Marcus Hass' [MS] Blog : Desktop

Windows XP/XPe and Remote Desktop Services Single Sign On

mhass — Thu, 16 Apr 2009 18:03:00 GMT

This week I was working with a retail customer that has plans to place HP Windows XP Embedded devices at their many retail stores. Applications will be served up either locally on the XPe device, through a remote desktop, or through Remote Applications.

There is a slight challenge with this setup because technically Microsoft supports this configuration, but doesn’t give you great tools to setup Single Sign On (SSO). When Vista was first introduced, Microsoft created a new credential manager that could handle SSO for Terminal Server as well as products such as HyperV. Fortunately, the product team also back-ported the credential manager (CredSSP) functionality to Windows XP. While Vista has an easy enough local Group Policy you can edit, Windows XP never got the same treatment. In order to get it to work in XP and XPe, you have to make a bunch or registry edits, which are also not provided in an easy to copy .REG format.

Well, as a service to the public, I have included a text copy of my .REG file below. The information below is provided as-is, no warranty, no support, please don’t cry to me. But, I have tested it pretty thoroughly and it seems to work.

A couple caveats:

If you use a smartcard to authenticate to Windows, no matter how hard you try you won’t be able to get an RDP session to honor your Windows credentials, you will always be prompted for credentials when running MSTSC or a .RDP file. This is counter-intuitive as you would think 2 factor authentication would be more trusted than simple username/password, but it is a known limitation in Windows XP. Citrix does provide their own credential manager that can add functionality here.
One of the registry entries is in hex so you can’t see what it is. It is one of two entries that require you to APPEND the necessary settings for CredSSP to work. If you have other entries for GINA’s or other credential providers, please be careful as this will overwrite them with the default+CredSSP entries

Many thanks to Olga and Sergey on the product team as well as Kevin Martin from HP for their help this week.

References:

http://support.microsoft.com/default.aspx/kb/951608

http://blogs.msdn.com/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx

Here is my .REG file, I hope to create an ADM file at some point that I can share. You can go ahead and cut/paste the rest of this blog entry into a text file and rename it to a .REG file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
6e,00,65,00,6c,00,00,00,77,00,64,00,69,00,67,00,65,00,73,00,74,00,00,00,74,\
00,73,00,70,00,6b,00,67,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]
"AllowDefaultCredentials"=dword:00000001
"ConcatenateDefaults_AllowDefault"=dword:00000001
"AllowDefCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowDefNTLMOnly"=dword:00000001
"AllowFreshCredentials"=dword:00000001
"ConcatenateDefaults_AllowFresh"=dword:00000000
"AllowFreshCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowFreshNTLMOnly"=dword:00000000
"AllowSavedCredentials"=dword:00000000
"ConcatenateDefaults_AllowSaved"=dword:00000000
"AllowSavedCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowSavedNTLMOnly"=dword:00000000
"DenyDefaultCredentials"=dword:00000000
"ConcatenateDefaults_DenyDefault"=dword:00000000
"DenyFreshCredentials"=dword:00000000
"ConcatenateDefaults_DenyFresh"=dword:00000000
"DenySavedCredentials"=dword:00000000
"ConcatenateDefaults_DenySaved"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyDefaultCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyFreshCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenySavedCredentials]

Automated install of Outlook Conferencing Addins

mhass — Wed, 13 Feb 2008 23:59:00 GMT

My customer (Mike Vrabel) and I got completely frustrated today in trying to find a way to deploy the Outlook Conferencing Addin for Live Meeting 2007 via SMS. The Office web site gives you a ConfAddins_Setup.exe which is neither an MSI or provides you switches for automated install or answer file.

