Opening .CHM files from network drives – the GPO way

Posted on December 11th, 2008 in Security, Server 2003, Vista by alt-92

Trying to read non-local HTML Help files since Security Bulletin MS05-026 has always been a very frustrating process.
First, there is the common ‘Oh oh, you’re opening a potentially dangerous file’ popup:

Well, yes. I want to, it’s already stored on my network. I put it there. In fact, I already unblocked the content when I downloaded the file.

But still I get a blank page in the Helpfile:

So let’s go check the KB Article page to see what we can do.

Ah. While there is a helpful section explaining the registry keys needed to Make Things Work again regeditting manually is not everyones favourite pastime:


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"MaxAllowedZone"=dword:00000001
"UrlAllowList"="\\\\alt-92.net"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
"MaxAllowedZone"=dword:00000001
"UrlAllowList"="\\\\alt-92.net"

No, the double \\ are no mistake. You need to escape backslashes.

Now repeat for every computer. Wash, rinse, repeat.

Time to get busy.
Using GPOs seems a likely solution. In fact, the KB article references GPO’s but in a very nasty way.
So why not use Vista’s new GPO Preferences?

To start off, create a new GPO (appropriately named GP_HTMLHelpFix ).
Dig down into the Computer Configuration tree, until you reach Preferences> Windows Settings > Registry.

Create new entries for the values needed:

You can use the UrlAllowList setting to enter DFS roots or local intranet domain.

After linking the Computer GPO to the proper OU and doing a gpupdate, you should see the results in the Registry Editor:

The above approach works in most cases. Except.. it’s still not working.

As it turns out, I not only need to configure the registry keys, but also need to properly configure Internet Options to include the namespace in the local Intranet Zone.
Apparently, there is a problem in IE7 listed in MSKB article 941001.

If you configure a policy setting to a value other than the default value, a local site may appear as “Local Intranet” even though you expect it to appear as “Internet,” or vice versa.

The default settings which should work but don’t:

So let’s tick off Autodetect, tick “Include all Network paths (UNCs)” since a drivemapping is also UNC..

Click Advanced, and enter the domain as a file://-based UNC path..

Re-tick autodetect, with the settings enabled and ‘Ok’ your way though.

Import these settings in the appropriate GPO object to control IE settings if you have them.

Bonus: Use a WMI filter to exclude or include the operating systems you wish to apply these settings to. The Filter shown ensures the GPO only applies to XP desktops and Vista RTM or SP1 desktop machines, and not to any 2000 Pro or 2003 Server machines that inadvertently stray out of their OU.

By the way:

It worked!

Smart-resizing Remote Desktop connections?

Posted on November 21st, 2008 in Server 2003, Server 2008, Vista by alt-92

Guess you can learn something new every day.

http://blogs.msdn.com/ts/archive/2008/08/07/smart-sizing-the-ts-client.aspx

Since the Windows XP timeframe, the TS Client has had the ability to run in “smart-sized” mode (users of Remote Assistance will be familiar with this mode). Smart-sized mode means that the entire remote desktop is always visible in the client window, with no scrollbars being necessary. In effect, for the same size client window, smart-sizing shows you more graphic data, while a non-smart-sized client window has to use scrollbars and shows much less.

Which means by adding

smart sizing:i:1

to a .rdp file (which is a textfile after all) you can get resizing Remote desktop windows too :)

Link Layer Topology Discovery driver on Windows 2003

Posted on August 16th, 2008 in Server 2003, Vista by alt-92

Vista (and Server 2008) introduced the Network Map feature ( as discussed here ).

This feature shows you a Diagram with all LLTD-capable hosts in your home network and you can start it from the Network and Sharing Center Control Panel applet by clicking View Full Map:

Your Network Map would look something like this:

Now, only Vista has this on by default, and the only other Windows version for which LLTD is available is XP.

Shuttle is a WIndows XP MCE2005 machine and has the LLTD Responder installed as provided from MSKB article 922120 (Validation is required to get the download).

My network however also features some 2003 Servers, how do we get these to show?
Installing the driver on Windows 2003 Server does not work, since the updater checks your Windows buildnumber. The update_SP2QFE.inf and update_SP2GDR.inf files contain this entry:

[Version]
Signature = "$Windows NT$"
LanguageType = %LangTypeValue%
NtBuildToUpdate = 2600
NtMajorVersionToUpdate = 5
NtMinorVersionToUpdate = 1
MaxNtBuildToUpdate = 2600
MaxNtMajorVersionToUpdate = 5
MaxNtMinorVersionToUpdate = 1
MinNtServicePackVersion = 512
MaxNtServicePackVersion = 512
ThisServicePackVersion = 512
CatalogFile = %SP_SHORT_TITLE%.cat

Editing the MaxNtMinorVersionToUpdate to 2 (NT 5.2 meaning 2003 Server) might seem like an option, but this invalidates the signature with which all Microsoft updates are signed to prevent tampering.

Turns out there is a very simple way to install the LLTD responder.
First, extract the hotfix to a directory:

.\WindowsXP-KB922120-v5-x86-ENU.exe /X:D:\temp\kb922120

Move the files into your preferred location. In my case, I’m using a DFS network share for AD software deployments.
Create a batchfile, vbscript or whatever you like, and let it perform the following actions:

copy "\\yourserver\appinstall\lltd_2k3\SP2QFE\rspndr.sys" %windir%\system32\drivers
copy "\\yourserver\appinstall\lltd_2k3\SP2QFE\rspndr.exe" %windir%\system32
copy "\\yourserver\appinstall\lltd_2k3\SP2QFE\ip\rspndr.inf" %windir%\inf
start %windir%\system32\rspndr.exe -i
exit

This obviously copies the files in their corresponding target locations and then starts the Responder Service.
Deploy the files in the way that suits you best,

Now, check your Network Map again and you will see your Windows 2003 Server:

And since the Responder can be started and stopped as a regular Service, you can influence the behaviour from whatever mechanism you prefer (MOM Tasks, startup/logon scripts, SMS, System Center) .

