Michael Niehaus' Windows and Office deployment ramblings

Back from a long vacation, leaving again soon

I'm back from a three-week vacation (longest I've ever taken, unless you go back to the summer after my college sophomore year), and for those of you who sent me e-mails and read my out-of-office reply, there was much more e-mail during that time than I could possibly reply back to.  So I'm going to wipe the slate clean and start over.  If you are looking for a reply from me, send the e-mail again :-)

I'm only going to be in the office for a couple of days before heading out again.  I'll be speaking at TechEd New Zealand in Auckland (two sessions) and TechEd Australia (three sessions) in Sydney next week, so hopefully I'll see some of you there.

Losing the (e-mail) battle

I get a lot of e-mail (and send a lot too).  Overall, for those e-mails that need a reply my system is very simple:  reply immediately, or flag the e-mail for follow up and get back to it when I have some time.  My goal is to keep that "For Follow Up" pile nice and small, but somehow it just keeps on growing.  The current tally:

So if you are one of those 364 people waiting for me to reply to an e-mail, I apologize - it's going to take me a while to get through them, especially since we have our internal TechReady 7 conference in Seattle next week, and then I am then going to take a few weeks off (the longest vacation I've ever taken).

My current excuse:  We have a new release coming out.  More on that soon.  (For the Microsoft guys in Seattle next week, you can get all the details in session CLI301.)

Even more certified

I took another certification exam today:

70-622 PRO: Supporting and Troubleshooting Applications on a Windows Vista Client for Enterprise Support Technicians

Let me offer a few general test-taking suggestions:

• Test-taking computers don't always work (the infamous "computer problems" excuse), so don't be disappointed if you need to reschedule.  (Exam attempt #1.)
• You really do need to take a photo ID in order to take an exam.  (I forgot my wallet that day, and sob stories to the attendant don't do any good at all.  Exam attempt #2.)
• Don't be late.  (Prometric generally won't allow you to start the exam if you are more than 30 minutes late.  Fortunately, I was only 29 minutes late - finally something goes my way with exam attempt #3.)
• Review the exam preparation guide before taking the exam, not after.

There were a few points during the exam that I wondered if I would actually pass, and failing would be just too embarrassing to admit.  Fortunately, my final score showed that I passed with flying colors.  I guess I guessed well.  (OK, maybe you can call it "deductive reasoning."  I always thought "what you know" exams were overrated.  I'm still waiting to see an exam that measures how well you can figure things out - being able to quickly and effectively find the answers is a crucial skill.)  Some areas covered in the exam:

• The new Windows Vista task scheduler.  (How many of you have actually used this?  There's quite a lot of new functionality.)
• Issues you might encounter with IPsec, Windows Firewall, Windows Defender, and secure communication, and knowing what issues each can cause.
• Troubleshooting issues with the Windows Update Agent, including interaction with WSUS.
• Group policy, including software restriction policies, software installation, UAC settings, loopback processing, folder redirection and troubleshooting.
• Plenty of network troubleshooting (DHCP issues, IPv6 configuration, wireless security options, wireless troubleshooting, IPCONFIG, NBTSTAT, etc.)
• Investigating issues with security templates.
• Application Compatibility Toolkit and User State Migration Tool.
• Internet Explorer 7 configuration.

It's a pretty broad exam - real-world experience would certainly help.  Even though I've been removed from the real world for last couple of years working at Microsoft's Redmond campus, I feel like I at least still have a strong connection to the real world :-)

With this exam and the previous 70-620 exam, I now have a new certification:

MCITP: Enterprise Support Technician

Of course now I notice that I could have just taken exam 70-621 to upgrade my existing MCDST certification to the new MCITP: Enterprise Support Technician certification.  But this way was more fun :-)

Installing IE 8 Beta 1 as part of an MDT 2008 Lite Touch deployment

The Internet Explorer team described how to slipstream IE 8 Beta 1 into a Windows Vista or Windows Server 2008 image using the process described at http://blogs.msdn.com/ie/archive/2008/06/20/slipstreaming-ie8.aspx.  Here's the same basic process with MDT 2008:

