Windows Server 2012 Masterclass Clinic 21-22 September 2013
Always wondered how to implement BranchCache, or what’s involved in a VDI infrastructure? Then book on this one-off weekend Masterclass special. Places are limited, and we will be covering the topics YOU want to know more about. Drop in with your questions for MVP Chris Rhodes to answer on topics surrounding Windows Server 2012. Demos and guidance from veteran MCT Chris Rhodes at the picturesque York University Ron Cooke Hub by the lake. September 21-22. Call 01904 325154 or email Andrew.Bettany@York.ac.uk for more info on how to take advantage of this limited offer.
More info here http://www.itmasterclasses.com/masterclasses/eventdetails.aspx?eventid=78
AppLocker
History
Allow me to start by telling you a story. A long while ago, I did some work for a travel agency. The project I was involved in was a desktop upgrade, rolling out NT 4.0 Workstation across the company. This included the computers in the agency retail outlets used to help sell flights and holidays. The company needed to limit the applications were allowed to run on the computers, as it hardly looked professional if a customer entered the shop to see an assistant playing Solitaire! Back in those days, we used Poledit.exe to customise what users could see and do on the desktop. So much has changed since then.
In more recent times, such as with Windows XP, Group Policy incorporated newer settings for administrators to manage desktops, and this included Software Restriction Policies (SRPs). SRPs allowed administrators to limit which applications users could run, based on rules such as path, and certificate publisher.
Today
Now with Windows 7 and Windows 8 Enterprise editions, administrators can now leverage a more modern set of tools via the Applocker feature in Group Policy. Applocker settings can be found in the following area as seen in figure 1.
Figure 1. Applocker settings in Group Policy.
You can configure the following types of rules in Applocker:
· Executable rules – rules that point to a folder containing executables, or a specific executable.
· Windows Installer Rules – rules which control which programs can be installed in the first place, rather than limit them running afterwards.
· Script Rules – increasingly, administrators use scripts like PowerShell scripts to manage desktops. The behaviour of scripts can now be controlled.
· Packaged App Rules – the newest to the collection. This is for Windows 8 Apps, or otherwise known as side-loaded apps. You can find out more about side-loading in the Windows 8 Jump Start video collection.
Why use Applocker?
One of the benefits for administrators is that Applocker allows very customisable rules that allow/disallow applications, scripts and installers, and not just system-wide like SRPs used to do, but per user or per group now as well. This gives a level of granularity that simplifies management, and the number of Group Policies that need to be deployed across an organisation.
Administrators should be interested in this feature to ensure security and licencing compliance needs are met, and to help reduce the TCO in managing applications that users might otherwise download and install.
How Does It Work?
Firstly an administrator will create/edit a Group Policy Object such as the one you’ve seen above. Based on the business needs, rules are created to permit/deny some applications/scripts/installers to run for different users or groups. In figure 2, I’ve created an executable rule by first creating the default rules that allow users to run all programs from ‘Program Files’ and ‘Windows’ folders, and administrators to be able to run all applications from all folders. I’ve then created a rule that specifically denies notepad.exe using a hash rule, meaning that even if the file is moved or renamed, the rule will still control access to that application. It’s also important to remember to configure rule enforcement, as by default no action is taken.
Figure 2. Executable rules configured in Applocker in Group Policy.
Once the policy applies to a Windows 7 or Windows 8 domain joined computer, the Application Identity service will use the deployed information whenever a request to launch an application takes place.
Summary
The desktop administrator today has more options than ever before to control Windows operating systems. When used in an Active Directory environment, Windows 7 and Windows 8 can be robustly managed to help ensure licencing compliance and security on the desktop with Applocker.
For more information on Applocker and Group Policy, visit the Springboard website.
70-410 & 70-417 TechEd Sessions
Win a trip to TechEd Madrid!
The kind folks at TechNet are giving away, not just a show ticket, but a fully funded flights an’ all trip to TechEd Europe. That’s a pretty good offer. Normal entrance price alone for the conference is €2000.
It’s pretty easy to enter. All you need to do is to download/trial one of more of the following technologies:
- Windows Server 2012
- System Center 2012 SP1
- Windows Azure
Then write a review and submit it. Simples.
There is a golden ticket up for grabs for each technology, so you have 3 chances to win!
Or you could win a runner up prize of a shiny new Windows Phone.
