There are two available schema extensions for Vista.  One is to enable a central recovery solution for BitLocker and the other is for configuration of network authentication.  Details below. 

Configuring Active Directory to Back up Windows BitLocker Drive Encryption and Trusted Platform Module Recovery Information

Source: http://www.microsoft.com/downloads/details.aspx?FamilyID=3a207915-dfc3-4579-90cd-86ac666f61d4&DisplayLang=en

Active Directory Schema Extensions for Windows Vista Wireless and Wired Group Policy Enhancements

Wireless and wired clients running Microsoft® Windows Vista™ support enhancements that can be configured through Group Policy settings and are supported by domain controllers running Windows Server® Code Name "Longhorn" (now in beta testing). To support these enhancements for an Active Directory® directory service environment consisting of domain controllers running Windows Server 2003 or Windows Server 2003 R2, the Active Directory schema must be extended. This article describes how to extend the Active Directory schema to support these new features for Windows Vista wireless and wired clients.

Source: Active Directory Schema Extensions for Windows Vista Wireless and Wired Group Policy Enhancements

I'm loving this article from Mike Neil in the Windows Server group.  Especially the quote below.  I can't tell you how much time I've spent in the last few months thinking about this very concept.  Education could really benefit from a widescale virtual application delivery model.

"And in my mind’s eye, I see a time when application virtualization will allow customers to easily move to an on-demand computing / services model for the hundreds of thousands of Windows applications built by partners, customers and Microsoft."

Source: Windows Server Division WebLog : Where we're headed with virtualization

 Josh, you beat me to it.  I can officially clear this from my Outlook 2007 todo bar.  Great article.

When working with schools on BDD I try to find time to show how to enable the wizard page that automatically sets up the image install as prepared for Bitlocker.  If you have machines already deployed and need a tool to build a partition and move your boot files for BitLocker, this is what you are looking for.  Josh fully spells out how to use it.

Link to Josh's Windows Weblog : BitLocker Drive Preparation Tool

So you're a student taking an online class and you need to keep track of all your assignments, when they are due, which have been graded and returned, etc.  Wouldn't it be nice if you had the information always in front of you and up to date so you were never late with an assignment again?

I've had the pleasure of working with a student consulting group (OTCR) at the University of Illinois to build a Vista Sidebar gadget for SLK or the SharePoint Learning Kit.  SLK adds functionality to standard WSS doc libraries to support assigning/grading/reviewing SCORM content.  In this way you can use SharePoint to host an online class with assignment submission and reporting fully built in.  SLK is available as shared source from http://www.codeplex.com/slk.  I am going to work on getting the gadget posted to codeplex under the same site.  In the mean time if you are interested and would like to expirement with the gadget let me know through my blog contact page and I'll send it to you.  Keep in mind this is a project to show what could be done with the gadget that has really become highly functional but it is not a Microsoft supported solution.

This gadget attaches to a doc library and exposes the assignment information.  Here is a screenshot of the gadget docked when you are logged in as a student.  Man, if only I had this when I was in school...

And here it is undocked.

As I'm sure you can tell I'm on the road this week.  In fact, I'm on the road almost solid through the end of March.  There is an absolutely wonderful enthusiasm in Education right now about Windows Vista.  For my blog this means I don't have a lot of time for original content so I'm linking out to great information that people supporting Vista in Education can take advantage of.

I've been using Sysinternals tools for years.  It's great to have these tools available as part of the support stack.  The TechNet site for this information is fully built out and has all my favorite old application troubleshooting tools, Filemon, Regmon, etc!

Link to Microsoft TechNet: Windows Sysinternals

 Ha, so I am preparing to deliver an overview of Vista deployment scenarios this afternoon and over the weekend I created a slide that called out the Hardware Assessment tool and Easy Transfer Wizard Companion as out of scope for a detailed discussion since neither had not been released yet.  Wouldn't you know it - the day of my presentation, this gets released!  I am really happy it's available and look forward to testing it.

The Windows Vista Hardware Assessment solution Accelerator is an inventory, assessment, and reporting tool that will find computers on a network and determine if they are ready to run the Windows Vista™ operating system.

Source: Windows Vista Hardware Assessment: Overview

 Virtual PC 2007

Link to Microsoft Virtual PC 2007

VAMT - a tool for doing proxy MAK activation and analyzing groups of machines for VA status.

Volume Activation Management Tool (VAMT)

Finally, these were online last week but not officially announced until today.  KMS for 2003 and the MP for KMS.

