Configuring Windows 7 (Training Kit) - Part 30 pptx

FIgUre 5-5 The Internet Explorer Compatibility Test ToolSetup Analysis Tool The Setup Analysis Tool monitors the actions taken by application installers and can detect the following comp

FIgUre 5-5 The Internet Explorer Compatibility Test Tool

Setup Analysis Tool

The Setup Analysis Tool monitors the actions taken by application installers and can detect

the following compatibility issues:

n Installation of kernel mode drivers

n Installation of 16-bit components

n Installation of Graphical Identification and Authentication dynamic-link libraries (DLLs)

n Modification of files or registry keys that are guarded by Windows Resource Protection

(WRP)

To perform an analysis, open the Setup Analysis Tool and type in the location of the setup

file that you want to analyze The Setup Analysis Tool runs the setup command and profiles

the installation procedure to determine what issues might exist

Standard User Analyzer

The Standard User Analyzer, shown in Figure 5-6, allows you to test applications to determine

if they might have compatibility issues caused by User Account Control The Standard User

Analyzer provides data about problematic files and APIs, registry keys, ini files, tokens,

privileges, namespaces, processes, and other related items that the application uses that

might cause problems when running on a computer with Windows 7 installed To use the

Standard User Analyzer, start the tool, specify the target application, and then click Launch

The application attempts to start, and the Standard User Analyzer profiles how it interacts with the Windows 7 environment

FIgUre 5-6 Standard User Analyzer

More Info aCt

For more information about the ACT, consult the following TechNet Magazine article:

http://technet.microsoft.com/en-us/magazine/dd797545.aspx.

Application Compatibility Diagnostics Policies

There are six application compatibility related group policies that influence how Windows 7 responds when it encounters an application compatibility problem These policies are located

in the Computer Configuration\Administrative Templates\System\Troubleshooting and Diagnostics\Application Compatibility Diagnostics node of a Group Policy Object (GPO) These policies are shown in Figure 5-7

FIgUre 5-7 Application compatibility diagnostics policies

The policies have the following functions:

n Notify Blocked Drivers When enabled, Windows notifies the user when a driver is

blocked due to compatibility issues

n Detect application Failures Caused By Deprecated COM Objects When enabled,

Windows notifies the user if a program attempts to create a COM object that is not

supported by Windows 7

n Detect application Failures Caused By Deprecated Windows DLLs When enabled,

Windows notifies the user if a program tries to load Windows DLLs that are not

supported by Windows 7

n Detect application Install Failures When enabled, application installer failures are

detected and the user is presented with the option to restart the installation process

using application compatibility mode

n Detect application Installers that Need to Be run as administrator When enabled,

application installations that fail because they need to be run as an administrator can

be restarted with the Run As Administrator option

n Detect applications Unable to Launch Installers Under UaC This setting is similar to

the previous one except that instead of running as an administrator, the user receives

a User Account Control prompt to elevate privileges when the installation of an

application fails

If you do not configure these policies, the default Windows 7 setting is to notify the user

that the failure has occurred and, in some instances, to start the Program Compatibility

Troubleshooter In environments where users are not able to resolve application compatibility

issues by themselves, administrators often disable these notifications because there is little

reason to notify a user of the reason for the failure if the user is unable to resolve the problem

causing the failure

Windows XP Mode for Windows 7

Windows XP Mode is a downloadable compatibility option that is available for the Professional,

Enterprise, and Ultimate editions of Windows 7 Windows XP Mode uses the latest version

of Microsoft Virtual PC to allow you to run an installation of Windows XP virtually under

Windows 7 The difference between Windows XP Mode and other operating system

virtualization solutions is that all applications that you install on the Windows XP Mode client will

be available automatically on the Windows 7 host computer For example, if you install Microsoft

Office 2000 on the Windows XP Mode client, the shortcuts for the Office 2000 applications

become available on the Windows 7 Start menu When you run an application, it starts in its

own separate window as any other application does From the perspective of the user, this

means that applications appear as though they are executing directly within Windows 7

Windows XP Mode requires a processor that supports hardware virtualization using either

the AMD-V or Intel VT options Most processors have this option disabled by default; to

enable it, you must do so from the computer’s BIOS After the setting has been configured,

it is necessary to turn the computer off completely The setting is not enabled if you perform

a warm reboot after configuring BIOS As 256 MB of RAM must be allocated to the Windows

XP Mode client, the computer running Windows 7 on which you deploy Windows XP Mode requires a minimum of 2 GB of RAM, which is more than the 1 GB of RAM Windows 7

hardware requirement

To install applications that are not compatible with Windows 7, you must start the Windows

XP Mode client from the Windows Virtual PC folder of the Start menu After you have installed the application, you can then start it from the Virtual Windows XP Applications folder of the Start menu You can also copy items from this folder to the desktop or to the Taskbar to start them directly as you would any other program installed on a computer running Windows 7 When you start an application installed on Virtual XP directly from the Start menu in Windows 7, the Virtual Windows XP operating system is shut down, as shown in Figure 5-8