1. Download the needed version(s) of Internet Explorer 8 Beta 1.
   x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=C3C6E8C1-BD91-490B-86F5-F3652DD691DE&displaylang=en
   x64: http://www.microsoft.com/downloads/details.aspx?FamilyId=D399733E-D4A9-44FD-821B-1C52D3C677E3&displaylang=en
2. Extract the updates from the downloaded self-extracting installer files (into separate folders if you downloaded both platforms in step #1).
   x86: IE8-WindowsVista-x86-enu.exe /x:c:\temp\ie8x86
x64: IE8-WindowsVista-x64-enu.exe /x:c:\temp\ie8x64

3. Import the IE 8 updates into Deployment Workbench (right click on the "OS Updates" node and choose "New") by pointing it to the subdirectories you created above.
4. Deploy an OS :-)

Here's what the updates look like in Workbench:

Wizard Editor now available on CodePlex for download

At previous conferences, I showed a utility that could be used to edit the Microsoft Deployment Toolkit wizard XML template files.  But as some of you noticed (and e-mailed me about), the utility was nowhere to be found, so I was just teasing you :-)

So I'll tease no more.  The Wizard Editor is now available at http://www.codeplex.com/MDTWizardEditor for anyone to download and use.  It is provided as-is and could quite easily contain many bugs (for safety's sake, be sure you have a backup copy of the XML file before you change it), so please submit bugs through the CodePlex site; this is done by creating new issues on the "Issues" tab.    New feature requests can also be submitted via that mechanism.

If you are interested in contributing to the development of this tool, please let me know.  It is officially an open source project, covered by the standard Microsoft Public License terms.

Automatically installing Hyper-V RTM with MDT 2008

Unless you've been hiding under a rock, you probably noticed that the final RTM release of Hyper-V was made available today for Windows Server 2008.  If you haven't tried Hyper-V yet, you've got to check it out - it's pretty impressive.  Now that it is RTM, you no longer have an excuse :-)

John Howard posted a blog entry explaining how to inject the final Hyper-V update into a Windows Server 2008 WIM; read more about that at http://blogs.technet.com/jhoward/archive/2008/06/26/deploying-windows-server-2008-with-slipstreamed-hyper-v-rtm-part-1.aspx.  For those of you who are familiar with Microsoft Deployment Toolkit, you probably know that there is an easier way for Lite Touch deployments.  Here are the steps:

1. Download the Hyper-V update from http://www.microsoft.com/downloads/details.aspx?FamilyId=F3AB3D4B-63C8-4424-A738-BADED34D24ED.  (Note that this is for x64 only, since Hyper-V is a 64-bit only feature.)
2. (Optional)  Download the Hyper-V management tool updates that you may need (note that these require Windows Vista SP1, and no separate package is needed for Server 2008 x64 since the management tools are included in the update downloaded in step #1):
   Windows Vista SP1 x64: http://www.microsoft.com/downloads/details.aspx?FamilyId=88208468-0AD6-47DE-8580-085CBA42C0C2
   Windows Vista SP1 x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=BF909242-2125-4D06-A968-C8A3D75FF2AA
   Windows Server 2008 x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=6F69D661-5B91-4E5E-A6C0-210E629E1C42
3. Import all the downloaded updates into Deployment Workbench in the "OS Packages" node.  (MDT 2008 will automatically extract the needed CAB files from the MSU files that you downloaded.)
4. Deploy an OS :-)

That's all there is to it: MDT 2008 will automatically inject the appropriate updates into Windows Vista SP1 (x86 or x64) and Windows Server 2008 (x86 or x64) as part of the OS deployment process, so they will be there from the first boot of the OS.

Now if you actually want to install the Hyper-V role, you can do this using the "Install Roles and Features" action.  Just add it into your Windows Server 2008 task sequence, check the "Hyper-V" role, and it will be installed.

You'll have to wait for the Hyper-V updates to be available through Windows Update before you can do the same thing with ConfigMgr 2007, but fortunately you won't have to wait long: those updates will be published in the next couple of weeks.

