrypted data. If you try to do so, Windows Vista automatically decrypts the data and then compresses it. Likewise, if you try to encrypt compressed data, Windows Vista uncompresses the data and then encrypts it.

Compressing Drives

To compress a drive and all its contents, complete these steps:

1. | In Windows Explorer or Disk Management, right-click the drive that you want to compress and then select Properties.
2. | On the General tab, select Compress Drive To Save Disk Space and then click OK.
3. | When prompted, specify whether you want to compress only the root folder of the drive or the entire drive. To compress the drive's root folder only, select Apply Changes To Drive...Only. To compress the drive's root folder, subfolders, and files, select Apply Changes To Drive..., Subfolders And Files.
4. | Click OK.
Compressing Files and Folders

If you decide not to compress an entire drive, Windows Vista lets you selectively compress files and folders. To compress a file or folder, complete these steps:

1. | In Windows Explorer, right-click the file or folder that you want to compress and then select Properties.
2. | On the General tab of the related property dialog box, click Advanced. In the Advanced Attributes dialog box, select the Compress Contents To Save Disk Space check box.
3. | Click OK. For an individual file, Windows Vista marks the file as compressed and then compresses it. For a folder, Windows Vista marks the folder as compressed and then compresses all the files in it. If the folder contains subfolders, Windows Vista displays the Confirm Attribute Changes dialog box, which allows you to compress all the subfolders associated with the folder. Simply select Apply Changes To This Folder, Subfolders And Files and then click OK. Once you compress a folder, any new files added or copied to the folder are compressed automatically.

Note

If you move an uncompressed file from a different drive to a compressed folder, the file is compressed. However, if you move an uncompressed file to a compressed folder on the same NTFS drive, the file isn't compressed. Remember also that you can't encrypt compressed files.

Expanding Compressed Drives

You can remove compression from a drive as follows:

1. | In Windows Explorer or Disk Management, right-click the drive that contains the data that you want to expand and then select Properties.
2. | On the General tab, clear the Compress Drive To Save Disk Space check box and then click OK.

Tip

Windows always checks the available disk space before expanding compressed data, and you should, too. If there is less free space than used space available, you might not be able to successfully complete the expansion. For example, if a compressed drive uses 1 gigabyte (GB) of space and has 700 megabytes (MB) of free space available, there might not be enough free space to expand the drive. With regard to disk quotas, it is also important to point out that the full size of the data, rather than the compressed size, is tracked. This ensures there is room if needed to expand the data.

Expanding Compressed Files and Folders

If you decide that you want to expand a compressed file or folder, reverse the process by completing the following steps:

1. | Right-click the file or folder in Windows Explorer.
2. | On the General tab of the related property dialog box, click Advanced. The Advanced Attributes dialog box appears. Clear the Compress Contents To Save Disk Space check box and click OK.
3. | With a file, Windows Vista removes compression and expands the file. With a folder, Windows Vista expands all the files within the folder. If the folder contains subfolders, you'll also have the opportunity to remove compression from the subfolders. To do this, select Apply Changes To This Folder, Subfolders And Files when prompted and then click OK. Note Windows Vista also provides command-line tools for compressing and decompressing your data. The compression tool is called Compact (Compact.exe) and the decompression tool is called Expand (Expand.exe).

Managing BitLocker Drive Encryption

BitLocker Drive Encryption, a feature of the Enterprise and Ultimate Editions of Windows Vista, provides an additional layer of protection for your organization's computers. Regardless of whether you work in a large or small organization, you should consider using BitLocker Drive Encryption on any computer that stores sensitive information, as well as on your mobile PCs.

Introducing BitLocker Drive Encryption and Trusted Platform Module

BitLocker Drive Encryption protects computers from attackers who have physical access to a computer. BitLocker Drive Encryption uses Trusted Platform Module (TPM) to validate the integrity of the computer's boot manager and boot files at startup, and to guarantee that a computer's hard disk has not been tampered with while the operating system was offline. BitLocker Drive Encryption also stores measurement details pertaining to core operating system files in the TPM.

When a computer is started, Windows Vista validates the boot files, the operating system files, and any encrypted volumes to ensure they have not been modified while the computer is offline. If the files have been modified, Windows Vista alerts the user and refuses to release the key required to continue startup. The computer then goes into recovery mode and the user is prompted to provide a recovery key before allowing access to the boot volume. The recovery mode is also used if a disk drive is transferred to another system.

If BitLocker Drive Encryption is not enabled, an attacker could start the computer with a boot disk and then reset the administrator password to gain full control of the computer. Alternatively, the attacker could access the computer's hard disk directly with a different operating system to bypass file permissions. BitLocker Drive Encryption prevents this by entering recovery mode at startup if there are any offline changes to boot files, operating system files, or encrypted volumes. In this way, BitLocker Drive Encryption reduces the risk of an attacker using offline attacks to gain access to confidential data.

To use BitLocker Drive Encryption, a computer must be running Windows Vista Enterprise or Ultimate editions. BitLocker Drive Encryption can be used both on computers that have compatible TPM architecture and on computers that do not have compatible TPM architecture. If a computer has TPM Version 1.2, using BitLocker Drive Encryption requires that the computer must also:

  • Have a configured TPM

  • Have its disk drives configured appropriately for working with BitLocker Drive Encryption

  • Have BitLocker Drive Encryption enabled

Computers with a compatible TPM can use one of two TPM modes with BitLocker Drive Encryption:

  • Startup key Uses TPM and a startup key for validation. When the computer starts up, TPM is used to validate the boot files, the operating system files, and any encrypted volumes. The user must have a startup key to log on to the computer. The startup key can either be physical, such as a universal serial bus (USB) flash drive with a machine-readable key written to it, or personal, such as a personal identification number (PIN) entered by the user. If the user doesn't have the startup key or is unable to provide the correct startup key, BitLocker enters recovery mode. BitLocker also enters recovery mode if the TPM is missing or the integrity of boot files or encrypted volumes has changed.

  • TPM-only Uses only TPM for validation. When the computer starts up, TPM is used to validate the boot files, the operating system files, and any encrypted volumes. The user doesn't need to provide an additional startup key, so this mode is transparent to the user, and the user logon experience is unchanged. However, if the TPM is missing or the integrity of data has changed, BitLocker enters recovery mode and requires a recovery key or password to regain access to the boot volume.

If a computer doesn't have TPM Version 1.2 or later, using BitLocker Drive Encryption requires that the computer must also:

  • Have its disk drives configured appropriately for working with BitLocker Drive Encryption

  • Have BitLocker Drive Encryption enabled

Computers without a TPM or computers with TPMs that are incompatible with Windows Vista do not have the added security benefit of early boot file integrity validation. Here, BitLocker Drive Encryption uses USB Flash Drive Key mode, which requires a USB flash drive containing a startup key. The user inserts a USB flash drive in the computer before turning it on. The key stored on the flash drive unlocks the computer. If the user doesn't have the startup key or is unable to provide the correct startup key, BitLocker enters recovery mode. BitLocker also enters recovery mode if the integrity of encrypted volumes has changed. BitLocker doesn't attempt to validate the boot files. The sections that follow discuss working with Trusted Platform Modules and BitLocker Drive Encryption. Because most new business computers that are shipped with Windows Vista Enterprise or Ultimate should have appropriately configured TPMs and drives, the only step that administrators typically must perform is enabling BitLocker Drive Encryption.

Working with Trusted Platform Modules

Before you can use TPM, the TPM must be initialized for first use and turned on. You'll find that most business computers that have a TPM are shipped with that TPM initialized and turned on. That said, if for some reason, a TPM isn't ready for use on a computer equipped with a TPM, you can use the Trusted Platform Module Management console to initialize and turn on the TPM. To start the Trusted Platform Module Management console, follow these steps:

1. | Click Start, click All Programs, Accessories, and then Run.
2. | Type tpm.msc in the Open box and then click Enter.
3. | Manage the computer's TPM configuration using the commands listed under Actions.

In addition to using this console to initialize and turn on TPM, you can use this console to perform the following tasks:

  • Turn off the TPM as might be necessary if you don't want to use TPM.

  • Cancel TPM ownership and shut down the TPM such as might be necessary when you are recycling a computer.

  • Change the owner password associated with the TPM such as might be necessary if you suspect the TPM owner password has been compromised.

Working with BitLocker Drive Encryption

Before a computer can use BitLocker Drive Encryption, a BitLocker Drive Encryption partition must be created on the computer's hard drives. If a computer isn't shipped with this partition, it can be created before or after installation of the operating system. (See http://www.microsoft.com/technet/itsolutions/msit/security/bde_note.mspx for details and ensure that you test first before trying the Microsoft procedure on production computers.) The next step to configure a computer to use BitLocker Drive Encryption is to enable the feature in the operating system:

1.
Log on to the computer as an administrator. Click Start, Control Panel, Security, and then BitLocker Drive Encryption.

2.
For the system volume, click Turn On BitLocker. This starts the Turn On BitLocker Drive Encryption Wizard. After you read the welcome message, click Next.

3.
On the Save The Recovery Key As A Password page, the BitLocker Drive Encryption Wizard provides options for you to display, print, or save the 48-digit recovery password.

Tip

Store the recovery password in a secure location. You will need the recovery password to unlock the secured data on the volume if BitLocker Drive Encryption enters a locked state. Each recovery password is unique to a particular BitLocker encryption. You cannot use it to recover encrypted data from any other BitLocker encryption session.

4.
Click Print The Password to print the password. Be sure to store the printed password in a secure location.

5.
Click Save The Password. In the Save BitLocker Drive Encryption Password As dialog box, type a file name for the password and then click Save. The password is saved by default in the Documents folder in your user profile.

6.
Click Next. The Save The Recovery Key On A USB Device page is displayed. If you want to save the recovery password to a USB memory device, insert the device and select the corresponding drive in the list provided. Then click Save Key.

7.
Click Next. The Save The Recovery Key To A Folder page is displayed. If you want to save the recovery password to a folder on another computer or a network share, click Save and then use the Browse For Folder dialog box to select the save location.

8.
Click Next. If you are on a TPM-equipped computer, the Create A PIN For Added Security page gives you the option of creating a PIN for added security. If desired, enter and confirm a PIN and then click Set PIN. The PIN will then be required to start the computer. Click Next.

9.
On the Create A Startup Key For Added Security page, you have the option of creating a startup key. When using a startup key, keep the following in mind:

  • On a TPM-equipped computer, creating a startup key is optional. If you want to require a startup key to boot the computer, insert a USB memory device and select the corresponding drive in the list provided. Then click Save Key.

  • On a computer without TPM, creating a startup key is required. Insert a USB memory device and select the corresponding drive in the list provided. Then click Save Key.

Note

The startup key is different from the recovery key. Every user of a particular computer will need the startup key to start the computer. On the other hand, the recovery key is required only to unlock the computer if BitLocker enters recovery mode, such as would happen if BitLocker suspects the computer has been tampered with while offline.

10.
Click Next. On the Encrypt The Selected Disk Volume page, click Encrypt to encrypt the selected disk volume. An Encryption In Progress status bar is displayed. You can monitor the ongoing completion status of the disk volume encryption by moving the pointer over the BitLocker Drive Encryption icon in the toolbar at the bottom of your screen. Volume encryption takes approximately one minute per gigabyte to complete.

When the encryption process is complete, you have encrypted the entire volume and created a recovery key unique to this volume. If you created a PIN or startup key, this key will be required to start the computer.

Recovering Volumes Protected by BitLocker Drive Encryption

If you've configured BitLocker Drive Encryption and the computer enters recovery mode, you will need to unlock the computer using a startup or recovery key stored on a USB memory drive. Follow these steps to unlock the computer:

1. | Turn on the computer. Because the computer is in BitLocker Recovery mode, the computer starts the BitLocker Drive Encryption Recovery Console when you start the computer.
2. | When you are prompted, insert the portable USB memory drive that contains the startup or recovery key and then press Enter.
3. | The computer will unlock and reboot automatically. You will not need to enter the recovery key manually.

To unlock the computer by typing the required recovery key, follow these steps:

1. | Turn on the computer. Because the computer is in BitLocker Recovery mode, the computer starts the BitLocker Drive Encryption Recovery Console when you start the computer.
2. | Type the recovery password and press Enter.
3. | The computer will unlock and reboot automatically.

In some cases, the computer might become locked. For example, if you tried to enter the recovery key but were unsuccessful, you can press Esc twice to exit the recovery prompt and turn off your computer. You can then turn on the computer and try to unlock it again using the correct startup or recovery key.

A computer might also become locked if an error related to TPM occurs or if a boot file is modified. In this case, the computer halts very early in the boot process, before the operating system starts. Because the locked computer cannot accept standard keyboard numbers at this point, you must use the function keys to enter the recovery key password. In this case, the function keys F1F9 represent the digits 1 through 9, and the F10 function key represents 0.

Managing the Encrypting File System

File encryption allows users to store data in encrypted format, which is more secure than standard file access permissions. By default, the person who encrypted the file is the only one who can read files in encrypted format. Before other users can read an encrypted file, the user must decrypt the file or grant special access. Otherwise, encrypted files can be copied, moved, and renamed just like any other filesand these actions, in most cases, don't affect the encryption of the data. However, if you move an encrypted file to a device formatted using FAT, the file is decrypted automatically.

The process that handles encryption and decryption is called the Encrypting File System (EFS). The default setup for EFS allows users to encrypt files without special permission. Files are encrypted using a public/private key that is automatically generated by EFS on a per-user basis.

Tip

By default, the encryption algorithm used is Advanced Encryption Standard 128-bit Cyclical Bit Check (AES-128-CBC). For stricter security, Windows Vista supports the Triple DES encryption algorithm (Transport Layer Security [TLS] traffic encryption, RSA public key algorithm for TLS key exchange and authentication, and SHA-1 hashing for any TLS hashing requirements). You can use Triple DES encryption by enabling the System Cryptography: Use the FIPS Compliant Algorithms For Encryption policy in Group Policy. This policy is under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. Regardless of the encryption algorithm you choose, administrators designated as recovery agents can decrypt files if necessary. If you enable Triple DES encryption, Internet Explorer also uses only TLS for Secure Sockets Layer (SSL), which not all Web sites support.

Encrypting Files and Folders

With NTFS volumes, Windows Vista enables you to select files and folders for encryption. When you encrypt a file, the file data is converted to an encrypted format that only the person who encrypted the file can read. Users can only encrypt files if they have the proper access permissions. When you encrypt folders, they are marked as encrypted, but actually only the files within them are encrypted. All files that are created in or added to a folder marked as encrypted are encrypted automatically.

You can't encrypt compressed files, system files, or read-only files. If you try to encrypt compressed files, they are automatically uncompressed and then encrypted. If you try to encrypt system files, you'll get an error message.

To encrypt a file or folder, complete the following steps:

1. | Right-click the file or folder that you want to encrypt and then select Properties.
2. | On the General tab of the related property dialog box, click Advanced. The Advanced Attributes dialog box appears. Select the Encrypt Contents To Secure Data check box.
3. | Click OK.

For an individual file, Windows Vista marks the file as encrypted and then encrypts it. For a folder, Windows Vista marks the folder as encrypted and then encrypts all the files in it. If the folder contains subfolders, Windows Vista displays the Confirm Attribute Changes dialog box, which allows you to encrypt all the subfolders associated with the folder. Simply select Apply Changes To This Folder, Subfolders And Files, and then click OK.

Note

On NTFS volumes, files remain encrypted even when they're moved, copied, and renamed. If you copy or move an encrypted file to a FAT16 or FAT32 drive, the file is automatically decrypted before being copied or moved. Thus, you must have proper permissions to copy or move the file.