Key Management Service (KMS) for Windows 2003

KMS Management Pack for Management Operations Manager 2005

This is a great reference for configuring or troubleshooting VA technical issues.  100% of the issues I had heard so far have been related to network access or name resolution.  In most cases it was name resolution.  The SRV record must be in the default DNS zone for the client.

The Technical Attributes document provides in detail the WMI and registry attributes where information is defined.  Some of these values are configurable.  For example, you can set the interval that a new KMS client that has not been activated uses to determine how frequently it should attempt to contact the server.  You can provide the same interval for clients that have been activated.

Clients which have not been activated:

VLActivationInterval (default 120 or 2 hours)

The activation frequency, in minutes, of how often the current machine should contact the key management service machine before the client is licensed."

Clients that have been activated:

VLRenewalInterval (default 10090 or 7 days)

The renewal frequency, in minutes, of how often the current machine should contact the key management service machine after the client is licensed.

Both values have an acceptable range of 15 (minutes) to 43,200, or 30 days.  You cannot configure the period of time used as a grace period for activated clients.  An activated client has 180 days to reach the server again before it begins prompting the user to either provide a network connection where the KMS server may be contacted or enter an MAK.  However, you can query this information using WMI.

Source: Windows Vista Volume Activation 2.0: Technical Attributes

This can be scripted quite easily using PowerShell.  See below, simply query the SoftwareLicensingProduct class in WMI, filtering for LicenseStatus = 1 and then return Description to see what type of key is being used and GracePeriodRemaining to show how many days until the client gets in to trouble.

PS C:\>get-wmiobject softwarelicensingproduct -filter "LicenseStatus='1'" | format-table -property Description,GracePeriodRemaining

Description                                                                   GracePeriodRemaining
-----------                                                                             --------------------
Windows Operating System - Vista, VOLUME_KMSCLIENT channel          257780

So in the above table, it appears my machine is a KMS client and has a little better than 179 days to contact the server again.

Just a quick post to flag this article.  This is really good to have handy.  Note that making changes to schema is risky business and should not be taken lightly but when done correctly it can be quite valuable.  Another good option is to have an ADAM directory online if you have a high number of custom attributes to store.

Link to My Research Notes and other usefull documentation : Adding Custom Attributes in Active Directory

It's a pet peeve of so many geeks...  For years now people have crossed the names between Office and Windows by saying things like "I think I'm running Windows 97" or "umm, I believe I am running Office 2000", and then come to find out they are running Windows 2000 and don't have Office installed at all!

So, of course we are now on Windows Vista and Office 2007.  My task at Microsoft is to help schools and universities nationwide to learn about Vista; what it is, how to deploy it, how to manage it, how to secure it, how to support it, etc.  Recently I was planning a presentation with one of our account managers.  She mentioned, "Can you also talk to them about Office?".  I gave my usual reply that I am happy to give an overview of how to build the Office file to automate the install and how to build it in to an image using BDD but generally speaking that is a subject that one of our Office specialists should cover because they work very hard at delivering that information.

She then made a good point, that our customers don't always see it that way.  Many organizations that are planning or starting a deployment of new desktops consider Vista and Office one big upgrade.  If you are refreshing the OS why not also take that opportunity to deliver the new version of Office?  You absolutely do not have to install them together.  Office 2007 runs on XP and Office 2003 can run on Vista.  On the other hand, it makes a lot of sense to build a deployment strategy that includes both.

As a result, from now on I am going to at least briefly discuss how to install Office as part of an image or automatically after the image has been installed.  If you are planning an upgrade, this is something to think about.

This looks really interesting.  I will be testing today. 

Windows Easy Transfer Companion enables you to automatically transfer your most important programs from your Windows XP-based PC to your new Windows Vista-based PC. This way you can become productive on your new PC as soon as possible. Easy Transfer Companion is designed to be used in addition to Windows Easy Transfer—which transfers your data and settings.

Source: Download details: Windows Easy Transfer Companion (Beta)

I recently worked with a school district to walk through a full setup and capture using BDD.  This was a really nice experience for me since in technical sales you sometimes spend too much time talking about a solution and not enough time working with it to flush out the details and questions that only come up in the real world.

In the old BDD there was emphasis on automating your image build process which was an interesting topic since the focus of most deployment projects is to automate the deployment, not the preparation for the deployment.  In BDD 2007 the process of building your images is very well integrated in LTI so even if your imaging environment is not all that mature, you now can take it to the next level without spending a lot of time and resources.  This means you can walk through a wizard, pick an OS and applications, and BDD will build your image for you start to finish with no need for interaction until your image is on a file share and ready to go.  Nice!