It's official: Microsoft certifies that I can indeed configure Windows Vista

I recently participated in some discussions around Microsoft certifications, which reminded me of how long it has been since I've actually taken a certification exam.  So I decided I would get back into it again, and decided to start with something I should be able to handle with little difficulty, considering I've been working with Windows Vista for, well, since before it was even called Windows Vista:  exam 70-620, Configuring Windows Vista Client (http://www.microsoft.com/learning/en/us/exams/70-620.mspx).  So I scheduled the exam on Friday and walked in this morning, without any preparation except for "real world experience."

There were plenty of questions on the exam that made me cringe, not because of what they were asking but because of how the questions began:

You are an IT professional responsible for supporting PCs for your company.  A user in your organization is running Windows Vista Ultimate.

Of course we all know that you would normally want to run Windows Vista Business or Windows Vista Enterprise in your organizations.  And they get better:

You are an IT professional responsible for supported PCs for your company.  A user in your organization is running Windows Vista Home Basic and would like to upgrade to Windows Vista Ultimate.

Yikes.  I don't think I want to work for that company.  Overall, though, it wasn't a bad exam and I passed easily, so now I am indeed qualified to configure Windows Vista clients.  Aren't you glad?  :-)  If you are looking to take the exam yourself, be sure to know Windows Defender, Windows Meeting Place, Windows Mail, Internet Explorer add-on configuration, Windows Sidebar, Windows Calendar, Windows Fax and Scan, and connecting to networked video projectors.  And then there's the topics that you know will be stressed, like User Account Control, Windows Firewall, network configuration and troubleshooting, Device Manager, etc.

The funniest part: In the "Sectional Results" area of the exam results page, my weakest area was "Installing and Upgrading Windows Vista."  Sigh, back to work on the full-time job of installing and upgrading Windows Vista.

Sorting MDT's lists of applications, task sequences, patches, etc.

It seems to be a common request:  You want the MDT Deployment Wizard to show items sorted alphabetically.  So here's a simple script to do that:

' First parameter:  XML file name
' Second parameter: name of the element to sort on, e.g. Name (case-sensitive)

If WScript.Arguments.Count <> 2 then
    WScript.Echo "Usage: cscript.exe SortXML.vbs <filename> <node to sort on>"
    WScript.Echo "Sample: cscript.exe SortXML.vbs C:\Distribution\Control\Applications.xml Name"
    WScript.Quit
End if

' First load the specified XML file
Set oXML = CreateObject("MSXML2.DOMDocument")
oXML.PreserveWhiteSpace = true
oXML.Async = false
If not oXML.Load(WScript.Arguments(0)) then
    WScript.Echo "Unable to load XML file " & WScript.Arguments(0) & ", aborting"
    WScript.Quit
End if

' Populate the XSL transform

Set oXSL = CreateObject("MSXML2.DOMDocument")

oXSL.loadXML "<xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" >" & _
    "    <xsl:template match=""@*|node()""><xsl:copy><xsl:apply-templates select=""@*|node()""><xsl:sort select=""" & WScript.Arguments(1) & """ /></xsl:apply-templates></xsl:copy></xsl:template>" & _
    "</xsl:stylesheet>"

' Transform the XML and save it back

oXML.transformNodeToObject oXSL, oXML
oXML.Save WScript.Arguments(0)

Save this as "SortXML.vbs" and then you can do things like this (substituting appropriate paths for your environment):

cscript.exe SortXML.vbs C:\Distribution\Control\Applications.xml FullName

cscript.exe SortXML.vbs C:\Distribution\Control\TaskSequences.xml Name

cscript.exe SortXML.vbs C:\Distribution\Control\Drivers.xml Name

For safety, make sure you have a backup copy of the file before you do this.  And don't do this while the Deployment Workbench is running, as it could overwrite your sorted file.

New chipsets due soon from Intel

It's a Windows XP or Server 2003 image builder's nightmare: a new chipset that needs to be supported by your images.  Why is it such a big deal?  Because new chipsets mean new drivers, or at least new versions of existing drivers.  And that includes new mass storage drivers.  And adding a new mass storage driver typically means rebuilding and recapturing your Windows XP and Server 2003 images.  (This isn't nearly as big of a deal for Windows Vista and Windows Server 2008 as you can inject these drivers without much fuss.)