Some digging turned up a solution:

1. Copy confAddins_Setup.exe to a local directory on your test PC
2. Open a command prompt (if Vista make sure the command prompt is administrator elevated)
3. Using the command prompt navigate to the directory where confAddins_Setup.exe resides
4. Type the following command line - "confAddins_Setup.exe -out <drive>:\<folder path>"
5. Step 4 should have extracted the LMAddinPack.msi file
6. From the directory that contains LMAddinPack.msi install the Addin from the command line using the following command line "msiexec /i <filename.msi> /qn"

You can then use the normal MSI command line switches to deploy silently, just make sure to kill Outlook on the target machine first:

msiexec /I LMAddinPack.msi APPCONFLICT=IGNORE /qn

Windows 2000 to XP Upgrade Nuances

mhass — Mon, 24 Apr 2006 19:20:00 GMT

In the process of helping a customer upgrade their remaining 5,000 desktops from Windows 2000 to XP, I have found a couple entertaining and frustrating issues with the upgrade process.

First of all, this only applies to an unattended upgrade of Windows 2000 Professional but it might also affect servers as our internal bugs indicate. Second, Microsoft does not recommend that corporate desktop us the Upgrade process, rather we recommend “wipe and load”. But, in a customer scenario where you don’t have applications packaged and easily deployable to 5,000 users, upgrades are the way to go.

In our specific scenario, we are using various Dell desktops and laptops. Through testing, we discovered that two of the desktop models completely loose their NIC’s during the upgrade. So, we tried to upgrade the drivers for the NIC’s before the upgrade. No dice, once the OS is Windows XP the system has an error with the Network Adapter in Device Manager.

We then tried to use the Microsoft provided means to upgrade the drivers during Windows Installation in the unattended file (below).

[Unattended]

Oempreinstall=yes

OEMSkipWelcome=yes

This tells setup to look in the SourceFiles\i386\$oem$\ folder for drivers and copy them over during the install process.

The only problem is that we are using the UPGRADE flag in the unattended file that negates much of the settings. When you set NTUpgrade=Yes, Windows ignores most of the Unattend file. In fact, Microsoft officially only supports and tests the following flags when NTUpgrade=Yes:

Productkey =

AutoActivate =

DuDisable =

DuShare=

DuStopOnError=

This means that we can’t use any of the cool $oem$ functionality like upgrading the drivers or even running the $oem$\cmdlines.txt which would allow us to kick off a script before Windows logs in. The idea being that we could upgrade the drivers with a batch file before the user logs in. What a nightmare!

I did find that although Microsoft doesn’t support the entries, there are more settings that the unattended process will honor, these include:

[GuiRunOnce]

Command0="C:\upgrade\apf\CmdLines.cmd"

Command1="C:\upgrade\apf\PostOS.cmd 1"

[WindowsFirewall]

Profiles=WindowsFirewall.TurnOffFirewall

[WindowsFirewall.TurnOffFirewall]

Mode=0

So, how did I get around these challenges? I did a bunch of scripting before the upgrade and after the upgrade. Basically, here are the steps:

1) Download all the Windows XP source files and drivers to the workstation hard drive

2) Run a script that prepares the box for an upgrade

a. Disable Wired/Wireless NICS (see my blog on devcon on how to automate this)

b. Removes LegalNoticeText to ensure AutoAdmin logons

c. Resets Local administrator password

d. Sets AutoAdmin logon settings

3) Starts Windows Unattended Setup and uses local source files

4) After the OS is upgraded, it does a GUIRunOnce that I specified
Command0="C:\upgrade\apf\CmdLines.cmd"
Command1="C:\upgrade\apf\PostOS.cmd 1"
This kicks off a PostOS scripting engine call APF (automated purposing framework) that can be found as part of MSA 2.0.

5) The APF engine does the following

a. Phase 1 – HotFixes

b. Phase 2 – Dell Drivers

c. Phase 3 – Enable Dell NICS

d. Phase 4 – Update GPO’s

e. Phase 5 – Finish

i. Set RunOnce (sets user profile settings)

ii. Copies “Default User” profile

iii. Clears AutoAdminLogon Settings

iv. Deletes Source bits

f. Phase 6 – Reboot

6) Once a user logs in for the first time, we fire the RunOnce script that sets some corporate standard user experience settings

I guess the overall advice I can lay down for upgrades are, “This isn’t as easy as running winnt32.exe and then upgrading drivers”. This can be a very complex process to get right, especially when you want to do it for thousands of machines. Wipe and load is still the preferred mechanism, and there is good justification for getting your application packaging strategy working first before you tackle upgrading OS’s,

Updating drivers from the command line

mhass — Sat, 08 Apr 2006 07:53:00 GMT

So, I am off doing a desktop migration for a customer of approximately 5,000 desktops. Vista you ask? No, not that sexy. Just trying to help one of our core telco customers get everyone off Windows 2000 onto XP. And by the way, get in infrastructure in place like BDD using OSD with SMS (it's cool to say all those acronyms really quickly) so they can be ready for Vista someday.