During the capture, we agreed it would also be nice to have the option to interact with the process after Vista has been installed and autologon has completed but before sysprep runs.  This would allow you to make custom changes, install applications that you were not able to automate, etc.

I sent out this discussion point to others interested in BDD and Ben Hunter, a consultant with Microsoft Consulting Services had a great solution.  He adds a new item as an application but the application "install" is actually just having notepad open a text file.  In the file, he lists out the procedures to complete any manual customizations, and then when the technician has finished and closes notepad, BDD takes over and finishes the capture.  This is really clever and as he says "the simple solutions are the best"!

Here is the command and working environment to setup as an application:

Command:                          c:\windows\notepad.exe tasklist.txt
Working Directory:          .\Applications\ManualTasks

Thanks for the idea Ben!  Another application I'd like to test would be an .hta file in IE7.  That would allow for a more graphical interface and custom scripting.

If you have a Tablet PC, you’ll love using Ink Desktop. It’s like having a portable dry-erase board on your screen all of the time. Whenever you want, you can jot down a phone number, directions, or top priorities for the day. And, for added fun and functionality, don’t forget to download Microsoft Experience Pack for Windows Vista, which contains four programs that provide unique functionality and fun to enhance your experience using a Tablet PC. It’s available separately for download.

This seems like it would be incredibly valuable for both students and teachers using Tablets!

Link to Download details: Ink Desktop

The download for WAIK had been offline.  It is back now! 

Link to Download details: Windows Automated Installation Kit (AIK)

Ken IM'ed me just after he posted this to see if I happened to have run in to the same problem.  Ironically I have had a task in queue for a couple of weeks to build a public-facing WSS site for a side project I'm working on.  I got all the way through configuration and recalled I would need to configure the "Internet" name.  Here's how: 

Link to Ken Lince - Delta Force Partner Technology Team : Alternate Access Mappings for SharePoint 2007

This alone is a major improvement from previous versions of WSS.  The issue is with how name translation works when the site was built using one host name but needs to understand that it may have links called that include some totally other FQDN.

Project Description
What Is the Learning Network Manager? The Learning Network Manager (LNM) offers a standard way of setting up and configuring computer labs, while reducing support and training requirements. It provides a controllable infrastructure that can be customised to meet the needs of individual institutions, ensuring that they can build on existing investments. Implemented as a layer on top of Microsoft Windows Server™2003, Learning Network Manager makes it easy to create and manage end users, computer groups, new PCs, and Internet access. Once installed, it automates many common tasks including software upgrades and enhances security, stability, and privacy of information. Learning Network Manager prolongs system life and makes it easier to recycle old machines for reuse in modern, efficient networks. Learning Network Manager also supports the teaching process by supporting e-learning across most network topologies. And because only basic IT skills are required, busy IT teams or even teachers can set up a network with only a few keystrokes

Source: Learning Network Manager

This started off as an experiment but is working well enough I use it as my default engine.  The goal was to create a search macro off Live.com that would help cut back on the number of retail sites that are given in search results.

Don't get me wrong, customer feedback on sites like Amazon can be really valuable, on the other hand, if I want to search about <topic> and want to find manufacturers, organizations, etc, it usually does not help when I get 5 results in my top 15 that are online resellers with only a copy of the original information.  In other words, it's valuable when I desire it to be in my results and not as valuable when I specifically would prefer not to have them there.

This is true for all engines I have used, not just Live.  It's easy for a retailer to have so much information on their site that they legitimately are a decent source and any good index would include it.  However, it many cases those sites are not among the sources of information I am looking for.  Live.com gives you the unique advantage of applying rules to results. 

And of course, if the results don't have what I'm looking for I just click the "web" tab on the top of the page to go back to original results or possibly even click on "Products" to search only among online retailers!

I'm interested in feedback.  I currently use the following filter:

-price -retail -buy -order prefer:history,article,definition,design,manufacture,recipe

Fewer Retail Sites - Macro

The filter is not perfect.  I originally included the word "store" and found that was blocking some technical sites especially if I was looking for information about Exchange (because of the message store).  I can imagine for other disciplines the word order may also cause concerns.

I am constantly intrigued to watch as new communities evolve online.  I've posted before about admiration for The Student Tablet PC blog.  There are a few sites that when I notice a new feed has arrived I can't wait to read it, and this is one of them.  Another great education site started about a month ago and is really taking off!  It's named "Teachers Using Technology" and focuses on real teachers and grad students using technology in learning environments.  The site shares best practices and experiences for actually using these technologies in the classroom.  For both sites, it has been really interesting to listen to their experiences upgrading to Vista and Office 2007.