Sharing Decrypted Files

By default, encrypted files can be viewed only by the file owner. If you want other users to be able to access an encrypted file, you must either decrypt the file or grant the users special access to the file by completing the following procedure:

1. | Right-click the file or folder in Windows Explorer and then select Properties.
2. | On the General tab of the related property dialog box, click Advanced. The Advanced Attributes dialog box appears.
3. | Click Details. The Encryption Details For dialog box appears. Users who have access to the encrypted file are listed by name.
4. | To allow another user access the file, click Add.
5. | If a user certificate is available for the user to whom you are granting access, select the user's name in the list provided and then click OK. Otherwise, click Find User to locate the certificate for the user.
Decrypting Files and Folders

If you decide later that you want to decrypt a file or folder, reverse the process by completing the following steps:

1. | Right-click the file or folder in Windows Explorer and then select Properties.
2. | On the General tab of the related property dialog box, click Advanced. The Advanced Attributes dialog box appears. Clear the Encrypt Contents To Secure Data check box and click OK twice.

With a file, Windows Vista decrypts the file and restores it to its original format. With a folder, Windows Vista decrypts all the files within the folder. If the folder contains subfolders, you'll also have the opportunity to remove encryption from the subfolders. To do this, select Apply Changes To This Folder, Subfolders And Files when prompted and then click OK.

Tip

Windows Vista also provides a command-line tool called Cipher (Cipher.exe) for encrypting and decrypting your data. Typing CIPHER at the command line by itself shows you the encryption status of all folders and files in the current folder.


Enhancing Computer Security

Security settings are critically important for maintaining the integrity of Windows Vista computers. Computers with weak or improperly configured security are open to a wide variety of attacks whenever they connect to a network. To make it easy to manage and determine the status of various security features, Windows Vista includes Windows Security Center. This central security management console provides an overview of the current security configuration and provides quick access to security features including Windows Firewall, Windows Update, and Windows Defender.

Using Windows Security Center

Windows Security Center, shown in Figure 15-4, is meant to be a central location for checking the most important aspects of system security. Through Security Center, you can quickly determine the status of any of these important security features and get recommendations for how these features should be configured. If the computer might be at risk due to poor security configuration, you can access Windows Security Center by clicking the Windows Security Center icon (the red shield with an x) in the notification area of the system tray. Otherwise, you can access Windows Security Center by clicking Start and then clicking Control Panel. In Control Panel, click Security and then click Security Center.

Figure 15-4. Windows Security Center provides a quick overview of the status of essential areas of security.

[View full size image]

In Windows Security Center, the core set of security tools available is the same for both workgroups and domains. However, the default way in which Windows Security Center works changes depending on whether the computer is a member of a workgroup or a domain. In a workgroup, individual users can manage the security settings, and Windows Security Center reports the current status of security features. In a domain setting, the core functionality of Windows Security Center itself is turned off by default. As a result, Windows Security Center doesn't report the current status of security features and can only be used to access the core security tools, by using the links provided on the left panel. In a workgroup where individual users can manage the security settings, Windows Security Center reports the current status of security features by default and also enables users to manage these features.

Tip

In a domain, you can allow users to manage and view the current status of security features by enabling the Turn On Security Center policy under Computer Configuration\Administrative Templates\Windows Components\Security Center. This policy is disabled by default. If you enable this policy and it was previously disabled, you will be able to access Windows Security Center only after you restart the computer. The Turn On Security Center policy does not apply to computers in workgroups. Windows Security Center cannot be turned off for computers in workgroups.

Windows Security Center options help you manage and track the status of the following security features:

  • Firewall Shows the status of the computer's firewall. A firewall helps protect the computer against network-based attacks and other security threats from remote systems. Both Windows Firewall and Advanced Windows Firewall are installed with the operating system and turned on for all connections by default. See the "Managing Windows Firewalls" section in this chapter for more information.

    • If the Windows Firewall is turned off and you want to turn it on, expand the Firewall entry by clicking the button to the right of the Off designator and then click Turn On Now. When initially enabled, Windows Firewall uses the default state, in which inbound connections that do not have an exception are blocked automatically.

    • If you've installed a firewall that Windows Vista doesn't detect, you can tell Security Center that you'll monitor the firewall status yourself. Expand the Firewall entry by clicking the button to the right of the Off designator and then clicking Show Me Other Available Options. In the Recommendation dialog box, select I Have A Firewall Solution That I'll Monitor Myself. The status of Firewall will change to Not Monitored.

    • If multiple firewalls are enabled and Windows Vista detects this, you'll see a warning prompt specifying that to ensure programs operate properly, only one firewall should be configured. In this case, you should disable all but one of the firewalls.

  • Automatic Updating Shows the status of automatic updating. If automatic updating is off and you want to turn it on, expand the Automatic Updating entry by clicking the button to the right of the Off designator and then clicking Turn On Now. This turns on Windows Update and uses the default (recommended) mode, in which updates for the operating system are downloaded and installed automatically. See the "Configuring Automatic Updating" section in this chapter for more information.

  • Malware Protection Malware protection software helps safeguard a computer from viruses, spyware, and other similar types of malicious programs. The two most commonly used types of malware protection software are antivirus software and anti-spyware software.

    • Windows Vista does not include antivirus software. You'll need to use a third party solution. If antivirus software is not found or is in an unknown state, you'll see a Check Settings warning. When you expand the Malware Protection entry using the button provided, you'll be able to find antivirus software to install over the Internet by clicking Find A Program. If you don't want Windows Vista to monitor the status of antivirus software, click Show Me Other Available Options and then select the I Have An Antivirus Program That I'll Monitor Myself.

    • Windows Vista includes Windows Defender to provide anti-spyware protection. If Windows Defender is turned off and you want to turn it on, expand the Malware Protection entry by clicking the button to the right of the Check Settings warning and then clicking Turn On Now. This uses the default configuration as discussed in the "Managing Windows Defender" section in this chapter. If you've installed anti-spyware software that you want to use instead of Windows Defender, you can tell Security Center that you'll monitor the anti-spyware software status yourself. Click Show Me Other Available Options. In the Recommendation dialog box, select I Have An Antispyware Program That I'll Monitor Myself. The status of Antispyware will change to Not Monitored.

    Tip

    By default, Windows Security Center is configured to alert the currently logged on user if the firewall, malware protection, or Automatic Updates settings are not properly configured. The alerts are displayed in a balloon message box stating Your Computer Might Be At Risk. To view or configure the alerts, access the Windows Security Center and click Change The Way Security Center Alerts Me in the left pane. You can then use the dialog box provided to change the way notification works.

  • Other Security Settings Shows the overall status of Internet security settings and User Account Control (UAC). You'll see a warning if Internet security settings are set below their recommended levels or if user accounts are configured in a way that increases risk. The recommendations offered depend on the settings that put the computer at risk.

In the left panel of Windows Security Center, you'll find several helpful links, including:

  • Windows Update Opens the Windows Update utility in Control Panel.

  • Window Defender Opens Windows Defender if this feature is turned on. If Windows Defender is turned off, you'll be prompted to turn on Windows Defender. Click Turn On And Open Windows Defender and then Windows Vista will open Windows Defender.

  • Windows Firewall Opens Windows Firewall.

  • Internet Options Opens the Internet Properties dialog box with the Security tab selected.

Managing Windows Firewalls

Windows Firewall is installed and enabled by default on all computers running Windows Vista. Two versions of this Firewall Settings are included:

  • Windows Firewall The basic version of Windows Firewall protects the computer by preventing unauthorized users from gaining access. It does this by blocking inbound access to Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports on the computer and disallowing most types of Internet Control Message Protocol (ICMP) requests.

  • Windows Firewall With Advanced Security The advanced version of Windows Firewall protects the computer from unauthorized access and unauthorized use, and it also provides secure authentication. It does this by blocking both inbound and outbound connections, disallowing most types of ICMP requests, and ensuring connections can be authenticated using standard security protocols.

Both firewalls are used together. On a computer that uses Windows Firewall, Windows Firewall provides the protection baseline, and Windows Firewall With Advanced Security extends and enhances this basic protection baseline. Additionally, under Windows Vista, each network category has a different firewall profile. This means there is a domain profile, a private profile, and a public profile. When working with Windows Firewall, the profile for the current network category (based on the current connection) is the only one you can view and configure. When working with Windows Firewall With Advanced Security, you can view and manage each firewall profile separately.

Configuring Windows Firewall

Windows Firewall is automatically enabled for all network connections on a computer. This means all modem, network cable, wireless network, and IEEE 1394 (FireWire) connections are automatically protected by the firewall. The sections that follow discuss techniques for configuring Windows Firewall, including:

  • Enabling and disabling Windows Firewall

  • Configuring exceptions for programs

  • Configuring exceptions for TCP and UDP ports as well as services

  • Restoring the original Windows Firewall configuration

Real World

For computers that are part of a domain, you'll find several important policies for configuring Windows Firewall under Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall. If Windows Firewall: Allow Authenticated IPSec Bypass is enabled, any authenticated Internet Protocol Security (IPSec) connection to a computer completely bypasses the Windows Firewall, and you can set specific exemptions (exclusions) for computers, users, and groups. Use the policies under Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile to configure the way Windows Firewall is used when a computer is connected to a Microsoft Active Directory directory service domain. Use the policies under Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Standard Profile to configure the way Windows Firewall is used when a computer is disconnected from an Active Directory domain, such as when a laptop user takes his computer home.

Enabling and Disabling Windows Firewall

You can enable or disable Windows Firewall in one of two ways: either completely or on a per-connection basis. To enable or disable the firewall completely, click Windows Firewall in Windows Security Center and then click Change Settings. This displays the Windows Firewall Settings dialog box, shown in Figure 15-5. You can now:

  • Select On to enable Windows Firewall and set it to block all outside connections to the computer, with the exception of the exclusions lists on the Exceptions tab and any inbound ICMP requests allowed on the Advanced tab. In this configuration, Windows Firewall uses Security Alerts to notify you of any programs it is blocking, and you can determine whether to keep blocking the program, unblock the program, or have it prompt you later.

  • Select On and choose Block All Incoming Connections to enable Windows Firewall, set it to block all outside connections to the computer, and specify that no exceptions from the Exceptions tab should apply. This configuration is best for laptop computers when they are off the corporate network. In this configuration, Windows Firewall will not alert the user when it is blocking programs. Further, it should be noted that any inbound ICMP requests allowed on the Advanced tab are still allowed and are not blocked.

  • Select Off to completely disable Windows Firewall. In this configuration, Windows Firewall is disabled for all connections and the computer is more vulnerable to attack.

Figure 15-5. Use the General tab to completely enable or disable Windows Firewall.

To enable or disable Windows Firewall on a per-connection basis, follow these steps:

1. | Click Windows Firewall in Windows Security Center. Note the network category you are configuring and then click Change Settings. In the Windows Firewall dialog box, ensure that On is selected on the General tab and then select the Advanced tab.
2. | Each network connection configured on the computer is listed in the Network Connection Settings panel. Clear the check box for a connection to disable Windows Firewall for that connection. Select the check box for a connection to enable Windows Firewall for that connection.
3. | Click OK when you are finished.
Configuring Firewall Exceptions for Programs

In a domain, Core Networking is the only allowed exception on a computer by default. If you've allowed network discovery, configured sharing, or other features, these features may be configured as allowed exceptions as well. You can make exceptions for other programs and services as well using the Exceptions tab of the Windows Firewall dialog box.

As Figure 15-6 shows, standard exceptions can be easily allowed or disallowed. To allow an exception, select the related check box. To disallow an exception, clear the related check box. If you have a question about the purpose of an exception, click it and then click Properties to see a detailed description of the service or feature.

Figure 15-6. Use the Exceptions tab to allow some types of remote connections.

You can add programs as exceptions if other computers need to remotely communicate with a program or connect to the computer over a specific port. To configure programs as exceptions, complete the following steps:

1.
Click Windows Firewall in Windows Security Center. Note the network category you are configuring and then click Change Settings. This displays the Windows Firewall dialog box.

2.
In the Windows Firewall dialog box, select the Exceptions tab and then click Add Program.

3.
In the Add A Program dialog box, select the program in the Programs list or click Browse to use the Browse dialog box to find the program.

4.
By default, any computer, including those on the Internet, can access this program remotely. To restrict access further, click Change Scope. You can then select:

  • Any Computer (Including Those On The Internet) to allow any computer to remotely communicate with this program

  • My Network (Subnet) Only to allow only computers on the same subnet as this computer to remotely communicate with this program

  • Custom List to enter a comma-separated list of Internet Protocol (IP) addresses that can remotely communicate with this program

5.
Click OK three times to close all open dialog boxes.

Configuring Firewall Exceptions for TCP and UDP Ports

TCP and UDP ports can be opened for remote access to a computer by configuring the appropriate port as an exception. If you know which port you want to open, complete the following steps to designate it as an exception:

1. | Click Windows Firewall in Windows Security Center. Note which network category you are configuring and then click Change Settings. This displays the Windows Firewall dialog box.
2. | In the Windows Firewall dialog box, select the Exceptions tab and then click Add Port.
3. | In the Name field of the Add A Port dialog box, type a descriptive name for the port and then type a port number, such as 80, in the Port Number field.
4. | Select whether you are making an exception for a TCP or UDP port by choosing the appropriate radio button.
5. | By default, any computer, including those on the Internet, can access this program remotely. To restrict access further, click Change Scope, make a different selection, and then click OK.
6. | Click OK two times to close all open dialog boxes.
Restoring the Original Windows Firewall Configuration

If you are unsure of the state of Windows Firewall and its configuration, it is sometimes better to restore the original Windows Firewall configuration and then modify the configuration as necessary afterward. In this way, you start with a known secure configuration of the firewall and then make changes as necessary for the computer. You can restore the Windows Firewall settings by completing the following steps:

1. | Click Windows Firewall in Windows Security Center. Note which network category you are configuring and then click Change Settings. This displays the Windows Firewall dialog box.
2. | In the Windows Firewall dialog box, select the Advanced tab.
3. | Click the Restore Defaults button. When prompted to confirm the action, click Yes.
4. | Once the configuration is restored, click OK.
Configuring Windows Firewall With Advanced Security

Windows Firewall With Advanced Security extends the features found in Windows Firewall. These extensions allow you to perform the following tasks:

  • Create and manage separate firewall profiles for domain networks, private networks, and public networks.

  • Configure both inbound and outbound exceptions.

  • Use both firewall filtering and IPSec.

The sections that follow discuss how to manage a computer's firewall configuration using Windows Firewall With Advanced Security.

Using Windows Firewall With Advanced Security

You can work with Windows Firewall With Advanced Security, shown in Figure 15-7, in several different ways. You can use:

  • Group Policy For Group Policybased configurations, you can use the policy settings under Computer Configuration/Windows Settings/Security Settings/Windows Firewall With Advanced Security. Computers running Windows XP with Service Pack 2 (SP2) or Windows Server 2003 with Service Pack 1 (SP1) will ignore the Group Policy settings for Windows Firewall With Advanced Security. The advantage of using Group Policy is that the configuration applies to all computers that process the related Group Policy Object (GPO).

  • A preconfigured management console The preconfigured tool can be found on the Administrative Tools menu. Click Start, All Programs, Administrative Tools, and then Windows Firewall With Advanced Security. If the Administrative Tools menu isn't accessible, you can access the preconfigured tool by clicking Start and then clicking Control Panel. In Control Panel, click System And Maintenance, Administrative Tools. Then scroll down and click Windows Firewall With Advanced Security. The disadvantage of using the preconfigured tool is that you can only manage firewall settings for the local computer.

  • An MMC snap-in You can add the snap-in to any updateable Microsoft Management Console (MMC) by following these steps:

    1. In an updateable MMC, click File, select Add/Remove Snap-In, and then double-click Windows Firewall With Advanced Security.

    2. When you are prompted to select a computer to work with, select either Local Computer or Another Computer. If you select Another Computer, type the name or IP address of the computer with which you want to work.

    3. Click Finish and then click OK.

    The advantage of using the snap-in is that you can use it to configure firewall settings on remote computers without having to use a remote desktop connection.

