Supporting Windows 7, for XP Experts

Supporting Windows 7, for XP Experts (Comprehensive Edition) The complete technical support professional's guide to deploying, managing, troubleshooting and just plain getting the most out of Windows 7... for those of us who skipped Vista	“From 'XP Expert' to 'Windows 7 Wizard' in three days, avoiding the need for a stop in Vistaville along the way!”
*a three-day course by Mark Minasi, author of many of the Mastering* series of Windows books**
Schedule of dates and cities • Course Objectives • Prerequisites • Course Outline • Course Materials • Bring a Class to Your Site • About the Instructor
Course Objectives Most of the Windows-using world relies upon XP Professional, and has for nearly ten years. For most of that world, however, it's time for a change, and Windows 7 seems to fill the bill with its vastly improved deployment tools, a completely revised, more modern and faster network stack, a dozen or so new built-in security technologies, much more complete central administration capabilities (including nearly two thousand new group policy settings), and several big improvements in storage. That's all great news, but how to get your current XP experts up to speed on Windows 7 in the shortest time? After all, Windows 7 offers a wealth of upgrades from XP, but it also does many things quite differently than XP did, and often in ways that aren't apparent -- unless you know where to look. Learning what's new, better, worse, and different than XP, as well as how to support all of those new, better, worse and different things can be quite time-consuming -- unless you let veteran Windows techie Mark Minasi guide you through that thicket. In three days, Mark explains everything that an XP expert needs to become a Windows 7 wizard, and course delivers it with his distinctly entertaining style, with a host of illuminating demonstrations and trademark humor. Hey, if nothing else, you won't want to miss this class for its complete coverage of how to smoke out and stamp out Windows blue screens! Key Seminar Benefits Hear the good news and bad news about supporting Windows 7, from one of the most trusted names in the Windows world, an independent source who's been analyzing, supporting, writing and teaching about Windows and other PC operating systems for a quarter-century Discover the new deployment tools in Microsoft's Windows Automated Installation Kit (WAIK) and how they can save you time and money Learn all of Windows 7's new security technologies so that you're ready to solve application compatibility and "why doesn't this work any more?" problems. Know how to control and repair Windows boot parameters with the new BCDEDIT, BOOT.INI's replacement, and go beyond what most sources cover to unlock the secrets of how to make a non-bootable system bootable in just a few commands! Use Windows' new GUI and command-line tools to control volumes, partitions and the new built-in virtual hard drive support Enable AppLocker and control which people can run what application Find out exactly what that annoying User Account Control thing's doing, how it works... whether or not to disable it! Avoid the dread possibility of malware (or other files or registry keys) that can't be deleted by understanding and controlling Windows Integrity Levels Grasp the essentials of file and Registry virtualization to enable "legacy" (that is, pre-October 2006) applications to run under Windows 7 Simplify your support tasks and keep from losing company data by exploiting CompletePC backup and Previous Versions on your systems Get the most out of Windows 7's changes to group policies Get the details on how Windows 7 lets your users organize their files in completely new, faster and more efficient ways with libraries, stacks, and the new Windows Search Service (and the sneaky trick to get Windows to allow you to add a non-indexed file share to a library) Ensure that when you lose a laptop, you lose only the hardware, not the data, with BitLocker Keep your company's data safe even when it's on a USB stick with BitLocker To Go Block users from installing particular types of hardware through group policies Lock down services with Windows 7 and sc.exe's new (and largely unknown) ability to bolster system security against buffer overflow vulnerabilities Uncover the causes and fixes to Windows' dread blue screens Prerequisites Anyone taking this class should have at least a basic knowledge of Windows support, Windows networking and security in the XP world. For example, you'll get the most out of this class if you know that Active Directory lets us centrally administer user accounts and machine settings, if you know what the Registry does, and have some familiarity with group policies. And, of course, all attendees must have a solid knowledge of the .NET CLR, C# and APL programming. (Okay, we're just kidding on that last point; no programming experience necessary!) Course Outline Introduction: Windows 7 in Perspective Vista's perceived failure in the marketplace, coupled with XP's time-tested reliability has made many folks a bit gun-shy about adopting a new Windows. Will Windows 7 require major hardware upgrades? Can you find drivers for it? 32-bit or 64-bit? Will my apps run on it? Which one of Windows 7's 273 versions should I adopt? We'll look at all of these issues in this section. Why consider an