Full details here http://www.microsoft.com/uk/techedchallenge/
TechEd Europe is 24-28 June 2013. Full conference site here.
Also worth tweeting to see if you can win a spot prize, just for using the hashtag #TechEdChallenge
What have you got to lose?!
End of Good Times?
Well, as operating systems go, it was a good one. It had a great life, and everyone loved it. Heck, I still have a hard time convincing people to get off it. The cold hard fact of the matter is that as of April 9th 2013 (i.e. it’s already too late!) Windows 7 is no longer supported.
Hey, wait a minute – did he say Windows 7??
Yes. OK, let me be a little more specific, Windows 7 RTM – i.e. those systems without SP1. As per lifecycle policy, and therefore it should come as no surprise, support has now ended.
Don’t panic!
All is well, you good people, (as I’m sure you are), as you will have been good boys and girls and of course installed SP1 ages ago, so all is well. That’s if you are not already using Windows 8 of course. In fact, Windows 7 has many good years of life left in it yet, until 2015 for mainstream support, and until 2020 for extended support. Phew!
But the passing of this date does draw into focus a slightly more worrying deadline that I fear many are going to fall foul of. That being the 8th April 2014. Yes, that’s not far away, less than a year as of the time of writing. 347 days to be exact. This time I am talking of course about Windows XP. Again, this should not come as a surprise, it has been well documented for quite some time.
The thing that worries me (and I’ll stop short of saying it keeps me awake at night), is that many companies are either a) blissfully unaware – spot the deliberate pun? or b) they know this, but simply haven’t started rolling out a replacement yet. Many are in the pipeline, but if you have not yet started, please be aware, the average company takes between 12-18 months to complete a rollout of a desktop operating system from envisioning the plan to actually supporting it out in the field.
This unfortunately doesn’t give much time to get out of the situation of being unsupported. There is good news of course. There is a wealth of information and experience out there for IT Pros to tap into, and a whole bunch of tools that make deploying Windows way simpler than you think. Start by visiting the Springboard site which is a dedicated portal for IT Professionals to make understanding these kinds of key technologies.
Also well worth a visit is the deployment module on the Microsoft Virtual Academy. Great for learning at your own pace the tools and techniques that are used in deploying a modern operating system. Feel free to comment with questions.
One idea for the weekend for you is to pilot a VDI solution. This allows you to deploy virtual machine based Windows clients, thus accelerating your upgrade pathway out and away from XP.
Let’s face it folks, XP had a great run for it’s money, and before the coffin gets laid to rest next year, it will have had 12 years of support from Microsoft, but every dog has it’s day. Do yourself a favour and get onto Windows 7 or Windows 8. You won’t regret it. 
For more information on the lifecycle policy click here.
More info and links on the countdown and what you can do about it can be found here.
*Free* Learning Resources
I get a lot of questions in my job as an MCT about recommending resources to people who want to either study for exams, or just further their understanding about new technologies. Just today a friend of mine in the US wanted to know about some resources he could use to help prepare him for his upcoming Windows 7 exam.
It got me thinking. Sometimes it’s great to go on a 5 day course (well I would say that, I teach ‘em!). Without doubt, you get unrivalled knowledge from a super qualified Microsoft approved instructor who is typically a top bod in their field on the chosen subject.
However, that doesn’t always fit for some folks due to time and monetary constraints. Let me point you folks to four (thanks @Shih_Wei for the correction!) super cool resources you may not know, and will allow you to learn in your own time, at your own pace, sat in your comfy armchair at home.
1) Free E-Books. Check out these titles from MS Press that you can download and read offline for nowt!
http://blogs.msdn.com/b/microsoft_press/archive/2012/05/04/free-ebooks-great-content-from-microsoft-press-that-won-t-cost-you-a-penny.aspx
2) Springboard. For all things Windows, you just can’t beat it. There are tutorials, articles, videos, walkthroughs and much, much more. IT Pro’s should know this and have it bookmarked in their browser for sure. http://www.microsoft.com/springboard Check it out!