Unfortunately there are forces at work that will not allow us to do wipe-and-loads of desktops, like Microsoft recommends. So, me and Mike Vrabel from INS are having to work through an OS upgrade scenario. This causes us to upgrade a few corporate applications before we can upgrade the OS, because they just won’t work after the upgrade. Mike is primarily of storming the beach head of application remediation, while I work on unattend files and drivers.

I ran into some serious issues trying to upgrade drivers so that the NIC, Sound and Display would still work after an upgrade. Here were my approaches:

Upgrade Drivers while still in Windows 2000 to the XP version. Since most drivers are compatible, this should work. WRONG – the closest I got was the “Windows has found new hardware” once the box was upgraded to XP. Since this needs to be completely scripted, this isn’t an option
Use the Windows Unattend file to specify new drivers. I have used unattend files a million times before when building out big datacenters, so I have a really high level of confidence when it comes to unattend files. But, the upgrade scenario is different than a bare metal install or sysprep. It appears that Windows doesn’t care about the drivers I specify in the Unattend, and won’t even copy the ones I place in the \i386\$oem$\$1\drivers\yadayada folders. From what I can tell, these drivers are only copied during text mode (which does not occur in an upgrade), and it never looks in the unattend file for the drivers during an upgrade.
Upgrade the drivers once the upgrade is done. Ya, but how do you do it from the command line without user interaction? Well, DEVCON is your friend. Devcon.exe is a command line version of Device Manager, and the latest version is included in the Windows Server 2003 Service Pack 1 Support Tools.

The thing I learned about devcon, thanks to Scott McArthur from Microsoft Support, is that when you specify a device to update, use the “base” id. If you run:

Devcon driverdetails * > drivers.txt

You will get a list of all devices with their associate drivers. The devices are very specific like:

PCI\VEN_8086&DEV_100E&SUBSYS_01511028&REV_02\4&1C660DD6&0&60F0

There are other devices associated with this device, so if you try and update the specific device, it usually comes back with a “devcon failed”. You need to broaden the device path, and take the “base” device like this:

PCI\VEN_8086&DEV_100E

So the command that I end up running to update the drivers:

devcon updateni "C:\DRIVERS\Intel10.3\PRO1000\WS03XP2K\e1000325.inf" PCI\VEN_8086&DEV_100E

So hopefully this great little devcon tool will help you out, and make sure to be generic when specifying device drivers.

The making of Virtual Earth

mhass — Mon, 22 Aug 2005 22:11:00 GMT

Kinda, well almost funny:

http://www.virtualearthinfo.com/video.asp

BTW, here is a cool app on virtual earth that tracks the International Space Station:

http://www.vehacks.com/vehacks/nasaspacestation.htm

Zotob, a hard and unfortunate lesson (again) for Enterprises

mhass — Thu, 18 Aug 2005 01:00:00 GMT

Unless you have been on vacation on the moon for the last few days, you know that there is new exploit in the wild that mainly affect Windows 2000 and pre SP2 Windows XP OS’s called Zotob (and variants). This worm is hitting some of the same big name companies that were crippled by CodeRed, Sasser and Blaster.

In the years since those nightmares, there have been a lot of great tools that have come out to help avoid these nightmares. I can’t believe that some of the big enterprises (some of them are my customers) don’t have a better strategy or mandatory policy to update desktops and servers with security updates quickly. Microsoft and others have been preaching for at least the last 3 years that it is only a matter of time for a 0 day exploit. While Zotob is not a zero day exploit, it is close.