upgrade from XP? SKUs: Win 7 Pro versus Win 7 Enterprise/Ultimate Upgrade paths (good news and bad news) 32 or 64 bit? Some candid advice Making the Win 7 Pro/Win 7 Enterprise choice Hardware compatibility and requirements Software compatibility Post-XP Windows Deployment: Almost Everything You Know Is Wrong, But That's All Right For years, Microsoft was never really been successful in developing popular tools for automating Windows, whether for Windows 3.1 or Windows XP. While scripted installs and Remote Installation Service are good technologies, they've never really caught on amongst support professionals, and in truth the most-used Microsoft deployment tool in the XP world was Sysprep, and then only to facilitate using Ghost or similar products. Since 2006, though, Microsoft has re-thought deployment and given us a whole new arsenal of rollout tools. Are those tools the answer, or will they just be another case of "nice try, Redmond?" In this section, you'll meet Win 7's new "rollout team" and decide for yourself. New concepts Windows image (WIM) files The Windows Automated Installation Kit (WAIK) 2.0 The "repair OS," Windows Preinstallation Edition version 3.0 WIMs versus Ghost Mountable Delivering patches Deployment tools WAIK Tools Imagex Windows System Image Manager Windows PE 3.0 Sysprep Windows Deployment Services USMT and upgrades Deployment Image Servicing Manager (DISM) Working With WIMs (Windows Image files) What's a WIM? Peeking into WIMs with System Image Manager Working the WIM with imagex Deploying a WIM with WinPE and Imagex Deployment's all-new tool: the Deployment Image System Manager (DISM) replaces pkgmgr, intlcfg and peimg DISM goals: feature activation, image servicing Online versus offline behavior DISM examples: image mounting, offline hotfix installs, feature enable/disable, driver installs, image unmounting Awful activation: key management service (KMS) overview Windows activation in Windows 7 Multiple Access Key (MAK) activation versus KMS activation What KMS does Finding a KMS server Windows' New Boot Structure: BOOT.INI's Gone, BCDEDIT's Here Once you've got Windows 7 deployed, you'll start it up... and that's where we've got some new things to learn. Part of running any system involves controlling how it starts up in the first place. Ever since NT 3.1, we've controlled how the NT part of the Windows family boots through a simple text file called boot.ini. Vista, however, retires boot.ini and replaces it with a more flexible, architecture-independent tool: the boot configuration database, or BCD. But don't reach for Notepad to edit BCD... you'll need to learn BCDEDIT, a whole new tool. And while we're at it, Windows 7 likes to chop up your system's boot disk in a somewhat new way with a 100 MB "hidden partition" but, then it won't be hidden to you once we've covered it! Talkin' BCD: new terminology The "store" Boot entries Entry options Global bcdedit settings Boot entries, GUIDs and well-known GUIDs A guide to the most useful entry options New disk layout: booting from the "unlettered drive" BCDEDIT black belt skills: making unbootable systems bootable Virtual Disks on Physical Systems: VHDs and Boot from VHD. Windows 7 desktop and server use your disk in ways we've not seen before, with new in-the-box support of the VHD (Virtual Hard Disk) format for storing data and the ability to "boot VHDs natively," a concept that we'll explain in depth in this section. As you'll see, Microsoft may have to change the name of VHDs to remove "virtual," as Windows 7 uses VHDs in ways that have nothing to do with virtual machines. Booting from VHD explained and examined Native VHD support in detail: creating VHDs, populating them, attaching/detaching Getting images onto VHDs in the first place Advanced boot-from-VHD: run Windows from a handful of files, step by step! BCDEDIT revisited: doing the boot surgery for boot-from-VHD Can't [locate] the drive? BCDEDIT troubleshooting Finding and Storing Things Made Easier: Libraries, Tags, and the Search Index Over the years, Microsoft has experimented with different ways of letting your users store and organize their data. Windows 7 introduces a new, more flexible concept in the form of libraries, which you might think of as a sort of "My Documents" done better. If you choose to adopt Windows 7, then you should understand how these work and how to get the most out of them. Data organizing help: keywords, group by, ratings Libraries explained A sort of "super folder" Much more comprehensive search-wise Adding networked resources to libraries Deployment issues Search basics in Windows 7: XP's "index service" becomes the "Windows Search" service, but with important changes Reconfiguring Search Service (and why you'd want to) Using Windows' powerful new search language, the answer to "I used to be able to tell XP to show me all files that are over 10 megabytes and whose name starts with 'r,' but I can't figure out how to do it in Windows 7" Windows Storage News One of the sources of big changes in post-XP Windows comes from an often-overlooked area: storage. Windows 7 includes a completely different set of backup tools than those found in XP, a number of data integrity tools, and built-in support for creating and managing virtual hard disks (VHDs) which, despite their name, aren't just for virtual machines. You can even boot a physical Windows 