More Vista Notes...

Some other notes on Windows VISTA…

Microsoft developed VISTA with something they call the Secure Development Lifecycle. The largest part of the new O/S is security. Yes it looks pretty, but security was the overall goal. Vista comes with the UAC (User Account Control) and Windows Defender (Anti-Spyware). There are 2400 GPOs (Group Policies) and PERFMON (Performance Monitor), which shows when software was installed, patches downloaded, spyware or malware installed, and registry changes. It can tell where and what is slowing down your system. Overall, the security has a large presence and so far, it has made me feel more secure and safe using Windows VISTA. I also fell in love with the Instant Search feature. It’s available almost everywhere you look in VISTA. It’s located in the Start menu, Each Explorer window, and in the Control Panel.

AERO is what makes VISTA look futuristic and “beautiful.” It has the ability to use Flip 3D. Microsoft took a page out of Apple, but it’s works great – Just hold down the tab + Windows key and you can flip through each open program just like a Rolodex. AERO is available on Home Premium, Business, and Ultimate. I’m not sure about Enterprise, since it’s for multi-installation use. My big question this week was – How come BitLocker is only available with the VISTA Ultimate Edition and VISTA Enterprise? Why doesn’t it come with VISTA Business? That would make sense, right? Well – the general feeling was Microsoft did not want to get caught up in lawsuits where companies using BitLocker in Business Edition lost data or could not get to it for being too secure – so they left that up to a third party vendor. There’s more to come on that topic once I find out.

Stay tuned.

Compatibility Issues with Windows VISTA

Several computer users may notice that various software programs are not compatible with Microsoft Windows VISTA. Users of these select programs will need to check with the software manufacturers for updates and patch information before going forward.
Here is a list of known software with Vista compatibility issues:

• Adobe InDesign CS2
• Adobe Reader 7
• Adobe Acrobat 8
• Google Desktop Search
• MSN Messenger 7.0
• Norton Antivirus 2004/2005
• Norton Internet Security 2004/2005
• Pinnacle Studio 10
• Quicken 2006
• Spybot Search and Destroy
• Trend Micro PC-illin Internet Security
• Remedy ARS

IT Conference T-Shirt of the Week

IT Conference T-Shirt of the week:

Geek ('gek), noun.

1. Obsessive computer user: Somebody who enjoys or takes pride in using computers or other technology, often to what others consider an excessive degree.

2. Someone with greater than normal computer skills.

Thursday

Tips and Tricks for Monitoring System Performance

Today at the IT Conference, I listened and asked questions about something very close to an IT support Helpdesk: Performance!

Windows VISTA uses Performance Monitor (PERFMON) and it's quite a tool. It shows the reliability and performance of a client's machine and let's us know if the error is something server-side or local. With Performance Monitor, user's or IT staff can tell when Registry changes occur, when installations occur, patches are downloaded, or spyware, malware, or other harmful software is executed. It's all in a graph-like area located within Vista under the Control Panel. It's very smooth and will be very useful for ANY Help Desk staff. You can even spit out reports from the PERFMON, but since Vista is an XML based framework, you're going to see XML through a IE browser window - not too bad if a client gets a BSOD (Blue Screen Of Death), they can then call or send an Email - After doing your own research, the IT Support staff can come up with strategic ways to have clients either view or print from PERFMON, then send it to the IT staff for assistance. This will also be easier if your company decides to implement Remote Access. Each IT representative could login and view the client's PERFMON and find out what happened.



Wireless (802.11 - This is the area specific to Over-The-Air wireless networks) & VISTA Security

An Ethernet connection (802.3) is not always available and therefore, clients and employees will use the LOCAL Wireless LAN. The SSID (Service Set IDentifier) will always be listed.
This lets the end-user know that they're connecting to the CORRECT Network. (Note: The latest security threat is something called, 'Evil Twin.' It looks like the same SSID and once connected the hacker collects usernames, passwords, credit cards, etc. There is more information on this located here: http://tech.yahoo.com/xb/null;_ylt=AsZUpDYbVVYSg3slZ_3w3I4sLpA5?blogpost=23163&comment_start=1&comment_count=20&sendurl=http%3A%2F%2Ftech.yahoo.com%2Fblogs%2Fnull%2F23163%2Fbeware-the-evil-twin-wi-fi-hotspot).