The first signs of Intel's newest desktop 4 Series chipsets, which include the X48, G43, G45, P43, and P45, are showing up on the Intel site.  First up is an updated Intel Matrix Storage Manager driver (iastor, one of our "favorites"), posted today and downloadable from http://downloadcenter.intel.com/filter_results.aspx?strTypes=all&ProductID=2973.  Machines that include these chipsets can't be too far behind.

Windows Vista driver management

In the Microsoft Deployment Toolkit (Lite Touch and Zero Touch for SMS 2003), as well as in ConfigMgr 2007, drivers are added just-in-time to a Windows Vista image as it is being deployed (after it is placed on the disk, but before it boots for the first time).  This is done using the PKGMGR.EXE utility or the underlying APIs to add new drivers into the Windows Vista driver store, a special directory structure (located in C:\WINDOWS\system32\DriverStore) that Windows Vista uses to hold both in-box drivers and "trusted" third-party drivers.

It's worth noting that after MDT injects the drivers into the driver store, it no longer needs the local copies in C:\Drivers; they will be cleaned up later in the process.

It's also possible to add drivers later, after Windows Vista is up and running (online), using PNPUTIL.EXE, a new utility for interacting with the driver store.  (Want to get really fancy?  You can even self-sign unsigned drivers.  See http://technet2.microsoft.com/windowsserver2008/en/library/4bbbeaa0-f7d6-4816-8a3a-43242d71d5361033.mspx?mfr=true for the details.)

Let's say you just want to see what additional drivers have been added to the driver store.  That's pretty easy to do using PNPUTIL.EXE.  Just issue this command:

PNPUTIL.EXE -e

This will show a brief listing of all third-party drivers present in the driver store.  You can also delete third-party drivers (one at a time) using PNPUTIL.EXE -d, add drivers into the driver store with PNPUTIL.EXE -a, etc. 

There are some other driver management improvements in Windows Vista worth mentioning:

• Windows Vista will recursively look through specified directory structures (e.g. those specified via OEMPnpDriversPath or the DevicePath registry setting), so it's no longer necessary to list each subdirectory containing drivers like you needed to do in Windows XP.
• Windows Vista allows the specification of network UNC paths to locations containing drivers.  A few comments about that:
• Assuming the machine is domain joined, Windows Vista will use the computer account to access that share, so make sure security is set appropriately.
• Obviously this doesn't work for all types of drivers, e.g. network drivers needed to get to the UNC share.
• Don't point to huge directory structures as device installation can then take a very long time as it searches through the entire directory structure (generating lots of network traffic as it processes each INF file it finds) looking for a matching driver.
• Don't assume laptops will be on the corporate network - they may need the drivers when roaming, so plan accordingly (i.e. consider adding them to the driver store).
• This is probably most useful for common peripheral drivers - devices that are not present when the OS is installed but could be inserted at any point in the future.
• Windows Vista can automatically download drivers from the Windows Update website (at least once you have a network driver loaded).  This works well for many devices, as there are thousands of drivers available via this method.  (Want to search through them yourself?  Be sure to check out the http://catalog.update.microsoft.com website.)

New command option available in Windows AIK 1.1's BOOTSECT.EXE to update MBR

Windows AIK 1.0 included a BOOTSECT.EXE tool that could update the boot sector to either a Windows Vista/Server 2008 (/nt60) or a Windows XP/Server 2003 (/nt52) version.  But it didn't provide a way to update the master boot record (MBR).  If you wanted to do that, you had to boot into the Windows recovery environment and then run "FIXBOOT /MBR".  The downside of that: it can't easily be automated.  (What's the difference between a boot sector and an MBR?  Read up on it at http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/prork/prcb_dis_qxql.mspx?mfr=true.)

The MBR code was updated for Windows Vista, and if you install Windows Vista using SETUP.EXE (e.g. straight from the DVD or using MDT Lite Touch) it will update the MBR appropriately.  And running DISKPART "CLEAN" will also update the MBR.  But if you aren't wiping the disk and aren't using SETUP.EXE, the old MBR would be left in place.