7 system from a VHD, as you'll see in this section. Resizable volumes: no more Partition Magic needed Windows Backup Completely new backup system No tapes... but supports DVD and CD Data organization Windows Backup problems Recovering from catastrophic failure: CompletePC backup How CompletePC backup works Administering CompletePC: starting, stopping, scheduling, monitoring Restoring CompletePC backups: the Windows Recovery Environment Doing bare metal restores with CompletePC Getting Data Back Volume shadow copies Undelete comes to Windows 7: "Previous Versions" with no server needed Configuring "Previous Versions" NTFS and Registry change: transactions How transaction-based changes work Implications for patches Optical disk support via "isoburn" User Account Control Once we've mastered storage, it's time to start working with everyone's favorite Windows headache: security. You may not know of every post-XP feature, but there's at least one new Windows feature you probably know: User Account Control. Known informally as "the Vista feature that everyone loved to hate," UAC was intended as an anti-malware tool that actually didn't really work, but we think it's useful for other reasons, as you'll learn here. The key to UAC lies in understanding it, and understanding how it can contribute to application compatibility problems. Additionally, UAC contains a very important and useful patch that actually solves many app compat problems automatically, allowing you to run older applications that would otherwise fail when run as a standard user rather than an administrator. Yes, UAC can be annoying, but to know it is to love it -- and in this section, we'll show you more about UAC than you can find anywhere else! UAC component overview Administrator Approval Mode "Standard user" "Elevation" Split token Deciding which token to offer File and Registry virtualization What are administrators made of? How UAC creates the split token The Notorious Nine The Fearsome Four Integrity levels Controlling UAC and elevation UAC's seven rules to elevate How to override UAC's defaults Solving UAC-related application compatibility issues in Windows 7: understanding manifests File and Registry virtualization What it is, how it works, seeing it in action Rules for virtualizing Fine-tuning Registry virtualization Monitoring virtualization: virtualization as a software inventory tool Windows Integrity Levels Perhaps Windows 7's least-known but most potentially scary new feature is something called Windows Integrity Levels (WILs). WIL is a concept intended to protect your files from malware by identifying different levels of "trustworthiness" on users, processes, and objects (files and folders, for example). Once those levels of trustworthiness — "integrity" is Microsoft's phrase — are established, then higher-integrity objects (like your personal data) can be shielded from lower-integrity objects (like any malware derived from the Internet). That sounds like file permissions, yes, but it's more than that, as "integrity permissions" always beat file permissions. The sad news is that Microsoft implemented integrity levels, but didn't do much with it, nor did they tell anyone about it. The bad news is that malware writers can, using these integrity levels, create malware that cannot be deleted by an administrator... yikes! But after completing this section, you'll know how to control WILs so as to combat those kinds of attacks, as well as get some ideas about how to use this new tool to protect your data and applications. The basics: mandatory access controls and integrity levels How integrity levels affect object access in Windows Extending the integrity model chml, a tool to let you modify integrity levels Integrity levels versus permissions Controlling Who Can Use Which Applications: Applocker In October 2001, XP introduced the idea of "Software Restrictions Policies" (SRPs), a set of group policies aimed at letting administrators block users from running unauthorized applications. It wasn't a bad first try, but the software environment at the time — one wherein very few applications could be identified by their digital signatures — limited SRP's usefulness. As time's gone on, however, far more applications are signed, and so SRPs deserve a second look even in XP shops. With Windows 7, however, Microsoft introduces a significantly improved update on SRPs that they've called "Applocker." This section explains the differences between SRP and Applocker and suggests how each can assist your organization in controlling the range of apps that you allow to run on your desktops. Applocker/SRP similarities Applocker/SRP differences Using Applocker audit/block settings for testing Moving Applocker policies from the lab to the enterprise What to do when you've "Applocked" yourself out Clearing Applocker settings Where Software Restriction Policies can be more useful than Applocker Windows and Physical Security I: BitLocker Years back, Microsoft offered a set of ideas that they called the Next Generation Secure Computing Base initiative, or you may recall its code name "Palladium." About the only thing that's actually seen the light of day from the Palladium ideas is a terrific anti-data-theft tool called BitLocker. This section shows you what BitLocker does, but, better, it shows you how to do the extra BitLocker stuff that Microsoft