  • Command-line For command-line configuration, you can use the commands in the netsh advfirewall context to configure all basic and advanced firewall settings. This context is not available for computers running Windows XP with SP2 or Windows Server 2003 with SP1.

Figure 15-7. Use Windows Firewall With Advanced Security to configure advanced firewall settings.

[View full size image]

With Windows Vista, each network category has a different firewall profile. When you select the Windows Firewall With Advanced Security node in the console tree, you'll see an overview of the current state of the firewall for each profile. You'll also find links to information for working with this tool under Getting Started and Resources. The other nodes in the console tree are as follows:

  • Inbound Rules Lists the rules for incoming traffic and provides a summary overview of how those rules are configured. Inbound rules either explicitly allow or explicitly block incoming traffic that matches the rule criteria.

  • Outbound Rules Lists the rules for outgoing traffic and provides a summary overview of how those rules are configured. Outbound rules either explicitly allow or explicitly block outgoing traffic that matches the rule criteria.

  • Connection Security Rules Lists the rules for protected traffic and provides a summary overview of how those rules are configured.

  • Monitoring Provides a summary of each firewall profile. By default, the panel for the active (current) profile is expanded and the profile name is modified to include the text "is Active."

Configuring Windows Firewall With Advanced Security requires much more fore-thought and planning than configuring the basic firewall. When you configure Windows Firewall With Advanced Security, you'll need to set firewall profile properties, specify any necessary inbound or outbound exceptions, and define any necessary connection security rules. Each of these tasks is discussed in the sections that follow.

Configuring Firewall Profile Properties

When working with Windows Firewall With Advanced Security, you can view and manage each firewall profile separately. The Domain Profile is used when the firewall is enabled and the computer is connected to a network with a domain. The Private Profile is used when the firewall is enabled and the computer is connected to a private network. The Public Profile is used when the firewall is enabled and the computer is connected to a public network.

Each profile has separate settings for the firewall state, blocking or allowing of connections, notification and response behavior, and logging. You can configure profile settings by following these steps:

1.
In Windows Firewall With Advanced Security, select the Windows Firewall With Advanced Security node.

2.
Scroll down in the main pane and then click Windows Firewall Properties.

3.
In the Windows Firewall With Advanced Security On ... dialog box, select the profile with which you want to work. (See Figure 15-8.)

Figure 15-8. Manage the settings for each profile separately.

4.
To enable the firewall for the profile, select On (Recommended) and then configure the global default setting for inbound and outbound connections. For inbound connections, select Block, Block All, or Allow as appropriate. For outbound connections, select Block or Allow as appropriate.

Note

The difference between Block and Block All is important. Use Block to block all programs not specifically listed as allow exceptions. Use Block All to block all programs, including those specifically listed as allow exceptions.

5.
Behavior settings determine notification on blocking, response types, and rule merging. To configure profile behavior, click Customize on the Settings panel and then use the options provided to configure the desired behavior. If you are working with Group Policy, you'll be able to specify whether local computer rules should be merged with rules set in Group Policy.

6.
Logging settings determine whether logging is used, such as might be necessary for troubleshooting firewall issues. To enable logging, click Customize on the Logging panel and then set Log Dropped Packets to Yes and Log Successful Connections to Yes. The default path for the log file is %SystemRoot%\System32 \Logfiles\Firewall\Pfirewall.log. Click OK.

7.
IP Security (IPSec) settings determine how secure connections are established. The same settings are used for all profiles. To configure IPSec settings, click Customize on the Internet Protocol Security (IPSec) panel; use the options provided to manage integrity, privacy, and authentication settings for IPSec; and then click OK.

Creating and Managing Inbound Rules

The default configuration for all firewall profiles is to block all inbound connections to a computer unless there are specific inbound rules that allow incoming connections. You can view currently defined inbound rules by selecting the Inbound Rules node in Windows Firewall With Advanced Security.

Although many inbound rules are defined by default, only a few are enabled. You can quickly determine which by clicking the Enabled column twice so that the Enabled-Yes rules are listed first. You can create and enable a new inbound rule by following these steps:

1. | In Windows Firewall With Advanced Security, select the Inbound Rules node.
2. | Under Actions, click New Rule to start the New Inbound Rule Wizard.
3. | Follow the prompts to define the inbound rule. Click Finish to close the wizard.
4. | If you want the inbound rule to be enabled, right-click it and then select Enable Rule.

You can modify and enable an existing inbound rule by following these steps:

1. | In Windows Firewall With Advanced Security, select the Inbound Rules node.
2. | Double-click the inbound rule you want to configure.
3. | Change settings as necessary using the tabs and options provided.
4. | If you want the inbound rule to be enabled, right-click it and then select Enable Rule.
Creating and Managing Outbound Rules

The default configuration for all firewall profiles is to allow all outbound connections from a computer unless there are specific outbound rules that block outgoing connections. You can view currently defined outbound rules by selecting the Outbound Rules node in Windows Firewall With Advanced Security.

By default, many outbound rules are defined. However, only a few outbound rules are enabled. You can quickly determine which by clicking the Enabled column twice so that the Enabled-Yes rules are listed first. To create and enable a new outbound rule, follow these steps:

1. | In Windows Firewall With Advanced Security, select the Outbound Rules node.
2. | Under Actions, click New Rule to start the New Outbound Rule Wizard.
3. | Follow the prompts to define the outbound rule. Click Finish to close the wizard.
4. | If you want the outbound rule to be enabled, right-click it and then select Enable Rule.

You can modify and enable an existing outbound rule by following these steps:

1. | In Windows Firewall With Advanced Security, select the Outbound Rules node.
2. | Double-click the outbound rule you want to configure.
3. | Change settings as necessary using the tabs and options provided.
4. | If you want the outbound rule to be enabled, right-click it and then select Enable Rule.
Creating and Managing Connection Security Rules

IPSec provides rules for securing IP traffic. Windows Firewall With Advanced Security uses connection security rules to define IPSec policies. No connection security rules are defined by default. You can create a new connection security rule by following these steps:

1.
In Windows Firewall With Advanced Security, select and then right-click the Connection Security Rules node in the console tree and then click New Rule. This starts the New Connection Security Rule Wizard.

2.
On the Rule Type page, shown in Figure 15-9, you can specify the type of connection security rule to create and then click Next. The types of rules that can be created are as follows:

  • Isolation Isolates the computer by restricting connections based on domain membership or health status. With this type of rule, you must specify whether authentication should occur for incoming or outgoing traffic, whether you want to require or only request secure connections, the authentication method for protected traffic, and a name for the rule. Isolating computers based on their health status uses Network Access Protection (NAP) policy.

    Real World

    NAP is designed to help safeguard the enterprise network from client computers in potentially unhealthy states. NAP uses protection policies configured by enterprise administrators to determine whether a particular local or remote client can connect to the enterprise network. If a client computer running Windows Vista or later isn't deemed "healthy" as defined in the enterprise protection policy, the client computer is either prevented from accessing the network, provided with instructions on how to get updates, or granted limited access to the network. Administrators can define NAP policy using the NAP Server Configuration tool and then can use the NAP Client Configuration tool to enforce policy. NAP can be applied to both locally connected and remotely connected computers. The health of a computer is determined by the service packs, updates, and other security configurations currently in place.

  • Authentication Exemption Defines an authentication exemption for computers that do not have to authenticate themselves or secure their traffic. With this type of rule, you must specify a name for the rule and the computers to exempt according to their IP addresses.

  • Server To Server Designates how authentication should be used for communications between specific computers, typically servers. With this type of rule, you must specify the endpoint IP addresses, when authentication should occur, the authentication method for protected traffic, and a name for the rule.

  • Tunnel Creates a secure, tunneled connection between computers. Typically, you'll use this type of rule between two secure gateway computers that send packets over the Internet. You must specify the tunnel endpoints by IP address, the authentication method, and a name for the rule.

  • Custom Creates a rule with a custom authentication behavior. Use this option when you want to manually configure a rule. You must specify a name for the rule.

Figure 15-9. Specify the type of connection security rule to create.

[View full size image]

3.
Once you've configured the rule, click Finish to create and enable the rule.

You can modify the settings of a rule by right-clicking the name of the rule, clicking Properties, and then using the properties dialog box provided to modify the rule settings as necessary. If you want to disable a rule, right-click the rule and then select Disable Rule.

Managing Windows Defender

Windows Defender is the anti-spyware program included with Windows Vista. It protects a computer from harmful and unwanted software in real time by stopping malicious programs from installing themselves and by detecting and blocking the activities of any malicious programs that might have slipped by its defenses. Windows Defender detects spyware programs according to:

  • How they try to install themselves

  • How they try to manipulate a computer's files and settings

  • The types of data they create, record, or send

Collectively, these characteristics are referred to as a spyware program's signature. Like antivirus software, Windows Defender maintains definition files with information on spyware signatures. To protect the computer from an ever-evolving array of spyware, Windows Defender must be updated periodically to the newest definition files regarding spyware signatures. Windows Defender includes an automatic update feature that checks for updates periodically. You can manually check for updates as well. As discussed in Chapter 5, a key component of Windows Defender is Software Explorer, which can be used to terminate a program, block incoming connections to a program, and disable or remove a program. Windows Defender uses Software Explorer to help detect the activities of malicious programs.

Working with Windows Defender

You can open Windows Defender by clicking the Windows Defender link in Windows Security Center. If Windows Defender is turned off, you'll need to turn it on, when prompted, by clicking Enable Now To Turn On Windows Defender and then clicking OK. As shown in Figure 15-10, the Windows Defender home page provides an overview of the current status. You'll see a normal status if Windows Defender's definitions are up-to-date and no known unwanted or harmful software is installed on the computer. You'll see a warning status if Windows Defender's definitions are out of date or known unwanted or harmful software is installed on the computer. You can then retrieve updates over the Internet from the Microsoft Web site and install them automatically by clicking the Check Now button provided as part of the warning.

Figure 15-10. Use Windows Defender to protect a computer from spyware.

[View full size image]

When working with Windows Defender, you can use the Status area in the lower portion of the home page to determine the general status according to the following information:

  • Last Scan The date and time of the last scan as well as the type of scan that was performed

  • Scan Schedule The schedule for automatic scans, such as Daily at 2:00 A.M

  • Real-Time Protection The status of real-time protection, as either On or Off

  • Spyware Signatures The version, time, and date of the most recent definitions file

The general settings of Windows Defender enable you to choose how you want the program to run. You can configure general settings by following these steps:

1.
In Windows Defender, click Tools and then click Options.

2.
On the Options page, the following options panels are provided to configure the way Windows Defender works:

  • Automatic Scanning Used to set automatic scanning and automatic updating options. For automatic scanning, select Automatically Scan My Computer (Recommended) and then set the scan frequency, time of day, and type of scan. To have Windows Defender check for updates before scanning, select Check For Updated Definitions Before Scanning. To apply default actions to detected or suspected spyware programs, select Apply Default Actions To Items Detected During A Scan.

  • Default Actions Used to set the default action to take based on the alert level of a detected or suspected spyware program. Spyware with a high alert level are considered to be the most dangerous and have the highest probability of doing damage to a computer. The default action is to apply the recommended action according to the current definition file, which is either to ignore the program or to remove it. If you don't want to use Definition Recommended Action, you can specifically designate that programs should be ignored or removed.

  • Real-Time Protection Used to turn on and configure real-time protection. Real-time protection uses individual security agents to determine which areas of the operating system and which components receive real-time protection. Each of these security agents can be enabled or disabled using the check boxes provided. If you want to receive alerts related to real-time protection, you can enable the notification options provided.

  • Advanced Options Used to configure advanced techniques for detecting spyware. These options allow you to scan inside archives and use rule-based (heuristic) detection. Enabling these options is particularly important for detecting new spyware, hidden spyware, and software performing possibly malicious actions.

  • Administrator Options Used to specify whether Windows Defender is turned on or off, and to specify whether normal users can perform scans and choose actions to apply to potentially unwanted software. If you want to enable Windows Defender, Use Windows Defender must be selected. By default, users who do not have administrator rights can perform scans and specify actions to apply to potentially unwanted software. This is the recommended configuration.

3.
Click Save to save any changes you've made to the configuration.

Scanning the Computer for Spyware

To enhance a computer's security, Windows Defender can and should be used in both real-time protection mode and automatic scan mode. If the computer isn't on when the automated scan should have run, or you suspect spyware installed itself on the computer, you can scan the computer manually using a quick scan, a full scan, or a custom scan:

  • With a quick scan, Windows Defender checks areas of memory, the registry, and the file system known to be used by spyware programs, but doesn't perform a comprehensive search for spyware. To start a quick scan, click the Scan button on the Windows Defender toolbar.

  • With a full scan, Windows Defender performs a thorough check of all areas of the memory, the registry, and the file system for spyware. To start a full scan, click the Scan Options button (located to the right of the Scan button on the toolbar) and then select Full Scan.

  • With a custom scan, Windows Defender performs a thorough check of all areas of the memory and the registry, but only checks the areas of the file system that you specify. To start a custom scan, click the Scan Options button (located to the right of the Scan button on the toolbar) and then select Custom Scan. Next, click Select and specify the drives or folders to scan. Finally, click Scan Now.

Checking for Updates

Windows Defender can't do its job of protecting a computer if the spyware definitions are out of date. By default, Windows Defender automatically checks for updated spyware definitions prior to performing an automatic scan. If the computer has access to the Internet or an update server, Windows Defenders is then able to update the spyware definitions. If the computer doesn't have access to the Internet or an update server, Windows Defender is not able to update the spyware definitions and you'll need to manually update the spyware definitions by following these steps:

1. | Click Start and then click Control Panel.
2. | In Control Panel, click Security and then click Check For New Definitions under Windows Defender.

If Windows Defender is open, you can also check for updates by following these steps:

1. | Click the Windows Defender Help Options button. This is the button to the right of the Help button.
2. | Select About Windows Defender.
3. | Click Check For Updates.
Quarantining and Allowing Programs

Windows Defender is configured by default to automatically remove dangerous malicious programs. Other programs that are malicious but not necessarily dangerous may be quarantined. A user may also receive notification about a malicious program and elect to either allow it to run or to quarantine it. Windows Defender tracks details regarding both allowed items and quarantined items.

Quarantined items are disabled and moved to a protected location on the computer, where they can't cause problems. You view and manage quarantined items by clicking Tools and then clicking Quarantined Items. On the Quarantined Items page, quarantined items are listed by name with an alert level and a time stamp. You can manage quarantined items as follows:

  • Permanently remove all quarantined programs by clicking Remove All.

  • Permanently remove a specific program by clicking it and then clicking Remove.

  • Restore a specific a program by clicking it and then clicking Restore.

Allowed items are those that are identified and tracked by Windows Defender but allowed to run on the computer. You can view or manage currently allowed items by clicking Tools and then clicking Allowed Items. On the Allowed Items page, allowed items are listed by name with an alert level and a recommendation for how each program should be handled. If you want Windows Defender to start monitoring the activities of an allowed program again, click the item and then select Remove From List. Windows Defender will then notify the user of any possible malicious activity related to this program.

Managing Automatic Updates

The standard automatic updating feature in Windows Vista is called Windows Update. Windows Update is an enhanced version of the standard automatic update feature included in previous releases of Windows. Not only is Windows Update used to update the operating system, it is also used to update programs that ship with the operating system, such as Microsoft Windows Internet Explorer 7 in Windows Vista, and hardware device drivers. The sections that follow discuss how Windows Update works and how it can be used to help keep a computer up-to-date.

An Overview of Windows Update

Windows Update is a client component that connects periodically to a designated server and checks for updates. Once it determines that updates are available, it can be configured to download and install the updates automatically or to notify users and administrators that updates are available. The server component to which Windows Update connects is either the Windows Update Web site hosted by Microsoft or a designated Windows Update Services server hosted by your organization.