Why does this even matter?  One noticeable reason:  BitLocker wants to see a Windows Vista MBR, and won't let you enable BitLocker if it doesn't find one.  So you need a way to do that, something easily automated.  That something is a new version of BOOTSECT.EXE included in Windows AIK 1.1.  This version has a new /MBR switch that takes care of installing the latest MBR.

This is actually related to why ConfigMgr 2007 SP1 requires Windows AIK 1.1: it wants to use the new BOOTSECT.EXE /MBR command, so it needs the latest BOOTSECT.EXE /MBR command.  The old BOOTSECT.EXE will fail if you specify this previously-nonexistent command line option.  (MDT 2008 Lite Touch uses slightly different logic: it tries the BOOTSECT.EXE /NT60 /MBR command and if it fails it tries again without the /MBR switch.  So we can still support Windows AIK 1.0 and 1.1.)

Want to move from two partitions to one as part of your OS deployment?

In the Microsoft Deployment Toolkit refresh scenario (back up user state from current OS, boot to PE, wipe old OS from disk, install new OS image, boot into new OS, restore user state) we normally don't support any type of disk repartitioning or reformatting because we are actively running from the disk.  But there is a scenario that can be done successfully: remove a second partition and go back to having a single-partition setup.  So how would you do that?  It's really not too difficult:

• Add a new custom task sequence "Run Command Line" step that executes DISKPART.EXE to process a script such as this:
  
  SELECT DISK 0
  SELECT PARTITION 2
  DELETE PARTITION
  EXIT
  
• Ensure that the sysprep.inf is configured to specify ExtendOemPartition=1 (we do this by default in MDT 2008), or if deploying Windows Vista ensure that unattend.xml specifies ExtendOSPartition in the Microsoft-Windows-Deployment component, specialize phase:
  
  <ExtendOSPartition>
  <Extend>true</Extend>
  </ExtendOSPartition>

The custom DISKPART script removes the second partition (make sure there's nothing on it you want to keep first), and then the Windows XP mini-setup or Windows Vista specialize process takes care of extending the OS partition to take up the remainder of the disk.

On a slightly-related topic, it's actually this extension process that causes the issues described in KB 931760 (the uberbug).  If you deploy Windows XP with a sysprep.inf that doesn't specify ExtendOemPartition=1 you probably won't see any issues and won't have to do any of the workarounds described in the KB article.

If you want to move the other direction (from a single partition to two partitions) let me try to talk you out of it :-)  (I'm not a big fan of multiple-partition configurations, e.g. one partition for the OS and one partition for user data.)  It is possible to move from one to two, but it is more difficult.  The basic process would be to defragment the disk (in case there is something at the end of the partition), boot into Windows PE 2.0 (running from a RAMdisk so that the existing partition isn't in use), and then run DISKPART to shrink the current partition:

SELECT DISK 0
SELECT PARTITION 1
SHRINK QUERYMAX
SHRINK DESIRED=10000 MINIMUM=5000

In this case, the "QUERYMAX" statement would tell you how much you can shrink the partition, while the DESIRED and MINIMUM parameters specify how much to actually do (in MB).  (The SHRINK command was added in the Windows Vista/Windows PE 2.0 version of DISKPART, in case you missed it.)

Sysinternals tools directly from a file share

Wow, no more separate downloads and archive files - just grab them from \\live.sysinternals.com\tools.  (If for some reason this doesn't work for you, try http://live.sysinternals.com.)  I see a new XCOPY command in my standard computer installation process:

XCOPY \\live.sysinternals.com\tools\*.* C:\Tools

See the announcement for this new beta program at http://blogs.technet.com/sysinternals/archive/2008/05/28/updates-process-explorer-v11-20-zoomit-v2-0-sigcheck-v1-53-handle-v3-4-and-introducing-sysinternals-live-beta.aspx.

TechEd 2008 is rapidly approaching

In the US this year, they are trying something different: a two-week TechEd conference with the first week (June 3-6) focusing on developer topics and the second week (June 10-13) focusing on IT Professional topics.  (Don't worry, you will register for each week separately.)  This is very similar to the organization used for the European version of the conference, not surprisingly (although this year for the European event in November the IT Professional week will be held first).