would prefer that you didn't know. If you have laptops, then you need to understand BitLocker, as it's the tool that ensures that when you lose a laptop, then you lose only the hardware... not the data. BitLocker basics: full volume encryption How is it uncrackable? Is it uncrackable? Getting your system ready for BitLocker Setting up BitLocker with a "TPM" chip Setting up BitLocker without a TPM chip Choosing the level of encryption What to do when your laptop's toast and you need your data Configuring BitLocker with manage-bde Windows and Physical Security II: Plug and Play Restrictions Ever since the movie The Recruit, people have worried about data theft from USB devices. What keeps an unhappy employee or a visitor from popping a USB memory stick into a USB slot and siphoning off your company's data? Windows 7, that's what, with a new set of group policies controlling hardware installation. New hardware installation controls Creating whitelists or blacklists Understanding and finding hardware IDs, compatible IDs, and class GUIDs Steps to blocking a piece of hardware from installing Windows and Physical Security III: BitLocker To Go, Encryption for Portable Devices Vista and Server 2008 brought BitLocker, a tool that let you encrypt any or all of your internal hard disks. It slowed your drives down a bit, but ensured that if you left your laptop on an airplane then no one could peek at your data. With Windows 7, Microsoft has extended Bitlocker's job to enable you to use it to encrypt USB sticks and other portable data devices. Why do this? USB sticks worry many folks, as they fear that users might copy important company data onto a USB stick and then accidentally leave it where someone could find it and read that data. With BitLocker To Go, you can instruct one of your computers to only permit a user to copy data onto a USB stick if that USB stick's encrypted. That way, if the user loses the USB stick, then whoever finds it won't be able to read its data. This section explains how to make BitLocker To Go work, and what limitations it presents. BitLocker To Go overview and limitations Encrypting a USB stick Decrypting a USB stick Forcing systems to require BitLocker To Go Windows Service Architecture Changes Under Windows 7 Windows services are an important pillar of Windows' architecture... but they've been a source of security nightmares, as evidenced by Code Red, SQL Slammer, Nimda, Blaster, Sasser and others. In Windows 7, Microsoft has completely re-engineered how services work under-the-hood to allow developers to build services that are far more worm-resistant. But what about when those developers are a bit lazy? With the right knowledge, a savvy admin can tighten up many Windows services... without having to know how to write a line of C++! Review: why services offer vulnerabilities Service session isolation How it works Solving potential compatibility issues arising from it Reduced service privileges: "least privilege" and the new services How it works How to see if a service has been "least privileged" Dialing down a service's privileges without being a programmer Service isolation How it works: the new "restricted SID" Service SIDs How to restrict a service when the coders haven't bothered Service bounce: new Service Restart settings Why's that not up yet? Auto-delay services, a new type of service Short Post-XP Windows Security Items This section ends our look at Windows security with a roundup of short Windows 7 security topics. Changes to group policy security default settings Potential incompatibilities Administrator account disabled Folders and groups eliminated Windows Firewall changes Windows 7 Gets More (Remote) Controlling While running around to user's desks to fix things might be a good way to stay in shape, it's not really productive, particularly given the fact that there are an awful lot of users out there and fewer and fewer of us support folks -- so remote control's a good idea. Fortunately, Windows 7's got some nice upgrades for Remote Desktop and a completely new remote control protocol and tool, WinRM and Windows Remote Shell. This section shows you how to extend your reach with these new tools! Remote Desktop gets better in Windows 7 New name: Remote Desktop Services (RDS) More secure, if you opt for it Bandwidth throttling between interactive and noninteractive parts of RDS sessions EasyPrint simplifies remote desktop printing Block transfers speed up RDS sessions, once enabled Windows' RPC replacement: WinRM Why WinRM is replacing RPC WinRM essentials WinRM setup and security Where WinRM's currently in use in Vista, Server 2008, Windows 7 or Server 2008 R2 WinRM troubleshooting Secure remote control with winrs, "Windows Remote Shell" Back-porting WinRM to XP and 2003 Solving Windows 7/XP WinRM compatibility issues What's Changed in Windows 7's TCP and IP XP's network software has served us well, but the Internet's realities have changed between XP's 2001 debut and now, and Windows' networking software has changed to reflect that. Surprisingly, though, this has led to a situation wherein Windows up-to-date network software is showing up some older, less with-the-times network stacks, often leading to interoperability problems that seem to be caused by Windows 7, but that are actually the fault of the older stuff. In this section, you'll learn how to recognize and