Unlike previous versions' automatic updating features, which only distribute and install critical updates, Windows Update supports distribution and installation of the following:

  • Critical updates Updates that are determined to be critical for the stability and safeguarding of a computer

  • Security updates Updates that are designed to make the system more secure

  • Update roll-ups Updates that include other updates

  • Service packs Provide a comprehensive update to the operating system and its components, which typically include critical updates, security updates, and update roll-ups

A key part of the extended functionality allows Windows Update to prioritize downloads so that updates can be applied in order of criticality. This allows the most critical updates to be downloaded and installed before less critical updates. You can also control how a computer checks for new updates and how it installs them. The default polling interval used to check for new updates is 22 hours. Through Group Policy, you can change this interval. By default, every day at 3:00 A.M. local time, computers install updates they've downloaded. You can modify the installation to require notification or change the install times if desired.

Windows Vista reduces the number of restarts required after updates by allowing a new version of an updated file to be installed even if the old file is currently in use by an application or system component. To do this, Windows Vista marks the in-use file for update and then automatically replaces the file the next time the application is started. With some applications and components, Windows Vista can save the application's data, close the application, update the file, and then restart the application. As a result, the update process has less impact on users.

Real World

Automatic updating uses the Background Intelligent Transfer Service (BITS) to transfer files. BITS is a service that performs background transfers of files and allows interrupted transfers to be restarted. BITS Version 2.0, which is included with Windows Vista, improves the transfer mechanism so that bandwidth is used more efficiently, which in turn means less data is transferred and the transfer is faster. Through Group Policy, BITS can be configured to download updates only during specific times and to limit the amount of bandwidth used. You configure both settings using the Maximum Network Bandwidth That BITS Uses setting under Computer Configuration\Administrative Templates\Network\Background Intelligent Transfer Service in Group Policy. Additionally, using BITS 2.0, Windows Vista can obtain updates from trusted peers across a local area network (LAN) as well as from an update server or from Microsoft directly. Once a peer has a copy of an update, other computers on the local network can automatically detect this and download the update directly from the peer, meaning a required update may only need to be transferred across the wide area network (WAN) once rather than dozens or hundreds of times.

You can use automatic updating in several different ways. You can configure systems to do the following:

  • Install updates automatically With this option, the operating system retrieves all updates at a configurable interval (22 hours by default) and then installs the updates at a scheduled time, which by default is every day at 3:00 A.M. This represents a change in behavior because users are not required to accept updates before they are installed. Updates are instead downloaded automatically and then installed according to a specific schedule, which can be once a day at a particular time or once a week on a particular day and time.

  • Download updates but let me choose whether to install them With this option (the default), the operating system retrieves all updates as they become available and then prompts the user when they are ready to be installed. The user can then accept or reject each update. Accepted updates are installed. Rejected updates are not installed, but they remain on the system so that they can be installed later.

  • Check for updates but let me choose whether to download and install them With this option, the operating system notifies the user before retrieving any updates. If the user elects to download the update, she still has the opportunity to accept or reject it. Accepted updates are installed. Rejected updates are not installed, but they remain on the system so that they can be installed later.

  • Never check for updates When automatic updates are disabled, users are not notified about updates. You can, however, download updates manually from the Windows Update Web site (http://windowsupdate.microsoft.com/).

When Windows Update is configured for automatic update and install, users are not notified of update availability or installation. In a workgroup environment, a Windows Update icon is placed in the notification area to provide an initial notification. This icon is a yellow shield with an exclamation point. Clicking this icon allows you to configure the initial update and installation schedule. Whenever there are notifications, the icon is displayed as well. In an Active Directory domain environment, a Windows Update icon is not placed in the notification area. It is assumed that in a domain, administrators will configure Windows Update for users. Notifications are only displayed for users if you change the default configuration to require user interaction.

Configuring Automatic Updating

Windows Vista organizes updates into two broad categories:

  • Security and recommended updates Includes critical updates, security updates, update roll-ups, and service packs for the operating system and programs that ship with the operating system

  • Drivers and other optional updates Includes updates to drivers that are provided with the operating system and recommended optional updates

By default, Windows Vista is configured to automatically install security and recommended updates only. New updates are installed daily at 3:00 A.M. You can configure automatic updates on a per-computer basis by completing the following steps:

1. | Click Start and then click Control Panel. In Control Panel, click System And Maintenance.
2. | On the System And Maintenance page, click Windows Update. This displays the Windows Update page.
3. | In the left panel, click Change Settings. This displays the Change Settings page.
4. | Specify whether and how updates should occur. By default, Install Updates Automatically is selected.
5. | If you've enabled updates and want to also install drivers and optional updates, select the Include Recommended Updates... check box.
6. | Click OK.

In an Active Directory domain, you can centrally configure and manage automatic updating using the policy settings under Computer Configuration\Administrative Templates\Windows Components\Windows Update and under User Configuration\Administrative Templates\Windows Components\Windows Update. Table 15-1 summarizes the key policies.

Table 15-1. Policies for Managing Automatic Updating

Policy Setting

Description

Enabling Windows Update Power Management

When enabled and the computer is configured for automated, scheduled installation of updates, Windows Update will use the computer's power management features to wake the computer from hibernation at the scheduled update time and then install updates.

Allow Automatic Updates Immediate Installation

When enabled, this setting allows Automatic Updates to immediately install updates that do not interrupt Windows services or require the computer to be restarted. These updates are installed immediately after they are downloaded and are ready to install.

Allow Non-Administrators To Receive Update Notifications

When enabled, this setting allows any user logged on to a computer to receive update notifications as appropriate for the Automatic Updates configuration. If disabled or not configured, only administrators receive update notifications.

Automatic Updates Detection Frequency

When enabled, this setting sets the interval to be used when checking for updates. By default, computers check approximately every 22 hours for updates. If you enable this policy and set a new interval, that interval will be used with a wildcard offset of up to 20 percent of the interval specified. This means that if you set an interval of 48 hours, the actual polling interval would be dependent on the computer and be between 38 and 48 hours.

Configure Automatic Updates

When you enable this setting, you can configure how Automatic Updates works using similar options to those described later in this chapter. You can also schedule the installation.

Delay Restart For Scheduled Installations

By default, when a restart is required after an automatic update, the computer is restarted after a five-minute delay. To use a different delay, enable this policy and then set the delay time.

Turn On Recommended Updates Via Automatic Updates

When enabled, recommended updates, including those from drivers and other optional updates, are installed along with other updates.

Enable Client-Side Targeting

When enabled, this setting allows an administrator to define a target group for the current Group Policy Object. Client-side targeting allows administrators to control which updates are installed on specified groups of computers. Before an update is deployed, it must be authorized for a particular target group.

No Auto-Restart For Scheduled Automatic Updates Installations

When enabled, this setting specifies that the computer will not automatically restart after installing updates that require a restart if a user is currently logged on. Instead, Automatic Updates will notify the user that a restart is needed and wait until the computer is restarted. Restarting the computer enforces the updates.

Re-Prompt For Restart With Scheduled Installations

When enabled and when Automatic Updates is configured for scheduled installation of updates, this setting ensures the logged-on user is prompted again after a set interval if a restart was previously postponed. If the setting is disabled or not configured, the default reprompt interval of 10 minutes is used.

Remove Access To Use All Windows Update Features

When you enable this setting, all Windows Update features are removed. Users are blocked from accessing Windows Update, and automatic updating is completely disabled.

Reschedule Automatic Updates Scheduled Installations

When enabled, this setting specifies the amount of time for Automatic Updates to wait after system startup before proceeding with a scheduled installation that was previously missed.

Specify Intranet Microsoft Update Service Location

When enabled, this setting allows you to designate the fully qualified domain name of the Microsoft Update Services server hosted by your organization and of the related statistics server. Both services can be performed by one server.

Checking for Updates

The main Windows Update page provides details on the last time the computer or a user checked for updates, the last time updates were installed, and the current automatic update configuration. You can determine Windows Update usage or manually check for updates by following these steps:

1. | Click Start and then click Control Panel. In Control Panel, click System And Maintenance.
2. | On the System And Maintenance page, click Windows Update. Statistics are provided regarding the most recent check for updates, the last time updates were installed, and the current update configuration.
3. | If you want to manually check for updates, click Check For Updates.
Viewing Update History and Installed Updates

The Windows Update download manager tracks both successful and failed updates using an update history log. You can access this log by following these steps:

1. | Click Start and then click Control Panel. In Control Panel, click System And Maintenance.
2. | On the System And Maintenance page, click Windows Update.
3. | In the left panel, click View Update History. This displays the History page.

On the History page, updates listed with a Successful status were downloaded and installed. Updates listed with an Unsuccessful status were downloaded but failed to install. To remove an update while accessing the History page, click Installed Updates. Then on the Installed Updates page, right-click the update that you do not want and select Remove.

Modifying or Removing Automatic Updates to Recover from Problems

If an automatic update causes a problem on a system, don't worry. You can remove an automatic update in the same way that you uninstall any other program. Simply follow these steps:

1. | Click Start and then click Control Panel. In Control Panel, click System And Maintenance.
2. | On the System And Maintenance page, click Windows Update.
3. | Click View Update History and then click Installed Updates.
4. | To modify an update, select it in the list provided and then click Change.
5. | To remove an update, select it in the list provided and then click Remove.
Restoring Declined Updates

If a user declines an update that you want to install, you can restore the update so that it can be installed. To do this, complete the following steps:

1. | Click Start and then click Control Panel. In Control Panel, click System And Maintenance.
2. | On the System And Maintenance page, click Windows Update.
3. | Click Restore Hidden Updates.
4. | On the Restore Hidden Updates page, select an update you want to install and then click Restore.
5. | Windows Vista will unhide the declined update so that it can be reselected and installed through the normal notification and installation process.


Chapter 16. Supporting and Troubleshooting Windows Vista

In this chapter:
Using Remote Assistance to Resolve Problems | 512
Detecting and Resolving Windows Vista Errors | 516
Scheduling Maintenance Tasks | 518
Backing Up and Recovering a Computer | 523
Troubleshooting Startup and Shutdown | 530

Throughout this book, I've discussed support and troubleshooting techniques that you can use to diagnose and resolve problems with Microsoft Windows Vista. Some of the most extensive support and troubleshooting discussions are in Chapters 2, 3, and 15.

  • In the "Supporting Computers Running Windows Vista" section of Chapter 2, "Managing Windows Vista Systems," you'll find a detailed discussion on using key support tools to manage a computer, diagnose problems, and troubleshoot support issues. The "Managing System Configuration, Startup, and Boot" section is particularly important to review for troubleshooting system startup using selective startup of networking, services, and Windows components.

  • Chapter 3, "Configuring Systems, Hardware Devices, and Drivers," has extensive discussion on diagnosing and resolving hardware, memory, and resource issues using built-in diagnostics. The chapter also examines automated help and support. In the "Introducing Automated Help And Support" section, you'll find a detailed discussion on the entire automated help framework, including Problem Reports And Solutions, Restart Manager, Startup Repair Tool, and built-in diagnostics.

  • The "Checking for Disk Errors" section of Chapter 15, "Optimizing Windows Vista," details how to find and repair hard disk errors. The "Defragmenting Disks" section details how to defragment disks. If a computer uses BitLocker Drive Encryption and a hard disk has been tampered with while the computer is offline, you can recover the computer as discussed in the "Recovering Volumes Protected by BitLocker Drive Encryption" section. See the "Managing Windows Defender" section for details on how to remove malicious programs from a computer.

Other relevant discussions on support and troubleshooting techniques include the following:

  • Resolving problems with installed programs is covered in Chapter 5, "Installing and Maintaining Programs," in the "Managing and Repairing Installed Programs" section.

  • Resolving password problems is covered in Chapter 6, "Managing User Access and Security," in the "Recovering Local User Account Passwords" section.

  • Resolving hard disk problems is covered in Chapter 9, "Managing Disk Drives and File Systems," in the "Recovering a Failed Simple, Spanned, or Striped Disk" and "Troubleshooting Common Disk Problems" sections.

  • Troubleshooting NTFS file system (NTFS) permissions is covered in Chapter 10, "Managing File Security and Resource Sharing," in the "Determining the Effective Permissions and Troubleshooting" section.

  • Troubleshooting offline files and synchronization is covered in Chapter 11, "Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas," in the "Managing Offline File Synchronization" section.

  • Troubleshooting Transmission Control Protocol/Internet Protocol (TCP/IP) and networking issues related to Internet Protocol (IP) addressing, Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS) and Windows Internet Naming Service (WINS) is covered in Chapter 12, "Configuring and Troubleshooting TCP/IP Networking," in the "Troubleshooting and Testing Network Settings" section.

  • Troubleshooting dial-up, broadband, and virtual private network (VPN) connections is covered in Chapter 13, "Managing Mobile Networking and Remote Access," in the "Establishing Connections" section.

In this chapter, you'll learn techniques for improving support of computers regardless of their location and for recovering from specific types of problems, including problems with startup, programs, and Windows Vista itself. Let's start with a look at how using the Remote Assistance feature can help you troubleshoot problems when you're not at the user's keyboard.


Using Remote Assistance to Resolve Problems

Remote Assistance enables support personnel to view a user's desktop and take control temporarily to resolve problems or walk the user through the execution of complex tasks. Once Remote Assistance is configured locally as discussed in Chapter 6, or through Group Policy as discussed in Chapter 8, "Configuring User and Computer Policies," you can work with this feature.

Understanding Remote Assistance

Remote Assistance is a feature of Windows XP, Windows Vista, Windows Server 2003, and later releases of Windows. Only users running these operating systems can initiate and respond to Remote Assistance invitations. Users initiate sessions by creating an invitation request. Support personnel initiate sessions by offering help to users. Once a session is initiated, assistants can chat with users, observe their working screens, and if permitted, control their computers.

Remote Assistance invitations can be created using the following techniques:

  • E-mail invitation E-mail invitations are sent as e-mail messages to a named e-mail address. An attachment provided in the message is used to initiate the Remote Assistance session. You might want to configure a standard e-mail address, such as RemoteAssist@your_company_name.com, to allow users to send invitation requests easily to the support team. If this address is configured in Microsoft Exchange Server as a distribution list that delivers the invitations to support team members or as an additional mailbox for specific team members, support staff will be able to handle requests more efficiently and users will have a standard way of requesting help.

  • File invitation File invitations are saved as Microsoft Remote Control Incident (MsRcIncident) files. Double-clicking the file name initiates the Remote Assistance session. You can use file invitations if you are using Web-based e-mail and need to attach the invitation separately. You might also want to configure a shared folder that is automatically mapped as a network drive for users and ensure that it is accessible by support personnel. Name the share something that easily identifies it as being used for assistance requests, such as HelpDeskRequest or AssistanceInvitations.

With Windows Vista, invitations must be created with a control password, which is a change from previous releases of Windows to enhance security. The control password provides an additional layer of security in the Remote Assistance configuration, ensuring that users are authorized to provide remote assistance and that they know the invitation password. You should establish an official guideline that requires the use of invitation passwords. To streamline the invitation process, you might want to have predefined passwords that are used with invitations. Passwords should be changed regularly, and you might want to assign different passwords to different groups within the organization.

To work properly, Remote Assistance relies on the presence of a network connection between the user's computer and the assistant's computer. Remote Assistance uses TCP as the communications protocol, communicating over port 3389. Because most firewalls do not have this port open by default, a firewall between the two computers might prevent the assistance session. Port 3389 must be opened for outbound communications from the assistant's computer to the user's computer.

In Windows Vista, Remote Assistance has been improved in many ways. It is faster, uses less bandwidth, and can work through Network Address Translation (NAT) firewalls. When providing support using Remote Assistance, you'll find built-in diagnostics tools that you can run with a single click. For escalation of support issues, two different support staff can connect to a computer simultaneously. Finally, thanks to the automatic reconnect after restart feature, if you need to restart a computer you are remotely assisting, you won't need to reconnect to the computer manually. The Remote Assistance session is reestablished automatically after the computer reboots.