My personal favourite up there now is the Windows 8 jumpstart event. A whole day of recorded video content on the coolest OS from Microsoft yet. http://technet.microsoft.com/en-us/windows/jj687764
3) MVA. If you’re not already using it, go give it a visit, it’s the Microsoft Virtual Academy. Some superb content on all kinds of topics from developer content to Windows 8 and Windows Server 2012 and more. Check your stats out against your friends, your country and the world with the self-assessments on there too! You may even see some of the content I wrote too.
http://www.microsoftvirtualacademy.com
4) 90 Days to MCSA. The push to get certified in 90 days to attain MCSA – with a little help from your friends at Microsoft Learning. Great video and other resources to help you study and achieve your goals. Join in the fun!
http://borntolearn.mslearn.net/mcsa90/default.aspx?WT.mc_id=MSLS_MCSA90#fbid=pgT4jXIh2wA
Well, if you get through that lot, let me know and I’ll fix you up on one of my courses too!
Windows Server Certification Paths
I just saw this on the Microsoft Born To Learn website and had to share it.
It’s a great infographic showing where you need to start, or how you can upgrade your knowledge and certification to Windows Server 2012. Enjoy!
MVP Open Day UK at Bletchley Park
I was honoured recently to be awarded the MVP award by Microsoft.
The first event as an MVP I have been privileged to attend as a newbie, was the open day for UK and Ireland awardees that was held at Bletchley Park last week.
Apart from a great 2 days of meeting other MVPs and hearing some great sessions, we were afforded a tour of the museum, with it’s unrivalled collection of computers old and new.
Of course, most people will know Bletchley as the home of the code breakers from WWII. It rightly deserves its reputation as a place of great genius, that the allies and the wider world have benefited from as a result of what happened there during the war.
Here are a couple of the snaps I took during the visit that I hope will inspire techies old and young alike to go and visit. Even if you are not a techie, it’s well worth a day out with the kids. It’s an important part of our heritage, as a country of ingenious computing industry founders like Alan Turing who worked there.
A working rebuild of the now destroyed original Colossus computers commissioned in WWII.
Absolutely amazing to see how the reverse engineering of an unseen crypto machine (the Lorenz, not the Enigma machine – that was the Bombe – also a working copy of which is here) was done, and how this accelerated the interception of German communications during the war. This literally saved lives.
The Harwell Dekatron (aka the WITCH). Just the week before, it had been fully restored and working thanks to the computer conservationists and now on show at Bletchley Park. The oldest original functioning electronic stored program computer in the world. That’s quite amazing in itself. But it actually works! Of course, your average mobile phone has more computing power these days, but let’s not take the shine off what is an extraordinary achievement getting this back to it’s former glory.
Recognise this piece of more
‘modern’ kit?
Oh happy days. I remember many a school classroom kitted out like this in the ‘80’s.
What ever happened to that generation of kids? 
And more importantly, why are the kids of today not coding from the age of 6 like we did?
Go visit. Details here http://www.bletchleypark.org.uk/content/museum1.rhtm
Windows 8 Shortcut Keys
I’ve been trying to convince all I meet recently that they should take a look at Windows 8 if they haven’t already. I don’t know what it’s like where you live, but every, and I mean every ad break on TV right now contains Windows 8 adverts. Not a bad thing IMO, especially with Christmas round the corner.
One thing I have found on my travels from the uninitiated, is they feel that without a touch PC, they are missing out. I myself do not have one, and am quite happy on my lappy with keyboard and mouse – thank you very much. If anything, my productivity has increased since using Windows 7. That’s not to say if Santa is reading, that a new tablet wouldn’t be appreciated.
One of the reasons is (and perhaps I am forced to a little more to be fair), I am using more shortcut keys than ever before. So I thought I document a few here for those wanting to try it out, and see for yourselves. Incidentally, you can grab a 90 day eval here of Windows 8 Enterprise to see what all the fuss is about.