WEP (Wired Equivalent Privacy) is the encryption of Wireless LAN access. But "just because you're WiFi is encrypted does not equal integrity," according to Steve Riley from Microsoft. Riley spoke of wireless security and of VISTA security via wireless - I found this exciting, since the UI and the steps for adding a wireless network to your VISTA machine are different than with Windows XP. VISTA uses a wireless framework called (P)EAP (Protected Extensible Authentication Protocol) on it's wireless networks. It's a partnership with Cisco to make wireless networks more secure and prevent rogue wireless networks from accessing our network. This was more server-side discussion, but later he talked about the overall security of VISTA.

When setting up your laptop or desktop to connect to a wireless network using the Microsoft VISTA O/S, there are some minor changes, but major security changes. The UI displayed when trying to gain access to WiFi has a few enhancements. The preferred network order is strictly enforced. That means YOUR SSID will appear at the top and be the network most likely to connect. You can setup the preferences within the GPO (Group Policy) for each machine as well. There are also new dialogue boxes that appear in VISTA when applying for access to WiFi Networks. As discussed earlier, with VISTA, Administrators can now allow/disallow access to various wifi networks. (Each machine can be setup to allow/deny certain SSIDS like (Starbucks) tmobile, (Hilton) hhonors, or the millions of others available throughout the world). Please see last Tuesday's blog for more.

Connecting to a Wireless Network is not hard, but the UI has a new look and feel, just like the rest of VISTA. It looks, "Beautiful." (That is the buzz word down here) - When setting up a WiFi network connection, the back button is no longer at the bottom right, but is now located on the top left of each WiFi UI screen. The Network Name field really means the same thing as SSID. Note: Group Policy for Windows Vista is now built-in to VISTA and available for Windows XP.

Lastly, Riley said that he was not selling anything and that he asked us to believe in Microsoft. He admitted they were slow to catch up to security, but he believes that VISTA is the most secure product ever and that no third party software is necessary for protection. He said to at least give it a try and see what you can do - He also believes that Microsoft got serious about security late, but after Windows XP SP 2 things have tightened up and it's their priority to provide safe and secure products.

Keynote Address

The Keynote Address - Techmentor

The Keynote Address for TECHMentor '07 was by Mark Minasi. He is described as a "veteran Windows pundit and best-selling author, and popular technology columnist..." Minasi's speech was about LONGHORN (Microsoft Server 2007). It's not yet available, but he spoke about how it will work with Vista and it's many new features. He wasn't 100% impressed with Longhorn, but did have some good things to say, including the ability to set password expiration for different groups, or Active Directories (AD). (i.e. - make password expire every 6 months, but make senior employee's password expire every 10 months.) He also said there are new features inside msconfig (this allows different processes at startup to start/stop and it can be put in various orders, depending on what you want). He also spoke proudly of Vista and Longhorn's use of WDS (Windows Deployment Services). Yes, the keynote address was more about the upcoming new Microsoft LONGHORN server, but I found it quite interesting and exciting - just to know what the features are, how they will be put together, how it works, and what is good/bad about the new server structure. From the talk, it looks like Microsoft is making it easier to manage servers and more user-friendly, less time-consuming, depending on how large your network may be. All in all, he thought that "NT 4.0 Server is the apex of domain structures." After the talk, we mingled about and Minasi told me he is not an employee of Microsoft, but he critiques everything from Office 2007 to Vista to Longhorn and everything in between. He was a very well-spoken guest and I look forward to hearing more of his talks in the future.

Wednesday

Today at the IT Conference I got to see a very knowledgeable and popular speaker. He knows everything about Microsoft and happens to be delivering the keynote address at the conference as well. His name is Mark Minasi and today he spoke about Vista Security using BitLocker Technology.