troubleshoot these problems. We'll also spend a little time talking about another Internet change that we will all be dealing with in a year or two -- IPv6. In this section, we'll explain a bit about why IPv6 is imminent and pass along just a few "must-know" IPv6 pointers. Post-XP TCP: RFC 1323 and what it means Where you'll see performance improvements Problems arising from networks with older networking hardware Troubleshooting procedures and workarounds A few words on IPv6 The latest on IPv6 deployment levels De-weirding IPv6 What's in an IPv6 address High-level view of IPv6 auto-configuration Where systems get IPv6 addresses, routers Where IPv6 systems get DNS addresses Anatomy of an IPCONFIG output: what is all that new stuff in IPCONFIG? Short Network Items Simply focusing on the big changes to post-XP Windows networking would lead us to miss out on some of Win 7's small but likeable additions to Windows networking, which we cover in this short section. Wireless UI changes and faster wireless connection Network and Sharing Center In the box: setspn, whoami, robocopy, klist, sc and more Group Policies in Windows 7 From networking, we move next to Windows 7's many new management tools and management infrastructures. The premier Windows central management tools is group policies. Group policies are a great idea, but ever since they appeared in Windows 2000 they've been a bit clunky: useful, but hard to administer and troubleshoot. To combat that, Microsoft completely rebuilt the group policy engine, added 900 new group policy settings, changed how group policies are defined, and made a host of other changes to make group policies more useful and more of a "must-use" tool. And they did it all without sacrificing backward compatibility, mostly. Find out about these changes in this section. What group policies needed in XP The group policy engine New service rather than part of Winlogon Hardened service isolates third party client side extensions Improved GP refresh methods Multiple local GPOs Network Location Awareness service 2.0 Completely revised group policy engine logging New administrative templates XML based Centralized store of admin templates reduces "Sysvol bloat" Implementing the Central Store Getting the Group Policy Management Console onto Windows 7 New group policy settings areas GPMC improvements Comments (hey, don't laugh until you have to look at a ten-year-old group policy object!) Keyword searches Starter GPOs Win 7's New Event Viewer Who would have imagined that the Event Viewer would play a minor starring role in Windows 7? While uprooting and rebuilding pieces of Windows, Microsoft decided (rightly) that Event Viewer was way overdue for a facelift. The new Event Viewer bears very little resemblance to the tool that changed very little between Windows NT 3.1 and Windows Server 2003 R2. This section examines its extensive set of new capabilities and how to exploit them. Windows 7 Event Viewer features Completely restructured logs New urgency level "critical" Event triggers Events can be collected at a central system Log size limits gone Creating event triggers Centralizing events Configuration setup Security setup Command-line Event Viewer: wevtutil Getting the most out of the Event Viewer: the sneaky way to use Xpath queries Solving Blue Screens and Lockups The toolkit of anyone supporting any version of Windows simply isn't complete without a knowledge of blue screens -- what causes them, measures to prevent them, and tools to analyze and ameliorate them. This section explains why in the end analysis blue screens are quite good news, and what to do with that news! What causes blue screens Controlling the crash dump files Crash dump files and pagefiles Analyzing the dump: perhaps Microsoft will do it for free Analyzing a dump yourself Analyzing and solving system lockups with Driver Verifier and other tools Windows' New Management and Reliability Tools Windows 7 comes with a number of tools intended to help you keep your system running in peak shape and, given how hardware-intensive Windows 7 can be, that's a good thing! In this section, we'll meet those tools. Performance rating tool Reliability Monitor: quick answers to "when did the problem start?" Problem Steps Recorder: Windows 7's most-beloved unknown feature Action Center: provider of security advice, blue screen tracker, and the "mute button" for a lot of irritating notifications Resource Monitor System tray squelch: pop those balloons! ReadyBoost and ReadyDrive Getting green: using powercfg to monitor energy use and suggest new ways to save energy Course Materials and Course Format The class works from PowerPoint presentations. Every attendee gets a printed copy of the PowerPoints. To make it possible to run this course in just three days, this runs in mainly lecture format. Arranging a Course At Your Location We offer this class as a public seminar about a half-dozen times a year; you can view the current schedule www.minasi.com/pubsems.htm. But you needn't wait — Mark can come to your organization to teach it on-site. On-site classes offer you the flexibility to lengthen or shorten the class, add hands-on labs, modify the course's focus and zero in on your group's specific needs. Please contact our office at (757) 426-1431 between 12 Noon-5 Eastern time or email Assistant@Minasi.com to discuss scheduling and fees.