FIgUre 5-8 Virtual XP shut down to run application

Windows XP Mode provides an x86 version of Windows XP Professional SP3 Windows Virtual PC does not support x64 virtual clients, which means that you cannot use Windows XP Mode or Virtual PC as a compatibility solution for x64 applications Because the application is not executing natively within Windows 7, there will be some performance overhead to using

an application through Windows XP Mode

You should consider Windows XP Mode as a compatibility option of last resort This is because it requires significantly more system resources to use than the built-in or custom compatibility modes Another drawback to Windows XP Mode is that it requires administrators

to manage and maintain the Windows XP virtual client as they would any other client desktop computer in their organization This means that you need to keep the Windows XP virtual client

up to date with updates even though the people using the computer will not be accessing the Windows XP operating system directly

eXaM tIP

An application that functions well on a computer that has Windows XP SP3 installed, but which does not run normally on Windows 7, might run without a problem if you configure

it to use the Windows XP SP3 compatibility mode.

Practice Windows 7 Compatibility

In this practice, you investigate Windows 7 compatibility options for an application that you

have downloaded from the Internet

exercise Configuring Compatibility Options for Process Explorer

In this exercise, you explore the compatibility options for an application and verify that

an application is digitally signed Although Process Explorer functions without problems

in Windows 7, you need to obtain an application that is not included with Windows 7 to

configure compatibility options It is not possible to configure compatibility options for an

application that is included within Windows 7, such as Calc exe or Solitaire exe

1 If you are not logged on already, log on to computer Canberra using the Kim_Akers

user account If you have not already downloaded the file ProcessExplorer zip to the

desktop from Microsoft’s Web site, do so now

2 Right-click ProcessExplorer zip and then choose Extract All This opens the Extract

Compressed (Zipped) Folders Wizard Accept the default folder location and settings

and then click Extract

3 Right-click the Procexp exe application and then choose Properties Click the Digital

Signatures, select Microsoft Corporation, and then click Details Verify that the

application is digitally signed by Microsoft, as shown in Figure 5-9 Click OK to close

the Digital Signature Details dialog box

FIgUre 5-9 Verify the digital signature

4 Click the Compatibility tab Under Compatibility Mode, select the Run This Program In

Compatibility Mode For check box and use the drop-down menu to select Windows

Vista (Service Pack 2)

5 Select the Disable Desktop Composition check box and then select the Run This program As An Administrator check box, as shown in Figure 5-10 Click OK

FIgUre 5-10 Configuring application compatibility

6 Double-click procexp exe You should be confronted by a User Account Control dialog box that warns you that the following program may make changes to your computer, the program name, and the origin of the file, as shown in Figure 5-11 Click Yes

FIgUre 5-11 User Account Control prompt for Process Explorer

7 In the Process Explorer License Agreement dialog box, click Agree Process Explorer

does not execute with these compatibility settings Click Close The Program

8 Right-click Procexp exe and choose Properties Click the Compatibility tab and then

clear the Run This Program In Compatibility Mode, Disable Desktop Composition, and

Run This Program As An Administrator check boxes Click OK

9 Double-click Procexp exe Click Run if prompted by the Open File–Security Warning

dialog box

10 Verify that the application executes properly and then close the application

Lesson Summary

n You can run the Program Compatibility troubleshooter to diagnose common

application compatibility issues

n Windows 7 has several compatibility modes that allow the majority of existing software

to execute on it

n The ACT contains several tools that allow you to analyze potential compatibility

problems prior to deploying Windows 7 in your organization

n You can use the Compatibility Administrator to search for existing compatibility fixes

and compatibility modes that have already been developed for popular applications

n You can use the Internet Explorer Compatibility Test Tool to check existing Web sites

and applications for compatibility problems that might exist when Internet Explorer 8

is used as a browser

n Windows XP Mode allows you to run applications through a virtualized instance of

Windows XP that runs on Windows 7 Professional, Ultimate, or Enterprise edition

Lesson Review

You can use the following questions to test your knowledge of the information in Lesson 1,

“Application Compatibility ” The questions are also available on the companion DVD if you

prefer to review them in electronic form

note aNSWerS

Answers to these questions and explanations of why each answer choice is correct or

incorrect are located in the “Answers” section at the end of the book

1 You are planning to migrate all the computers in your organization to Windows 7

Professional Your organization has several applications that are installed on computers

running Windows XP Professional You are unable to install these applications on

computers running Windows 7 due to compatibility problems You are unable to

configure a custom compatibility mode to support these applications using the ACT

Which of the following solutions could you implement to deploy these mission-critical applications on the computers running Windows 7?

a Install the Window XP Mode feature Install the application under Windows XP

B Create a custom compatibility fix for the application using the ACT

c Create a shim for the application using the ACT

D Configure the application installer to run in Windows XP Professional SP2

compatibility mode

2 Which of the following compatibility modes would you configure for an application that works on computers running Microsoft Windows 2000 Professional but does not work on computers running Windows XP?