Creating Remote Assistance Invitations

To create a Remote Assistance invitation for e-mail, follow these steps:

1. | Click the Help And Support Home button on the toolbar and then click Remote Assistance under Ask Someone.
2. | In the Remote Assistance Wizard, click Invite Someone You Trust To Help You and then click Use E-mail To Send An Invitation.
3. | When prompted, enter and confirm a secure password for connecting to the computer. This password is used by the person you are inviting and is only valid for the Remote Assistance session.
4. | When you click Next, Windows Vista starts your default mail program and creates an e-mail message with the invitation. In the To field, type the e-mail address of the person you are inviting and then click Send.

To create a Remote Assistance invitation and save it to a file, follow these steps:

1. | Click the Help And Support Home button on the toolbar and then click Remote Assistance under Ask Someone.
2. | In the Remote Assistance Wizard, click Invite Someone You Trust To Help You and then click Save This Invitation As A File.
3. | In the field provided, enter a path and file name for the invitation. If you specify the path to a network folder, the invitation can be easily accessed by an administrator with access to this network folder.
4. | Enter and then confirm a secure password for connecting to the computer. This password is used by the person you are inviting and is only valid for the Remote Assistance session.
5. | Click Finish.

By default, Remote Assistance invitations are valid for a maximum of six hours and enable support staff to remotely control a computer. You can change these settings using the System Properties dialog box as discussed in Chapter 6 in the "Configuring Remote Assistance" section. Once you've sent the invitation for e-mail or created the invitation file, the Windows Remote Assistance dialog box is displayed, as shown in Figure 16-1. This dialog box provides the following options:

  • Cancel Effectively cancels the Remote Assistance request by not allowing the invitation to be used to connect to the computer.

  • Request Control/Stop Sharing Requests control or stops sharing of the computer.

  • Fit To Screen Resizes the other person's screen to fit your window.

  • Disconnect Ends the help session and disconnects.

  • Settings Allows you to configure the session settings. Available settings depend on the type of computer being helped. By default, when you press the Esc key, shared control of the computer is stopped, a log of the Remote Assistance session is saved, and the bandwidth usage is configured so full window drag and desktop backgrounds are not enabled. For fast or slow connections, you can modify the bandwidth usage settings using the Bandwidth Usage slider.

    Note

    By default, the Remote Assistance log is created in the %UserProfile%\Documents\Remote Assistance Logs folder on the computer of the user requesting remote assistance.

  • Chat Opens a chat window for sending messages between the helper and the current user of the computer.

  • Send File Transfers a file to the other computer.

Figure 16-1. Manage Remote Assistance sessions.

[View full size image]

Offering Remote Assistance or Answering a Remote Assistance Invitation

If you know that a user is having problems with her computer, you can follow these steps to offer remote assistance rather than waiting for her to send you an invitation:

1. | Click the Help And Support Home button on the toolbar and then click Remote Assistance under Ask Someone.
2. | In the Remote Assistance Wizard, click Offer To Help Someone.
3. | Type the name or IP address of the computer you want to assist. The computer must be configured to accept Remote Assistance offers.
4. | Click Finish.

If someone has already created an invitation, you can answer the invitation by double-clicking the related e-mail attachment or file. You can also answer an invitation saved to a file by following these steps:

1. | Click the Help And Support Home button on the toolbar and then click Remote Assistance under Ask Someone.
2. | In the Remote Assistance Wizard, click Offer To Help Someone.
3. | Click Browse. Use the Open dialog box to locate the invitation and then click Open.
4. | When prompted, provide the necessary password for the invitation.
5. | When you click Finish, you'll be connected to the computer of the user needing assistance, providing the user hasn't canceled the invitation, the invitation hasn't expired, and Remote Assistance is allowed.


Detecting and Resolving Windows Vista Errors

Any particular computer can have dozens, and in some cases hundreds, of different components, services, and applications configured on it. Keeping all these components working properly is a big job and the built-in diagnostics features discussed previously in this book do a good job of detecting common problems and finding solutions for them. As discussed in Chapter 3, known problems are tracked in the Problem Reports And Solutions console. Like the built-in diagnostic features, this console attempts to provide solutions to problems where possible. Not all problems can be automatically detected and resolved, and this is where the errors reported by Windows components, applications, services, and hardware devices become useful.

Using the Event Logs for Error Tracking and Diagnosis

Windows Vista stores errors generated by processes, services, applications, and hardware devices in log files. Two general types of log files are used:

  • Windows Logs Logs used by the operating system to record general system events related to applications, security, setup, and system components

  • Applications And Services Logs Logs used by specific applications or services to record application-specific or service-specific events

Entries in a log file are recorded according to the warning level of the activity, which can include errors as well as general informational events. You'll see the following levels of entries:

  • Information An informational event, which is generally related to a successful action

  • Audit Success An event related to the successful execution of an action

  • Audit Failure An event related to the failed execution of an action

  • Warning A warning, details of which are often useful in preventing future system problems

  • Error An error, such as the failure of a service to start

In addition to level, date, and time, the summary and detailed event entries provide the following information:

  • Source The application, service, or component that logged the event.

  • Event ID An identifier for the specific event.

  • Task Category The category of the event, which is sometimes used to further describe the related action.

  • User The user account that was logged on when the event occurred. If a system process or service triggered the event, the user name is usually that of the special identity that caused the event, such as Network Service, Local Service, or System.

  • Computer The name of the computer where the event occurred.

  • Details In the detailed entries, this provides a text description of the event, followed by any related data or error output.

Viewing and Managing the Event Logs

You can access event logs using the Event Viewer node in Computer Management. To open Computer Management, click Start. Then select All Programs, Administrative Tools, and then Computer Management. If the Administrative Tools menu isn't accessible, you can access this tool by clicking Start and then selecting Control Panel. In Control Panel, click System And Maintenance, Administrative Tools, and then Computer Management.

You can access the event logs by completing the following steps:

1. | Open Computer Management. You are connected to the local computer by default. If you want to view logs on a remote computer, right-click the Computer Management entry in the console tree (left pane) and then select Connect To Another Computer. Then, in the Select Computer dialog box, enter the name of the computer that you want to access and click OK.
2. | Expand the Event Viewer node and then expand the Windows Logs, the Application And Services Logs node, or both to view the available logs.
3. | Select the log that you want to view, as shown in Figure 16-2.

Figure 16-2. Event Viewer displays events for the selected log.

[View full size image]

Warnings and errors are the two key types of events you'll want to examine closely. Whenever these types of events occur and you are unsure of the cause, double-click the entry to view the detailed event description. Note the source of the error and attempt to resolve the problem using the techniques discussed in this book. To learn more about the error and steps you can take to resolve it (if necessary), you can click the link provided in the error description or search the Microsoft Knowledge Base for the event ID or part of the error description.


Scheduling Maintenance Tasks

When you manage desktop and laptop systems, you'll often want to perform routine maintenance tasks on a periodic or recurring basis. To do this, you can use the Task Scheduler service to schedule one-time or recurring tasks to run automatically. You automate tasks by running command-shell scripts, Windows Script Host (WSH) scripts, or applications that execute the necessary commands for you. Unlike earlier releases of Windows, Windows Vista includes an extensive library of preconfigured tasks. These tasks handle everything from uninstalling a Bluetooth device to defragmenting disks to performing Windows Defender scans.

Understanding Task Scheduling

Windows Vista provides several tools for scheduling tasks, including the Scheduled Task Wizard and the Schtasks command-line tool. Both can be used for scheduling tasks on local and remote systems. The Scheduled Task Wizard provides a point-and-click interface to task assignment, and Schtasks is its command-line counterpart. Both scheduling tools use the Task Scheduler service to monitor the system clock and run tasks at specified times. The Task Scheduler service logs on as the LocalSystem account by default. This account usually doesn't have adequate permissions to perform administrative tasks. To overcome this problem, each task can be set to run as a specific user, and you set the user name and password to use when you create the task. Be sure to use an account that has adequate user privileges and access rights to run the tasks that you want to schedule.

Note

The focus of this section is on the Scheduled Task Wizard. This is the primary tool you'll use to schedule tasks on Windows Vista systems. To learn more about Schtasks, type schtasks /? at the command prompt or refer to Chapter 4, "Scheduling Tasks to Run Automatically," in the Microsoft Windows Command-Line Pocket Consultant (Microsoft Press, 2004).

Windows Vista has two general types of scheduled tasks:

  • Standard tasks Used to automate routine tasks and perform housekeeping. These tasks are visible to users and can be modified if necessary.

  • Hidden tasks Used to automate special system tasks. These tasks are hidden from users by default and should not be modified in most cases. Some hidden tasks are created and managed through a related program, such as Windows Defender.

In Windows Vista, the creation and management of tasks is much more sophisticated than ever before. Every task can be configured to:

  • Run only when a user is logged on, or to run regardless of whether a user is logged on

  • Run with standard user privileges, or to run with the highest privileges required (including administrator privileges)

Because tasks created on Windows Vista are not compatible with earlier releases of Windows, you cannot copy a Windows Vista task to a computer running an earlier release of Windows and expect the task to run. However, when creating the task, you can specify that it should be created so that it is compatible with earlier releases of Windows. This would then allow you to copy the task to computers running earlier releases of Windows.

Tasks can have many properties associated with them, including:

  • Triggers Triggers specify the circumstances under which a task begins and ends. You can begin a task based on a schedule, user logon, computer startup, or processor idling. You can also begin a task based on events, a user connecting or disconnecting from the Terminal Server session, or a user locking or unlocking a workstation. Tasks with event-based triggers can be the most powerful, because they allow you to provide automated ways to handle errors and warnings.

  • Actions Actions define the action a task performs when it is triggered. This allows a task to start programs, send e-mail messages, and display messages.

  • Conditions Conditions help to qualify the conditions under which a task is started or stopped once it has been triggered. You can use conditions to wake the computer to run a task and to start the computer only if a specific network connection is available. You can use conditions to start, stop, and restart a task based on the processor idle time. For example, you might want to start a task only if the computer has been idle for at least 10 minutes, stop the task if the computer is no longer idle, and then restart the task again if the computer becomes idle once more. You can also use conditions to specify a task should only start if the computer is on alternating current (AC) power and stop if the computer switches to battery power.

Viewing and Managing Tasks on Local and Remote Systems

The current tasks configured on a system are accessible through the Task Scheduler node in Computer Management. You can view and manage the scheduled tasks configured on a computer by completing the following steps:

1.
Open Computer Management. You are connected to the local computer by default. If you want to view logs on a remote computer, right-click the Computer Management entry in the console tree (left pane) and then select Connect To Another Computer. Then, in the Select Computer dialog box, enter the name of the computer that you want to access and then click OK.

2.
Expand the Task Scheduler node and then expand the Task Scheduler Library node and related subnodes as necessary to view the configured schedule tasks.

3.
Select a task to view its properties using the tabs provided, as shown in Figure 16-3. If you want to manage the task, right-click the task and then:

  • Delete a task by selecting Delete.

  • Disable a task by clicking Disable.

  • Edit the task's properties by clicking Properties, making the appropriate changes in the Properties dialog box, and then clicking OK.

  • Export a task to a file that can be imported on another computer by selecting Export. After you export the task, use Computer Management to connect to the other computer, right-click the Task Scheduler Library node, and then select Import Task. You can then use the Open dialog box to locate and open the task in the other computer.

  • Run the task by clicking Run.

  • If the task is running, stop it by clicking End.

Figure 16-3. View and manage scheduled tasks.

[View full size image]

Note

Although you can modify and delete user-created tasks, most tasks created by the operating system cannot be configured or deleted. You can view hidden tasks by clicking View and then selecting Show Hidden Tasks.

You can view the scheduled tasks currently running on a computer by completing the following steps:

1. | Open Computer Management. You are connected to the local computer by default. If you want to view logs on a remote computer, right-click the Computer Management entry in the console tree (left pane) and then select Connect To Another Computer. In the Select Computer dialog box, enter the name of the computer that you want to access and then click OK.
2. | Right-click the Task Scheduler node and then select Display All Running Tasks.

Creating Tasks with the Scheduled Task Wizard

To create a task using the Scheduled Task Wizard, follow these steps:

1.
Open Computer Management. You are connected to the local computer by default. If you want to view logs on a remote computer, right-click the Computer Management entry in the console tree (left pane) and then select Connect To Another Computer. In the Select Computer dialog box, enter the name of the computer that you want to access and then click OK.

2.
Select and then right-click the Task Scheduler node and then select Create Task. This starts the Create Task Wizard.

3.
On the General tab, type the name of the task and then set security options for running the task.

  • If the task should run under a user other than the current user, click Change User Or Group. Use the Select Users Or Groups dialog box to select the user or group under which the task should run and then provide the appropriate credentials when prompted later.

  • Set other run options as necessary using the options provided. By default, tasks only run when a user is logged on. If you want to run the task regardless of whether a user is logged on, select Run Whether User Is Logged On Or Not. You can also elect to run with highest privileges and configure the task for earlier releases of Windows.

4.
On the Triggers tab, create and manage triggers using the options provided. To create a trigger, click New, use the options provided to configure the trigger, and then click OK.

5.
On the Actions tab, create and manage actions using the options provided. To create an action, click New, use the options provided to configure the action, and then click OK.

6.
On the Conditions tab, specify any limiting conditions for starting or stopping the task.

7.
On the Settings tab, choose any additional optional settings for the task.

8.
Click OK to create the task.

Troubleshooting Scheduled Tasks

When you configure tasks to run on a computer, you can encounter several types of problems. Some tasks won't run when they are supposed to. Others will start and won't stop. To determine the status of a task, select the task in the Task Scheduler and note the status, last run time, and last run result. If a task has a status of Queued, it is waiting to run at a scheduled time. If a task has a status of Ready, it is ready to run on its next run time. If a task should be running automatically but has a Last Run Time of Never, you'll need to check the task's properties to determine why it isn't running. If the Last Run Result is an error, you'll need to resolve the referenced problem so the task can run normally. Check a task's properties by clicking its entry in the Task Scheduler. The History tab provides detailed information on the task, from creation to its last run time. Use the history information to help you resolve problems with the task.

A task that is listed as Running might not in fact be running but instead might be a hung process. You can check for hung processes using Last Run Time, which tells you when the task was started. If a task has been running for more than a day, there is usually a problem. A script might be waiting for input, it might have problems reading or writing files, or it might simply be a runaway task that needs to be stopped. To stop the task, right-click it in the Task Scheduler and then select End.


Backing Up and Recovering a Computer

Windows Vista provides Backup And Restore Center as a central console for backing up and recovering a computer. You can access this console by clicking Start, clicking Control Panel, and then clicking the Backup Your Computer link under the System And Maintenance heading. Other tools for backing up and recovering a computer's data include Previous Versions, Startup Repair Tool, Windows Resume Loader, System Restore, and Backup. These tools are discussed in the sections that follow.

Backing Up and Recovering Files and Folders Using Previous Versions

Chapter 2 introduced Previous Versions and also discussed configuring and using this feature. Although Previous Versions is not a replacement for full system backups, it can be used to create automatic backups of changed files and folders on monitored drives. If a monitored file or folder was accidentally deleted or modified, you can recover the file or folder to the previous version using the technique discussed in Chapter 2 in the "Restoring a Previous Version" section.

Recovering from a Failed Resume

When a computer running Windows Vista enters sleep mode or hibernates, a snapshot of the current state of the computer is created. For sleep mode, this snapshot is created in memory and then read from memory when a user wakes the computer. For hibernate mode, this snapshot is written to disk and then read from disk when a user wakes the computer. Both operations are handled by the Windows Resume Loader.

Problems with resume can occur for a variety of reasons, including errors in the snapshot, physical errors in memory, and physical disk errors. If there is a problem resuming after waking the computer, Windows Resume Loader will prompt you with a warning message similar to the following:

Windows Resume Loader
The last attempt to restart the system from its previous location failed.
Attempt to restart again?

Continue with system restart
Delete restoration data and proceed to system boot.

