Windows 7 AppLocker overview

AppLocker is a new feature of Windows 7 that allows you to restrict program execution via Group Policy. It is comparable to—but better than—the Software Restriction Policies of former Windows versions, which are still supported in Windows 7 and Windows Server 2008 R2. Software Restriction Policies are not very popular among admins, because configuring them is time-consuming although it can easily be circumvented. AppLocker promises to address both downsides to Software Restriction Policies

AppLocker supports three types of rules: Path Rules, File Hash Rules, and Publisher Rules. Path Rules and Hash Rules are already available as part of the Software Restriction Policies.

Path Rules enable you to restrict the execution of programs to a certain directory path. For example, you can allow end users to launch applications only from the Windows Program Files folders. This is safe as long as end users are not allowed to install programs. The problem with this rule type is that users often also need to start applications from other locations—for example, from a file server. Depending on the complexity of your environment, it can be time-consuming to keep track of legitimate program folders.

Hash Rules use a cryptographic hash of the executable to identify a legitimate program. The major downside of this rule type is that you have to modify the rule whenever you update the program, because any kind of change to the executable will also change the hash.

Publisher Rules identify an application based on a digital signature of the application that was issued by the publisher. They are comparable to the Certificates Rules found in the Software Restriction Policies. However, Publisher Rules are more sophisticated. Most newer applications have a signature that can be used for Publisher Rules. In Vista and Windows 7, you can view this signature through the file properties of the executable. Certificates Rules usually work only with ActiveX controls that have an appropriate certificate, and these are very rare.

All three rule types (Path, Hash, and Publisher) can be applied to executables (.exe), to scripts (.ps1, .bat, .cmd, .vbs, .js), to installer files (.msi, .msp), and to system libraries (.dll, .ocx). The latter option is not yet implemented in Windows 7 Beta1 (build 7000).

All rule types allow you to configure exceptions. An exception can be one of the three rule types, and it can be a different rule type from the rule it belongs to. For instance, you could configure a Path Rule that allows the execution of all apps in the Program Files folder except those of the publisher Microsoft. This would prevent users from launching Internet Explorer, Windows Media Player, etc. Or you could restrict the rule to a certain user or user group. It is also possible to configure ‘allow’ and ‘deny’ rules.
Continue Reading »

Antivirus Programs compatible with Action Center

When you first install Windows 7, you'll get a popup balloon message telling you that you need to find an antivirus program online

Once you've installed a compatible package, the message will go away and you'll see a message in the Action Center telling you that "Virus protection" is On

However, Windows 7 do not detect every Antivirus program installed, it's because the antivirus must communicate with operating system and tell it's status.

The packages should also hook into the Windows 7 update mechanism and let you know when your virus definitions are out of date.

List of Antiviruses compatible with Windows 7 Beta Action Centre:

AVG Anti-Virus Free Edition
Avira AntiVir Personal Edition
Norton AntiVirus 2009
Avast! AntiVirus Home
Kapersky Anti-Virus 2009

Note: The fact that a antivirus is not compatible with Action Centre doesn't mean that it will not work on Windows 7, it just means that the Antivirus can't communicate with AC.
Continue Reading »

Fix jerky DWM animations on some NVIDIA cards

One thing we’ve noticed in Windows 7 when using NVIDIA graphics cards is that the animations for the Desktop Window Manager are not smooth. One reason for this could be that DWM now turns off transparency and blurring when rendering effects (as well as for Flip3D).

To work around this so that you experience is a bit smoother, turn off the animations:
1. Click on the Start button, right click on Computer, and click on Properties.
2. Click on Advanced System Settings in the task pane and accept any UAC prompts that may appear.
3. Under Performance, click on Settings.
4. Uncheck “Animate windows when minimizing and maximizing”.
5. Click on OK.
Continue Reading »

HowTo : Mount Virtual Hard Discs (VHD)

Windows 7 allows you to create and manipulate virtual hard disk files (or “VHD”s) as if they were real disks. This is great as it allows Virtual PC users to mount their virtual disks within a live Windows installation without the need of booting the virtual PC environment.

To create virtual hard disks:
1. Click on Start, right click on Computer, and then click on Manage. Provide consent to the User Account Control dialog if required.
2. In the left hand pane, click on Disk Management, and wait for it to load.
3. In the menu bar, click on Action, and then click on Create VHD.

Here you will be able to specfify the size and the location of the virtual hard disk file.

To attach a virtual hard disk file:
1. Click on Start, right click on Computer, and then click on Manage. Provide consent to the User Account Control dialog if required.
2. In the left hand pane, click on Disk Management, and wait for it to load.
3. In the menu bar, click on Action, and then click on Attach VHD.

In the dialog that appears, you can specify the location of the VHD file as well as mark it as read-only.