Note:
If you’re using VMware products, and both Host and Guest OS have the Responder installed, you’ll notice that VMware Bridging is represented as a Network Hub connection.

How NOT to translate a HOWTO

Posted on July 11th, 2008 in Crazy stuff, Server 2008, Vista by alt-92

This isn’t Dutch.
Not even close.

Spiegelbeeld 6001.18000 (x86 en x64 voor Venster Server 2008 en Vergezicht SP1) Standalone Downloaden

Spiegelbeeld zit te troepenleiding- wachtrij werktuig welk in staat stellen origineel werktuig vervaardiger (OEMs), vroedschap en Venster enthousiast voor inneming, voor wijzigen, en voor toepassen vijl- op basis van schijf spiegelbeeld voor stroomversnelling deployment. Spiegelbeeld werken van Venster spiegelbeeld (.wim) archief en annuleerteken werkzaamheden van andere technologisch welk toepassing .wim spiegelbeeld, zulke zoals Venster Instelling, Venster Deployment Diensten ( venster DS), en naar de Systematiek Regie Server (SMS) Besturingssysteem Wezenstrek Deployment Troep.

Spiegelbeeld zit plain tweedehands voor omgaan met en schipperen Venster instelling installatie schijf spiegelbeeld vijl tevredenheid, zulke omtrentslipstream Venster Vergezicht SP1 stap troep te RTM voorstelling van Venster Vergezicht spiegelbeeld. Spiegelbeeld komt zonder kosten vanVenster Automatiseren Installatie Kit ( venster AIK of WAIK). Naar de WAIK voorstelling 6001.18000 ( of 6.0.6001.18000) is vrijgekomen met het oogmerk barkas van Venster Server 2008 en Venster Vergezicht SP1.

WAIK zit te downloaden van ruim 1 GB, en vergen verbruiker voor brandwond naar de ISO spiegelbeeld voor schijf. Wanneer u vergen uitsluitend Spiegelbeeld, ketterij’ naar de uittreksel Spiegelbeeld voorstelling 6001.18000 voor 32- stukje (x86) en 64- stukje (amd64 of x64) Venster. Te naar de RAR samenpersen archief omvat naar de overeenkomstig voorstelling vanVsp1cln.exe, naar de werktuig voor schoonmaak en wegnemen backup-kopie RTM voorstelling van archief over installeren Stap Troep 1.

Downloaden Spiegelbeeld voor 32- stukje Venster: ImageX_x86.rar
Downloaden Spiegelbeeld voor 64- stukje Venster: ImageX_x64.rar

Beider archieven inhouden imagex.exe, intlcfg.exe, vsp1cln.exe, wimfltr.inf, wimfltr.sys, en wimgapi.dll.

voornaam: You’re voorlezing te toestel vertalen pagina wie zit voorzien ” zoals zit” zonder waarborg. Ongelikt menselijk vertaling, toestel vertaling doet niet verstaan naar de spraakleer, semantiek, zinsleer, taaleigen van natuurlijke taal, zus vaak voedingsmiddelen onnauwkeurig en loeien kwaliteit tekst wie zit illusoir en onbegrijpelijk. Zus, wees zo goed verwijzen voororigineel Engels stuk wanneer ter twijfeling.

If you got this far, my hat’s off to you.

The original text reads:

ImageX 6001.18000 (x86 and x64 for Windows Server 2008 and Vista SP1) Standalone Download

ImageX is a command-line tool that enables original equipment manufacturers (OEMs), corporations and Windows enthusiasts to capture, to modify, and to apply file-based disk images for rapid deployment. ImageX works with Windows image (.wim) files and can work with other technologies that use .wim images, such as Windows Setup, Windows Deployment Services (Windows DS), and the System Management Server (SMS) Operating System Feature Deployment Pack.

ImageX is commonly used to manipulate and manage Windows setup installation disc image file content, such as to slipstream Windows Vista SP1 service pack into RTM version of Windows Vista image. ImageX comes free with Windows Automated Installation Kit (Windows AIK or WAIK). The WAIK version 6001.18000 (or 6.0.6001.18000) is released with the launch of Windows Server 2008 and Windows Vista SP1.

WAIK is a download of more than 1 GB, and requires user to burn the ISO image to disc. If you require only ImageX, here’s the extracted ImageX version 6001.18000 for 32-bit (x86) and 64-bit (amd64 or x64) Windows. Within the RAR compressed archive includes the corresponding version of Vsp1cln.exe, the tool to clean up and remove backup RTM version of files after installing Service Pack 1.

Download ImageX for 32-bit Windows: ImageX_x86.rar
Download ImageX for 64-bit Windows: ImageX_x64.rar

Both archives contain imagex.exe, intlcfg.exe, vsp1cln.exe, wimfltr.inf, wimfltr.sys, and wimgapi.dll.

DFS Modlink utility

Posted on June 14th, 2008 in Server 2003, Server 2008, Storage, Vista by alt-92

If you add a new target ( DFSCMD /ADD \\dfsroot\link \\server\share ) the default behaviour is to enable the DFS link state.
Based on code found on MSDN for DFS_INFO_101 Structure (Windows) , this command line utility enables or disables the DFS target link state.

« Previous Page — Next Page »