BitLocker: “How to lose your laptop… without losing your data.”

According to Mr. Minasi, Windows XP Service Pack 2 solved a lot of security issues about Windows. That said, he told us that with BitLocker, your data is secure like never before.
The reason for BitLocker (BL) came about because of the security risks to Microsoft’s top customers – The Fortune 500. On average, about 1 million laptops are lost or stolen in the USA alone each year. I think some students at various Universities and Colleges may want this technology, but I also thought that some professors, doctors, research scientists may need this when migrating to Windows Vista. I know many schools in my area that have serious research going on and I’m sure they would like to know just how secure they can make their data – whether it is on a laptop or a desktop! Before Microsoft would hide the security key on the same computer and it was eventually found by hackers – now with BL Technology, it is a separate piece of hardware holding the key. A TPM (Trusted Platform Module) chip holds the security key in something called the PCR (Platform Configuration Register). This is where BL holds the key.

How BitLocker starts up on a TPM System:
O/S Boot Code hashes the code – driver talks to TPM (Trusted Platform Module) chip and drops that in PCR 0. Then it hashes the ROM (Random Access Memory) PCR 2 towards Boot Manager and PCR 10. BitLocker Access Control = PCR 11. That is when it takes over and encrypts your data on the Hard Drive from what Mr. Minasi explained this morning. It’s basically like a Real Estate Lock Box… but with even more layers of protection.
If there is no TPM chip, the other way to store data using BitLocker is with a USB Stick. It’s less secure, so PLEASE make sure you don’t put the USB Stick in the same bag as the laptop. Put it somewhere safe and secure! Either way, you can still set up a PIN (Personal Information Number) just like an ATM Bank. It would be an extra setup before the system boots. The demo was difficult, but I think with practice, it is something I could learn to do – but more importantly, it is something I could help clients with if called upon to do so…

1.5 GB is needed to use as reserve space for BitLocker. If you forget to – or don’t know how to partition – a Wizard can be run that will assist in partitioning out the necessary 1.5 GB needed.
On a Windows Server using AD (Active Directory), users can now back up the encryption keys for laptops that are Domain Members (AD).

Setup for BitLocker:
1. It wipes drive C: clean
2. Boot from Vista DVD
3. Click Next at ‘Pick Language / Keyboard’ page…
4. It takes you to…
5. Install Now. Do Not do this! – Instead, click Repair Computer.
6. Choose System Recovery Options
7. Choose Command prompt
8. Type: diskpart
9. Type: select disk 0
10. Type: clean (cannot go back at this point)
11. Type: create partition primary
12. Type: assign letter=c
13. Type: shrink minimum=1500 (1.5 GB)
14. Type: create partition primary
15. Type: active
16. Type: assign letter=p
17. Type: exit (takes user out of command line)
18. Type: format c: /y /q /fs:NTFS
19. Type: format p: /y /q/fs:NTFS
20. Type: exit
21. Press ESC (Escape) to return to the “Install Now” screen in Vista.
22. Install Vista as usual.

BitLocker encrypts the entire C Drive. (only available with Enterprise or Ultimate – why not Business?) Longhorn Server will also have the ability to use BitLocker. BitLocker partitions the C drive in one large BLOB (Binary Large OBject). If I hack or steal your laptop, I will see a volume, but will not have the opportunity to view it’s contents. Thieves can go no further.

Remember – In order to make BitLocker work – Make sure it boots the O/S (HDD) first.

Tuesday

The following is some notes I took today during the an IT Conference in Orlando, Florida.

What's New for VISTA?

Windows Search feature - The ability to search throughout your Vista machine and start a application with one click.