a Windows 98 / Windows Me

B Windows NT 4 0 (Service Pack 5)

c Windows XP (Service Pack 2)

D Windows 2000

3 Which of the following file types does the Windows 7 Program Compatibility

troubleshooter application work with?

a cab files

B exe files

c msi files

D zip files

4 An application used by the administrators in your organization is not configured to prompt for elevation when it is run Which of the following compatibility options could you configure for the application to ensure that users with administrative privileges are always prompted when they execute the application?

a Configure the application to run in Windows XP (Service Pack 3) compatibility mode

B Enable the Run In 256 Colors compatibility option

c Enable the Run This Program As An Administrator compatibility option

D Enable the Disable Desktop Composition compatibility option

5 Your organization’s internal Web site was designed several years ago, when all client computers were running Windows XP and Microsoft Internet Explorer 6 You want to verify that your organization’s internal Web site displays correctly when you migrate all users to computers running Windows 7 Which of the following tools can you use to accomplish this goal?

a Internet Explorer Administration Kit (IEAK)

B Application Compatibility Toolkit (ACT)

c Windows Automated Installation Kit (Windows AIK)

D Microsoft Deployment Toolkit (MDT)

Lesson 2: Managing appLocker

and Software restriction policies

Occasionally it might be necessary to limit the applications that users can run on a computer

You might want to block a specific application from running, or you might want to ensure

that only applications that are on an approved list function on your organization’s network

There are two different technologies that you can use with computers running Windows 7

to restrict the execution of applications: AppLocker and Software Restriction Policies You

manage AppLocker and Software Restriction Policies through Group Policy You can use these

technologies to restrict programs, installation files, scripts, and even DLL libraries In this

lesson, you learn the differences between the two technologies and the situations in which

you would choose to deploy one technology over the other

After this lesson, you will be able to:

n Configure Software Restriction Policies to restrict the execution of applications

n Configure AppLocker policies to restrict the execution of applications, installers,

and scripts

Estimated lesson time: 50 minutes

Software Restriction Policies

Software Restriction Policies is a technology available to clients running Windows 7 that is

available in Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008

You manage Software Restriction Policies through Group Policy You can find Software

Restriction Policies in the Computer Configuration\Windows Settings\Security Settings\

Software Restriction Policies node of a group policy When you use Software Restriction

Policies, you use the Unrestricted setting to allow an application to execute and the

Disallowed setting to block an application from executing

note CONtrOLLINg appLICatIONS thrOUgh perMISSIONS

Although it is possible to restrict the execution of an application on the basis of NTFS

permissions, configuring the NTFS permissions for a large number of applications on

a large number of computers requires significant administrative effort

You can achieve many of the same application restriction objectives with Software

Restriction Policies that you can with AppLocker policies The advantage of Software

Restriction Policies over AppLocker policies is that Software Restriction Policies can apply

to computers running Windows XP and Windows Vista, as well as to computers running

Windows 7 editions that do not support AppLocker The disadvantage of Software Restriction

Policies is that all rules must be created manually because there are no built-in wizards to

simplify the process of rule creation You learn more about AppLocker policies later in this lesson

Software Restriction Policies are applied in a particular order, with the more explicit rule types overriding more general rule types The order of precedence from most specific (hash)

to least specific (default) is as follows:

1 Hash rules

2 Certificate rules

3 Path rules

4 Zone rules

5 Default rules

If two conflicting rules with different security levels are established for the same program, the most specific rule takes precedence For example, a hash rule that sets a particular application to Unrestricted overrides a path rule that sets a particular application to

Disallowed This is different from AppLocker policies, which do not use precedence rules and where a block in any rule type always overrides any allow rule

note appLOCKer OVerrIDeS SOFtWare reStrICtION pOLICIeS

In environments that use both Software Restriction Policies and AppLocker, AppLocker policies take precedence If you have an AppLocker policy that specifically allows an

application that is blocked by a Software Restriction Policy, the application executes

Security Levels and Default Rules

The Security Levels node allows you to set the Software Restriction Policies default rule The default rule applies when no other Software Restriction Policy matches an application You can enable only one default rule at a time The three default rules, shown in Figure 5-12, are:

n Disallowed When this rule is set, users are unable to execute an application if the

application is not allowed by an existing Software Restriction Policy

n Basic User When this rule is set, users are able to execute applications so long as

those applications do not require administrative access rights Users are able to access applications that require administrative access rights only if a rule has been created that covers that application

n Unrestricted When this rule is set as the default rule, a user is able to execute an

application unless an existing Software Restriction Policy blocks that application

If you are working on an allow list of applications, you would configure the disallowed default rule This ensures that any application that is not specifically allowed cannot run

If you just want to block a couple of troublesome applications but do not want to go to the trouble of creating a rule for all the applications used in your environment, you should set the Unrestricted default rule This allows any application to run unless you explicitly block it