Is it worth subscribing to?  Check out the comments!!!  If I had half as many people leaving feedback I'd feel like a rock star!

Link to Teachers Using Technology

The Windows Automated Installation Kit includes pkgmgr.exe to inject packages and drivers to offline images.  "Packages" loosely means the updates that Microsoft releases, usually through Windows Update.  I believe there are partner initiatives underway to deliver 3rd party packages as well.  Technically the tool works with updates you download from Microsoft as .MSU files and contain .CAB files which can be extracted and applied.

Now for testing, this presented me with an issue because there aren't exactly a lot of hotfixes available for Vista to test with.  I looked in Windows Update history and searched the KB for the first in the list.

I had installed PowerShell earlier that day after downloading the install as a stand-alone .MSU.  I thought to myself, "Wait a minute, I think I just stumbled upon a very interesting possibility...  PowerShell is a Microsoft package, I wonder if you could inject it to an offline WIM?"  I fired up my BDD server and mounted a WIM of Vista Enterprise.  A few minutes later I had the answer file ready to go and set pkgmgr to inject my first ever offline update - PowerShell!  Here's the instructions, you can also find this in the WAIK user's guide:

Expand your update file

Per support article 928636 you no longer execute the file with a command line extension to extract the files.  Vista contains a tool for this function.  Simply run expand.exe with the proper statements as seen below.

Now that you it extracted, copy the .cab file in to your distribution share so you can create an answer file in SIM.

Finally, mount the WIM image and run pkgmgr to inject the image.

That's all you should expect to see as feedback at the command line.  Check your log folder for information.

2007-02-08 09:21:00, Info CBS Pkgmgr: Completed unattend install: Microsoft-Windows-PowerShell-Package-TopLevel~31bf3856ad364e35~x86~~6.0.6000.16386, hr: 0x0

and

2007-02-08 09:21:00, Info CBS Exec: Processing complete. Session: 3808:25980668, Package: Microsoft-Windows-PowerShell-Package-TopLevel~31bf3856ad364e35~x86~~6.0.6000.16386, hr: 0x0
2007-02-08 09:21:00, Info CBS Session: 3808:25980668 finalized. Reboot required: no
2007-02-08 09:21:00, Info CBS Pkgmgr: return code: 0x0

Now just unmount the WIM, don't forget to /commit!

Finally, your end result.  A freshly deployed install with PowerShell already installed!

Looking over the TechNet master OPML this morning and came across this post.  This has been a major ask from customers in education, especially those who deploy and manage computer labs.  Earlier this year I submitted a long list of customers in education who specifically have asked for this feature, I'm not saying I was the only one who pushed for it but man it's good when you can do right for your customers!

Now, keep in mind, nothing has gone RTM yet so don't go counting any chickens...

While the original WDS release plan was to have the feature set between WDS on Server 2003 and WDS on LH Server be identical, new hardware trends and customer feedback have necessitated some new feature development. Without further delay, we’d like to go ahead and announce the availability of three new features for WDS in LH Server –

1. Multicast.

2. TFTP download enhancements.

3. EFI x64 network boot support.

Link to Where System Builders Talk Shop... : WDS New Features Comming!!

MultiPoint is a new technology from Microsoft that allows developers to build applications that affordably increase the reach of existing classroom PCs and help students everywhere build essential 21st century learning skills such as collaboration, teamwork, and computer familiarity. Multipoint enables groups of students to use multiple mice on a single PC, giving students a new way to learn together and have more computer time than ever before.

Link to Download details: WMPSDK

What is "Grava"?

"Grava" is the code name for a new set of tools from Microsoft’s Education Products Group that is designed to allow the education community to create and assemble materials that will increase discovery and allow learners to go at their own pace and learning style. "Grava" tools are scheduled for release in fall 2007.

"Grava" Player—The "Grava" player enables users to view the rich interactive content created in "Grava" Authoring.

Developer Tools—The "Grava" SDK is built on Windows Presentation Foundation (WPF) and provides a programming model and tools for building rich educational experiences.

Authoring—"Grava" Authoring allows users to create interactive and stimulating non-linear projects to view in the "Grava" player.

Services—"Grava" provides an array of services which complement the authoring, SDK and player components. These services include the ability to do assessments, log results, and create intelligent learning solutions.

Link to Connect: "Grava" CTP

This scenario comes up frequently and I want to show exactly how the process works.  The concern I have heard is from Universities that wish to provide an image to a remote department and for whatever reason the KMS is not an option.  In most cases the KMS will work but there are examples of departments that are not well connected and have fewer than 25 machines or they consistently work off campus and the machines do not connect in for more than six months, etc.