Enter=choose

To have Windows Resume Loader attempt to reload the system state again, select Continue With System Restart. To have Windows Resume Loader delete the saved state of the computer and restart the computer, select Delete Restoration Data And Proceed To System Boot. Although the latter option, a full restart, will typically resolve the problem, it could mean losing data if work wasn't saved before the computer entered sleep or hibernate mode.

Repairing a Computer to Enable Startup

To start properly, computers running Windows Vista need access to specific system files. If a computer won't start due to a corrupted or missing system file, you can use the Startup Repair Tool to recover it as discussed in Chapter 3. Sometimes repairing a damaged or missing file won't fix all the computer's problems, and you might need to continue troubleshooting to diagnose and resolve the deeper problem.

Most other types of startup problems occur because something on the system has changed; for example, a device might have been incorrectly installed. The system configuration or registry might have been updated improperly, causing a conflict. Often you can resolve startup issues using safe mode to recover or troubleshoot system problems. When you are finished using safe mode, be sure to restart the computer using a normal startup. You will then be able to use the computer as you normally would.

In safe mode, Windows Vista loads only basic files, services, and drivers. The drivers loaded include the mouse, monitor, keyboard, mass storage, and base video. The monitor driver sets the basic settings and modes for the computer's monitor; the base video driver sets the basic options for the computer's graphics card. No networking services or drivers are started unless you choose safe mode With Networking option. Because safe mode loads a limited set of configuration information, it can help you troubleshoot problems.

Restart a system, in safe mode, by completing the following steps:

1.
If the computer is running but has started with errors, click Start. Then click the Options button to the right of the power and lock buttons and click Shut Down.

2.
During startup, press F8 to access the Advanced Options screen. If the computer has multiple operating systems or you've installed the Recovery Console, you'll see the Windows Boot Manager screen and can press F8 at that time.

3.
Use the arrow keys to select the safe mode you want to use and then press Enter. The safe mode option you use depends on the type of problem you're experiencing. The key options are as follows:

  • Safe Mode Loads only basic files, services, and drivers during the initialization sequence. The drivers loaded include the mouse, monitor, keyboard, mass storage, and base video. No networking services or drivers are started.

  • Safe Mode With Networking Loads basic files, services, and drivers, as well as services and drivers needed to start networking.

  • Safe Mode With Command Prompt Loads basic files, services, and drivers, and then starts a command prompt instead of the Windows Vista graphical interface. No networking services or drivers are started.

    Tip

    In Safe Mode With Command Prompt, you can start the Explorer shell from the command-line interface by pressing Ctrl+Shift+Esc and typing explorer.exe in the New Process window in the File menu of the Task Manager.

  • Enable Boot Logging Allows you to create a record of all startup events in a boot log.

  • Enable Low Resolution Video Allows you to start the system in low-resolution 640 x 480 display mode, which is useful if the system display is set to a mode that can't be used with the current monitor.

  • Last Known Good Configuration Starts the computer in safe mode using registry information that Windows Vista saved at the last shutdown. Only the HKEY_CURRENT_CONFIG (HKCC) hive is loaded. This registry hive stores information about the hardware configuration with which you previously and successfully started the computer.

  • Disable Driver Signature Enforcement Starts the computer in safe mode without enforcing digital signature policy settings for drivers. If a driver with an invalid or missing digital signature is causing startup failure, this will resolve the problem temporarily so you can start the computer and resolve the problem by either getting a new driver or changing the driver signature enforcement settings.

4.
If a problem doesn't reappear when you start in safe mode, you can eliminate the default settings and basic device drivers as possible causes. If a newly added device or updated driver is causing problems, you can use safe mode to remove the device or reverse the update.

5.
If you are still having a problem starting the system normally and suspect that problems with hardware, software, or settings are to blame, remain in safe mode and then try using System Restore to undo previous changes. See the "Backing Up and Recovering System State Using System Restore" section of this chapter.

6.
If System Restore doesn't work, try modifying startup options as discussed in Chapter 2.

Backing Up and Recovering System State Using System Restore

The "The System Protection Tab" section in Chapter 2 introduced System Restore and also discussed configuring this feature. Restore points can be used to recover systems that are experiencing problems after a system update, software installation, hardware installation, or other change. The following sections discuss how restore points can be created manually and how systems can be recovered using restore points. Restore operations are reversible in most cases.

Understanding Restore Points

System Restore monitors the operating system for changes and creates restore points before changes are introduced at regular daily intervals. The feature works by saving a snapshot of a computer's system configuration and writing this to disk so that it can be used to recover the system to a point in time if necessary. It is important to note that System Restore does not affect personal data. You can recover a system to a restore point without affecting a user's application data, cached files, or documents. System Restore doesn't write any information to the Documents folder either.

System Restore tracks and saves configuration information separately for each drive on a computer. This means that each drive has disk space made available to System Restore, and you can turn off monitoring of individual drives as needed. If a drive is configured for System Restore monitoring, you can recover from changes if a problem occurs. If a drive isn't configured for System Restore monitoring, configuration changes are not tracked, and changes cannot be recovered if a problem occurs. On most systems, you should configure System Restore for the system drive, which stores the operating system files, and for all drives containing critical applications.

Restore points can be restored in one of three ways: by checkpoint, by date, or by event. Individual snapshots scheduled by the operating system are called system checkpoints. When you installed Windows Vista, the first snapshotthe initial system checkpointwas created automatically. Other system checkpoints are made approximately every 24 hours. If a computer is turned off when a daily checkpoint is scheduled, System Restore creates the checkpoint the next time the computer is started.

Some snapshots are created automatically based on events that the operating system triggers when you make changes or install applications. For simplicity, I call these snapshots "installation restore points," and there's actually a group of them, each with a different purpose. The event-based snapshots are as follows:

  • Program name installation restore points Created prior to installing a program that uses a compatible installer. You can use installation restore points to track application installation and to restore a computer to the state it was in before the application was installed. Restoring the computer state means that all file and registry settings for the installed program are removed. It also means that programs and system files altered by the installation are restored to their previous state. Once completed, the program won't work and you'll need to reinstall it if the user wants to use it again.

    Caution

    These are called program name installation restore points instead of program uninstall restore points for a very good reason. The restore process doesn't uninstall all the application files. It removes file and registry settings that might affect the operation of the computer. To completely uninstall a program, you'll need to use the Programs tool in Control Panel.

  • Automatic update restore points Created prior to applying an automatic update. If a computer has problems after applying an automatic update, you can use the restore point to recover the computer to its previous state. (You can also use the Programs tool to remove automatic updates.)

  • Restore operation restore points Created prior to restoring a computer. If you find that you went back to the wrong restore point or that the restore point doesn't work, you can use these restore points to undo the restore operation and recover the computer to its state before you reversed the previous settings.

  • Unsigned device driver restore points Created prior to installation of an unsigned or uncertified driver on a computer. If a computer has problems after installing an unsigned or uncertified driver, you can use these restore points to restore the computer to its state before you installed the driver. For signed and certified drivers, the normal rollback procedure should allow you to go back to the previous driver being used.

  • Microsoft Backup tool recovery restore points Created prior to recovering files or system data using the Backup tool. If the recovery fails or if the computer doesn't work properly after the recovery, you can undo the changes and restore the computer to its previous state.

Users can also create snapshots manually. These snapshots are called manual restore points. You should recommend that users create snapshots prior to performing any operation that could cause problems on the system.

You can restore computers when they are running in normal mode or safe mode. In normal mode, a restore operation restore point is created prior to restoration of the computer. But in safe mode, the restore operation restore point is not created because changes you make in safe mode aren't tracked and you can't undo them using restore points. However, you can use safe mode to restore any previously created restore point.

Creating Manual Restore Points

You can create a manual restore point by following these steps:

1. | Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.
2. | In the Backup And Restore Center, click Create A Restore Point Or Change Settings under Tasks.
3. | Select the disk for which you want to create the restore point and then click Create.
4. | Enter a description for the restore point, such as Prior To DisplayMonitor Driver Update And Changes. Click Create.
5. | When the create operation completes, click OK.
Recovering from Restore Points

To recover a computer from a restore point, follow these steps:

1.
Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.

2.
Select Repair Windows Using System Restore under Tasks.

3.
The Restore System Files And Settings page has two options:

  • Recommended Restore The Recommended Restore option is selected by default. If you want to undo the most recent update, driver, or software installation, choose this option and then click Next.

  • Choose A Different Restore Point If you want to recover the computer to a specific point in time, choose this option and then click Next. On the Choose A Restore Point page, restore points are listed by date, time, and description. Click the restore point that you want to use and then click Next.

4.
Click Finish. When prompted, click Yes to confirm that you want to restore the computer's system files and settings using the selected restore point.

During the restoration, System Restore shuts down Windows Vista. After the restore is complete, Windows Vista is restarted using the settings from the date and time of the snapshot. After the system restarts, the System Restore dialog box is displayed again. Read the message provided and then click Close. If Windows Vista isn't working properly, you can apply a different restore point or reverse the restore operation by repeating this procedure and selecting the restore operation that was created prior to applying the current system state.

Creating and Using a Backup

Windows Vista includes Backup Recovery And Restore Center and the Backup Status And Configuration utility. You can use either tool to automate backups and to create a complete backup of a computer. You must have appropriate permissions to back up and restore files on a computer.

Automating Backups of Essential Files

Automated backups are used to periodically back up pictures, music, videos, e-mail, documents, and other types of important files. The computer must be turned on at the scheduled run time for automated backups to work. You can configure automated backups by following these steps:

1. | Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.
2. | Select Change Settings under Backup Files Or Your Entire Computer.
3. | If you haven't previously configured automated backups, click Set Up Automatic File Backup. Otherwise, click Change Backup Settings.
4. | On the Where Do You Want To Save Your Backup page, use the options provided to specify a backup location on a local disk, a CD/DVD drive, or on the network and then click Next.
5. | On the Which File Types Do You Want To Back Up page, select the types of files to back up. You can configure backing up pictures, music, videos, e-mail, documents, TV shows, or compressed files by selecting or clearing the related check boxes. Select Additional Files to back up any additional files that do not fit in the defined categories. System files, program files, and temporary files are never backed up regardless of your selections.
6. | On the How Often Do You Want To Create A Backup page, use the options provided to set the desired backup schedule. The How Often selection list lets you choose Daily, Weekly, or Monthly as the run schedule. If you choose a weekly or monthly run schedule, you'll need to set the day of the week or month to run using the What Day selection list. Finally, the What Time selection list lets you set the time of the day when automated backup should occur.
7. | To create the initial backup and save the backup schedule, click Save Settings And Start Backup. When prompted to confirm, click Yes.

Once you've configured automated backups, you can run a backup manually using the settings. Simply open Backup And Recovery Center and click Backup Files. To modify the run schedule or to disable automated backups, follow these steps:

1. | Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.
2. | Select Change Settings under Backup Files Or Your Entire Computer.
3. | If you want to change the backup settings, select Change Backup Settings and then complete steps 47 of the previous procedure.
4. | If you want to disable automated backups, click Turn Off.

You can recover files you've backed up by following these steps:

1. | Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.
2. | In Backup And Recovery Center, click Restore Files.
3. | On the What Do You Want To Restore page, select Files From The Latest Backup or Files From An Older Backup as appropriate and then click Next.
4. | Follow the prompts to complete the restore.

Performing Complete Computer Backups

Complete PC Backup creates a backup image of the entire computer and everything needed to completely restore it. You can start a Complete PC Backup by following these steps:

1. | Open Backup And Recovery Center. Click Start, click Control Panel, and then click the Backup Your Computer link under the System And Maintenance heading.
2. | In Backup And Recovery Center, click Back Up Computer.
3. | On the Where Do You Want To Save The Backup page, use the options provided to specify a backup location, preferably on removable media, and then click Next. Compressed hard disks cannot be used for Complete PC backups.
4. | On the Which Disks Do You Want To Include In The Backup page, the computer's system drive is selected by default. You cannot change this selection, but you can add other drives to the backup image by selecting the related check boxes. Click Next to continue.
5. | Click Start Backup to start the backup.

Once you've created a Complete PC Backup, you can use it to recover the computer completely by following these steps:

1. | Shut down the computer.
2. | Turn on the computer and hold F8 during startup.
3. | Windows Complete PC Restore should be available as a recovery option. Click this option and then follow the prompts.

If the recovery option is not available, you can begin recovery using the following procedure:

1. | Insert the Windows Vista installation disk and then restart the computer.
2. | On the initial screen, click Recovery Options.
3. | Click Windows Complete PC Restore and then follow the prompts.


Troubleshooting Startup and Shutdown

As an administrator, you'll often need to troubleshoot problems with startup and shutdown. The sections that follow look at techniques for resolving common problems.

Resolving Restart or Shutdown Issues

Normally, you can shut down or restart Windows Vista by clicking Start, clicking the Options button to the right of the power and lock buttons, and then clicking Restart or Shut Down as appropriate. Sometimes, however, Windows Vista won't shut down or restart normally and you must take additional actions. In those cases, follow these steps:

1. | Press Ctrl+Alt+Del. The Windows screen should display. If so, click Start Task Manager.
2. | On the Application tab, look for an application that is not responding. If all programs appear to be running normally, skip to step 5.
3. | Select the application that is not responding and then click End Task.
4. | If the application fails to respond to the request, you'll see a prompt that allows you to end the application immediately or cancel the end-task request. Click End Now.
5. | Try shutting down or restarting the computer. Press Ctrl+Alt+Del, click the Options button to the right of the power and lock buttons, and then click Restart or Shut Down as appropriate.

Real World

As a last resort, you might be forced to perform a hard shutdown by pressing and holding the computer's power button or by unplugging the computer. If you do this, Check Disk will probably run the next time you start the computer. This allows the computer to check for errors and problems that might have been caused by the hard shutdown. If Check Disk doesn't run automatically, you might want to run it manually.

Reinstalling Windows Vista

When you cannot recover Windows any other way, your final recovery option is to reinstall Windows Vista with the repair option. This option tells Windows to reinstall the base operating system over the existing installation. The repair and reinstall shouldn't affect user settings, so any programs that were previously installed and any data should remain intactin most cases.

To reinstall Windows Vista with the repair option, follow these steps:

1. | Insert the Windows Vista CD into the appropriate drive and then restart the computer.
2. | When the Setup program begins, do not select any of the repair options. Instead, press Enter to start setup normally.
3. | Press F8 to accept the license agreement. Windows Vista will then search your system for existing Windows installations.
4. | On the screen showing your existing Windows installation, press R to start the repair process.
5. | The remainder of this procedure follows the same steps you would take if performing a clean install of the operating system. (See the "Installing and Running Windows Vista" section of Chapter 1, "Introduction to Windows Vista Administration.") When Setup finishes, the system files will be refreshed, and the existing user settings and data should be available.

Note

Keep in mind that the repair process cannot repair a damaged disk. If the file system is defective, you might need to reformat the disk and then perform a clean install of the operating system. If the disk itself is defective, you will need to replace the disk and then install the operating system.

Making Sense of Stop Errors

The "Configuring System Startup and Recovery" section in Chapter 2 details how to configure Windows Vista to write debugging information. If a major error occurs while Windows Vista is starting, installing a program, or performing another operation, you'll see a Stop error message across the entire screen. Read this information carefully and write down the following information:

  • Error name The error name should be on the third line of the error screen and is listed in all caps, such as KERNEL_STACK_INPAGE_ERROR.

  • Troubleshooting recommendations The error name is followed by the troubleshooting recommendations. These recommendations are based on the type of error that occurred and provide general guidelines on resolving the problem.

  • Error number The troubleshooting recommendations are followed by technical information. On the next line after the Technical Information heading, you'll see the word STOP, an error number, and a list of error parameters. The error number following STOP is what you should write down, such as STOP: 0X00000050.

  • Driver information Immediately following the line with the Stop error number is a line that lists the name of the driver associated with the error. This information is only provided if the error can be traced to a specific driver. Write down the driver name.