Initializing virtual hard disks:
1. Click on Start, right click on Computer, and then click on Manage.Provide consent to the User Account Control dialog if required.
2. In the left hand pane, click on Disk Management, and wait for it to load.
3. In the menu bar, click on Action, and then click on Attach VHD.
4. Specify the location of the VHD file and click on OK, the Disk Management Service will go ahead and mount the VHD file.
5. Once it is mounted, right click on the virtual disk (which will show up as a blue hard drive) and click on Initialize Disk.
6. In the dialog that appears, select the partition style you wish to use and click on OK. The Disk Management Service will now initialize the disk for use.
7. Right-click on the unallocated space in the virtual hard disk and click on “New Simple Volume”, and follow through the instructions in the wizard to create a new partition within the VHD.

Now, if you go to Windows Explorer, you’ll see another hard drive here, which is the virtual hard disk – you can interact with it as if it were a real hard drive.
Continue Reading »

Uncle Laz : My experience with Windows 7

I'll start with the fact that I really hate Vista, and honestly I wasn't expecting too much from new Windows 7. I have mid-end laptop Asus Z99He, it's system specs are:
Intel Celeron M 520 1,6 Ghz
Intel 950 chipset with integrated GMA 950 graphics adapter
WiFi, bluetooth, 80 Gb Hard drive, and a 14,1" screen.

Windows Vista was unreal to bare, it was very slow.
And, like I mentioned, I was expecting the same thing from Windows 7, and I was wrong :)
Even in Beta stage, this operating system feels so confortable on my laptop, that I even erased Windows XP partition and made Windows 7 as my main system.

I will name the things that surprised me most in Windows 7:
- It has everything. The only thing that I installed for hardware support was hotkey utility, everything else was detected by Windows 7 with proper drivers installed. And actually Windows update was providing me with driver update along with system ones.
- Windows Management. It's so easy to manage my windows, that I even can work freely without a mouse
Win+Left Arrow and Win+Right Arrow docks a windows on left/right half of the screen;
Win+Up Arrow and Win+Down Arrow maximizes and restores / minimizes current windows
- Monitor Management. I'm studying at University, and I was about to make a presentation, I connected the projector, pressed Win+P, and selected prefered monitor mode. That's all, few clicks and your system is ready to work with multiple monitors
- Windows Aero works with no lag on my morally old chipset, and hell yeah, I even watch HDTV movies without lag or something
- Low space requirements is something that I really apreciate in this system, I removed DVD Maker and Internet Explorer 8, and along with all programs and pagefile my Windows 7 uses up to 8 GB on my hard drive, without touching the install ISO or something, everything is customizable at user level
- Amazing performance, even in Beta stage runs like hell
- Cool design makes every minute with Windows 7 pleasant
and much, much more

Honestly I'm impressed, I hope that M$ will keep this pace and will release RTM version soon.
Continue Reading »

How to restore quicklaunch in Windows 7

You might have noticed that the old faithful Quick Launch toolbar is not only disabled by default in Windows 7, it’s actually missing from the list of toolbars. As is probably obvious, the concept of having a set of pinned shortcut icons is now integrated directly into the new taskbar. To re-enable it, do the following:

- Right-click the taskbar, choose Toolbars / New Toolbar
- In the folder selection dialog, enter the following string and hit OK:
%userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
- Turn off the “lock the taskbar” setting, and right-click on the divider. Make sure that “Show text” and “Show title” are disabled and the view is set to “small icons”.
- Use the dividers to rearrange the toolbar ordering to choice, and then lock the taskbar again.
Continue Reading »

New limitations for some Windows 7 editions

Users who follow this blog closely already know that the cheaper, low-end editions of Windows 7 will come with limitations and less features than the medium- and high-end editions. Windows 7 Starter and Windows 7 Home Basic are the two editions that are usually considered low end. They miss features like full Aero support, touch functionality or Windows Media Center. The mid range products Windows 7 Home Premium and Windows 7 Professional all come with their own set of features. The core builds up on the lower editions but Microsoft has decided to add features unique to every edition. This is how the editions build up on each other:

Windows 7 Starter > Windows 7 Home Basic > Windows 7 Home Premium > Windows 7 Professional > Windows 7 Ultimate (Enterprise).

Paul Thurrott mentioned additional restrictions that have not been know before in a recent article on his website:
- Windows 7 Starter and Home Basic will not come with AAC, H.264 or MPEG-2 support. Microsoft seems to have the intention to provide upgrades for those systems to add the support.
- 4 Gigabytes of ram are supported by all Windows 7 editions in 32-bit mode. The differences are in 64-bit mode. Home Basic and Starter support a maximum of 8 Gigabytes, Home Premium 16 Gigabytes and Professional, Ultimate and Enterprise up to 192 Gigabytes of ram.
- Windows Media Player Remote Media Experience (RME) is not available in Windows 7 Home Basic or Starter. However, all versions can share media over a home network.
- All Windows 7 SKUs support 20 simultaneous SMB connections. This works out to 10 users, apparently.
- Only windows 7 Professional, Ultimate and Enterprise support the Virtual XP Mode.
Continue Reading »