So you want to provide the image to a remote department but you are concerned about exposing your MAK?  No problem, while you cannot encrypt the key in the answer file you can store and protect the key in your image.  The key point of understanding is which setup pass you select for storing the key in your answer file and when you use it.  Let's take a look at the documentation for the ProductKey attribute in the unattended reference guide:

ProductKey

ProductKey specifies the product key to apply for each unique installation of the Windows operating system.

There are two Product Key settings you can configure.

• Use this ProductKey setting to specify the Windows image to install during Windows Setup. This product key specified by this setting is stored on the computer after installation. If you choose to activate Windows, this product key will be used.
• Use the ProductKey setting to specify a different product key to activate Windows. For example, you can specify one product key to install Windows with the ProductKey in Microsoft-Windows-Setup component, and then specify a different product key to activate Windows with ProductKey

This translates in System Image Manager to whether you store the key in pass 1 (Windows PE) or 4 (Specialize).  They key you store in pass 1 will be used for the install but would not be retained through a sysprep.  However, you can set the key in pass 4 and it will be retained even through a sysprep, until the machine has been activated.  However, the key will not be shown in clear text within the cached answer file, it is protected within the OS.

System Image Manager:

Pass 1 - Setup - User Data - ProductKey - Key

Pass 4 - Shell Setup - ProductKey

Once you have created your answer file, use it when running setup to build your base machine.  You would not just provide the answer file to the department or leave it stored in the image.  When you are ready to build a workstation to create your custom image, boot off the Vista DVD and make sure the answer file is stored on removable media (floppy, USB key, etc) so it will be used during setup.  Do not activate the machine yet.  Once you have your customizations complete, run sysprep (possibly specifying another answer file for future OOBE) and after the machine shuts down use imagex.exe to capture it.

Even though the machine has been syspreped, the ProductKey is stored securely in the image.  It is not displayed in clear text as you can see below but is retained as I demonstrate in the screenshot using slmgr.vbs.  If you provided the key during pass 1 of setup, this would not be the case.

Finally, one concern I have heard on this topic is how to prevent someone from using the image with the MAK stored in it even though they do not have permission (piracy).  It's true you now have an image that you need to protect from broad availability.  However, if a problem should arise where a department admin accidentaly exposes the image publicly, VA 2.0 can handle the issue without needing to reimage or rekey existing machines.  The available activations for the embedded MAK would be changed to 0 and a new key would be issued for future use.

This is an answer file I use to demonstrate an unattended setup with Vista Business/Enterprise.  First off, please do not copy this file verbatim with hopes of using it in mass deployments.  There are settings I have cleared or set generically so you need to populate them on your own.  I am posting this template to assist everyone who has asked if I have a template they could compare against.

If you haven't worked with Vista answer files before, this article is probably not the best place to start but I would be happy to point you in the right direction.  I recommend downloading the WAIK and reading through the "Getting Started for IT Professionals" document, creating the test file it describes.  This will introduce you to using System Image Manager and the seven phases of setup.

A few things to know:

• This file will wipe the disk and create a new 40 GB partition.  I chose 40 GB somewhat randomly, I wanted to make sure it was a good size for testing application installs.  I have also found that letting the answer file extend volumes in a VPC dynamic disk can result in an error.
• This file will name the machine "NewPC".  I populated this setting only to show a completely silent install.  In most cases you would remove the <computername> attribute and use some other facility (like BDD) to name the machine during install.
• I have removed the passwords for the Administrator and LocalAdmin accounts from the file.  You will need to use SIM to set your own.  Since the passwords have been cleared but the attributes are still there, delete the password items from phase 7 and add them back in, setting the values with a secure password for each.
• I set the FullName attribute to "Test FullName" and the Organization attribute to "Test Organization".
• The time zone is set to Central (GMT-6).
• The screen resolution is set to 1024x768, this works well in VPC.
• This file does not include domain join.
• This file does not contain an MAK so the machine will be set to use a KMS.

I look forward to comments and suggestions.  I am planning to build additional templates such as this for scenarios such as sysprep, setup with domain join, etc.

The answer file will wipe and repartition the drive so do not use it on a machine where you might lose data if the drive is lost!!!  I use it for testing in Virtual PC.

As usual, I'm as excited to hang out with good friends and laugh at the commercials as I am about the game although that will change within 60 seconds after kickoff!  I'm a Rams fan but live in IL therefore, for today, Go Bears.

Link to SuperBowl.com - Official website of Super Bowl XLI