| Windows key | Brings up the start screen (like the start menu – but more real estate!). Also toggles you back and forth to the desktop. Hit this, start typing the name of an app, and you’re away. Great by itself – but more fun with friends! |
| Windows key + left arrow | snaps the current app to the left of the screen |
| Windows key + right arrow | snaps the current app to the right of the screen |
| Windows key + up arrow | maximises current app |
| Windows key + down arrow | restores/minimises current app |
| Windows key + Q | shows all installed apps |
| Windows key + R | run dialog |
| Windows key + X | admin tools – great for IT Pros. All the family favourites here |
| Windows key + I | brings up the settings pane, great for control panel or personalisation |
| Windows key + C | brings up charms |
| Windows key + M | minimises current app |
| Windows key + S | creates a screen clipping (requires OneNote) |
| Windows key + E | Launches file explorer |
| Windows key + <number> | Launches an app from the taskbar, counting left to right |
| Windows key + D | shows the desktop |
| Windows key + P | second screen settings |
| Windows key + W | search settings |
| Windows key + F | search files |
| Windows key + Tab | switches between Windows 8 apps (like alt+tab for x86 apps) |
| Windows key + U | Ease of access center |
| Windows key + T | toggles between taskbar apps |
| Windows key + H | share charm |
| Windows key + K | devices charm |
| Windows key + L | locks the screen |
| Windows key + Enter | starts Narrator |
| CTRL + + | zooms in when on the start screen |
| CTRL + – | zooms out when on the start screen |
| CTRL + left arrow | switches between groups of apps when zoomed out on the start screen |
| CTRL + right arrow | switches between groups of apps when zoomed out on the start screen |
Of course, there’s a whole load more to Windows 8 than this, but hope that helps the keyboard folks out there like me!
If I’ve missed one, comment please and I’ll add it in.
Windows 8 Application Compatibility–What Are My Options?
I’ve been doing a bit of work recently with application compatibility, or more commonly known as appcompat for short.
While I have found that there is a heap of documentation on the Microsoft Springboard site for detailing how-to’s on particular topics, one thing I’ve not really been able to put my finger on, is what exactly are the options for IT Pro’s in Windows 8 environments?
First, I would urge you to familiarise yourself with the excellent information that you can find in the appcompat area here. I will next attempt to summarise the whole issue of application compatibility, and why it warrants time spent dealing with it, before I move on to what we can do to deal with any issues that arise.
Setting The Scene
If you are not aware of why this is a massive problem, let me explain.
Suppose you run an enterprise network, such as a high street bank. There’s a good chance you are still running an older operating system on your client computers, with older applications to boot. So let’s suppose we imagine that a company runs Windows XP with Office 2003 and other business applications on their client computers right now.
The company realises that Windows XP’s days are numbered, with extended support ending in April 2014. This is a big deal to many companies, as they will loose their accreditation, or compliance rating if they are using out-dated, or more importantly, out of support products. For many organisations like banks, this simply won’t do.
So the solution is simple – right? Upgrade to a new operating system and applications. After all, having skipped a couple of versions, they are ripe for a refresh anyway, and they surely have wrung every last drop out of their investment in an operating system they could well have been using since 2001! (Most people wouldn’t dream of owning a car that long, never mind a PC).
Is it a problem?
Yes and no. But mostly yes.
If you are running a PC now with Windows XP, and that era of applications (or even older than that in most cases), then a lot has changed over the years to where we are now. This is not the place to detail all the in’s and out’s, so check out this link for more info why this is a big deal.
Suffice to say, older applications can just simply not work, or need fixing to make work on a modern OS such as Windows 8. The fact is, a typical organisation will need to assess this, as if an application is found to be incompatible with Windows 8, that could potentially be a show-stopper in the deployment of a new desktop refresh.
Where do I start?
Understand what you have.
I did some work for a UK bank not so long ago, and they found that they had over 12,000 applications in use at that time. The intention was to reduce that to 7,000 (still a big number, but way more manageable!), as part of deploying a new operating system to replace Windows XP.
If you don’t know what you have got installed on your machines, here’s a quick summary of your options in how to find out.
- Microsoft Assessment and Planning (MAP) Toolkit – a FREE tool that runs without agents on your PCs and gives you centralised reporting on readiness of hardware, but in this context, also tells us what applications (and their versions) are installed on the computers.
- Asset Inventory Service (AIS)– one of the constituent components of the MDOP suite for software assurance customers.
- System Center Configuration Manager (SCCM) 2012 – much more than just helping to inventory computers. This can help meter software usage as well, and of course can be used to deploy applications and operating systems.
- Windows Intune – cloud based computer management of computer assets that may or may not be domain-joined. Great for home workers, or field based computers. This is an awesome technology by the way, check it out on the 30 day free trial.
ACT Now!
I mean the Application Compatibility Toolkit.
This is a fantastic tool that can also report on what applications are installed, but more importantly, will assist the IT Pro in evaluating which applications are critical, are high priority and will help you spend the right time in the right areas. For example, there’s no point spending a week trying to make an application work, if only 3 people in the entire company actually use it.
This tool will help highlight which applications are known to not work, or have fixes suggested by the community database it taps into.
This brings me to the point of this blog post.