If the system is configured to write an event to the event logs if a Stop error occurs and it was possible to write the event before the system crashed completely, the error number and error parameters will be written to an event in the System log with an event source of Save Dump. The event will also specify if a dump file was created and where it was saved if applicable.

Real World

Windows Vista includes an Online Crash Analysis feature that allows you to send the dump file to Microsoft Product Support Services. If error reporting is enabled, you will be prompted to send this debugging information to Microsoft when you restart the system. You have the option of sending the debugging information anonymously or using your Microsoft Connect account. If you send the debugging information with your name and contact information through Microsoft Connect, a technician might contact you for further information and might also be able to suggest an action to correct the problem. You can manually upload crash information via the Microsoft Online Crash Analysis Web site (http://oca.microsoft.com/). The site also lets you track the status of your issue, and you can check for a diagnosis.

Once you have the Stop error information, you might need to start the system in safe mode as discussed in the "Repairing a Computer to Enable Startup" section of this chapter. You can then look to resolving the problem by performing the following tasks:

  • Look up the Stop error on the Microsoft Knowledge Base Visit support.microsoft.com and perform a search of the Microsoft Knowledge Base using the error number as the keyword. If a known problem is related to the error code, you should find a related Knowledge Base article. As appropriate, follow the instructions given to resolve the issue.

  • Check the driver (if driver information was provided) When you reboot the system, check the driver to ensure it is digitally signed. If the driver has been updated recently, you might need to consider rolling back to the previous driver version. Just because the driver is listed doesn't mean the driver is corrupt and needs replacing, however. The Stop error could have been caused by other factors.

  • Determine what has changed recently Stop errors can be caused by both hardware and software. Closely review any programs or hardware that have been installed recently on the computer. If you added new hardware, check to ensure that the hardware is installed correctly; that the latest, signed drivers are installed; and that the hardware is properly configured. If you added new software, check to make sure the installation completed successfully. You might also want to check for updates or patches to the software.

  • Check system resources Stop errors can occur if the system gets critically low on RAM or disk space. Once you get the system started, check the drives to determine the amount of free space available and, as necessary, free additional disk space using Disk Cleanup or other tools. Also open the Task Manager. (In a domain, press Ctrl+Alt+Del and click Task Manager; in a workgroup, simply press Ctrl+Alt+Del.) Look at the Performance tab to check the amount of physical and virtual RAM available. If very little memory is available, determine which programs are using memory and whether there are problem programs, such as adware or spyware, running.

  • Repair system files Stop errors can be caused by damaged or improper versions of system files. If you suspect a system file as being the cause of the problem and the system won't boot properly, you might need to repair the operating system or reinstall the operating system using the repair options as discussed in the "Repairing a Computer to Enable Startup" section of this chapter.

  • Check hardware and BIOS Stop errors can be caused by faulty hardware. If a computer frequently crashes, you might want to examine the hardware closely. Check the hardware drivers first; a driver might be causing the Stop errors. Check the physical hardware. Look specifically at the hard disks, RAM, CPU, and the graphics card. A hard drive might be going bad, RAM might be defective, the CPU might have overheated, or the graphics card might be incompatible with Windows Vista. Also look at the basic input/output system (BIOS). Check the settings carefully. You might need to see whether an update is available from the motherboard manufacturer.


About the Author

William R. Stanek (http://www.williamstanek.com/) has over 20 years of hands-on experience with advanced programming and development. He is a leading technology expert, an award-winning author, and a pretty-darn-good instructional trainer. Over the years, his practical advice has helped millions of programmers, developers, and network engineers all over the world. He has written over 25 computer books. Current or forthcoming books include Microsoft Windows Command-Line Administrator's Pocket Consultant, Windows Vista Administrator's Pocket Consultant, Microsoft Windows Server 2003 Administrator's Pocket Consultant, Second Edition, and Windows Server 2003 Inside Out.

Mr. Stanek has been involved in the commercial Internet community since 1991. His core business and technology experience comes from over 11 years of military service. He has substantial experience in developing server technology, encryption, and Internet solutions. He has written many technical white papers and training courses on a wide variety of topics. He frequently serves as a subject matter expert and consultant.

Mr. Stanek has an MS with distinction in information systems and a BS magna cum laude in computer science. He is proud to have served in the Persian Gulf War as a combat crewmember on an electronic warfare aircraft. He flew on numerous combat missions into Iraq and was awarded nine medals for his wartime service, including one of the United States of America's highest flying honors, the Air Force Distinguished Flying Cross. Currently, he resides in the Pacific Northwest with his wife and children.


Additional Resources for IT Professionals

Published and Forthcoming Titles from Microsoft Press


Microsoft Windows Server

Microsoft® Windows Server™ 2003 Resource Kit
Microsoft MVPs and Partners with Microsoft Windows Server Team
0-7356-2232-9

Microsoft Windows Server 2003 Administrator's Companion Second Edition
Charlie Russel, Sharon Crawford, and Jason Gerend
0-7356-2047-4

Microsoft Windows Server 2003 Inside Out
William R. Stanek
0-7356-2048-2

Microsoft Windows Server 2003 Administrator's Pocket Consultant Second Edition
William R. Stanek
0-7356-2245-0

Microsoft Windows® Small Business Server 2003 R2 Administrator's Companion
Charlie Russel and Sharon Crawford
0-7356-2280-9


Microsoft Windows Client

Microsoft Windows XP Professional Resource Kit, Third Edition
The Microsoft Windows Team with Charlie Russel and Sharon Crawford
0-7356-2167-5

Microsoft Windows XP Professional Administrator's Pocket Consultant Second Edition
William R. Stanek
0-7356-2140-3

Microsoft Windows Vista™ Resource Kit
Microsoft MVPs with the Microsoft Windows Team
0-7356-2283-3

Microsoft Windows Vista Administator's Pocket Consusltant
William R. Stanek
0-7356-2296-5

Microsoft Windows Command-Line Administrator's Pocket Consultant
William R. Stanek
0-7356-2038-5


Microsoft SQL Server 2005

Microsoft SQL Server™ 2005 Administrator's Pocket Consultant
William R. Stanek
0-7356-2107-1

Microsoft SQL Server 2005 Administrator's Companion
Whalen, Garcia, et al.
0-7356-2198-5

Inside Microsoft SQL Server 2005: The Storage Engine
Kalen Delaney
0-7356-2105-5

Inside Microsoft SQL Server 2005: T-SQL Programming
Itzik Ben-Gan, Dejan Sarka, and Roger Wolter
0-7356-2197-7


Microsoft Exchange Server 2003

Microsoft Exchange Server 2003 Resource Kit
Unkroth, Molony, Cherny, Reid, Strachan, English, and the Microsoft Exchange Server Team
0-7356-2072-5

Microsoft Exchange Server 2003 Administrator's Companion
Walter J. Glenn and Bill English
0-7356-1979-4

Microsoft Exchange Server 2003 Administrator's Pocket Consultant
William R. Stanek
0-7356-1978-6


Scripting

Advanced VBScript for Microsoft Windows Administrators
Don Jones and Jeffery Hicks
0-7356-2244-2

Microsoft VBScript Step by Step
Ed Wilson
0-7356-2297-3

Microsoft Windows Scripting with WMI: Self-Paced Learning Guide
Ed Wilson
0-7356-2231-0


Related Titles

Microsoft SharePoint® Products and Technologies Resource Kit
Bill English with the Microsoft SharePoint Teams
0-7356-1881-X

Microsoft Windows Security Resource Kit Second Edition
Ben Smith and Brian Komar with the Microsoft Security Team
0-7356-2174-8

Microsoft Systems Management Server 2003 Administrator's Companion
Steven D. Kaczmarek
0-7356-1888-7

Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant
Bud Ratliff and Jason Ballard with the Microsoft ISA Server Team
0-7356-2188-8

See even more titles on our Web site!

Visit: microsoft.com/mspress and microsoft.com/learning


More Great Resources for IT Professionals

Published and Forthcoming Titles from Microsoft Press


Administrator's Pocket Consultant

  • Practical, portable guide for fast answers when you need them

  • Focus on core operations and support tasks

  • Organized for quick, precise referenceto get the job done

Microsoft®
SQL Server™ 2005
Administrator's
Pocket Consultant
William R. Stanek
0-7356-2107-1

Microsoft
Windows
Server™ 2003
Administrator's
Pocket Consultant
Second Edition
William R. Stanek
0-7356-2245-0

Microsoft
Windows® XP
Professional
Administrator's
Pocket Consultant
Second Edition
William R. Stanek
0-7356-2140-3

Microsoft
Windows
Command-Line
Administrator's
Pocket Consultant
William R. Stanek
0-7356-2038-5


Administrator's Companion

  • Comprehensive, one-volume guide to deployment and system administration

  • Real-world insights, procedures, troubleshooting tactics, and workarounds

  • Fully searchable eBook on CD

Microsoft
Windows
Server 2003
Administrator's
Companion
Second Edition
Charlie Russel and
Sharon Crawford
0-7356-2047-4

Microsoft
Windows
Small Business
Server 2003
Administrator's
Companion
Charlie Russel,
Sharon Crawford,
and Jason Gerend
0-7356-2020-2

Microsoft
Exchange
Server 2003
Administrator's
Companion
Walter J. Glenn
and Bill English
0-7356-1979-4

Microsoft
Systems
Management
Server 2003
Administrator's
Companion
Steven D.
Kaczmarek
0-7356-1888-7


Resource Kit

  • In-depth technical information and tools from those who know the technology best

  • Definitive reference and best practices for deployment and operations

  • Essential toolkit of resources, including eBook, on CD

Microsoft
Windows Vista™
Resource Kit
Microsoft MVPs
with the Microsoft
Windows Team
0-7356-2283-3

Microsoft
Exchange
Server 2003
Resource Kit
Microsoft field
experts with
the Microsoft
Exchange
Server Team
0-7356-2072-5

Microsoft
Windows
Server 2003
Resource Kit
Microsoft MVPs
and Partners with
Microsoft Windows
Server Team
0-7356-2232-9

Microsoft
Windows Security
Resource Kit
Second Edition
Ben Smith and
Brian Komar with
the Microsoft
Security Team
0-7356-2174-8

Explore our full line of learning resources at: microsoft.com/mspress and microsoft.com/learning


Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]


A

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Access, Group Policy for
Accounts [See User and group accounts]
Activating Windows Vista
Active Directory 2nd
Active partitions or volumes 2nd
ActiveX controls
Add a Wireless Device to The Network wizard
Add Hardware wizard
Adding
menus
startup programs
user and group account members
Windows features
Add new users option
Add Printer wizard
Address toolbar
Admin Approval Mode
Administrative Template (.ADM) files
Administrative tools menu
Administrator accounts 2nd
ADMX eXtensible Markup Language
Advanced Configuration and Power Interface (ACPI)
Advanced Encryption Standard (AES)
Advanced Power Management (APM)
Advanced system information
Advanced tab, in system properties
data execution prevention (DEP) on
performance on
startup and recovery on
system and user environment variables on
virtual memory on
Alternate IP addresses
Application Compatibility Alerts
Applications
AutoPlay options for
compatibility of
default
Group Policy deployment of
installing
repairing
run levels of
Software Explorer for
virtualization of 2nd
Windows features and
Applying themes
Architectural changes in Windows Vista
hardware-independent
modularization and Windows imaging as
pre-boot environment as
preinstallation environment as
Area code rules, in dial-up connections
Audio devices, settings for
Automated help and support
introducing
support policies in
support services for
AutoPlay options
Autorun


B

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Background, desktop
Backup 2nd
Backup operator group
Balanced performance power plans
Basic disks 2nd 3rd
Basic NTFS access permissions
Battery status 2nd
BCDEdit tool
Bit Locker Drive encryption
Blocking disk I/O operations
Booting
to recover failed disks
in safe mode
system support tools for
Windows Vista
Boot partition or volume 2nd
Boot Performance Diagnostics
Broadband connections 2nd
Browser [See also Internet Explorer]
security of
testing
user interface of


C

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Cable modems
Cache, file 2nd
Calendar
Calling cards, in dial-up connections
Cards/adapters
Cascade Windows
Category control panel
Change-only synching
Classic control panel
Classic start menu
Clock
Color 2nd 3rd
Command line management
CompactFlash cards
Compatibility
Application Compatibility Alerts on
of applications 2nd
of data execution prevention (DEP)
forcing
plug and play 2nd
of wireless devices
Compatibility Administrator
Complementary metal oxide semi-conductor (CMOS) memory
Complete memory dumps
Components, information on
Compression 2nd
Computer Browser service
Computer console
Computer Management Console 2nd 3rd 4th
Computer name tab, in system properties
Configuring systems, hardware devices, and drivers
automated help and support for
introducing
support policies in
support services for
device drivers in
essentials of
group policy on
installing and updating
rolling back
signed and unsigned
tracking
uninstalling, reinstalling, and disabling
device manager for
device settings in
audio
of date and time
of keyboard
of mouse
regional
installing devices and
Internet time and
in domains
global settings for
managing hardware and
overview of
in workgroups
Connectivity, Group Policy for
Context menus
Control panel 2nd
Cookies
Corrupted files 2nd
CPU meter
Crash dump partitions or volume
Crashes, computer
Credential type
Critical battery alarm
Cryptographic operator group
Currency conversion
Cursor blink rate
Custom themes


D

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Data execution prevention (DEP)
Date and time setting
Default programs 2nd
Defragmentation 2nd 3rd
Deleting
disk drives
menus
user and group accounts
Deployment, in installation
Desktop
background on
icons on
public
sidebar and gadgets on
themes on
Desktop toolbar
Device(s) [See also Configuring systems, hardware devices, and drivers]
Device Manager for 2nd
Peripheral Component Interconnect (PCI) Express
with removable storage
wireless connection
Device drivers
essentials of
group policy on
installing and updating
rolling back
signed and unsigned
tracking
uninstalling, reinstalling, and disabling
Device settings
of audio devices
of date and time
of keyboard
of mouse
regional
DHCP server settings
Diagnostics
Boot Performance
built-in
for corrupt file detection
Disk
Memory
Memory Leak
network
performance
in startup
Windows Shutdown Performance
Windows Standby\Resume Performance
Windows System Responsiveness Performance
Dial-up connections 2nd
Disabling
device drivers
disk quotas
local area connections
personalized menus
services
startup applications
Discovery settings
Disk cleanup 2nd
Disk Diagnostic
Disk drives and file systems
basic and dynamic disk conversion and
basic disks and 2nd
Computer console for
deleting
designations for
Disk Management tool for
drive letters and paths for
dynamic disks and 2nd 3rd
FSUtil and DiskPart tools for
installing and initializing
partitions in
active
creating
deleting
formatting
troubleshooting
volumes on
deleting
formatting
label of
NTFS conversion of
shrinking or extending
spanned and striped 2nd
Windows Explorer access to
Windows ReadyBoost for
Windows ReadyDrive for
Windows SuperFetch for
Disk Management tool 2nd 3rd 4th
DiskPart tool 2nd
Disk quotas 2nd
disabling
entries of
on NTFS volumes
settings of
using
Display
color of
conserving power and
refresh rate of
video settings for
in Windows Mobility Center
Distribution groups
Domain environment
Group Policy in 2nd
Internet time in
local logon versus
network in
passwords in
user and group accounts in 2nd
Windows Vista in
Domain name system (DNS)
registering and flushing
of remote access servers
resolution of
Downloads 2nd
Dragging and dropping
Drive file size
Drivers [See also Configuring systems, hardware devices, and drivers]
Drives, disk [See Disk drives and file systems]
Drvload tool
DSL routers
Dual IP stack
Dumps, memory 2nd 3rd
Dynamic disks 2nd 3rd 4th
Dynamic Host Configuration Protocol (DHCP)
Dynamic IP addresses
Dynamic security protection