Everyone knows about “patch Tuesday”, including malware authors. You absolutely have to have a patch strategy these days to push security updates immediately or within 24 hours. This means 1000’s of boxes in some cases.

If you are an enterprise, don’t just stand there, get something! Windows/Microsoft Update, SMS, SUS, WSUS, ONiPatch, Hercules, etc it doesn’t matter!! Some you pay for, some are free, but just do it. I guarantee this isn’t the last time, and the next one might be even bigger.

I don’t want to get into a debate about how many security flaws Microsoft has over distributions of Linux or IIS vs Apache. You need a strategy for all of these systems.

If you have a single PC, home network with a couple computers or if you have an enterprise with 10,000 of pc/servers get a plan on how you get and apply updates.

BTW, don't get me started on the Media. Every single time I watch the "tech" portion of our local news channels I want to call them up and make at least 3 corrections (most of the time non-Microsoft stuff). They can't even get mobile phones right.

A great blog to subscribe to is the Microsoft Security Response Center Blog!.

Vista: Worth the upgrade?

mhass — Thu, 04 Aug 2005 02:12:00 GMT

I admit that I was pretty skeptical about whether I could see both office users and consumers upgrading to Vista. To me it seemed like Vista was just XP SP 3 that we where going to charge for.

After playing with a post Beta 1 build and a Brian Valentine demo this morning, I am convinced that everyone will see the benefits and justify the upgrade. There were a few key features that are available in Beta 1 that put me over the edge. It'll be great to see what ISV's do to exploit these coold new platform features.

RSS in IE7. Need I say anything else?
OS integrated Search. My thoughts on this were: "If we already have desktop search, why would we need an OS integrated search?". The answer is by having contextual search such as File Explorer, or Document Explorer. It is actually quite nice to have this feature that figures out exactly what you are trying to search for.
“Windows Presentation Foundation” aka Avalon. This is the new graphical desktop that will actually utilize your graphics card. The transparent windows are cool, but better yet the rotated tile feature lets me locate my applications quicker when I have a bunch open. The graphical task switch bar is also pretty awesome to preview what I am trying to “task to”.
Virtual Folders. Organizing your information regardless of where it is on the network or disk is a great way of organizing information

We saw some great Office 12 and Vista integration that makes it even more compelling, but you’ll have to wait for details until they enter Beta with Office 12.

Office 12: Highlight of TechReady

mhass — Wed, 03 Aug 2005 19:44:00 GMT

We have gotten two incredible demos of Office 12 during the last two days. I'll be the first to say that Office has been been pretty much the same product since Office 2000. Office 12 changes that, here are a couple morsels that should make the final release.

SharePoint integration is essential, this takes every single product in the Office Suite to a whole other level.
The GUI is much better at exposing all those cool features that a buried deep in the current menus.

Verdict: The most exciting thing Microsoft has done on the desktop in the last 6 years.

Detour: Paving in progress

mhass — Wed, 20 Jul 2005 18:07:00 GMT

There comes a time in every person’s life that they need to make an important decision. For me, that day is today.

I am going to backup my data and pave my Windows XP personal desktop. This box has served me well for 2 years, but it has gotten to the point where things aren’t adding up like they used too. For instance, I was able to play Battlefield 2 for about 2 weeks, then it won’t let me start single player maps anymore. iTunes occasionally hangs up and gives me the middle finger. And, I have reripped all my CD’s at variable bit rate for better quality, and the machine would just randomly freeze midway through a rip.

I think the key to its longevity has been to keep it clean (no kids games, wife’s stuff) and have good anti-spam and anti-virus. I honestly think that in the last 4 months iTunes and Battlefield have done some funky mojo to it, and now it isn’t as stable.

I’ll start later today, see you on the other side….

MS AntiSyware team responds to Claria mumblings

mhass — Tue, 12 Jul 2005 00:12:00 GMT

The AntiSpyware team has posted a response to the articles that have arose recently concerning Claria.

The response is posted at http://www.microsoft.com/athome/security/spyware/software/claria_letter.mspx

Not really what anyone is looking for in terms of why Claria is now set to "ignore" seeing how they are some of the biggest SpyWare offenders.