For more information on the events, see the official websites at http://www.microsoft.com/events/teched2008/itpro/default.mspx and http://www.microsoft.com/events/teched2008/developer/default.mspx.  Full session catalogs are available.

The sessions I am presenting are pretty much the same as those given at MMS 2008 in Las Vegas last month, with a couple of additional ones added to make our lives a little more interesting:

Advanced Operating System Deployment with Microsoft System Center Configuration Manager: Extending OS Deployment with the Microsoft Deployment Toolkit (Part 3 of 4)

Microsoft Deployment is the next version of Business Desktop Deployment (BDD) 2007. New features in Microsoft Deployment integrate with and extend the native OS deployment functionality of Configuration Manager 2007 while providing thorough project management guidance. Examine how the Microsoft Deployment toolkit uses and extends the OS deployment capabilities presented in parts 1 and 2, providing new wizards, task sequence templates, additional server deployment automation, and other features.

Advanced Operating System Deployment with Microsoft System Center Configuration Manager: Provisioning Your Windows Deployment with Microsoft Deployment (BDD) (Part 4 of 4)

Now that you have a good understanding of the OS deployment features and functionality provided by Configuration Manager and Microsoft Deployment, explore ways to create dynamic, data-driven deployment processes. We discuss performing rules-based, data-driven deployments; using external data sources; adding your own scripts and customizing those provided with Microsoft Deployment; overriding task sequence properties; and other advanced topics.

What's New in Microsoft Deployment Toolkit (MDT) 2008? Updates for Windows Server 2008 and Windows Vista SP1

Windows Server 2008 and Windows Vista SP1 introduce new changes in the underlying service stack and Windows Automated Installation Kit. These changes are addressed in the second release of the Microsoft Deployment Toolkit (MDT) 2008 (formerly BDD). This session introduces MDT 2008 changes. MDT 2008 focuses on Windows Vista SP1 support and Windows Server enhancements; it provides broader support for automated role installation using Server Manager in Windows Server 2008. This session is presented first-hand by solution developers and provides a current roadmap and release schedule for future MDT releases.

Unleash the Power of the Microsoft Deployment Toolkit (MDT) 2008 (formerly BDD) with Customization

This session is for those who fully understand the Microsoft Deployment Toolkit (MDT) 2008, Microsoft Business Desktop Deployment (BDD) 2007, Microsoft System Center Configuration Manager 2007, and Systems Management Server 2003 with OS Deployment FP toolsets, but are looking to do more. We pool the key deployment customization themes and provide concrete examples to improve your deployments. In this session, we do not cover overview themes or 300-level content, but we discuss topics such as: understanding and using rules, deep dive into the deployment wizards, how to utilize the scripting framework to create your own scripts, using naming conventions, custom database lookups, and Web service lookups. We encourage open dialog for additional advanced customization themes and requests.

Automated Windows Server 2008 Imaging and Deployment Using the Microsoft Deployment Accelerator

Deployment tools for Windows Server 2008 have changed and most legacy tools will not support automated installation of Windows Server 2008. Microsoft Deployment is the next version of Business Desktop Deployment (BDD) 2007. The fourth generation deployment accelerator supports Windows Server 2008 imaging and deployment. This session is delivered by solution developers and explains how you can use Microsoft Deployment to plan deployments, create disk images, customize installation task sequences, automate disk and NIC configuration, and automate server role defintion. We discuss the current released tools (System Center Configuration Manager 2007 and Windows Deployment Services [WDS] with multicast support), features and limitations, and the Microsoft Deployment release roadmap.

ConfigMgr 2007 hotfix for adding new supported platforms

See http://support.microsoft.com/kb/950527 for the ConfigMgr 2007 hotfix that adds new supported platform entries for:

• Windows Vista Service Pack 1 (SP1)
• Windows Server 2008
• Windows Server 2003 Service Pack 2 (SP2)
• Windows XP Service Pack 3 (SP3)

These changes should be included in ConfigMgr SP1 too, so you can choose to wait for that too.

A separate hotfix for SMS 2003 SP3 should be available in the near future.