What are my options?
The Options
As of Windows 8, we no longer have XP mode as an option.
It was a stop-gap solution, which frankly, should always have been used as a short-term appcompat solution. This used to allow us to run a Windows XP virtual machine in Windows 7, thanks to Windows Virtual PC. This is not a supported configuration (neither is MED-V for the same reasons at the time of writing) for Windows 8, so let’s move on to what we CAN use to help resolve appcompat issues.
- The following list is in no particular order as it depends on why the incompatibility exists in the first place, or how much time and effort should be put into making it work if an easier/cheaper way around can be found. Nevertheless, I’ve tried to include rationales for each option. I am happy to update this if folks have suggestions, but it should be seen as a starting point, as in some cases more than one option may exist for a given situation.
| Technology | What it does | When is it appropriate to use it? |
| Get a new version or patch from the original vendor | Brings the application current to a supported configuration on Windows 8 that allows it to run | Simple and quick way of bringing an incompatible app into a supported configuration. Sometimes the low-hanging fruit that IT Pros need. Always check this first! |
| Choose a new app | Replaces an incompatible app with one of equivalent functionality that runs on Windows 8 | Replace the faulty app with a whole new one. Sometimes cheaper than spending time trying to make an existing one work, or where the original vendor has gone out of business or is not interested in patching the older version. Maybe there’s a new app in the Windows 8 Store? |
| Create a fix | Use the ACT tools to create a ‘shim’ or fix(es) to fool the application that it is running on an older OS | When an app *almost* works, but needs a helping hand to eliminate runtime errors, such as demanding a particular version of Windows or IE, or insisting on admin rights to function.
Dozens of fixes are available in ACT. Often used in enterprise environments.
|
| Remote Desktop Services (RDS) Session | Virtualises a desktop session | Apps are installed on a server, then run via RDP in the Remote Desktop Connection program included in Windows (also available for MAC users)
intranet or homeworkers or field based users can run line of business apps without the need for a domain joined computer. Also good for older machines that won’t meet the hardware specification for a newer OS (can also be accessed via a browser) |
| RDS RemoteApp | similar to above, but just the app is presented via RDP, not an entire desktop session.
Avoids the ‘double desktop’ problem users otherwise may face. Great for hybrid scenarios where some apps are run locally, and some from the RDS server. (can also be accessed via a browser) |
|
| Virtual Desktop Infrastructure (VDI) | Presents Hyper-V Windows client virtual machines with RDS | Allows older computers to run Windows 8 and newer applications alongside their existing OS that wouldn’t locally support the new apps.
Users connect to Windows 8 VM’s via RDP. Can also be used to provide rapid access to the new environment ahead of a planned deployment later. |
| App-V | avoids apps being installed locally in the ‘traditional’ way.
apps are streamed to the desktop and can be cached and run from there |
Apps must be compatible with the underlying Windows OS in the first place. This does not directly solve appcompat issues.
It can be used, however, in situations like needing to maintain an older version of an app, alongside a newer version, where that would otherwise cause a conflict with both being installed locally. Imagine installing Office 2003 and Office 2010 on the same computer. Can be used to allow older add-on’s or plug-in’s to work in conjunction with older apps. Can avoid loading code on to a machine in the traditional way. Speeds up app deployment. |
| Hyper-V | hosts virtual machines that could be legacy operating systems including older applications | not really a great option, and not one that Microsoft want you to folllow, not least of which is because of licensing implications. Guest OS’s would need a licence as well as the host.
Would allow, for example, a Windows XP virtual machine to be installed and incompatible apps loaded onto it. A clunky way to solve appcompat problems, and not really dealing with the problem, just postponing it. Used in a minority of situations (if at all) as it would be a large overhead on the PC. |
Tip: check against the community database with this to save time and effort.Boot Note
Just to add something into the equation I did not say up top, but to get you thinking – also consider the BYOD situation, where users may be using their own computers. This could also now include Windows RT devices, where x86/x64 applications simply do not run. What if, for instance, a user wishes to use their RT device like a Surface? Well there actually is a RDP client for Windows 8 in the Store that users can pull down. This would give them access to RDS and VDI of course (see above).
This could well be the way forward for some organisations. They may simply not have apps installed locally any more. I’ll leave you with that thought!
Feel free to comment on ideas/omissions I may have inadvertently missed.
Chris Rhodes MVP 