E

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

E-mail 2nd
Earthlink.net
Effective NTFS access permissions
Elevation of privileges 2nd 3rd 4th
Enabling
local area connections
personalized menus
services
startup applications
Encryption 2nd 3rd 4th 5th
Energy-saving settings 2nd [See also Mobile computing]
Error logs
Error messages
Event logs
Event viewer
Extended partitions 2nd
Extensible Authentication Protocol (EAP)
External devices [See also Configuring systems, hardware devices, and drivers]
External drives 2nd 3rd


F

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Fast user switching
FAT (file allocation table) 2nd 3rd
Favorites and links, on Internet
Feed headlines
File cache
File ownership
File security and resource sharing
on networks
accessing 2nd
for administration
creating
NTFS access permissions for
assigning special
basic
effective
file ownership and
inheritance and
options for
of public folders
File signature verification 2nd
File systems [See Disk drives and file systems]
Filter Manager
Firewalls 2nd 3rd
FireWire ports 2nd 3rd
FireWire/USB-attached external hard drives
Fit to screen, images set to
Flash devices 2nd
Folder ghosting
Format, quick
Found New Hardware wizard
Fragmentation
FSUtil tool
FTP (File Transfer Protocol)


G

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Gadgets, desktop
Gateways, in networks
Ghosting, folder
Gopher Internet settings
Group accounts [See User and group accounts]
Group Policy
access and connectivity
accessing
for application deployment
application of
configuring
on connection settings
on device drivers
on disk quotas
on file sharing
on Internet
logon and logoff scripts and
on logon and startup
on network map
on offline files
on power plans
on remote access
on script behavior
security and
on security zone usage
startup and shutdown scripts and
on system restore
on unsigned drivers
updating
on Welcome screens
on Windows Explorer 2nd
Group Policy Management Console
Group Policy Object Editor 2nd 3rd
Groups, local
Guest user and group accounts 2nd 3rd


H

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Hard drives, external 2nd
Hardware devices [See also Configuring systems, hardware devices, and drivers]
Hardware-independent architecture
Hardware resources, information on
Hardware tab, in system properties 2nd
Help and support [See Automated help and support]
Hibernation file cleaner
Hibernation setting 2nd
Hiding 2nd 3rd
High performance power plans 2nd
Hints, password
Home pages
HTML (Hypertext Markup Language)
HTTP (Hypertext Transfer Protocol)
Hybrid sleep state 2nd


I

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Icons 2nd 3rd
Identify validation, in mobile networking
IEEE 1394 (FireWire) ports 2nd 3rd
IEEE 802.11 specifications
Images [See Desktop]
Imaging, Windows
Indexing service
Inheritance of permissions 2nd
Initializing disks
Installing
applications
device drivers
devices
disks
preinstallation environment for
Sysprep image-based
Windows Vista
Internal drives
Internet
browser user interface for
connection and proxy settings for
cookies and temporary files from
customizing URLs on
default programs on
dynamic security protection and
Group Policy for managing
Internet Explorer add-on manager and
Internet Explorer security zones and
pop-up blocker for
problems connecting to
programs connected to
Internet Explorer
add-on manager for
custom buttons for
default URLs (universal resource locators) in
icon for
Protect Mode of
RSS (Really Simple Syndication) feed in
security zones of
Internet files, temporary
Internet Protocol (IP) Address
dynamic
for mobile computing
problems with
static
Transmission Control Protocol (TCP) and
Internet Service Providers (ISP) 2nd 3rd
Internet time
in domains
global settings for
overview of
in workgroups


J

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Java applets


K

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Kerberos security
Kernal memory dumps
Keyboard, settings for
Key ring entries


L

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Laptops [See Mobile computing]
Legacy applications 2nd
License terms
Links toolbar
Local area networks (LAN) 2nd 3rd 4th [See also Networks]
Local Intranet sites, in security zones 2nd
Local machine account
LocalService accounts
LocalSystem accounts
Local users and groups 2nd
Lockdown
Locking taskbars
Logging on to Windows Vista
Logon, Group Policy for
Low battery alarm
Low priority I/O designation


M

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Malicious software
Managing Windows Vista
advanced system information on
computer management console of
control panel of
start menu of
system and performance information on
system properties of
advanced tab in
advanced tab in: data execution prevention (DEP) on
advanced tab in: performance on
advanced tab in: startup and recovery on
advanced tab in: system and user environment variables on
advanced tab in: virtual memory on
computer name tab in
hardware tab in
remote tab in
system protection tab in
system support tools of
boot options
disk cleanup
file signature verification
startup applications 2nd
taskbar of
user and administrator user accounts of
Windows Management Instrumentation (WMI) of
Manual Restore Points
MAPI (Messaging Application Programming Interface)
Master File Table (MFT)
Memory
complementary metal oxide semi-conductor (CMOS)
dumps of 2nd 3rd
Random Access
separate
SuperFetch and
virtual
Memory Diagnostics
Memory Leak Diagnosis
Memory protection technology
Menus
administrative tools
classic start
context
modifying
simple start 2nd
Messaging Application Programming Interface (MAPI)
Microsoft DirectX9
Microsoft Management Console (MMC) 2nd
Microsoft Office Outlook 2007
Microsoft Online Crash Analysis tool (OCA)
Microsoft Windows Installer Package
Microsoft Windows Server 2003 Administrator's Pocket Consultant (Microsoft Press) 2nd
Mobile computing
alarms in
Disk Management issues with
networking for
power button and password protection on wake setting for
power plans for
advanced settings for
balanced
command line management of
creating
in Group Policy
high performance
saver
selecting
sleep mode in 2nd
synchronization in
Windows Mobility Center for
Mobile networking and remote access
automatic or manual connections for
broadband connections for
connection attempts and automatic disconnection for
dial-up connections for 2nd
firewall for
identify validation for
logon information for
networking protocols and components for
phone numbers for
proxy settings for
redialing options for
understanding
VPN connections for 2nd
wireless connections for
adapter for
connecting to
devices and technologies for
security for
working with
Modularization of Windows Vista
Monitors
changing
drivers for
energy-saving settings for
Mouse 2nd 3rd
MS-DOS programs, installing
Multimedia settings
Multiple gateways, in networks
My Network Places


N

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Netcfg tool
Net commands
NET SHARE command 2nd
Net start themes command
Net stop themes command
Network adapters
Network Address Translation (NAT) firewalls
Network configuration operator group
Network Explorer 2nd
Network map
Network Projector Wizard
Networks [See also Mobile networking and remote access]
on Computer console
file security and resource sharing on
accessing 2nd
for administration
creating
guest accounts and
icon for
installing components for
local area connections for
domain name service resolution for
dynamic and alternate IP addresses in
enabling and disabling
multiple gateways for
static IP addresses in
status, speed, and activity for
viewing configuration information on
WINS resolution for
for mobile computing
programs connected through
public folder sharing on
troubleshooting
Windows Vista features for
wireless 2nd
NetworkService accounts
Normal startup
Notebooks [See Mobile computing]
Notepad
Notification area of taskbar 2nd
NTFS (NT file system) 2nd
access permissions through
basic
effective
file ownership and
inheritance and
special
conversions of
disk quotas in 2nd
security options on


O

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Offline files 2nd
files or folders as
Group Policy for
controlling
file cache
setting
synchronization
types of
synchronization of
unavailable
understanding
working on
Ownership, file


P

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Page file partition or volume
Paging file size
Partitions, disk
active 2nd
boot
crash dump
creating
deleting
extended
formatting
primary 2nd
system
Passwords
complexity of
creating
for guest accounts
key ring entries as
in mobile networking
reasons for 2nd
recovering
required on wakeup 2nd
as temporary Internet file
to unlock computers
User Account Control (UAC) and 2nd
PC cards
Performance 2nd [See also Diagnostics]
Performance log users group
Performance monitor users group
Peripheral Component Interconnect (PCI) cards
Peripheral Component Interconnect (PCI) Express devices
Permissions 2nd 3rd [See also NTFS (NT file system)]
Personal digital assistants (PDAs) [See Mobile computing]
Personalization console
Personalized menus
Personalize Windows option
Personal toolbars
Phishing
Photo Gallery Viewer
PING command 2nd
Playback devices
Plug and play 2nd 3rd
Plug-ins
Policies [See Group Policy]
Pop-up blockers
Power plans for mobile computing
advanced settings for
balanced
command line management of
creating
Group Policy for
high performance
saver
selecting
sleep mode in
Power users group
Pre-boot execution environment (PXE) 2nd
Preinstallation environment
Presentations 2nd
Previous versions of software
Primary partitions 2nd 3rd
Printers, adding
Privacy settings
Private network
Privileges, elevation of [See Elevation of privileges]
Processes tab
Processor power management
Productivity, taskbars and
Program Compatibility Assistant Service
Program Compatibility wizard
Programs [See Applications]
Projectors, networked
Public folders 2nd
Public network


Q

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Quick format
Quick Launch toolbar 2nd


R

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Random access memory (RAM)
Recording devices
Recovering 2nd
corrupted files
failed disks
passwords
rolling back drivers for
in system properties
Recycle Bin 2nd 3rd
Redundant array of independent disks (RAID)
Regional hardware device settings
Register Windows option
Reinstalling device drivers
Relational database
Remote access [See also Mobile networking and remote access]
Remote assistance 2nd
Remote desktop connections
Remote desktop users group
Remote tab, in system properties
Removing
startup programs
themes
user and group account members
user and group accounts
Windows features
Renaming user and group accounts
Repairing installed applications
Repeat delay
Replicator group
Reset disk, password 2nd
Resolution, screen
Resource Exhaustion Detection and Resolution
Resource sharing [See File security and resource sharing]
Restarting Windows Vista
Restart Manager
Restore
inheritance permissions
Show Desktop button
system 2nd 3rd
WMI statistics
Restricted Web sites, in security zones 2nd
Return on investment (ROI)
Robust Security Network (RSN)
Rolling back device drivers
RSS (Really Simple Syndication) feed
RunAsHighest applications
RunAsInvoker applications
RunAsAdmin applications
Run levels of applications
Run lists


S

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Safe mode
Saver power plans
Screen resolution
Screen savers 2nd
Scripts 2nd
Search box
Search button
Secure desktop
Secure Digital (SD) cards
Secure guest user and group accounts 2nd 3rd
Secured passwords
Security [See also File security and resource sharing]
applications and
in domain environment
dynamic protection for
Internet Explorer security zones for
Kerberos
of NTFS
User Account Control (UAC) for 2nd 3rd
Wired Equivalent Privacy (WEP) protocol for
for wireless connections
of WMI statistics
Security groups
Security identifiers (SIDs)
Selective startup
Services, system
Settings of hardware devices [See Device settings]
Setup Information files, for drivers
Set userprofile command
Sharing of resources [See File security and resource sharing; Networks; Offline files]
Show Desktop button
Shutting down Windows Vista 2nd 3rd
Side-by-side, show Windows
Sidebar, desktop
Signal strength, in wireless connections
Signed and unsigned device drivers
Simple start menu 2nd
Single-instance storage
16-bit programs, installing
Sleep state, computer in 2nd
Slide show, on desktop
Small memory dumps
Smart Cards
Socks Internet settings
Software Explorer
Software, information on
Sound themes 2nd
Spanned volumes 2nd 3rd 4th
Special identities, for permissions
Special NTFS access permissions
SSL (Secure Sockets Layer)
Stack Windows
Standard (in-place) file sharing
Start menu
adding options to
classic
rearranging items on
simple 2nd
Startup
Group Policy for
programs in
scripts for 2nd
Software Explorer and
in system properties
system support tools for 2nd
Startup Repair Tool (StR)
Static IP addresses
Storage 2nd 3rd
Striped volumes 2nd 3rd 4th
Submenus
Subnet mask
Summary network map
Support [See Automated help and support]
Sync Center
Synchronization 2nd 3rd
Sysprep image-based installation
System and user environment variables
System Checkpoint
System configuration utility 2nd 3rd [See also Configuring systems, hardware devices, and drivers]
System information
System partitions or volume 2nd
System properties of Windows Vista
on advanced tab
data execution prevention (DEP) on
performance on
startup and recovery on
system and user environment variables on
virtual memory on
on computer name tab
on hardware tab
on remote tab
on system protection tab
System restore 2nd 3rd
System support tools for Windows Vista 2nd
boot options
disk cleanup
file signature verification
startup applications 2nd
System time [See Internet time]


T

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Tablet display
Taking ownership permission
Taskbar
notification area of
size and position of
visibility of
Task Manager 2nd
Task scheduler
Templates 2nd
Temporary files, Microsoft Office
Temporary Internet files 2nd
Themes 2nd
3D flip view
Thumbnails 2nd
Tile images
Time 2nd [See also Internet time]
Toolbars 2nd
Total cost of ownership (TCO)
Tracking device drivers
Transfer files and settings option
Transmission Control Protocol/Internet Protocol (TCP/IP) networking
Transparency slider
Traveling users [See Mobile computing]
Troubleshooting
disks
networking
in preinstallation environment
safe mode for
services
startup applications
Trusted Web sites, in security zones 2nd
Turning off Windows Vista


U

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Unattended installation answer file
Uninstalling 2nd
Unsecured passwords
Unsigned device drivers
Updating 2nd
Upgrading to Windows Vista 2nd
URLs (universal resource locators)
Usability improvement
USB (universal serial bus) devices 2nd 3rd
USB (universal serial bus) ports 2nd 3rd 4th
User Account Control (UAC)
application installation and 2nd 3rd
enabling and disabling
in managing Windows Vista
for security 2nd
User and group accounts
adding and removing members of
changing types of
controlling logon to
creating local
creating workgroup local
deleting
domain versus local logon to
essentials of
existing domain accounts and
passwords for
creating
key ring entries as
recovering
remote access to
removing
renaming
secure guest
for workstations
User environment variables
User interface [See also Browser]
User profiles
Users, local
User's Files folder
Users' group


V

Previous Page
Next Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Versions, previous, of software
Video settings
View computer details option
Virtualization of applications 2nd
Virtual memory, in system properties
Volumes, disk
active
boot
crash dump
deleting
formatting
label of
NTFS conversion of
page file
settings for
shrinking or extending
spanned and striped 2nd
spanned or striped
system
VPN (Virtual Private Network) connections 2nd 3rd 4th


W

Previous Page

Index

[A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Welcome Center
Welcome screens
Wi-Fi Certified
Wi-Fi connection
Wi-Fi Protected Access (WPA)
Wi-Fi Protected Access Version 2 (WPA2)
Windows Aero 2nd
Windows Anytime Upgrade
Windows Classic
Windows Easy Transfer wizard
Windows Experience Index
Windows Explorer
configuring offline files in 2nd
drive access in
file type associations in
Group Policy for
sharing files in
viewing permissions in 2nd
Windows Features 2nd
Windows Hardware Quality Lab
Windows Imaging Format (WIM) 2nd 3rd
Windows Management Instrumentation (WMI) 2nd
Windows Mobility Center
Windows ReadyBoost
Windows ReadyDrive
Windows Resource Exhaustion Detection and Resolution
Windows Search service
Windows Shutdown Performance Diagnostics
Windows Standard
Windows Standby\Resume Performance Diagnostics
Windows SuperFetch
Windows System Responsiveness Performance Diagnostics
Windows Vista [See also Managing Windows Vista]
activating
architectural changes in
modularization and Windows imaging as
pre-boot environment as
preinstallation environment as
getting started with
installing
turning off and shutting down
in workgroups and domains
Windows Vista Basic
Winsock Service Providers
WINS resolution
Wired Equivalent Privacy (WEP) protocol
Wireless connections
adapter for
connecting to
devices and technologies for 2nd
networks through 2nd
security for
working with
Wireless Equivalency Protection (WEP)
Wizards
Add a Wireless Device to The Network
Add Hardware
Add Printer
Found New Hardware
Map Network Drive
Network Projector
Program Compatibility
Windows Easy Transfer
Workgroups
Internet time in
local user and group accounts of
Windows Vista in
Workstations, user and group accounts for