Offline Files (pretends to let you work online)

802.3 Wired Ethernet (updated 802.11) – It’s ready and waiting for the Microsoft Longhorn Server. It’s also ready for NAP (Network Access Point). That means if you setup your network as to only allow certain connections on wireless or wired – (Example: unhwireless is our SSID and VISTA can be setup to always allow connection to unhwireless since the SSID never changes, however you can also set Vista up to not allow other SSIDs like hhonors (Hilton) or tmobile (Starbucks).

Printers can now be used via wireless networks and setup from anywhere in the world to reach a printer wherever it may be located.

Group Policy and Vista Management
Group Policy is a client driven technology and it is not yet available for Microsoft Longhorn Servers. It can still be used on Active Directories (AD) or personal computers. Administrators need to manage other Vista machines from a Vista machine, otherwise the compatibility is lost. GPO=Group Policy Object - Administrators can create and deploy various GPOs for certain groups of users (i.e. – faculty, staff, students)
GPMC (Group Policy Management) is pre-loaded in Windows Vista. Vista is your personal management station. Each user has the power to have administrator rights. Windows Vista Management = User sees all settings. There are 18 Group Policy Functions and some are RegEdit, Disk quotas, Internet Explorer Settings, and Security. Overall, there are 2400 Group Policy Settings in Microsoft Windows Vista. Everything from Hide the “Add programs from Microsoft” option to Prevent access to 16-bit applications.

During the GPO demonstration, the instructor’s machine froze and then blue screened. The clock was 1 hour behind and upon executing the demo, the machine could not comprehend the actions and simply quit – Instructor had to reboot. Afterwards, I asked if there were any differences in the DST patch for Vista as opposed to Windows XP, like the patch released a few weeks back.

Also new, but not CSE (Client Side Extensions):

Windows Firewall w/ Advanced Security (WFAS)

User Account Control (UAC) for Microsoft Windows VISTA.

Hardware Control – Prevent iPods, USB Sticks, external HD, etc. from connecting. If you go to Group Policy Management in Vista, you can choose how specific to get. From not allowing any USB stick, to not allowing a certain size, model, or brand.

Internet Explorer 7.0 – Bundled with Windows Vista. It has more controls, tabs, more secure (see URL address bar change color when involved with an SSL web site.) The IE 6 proxy settings are no longer available.

Note: Vista Enterprise is the only version separate. All other versions are on the same DVD, no matter what version you buy – It is all separated by a different key code. If you buy Home Basic, Home Premium, Ultimate, or Business – they’re all on the same DVD, but you’re license only opens up what version you paid to receive.


Vista Installation and Deployment: (Vista and Longhorn Server will use WDS)
WDS = Windows Deployment Services
This used to be called RIS (Remote Installation Service) and is now called WDS (Windows Deployment Service).
To start installation, go naked. That means just have the O/S and any Service Packs available. WDS loads the O/S and applications with just one disc, almost like a photocopy of a machine. The install will put .WIM files (Windows Installation) on your machine.
WDS Install:
1. Tap F12 twice
2. Select WIM Vista Boot with Network Drivers
3. The package IDs appear…
4. Q. Where do you want to Install?
5. Choose partition
6. Next… (takes almost 25 minutes)
RIS Install:
1. Insert Disc
2. Tap F12 twice
3. Automatic Setup – Select: Vista Boot w/ Network Drivers
4. Select WinXP SP 2 to remove…
5. “Windows is configuring” message appears…
6. Blue Screen shows setup.
7. Click Next – It will install and it takes 25 minutes or more, but it removes and replaces the O/S.
If networked you will need to copy WinXP and local images over.


* I'll talk more tomorrow about the Expo and Windows Vista BitLocker technology.

Florida

Welcome to TechMentor!

Orlando Weather:
Monday Evening - Partly Cloudy, 76 Degrees
It looks to be a good week weather-wise with highs in the low 80s and only a slight chance of rain all week...

Hotel and Conference Center are located at the same location. I've already met people from Illinois, Texas, Seattle, Colorado, and Alabama. They're very polite and were eager to hear about life in "cold" New Hampshire!

Microsoft Windows Vista classes begin tomorrow...

Stay Tuned.