Why do we need an Automatic Resolution Policy?

Consider this example – I want to store the User Data Directory for the App-V client on the network (e.g. the users’ home drive) instead of the default location of AppData. This will allow me to deliver application settings between different desktop types (such as a physical desktop and a XenApp server), without having to implement roaming profiles.

Laptops will need to cache the network location so that users can access their applications when disconnected from the network. So I configure Offline Files (via Group Policy) to cache the network folder that hosts the User Data Directory.

The problem with this approach is that when the laptop synchronises the folder, the user may need to resolve file conflicts and is presented with a dialog box that looks something like this:

Most users are not going to know which option they should choose (and they certainly aren’t going to read the help). How many will know what the UsrVol_sftfs_v.tmp file is? I’d like to avoid this scenario as often as I can.

The feature does exist!

Last week I came across a knowledgebase article that Microsoft recently updated – Automatic resolution policy for an offline file synchronization conflict does not work if the “keep all changes” setting is enabled in Windows Vista or in Windows Server 2008. It appears that an automatic resolution policy does exist even though there’s no documentation on this feature, beyond one page on MSDN on the OFFLINEFILES_SYNC_CONFLICT_RESOLVE enumerator in the Offline Files API.

Configuring an Automatic Resolution Policy

An automatic resolution policy for Offline Files is implemented by adding a registry value for each network share for which you wish to control synchronisation, then specifying the policy for automatic resolution.

1. Click Start, type regedit in the Start Search box, and then press ENTER
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\NetCache 
3. On the Edit menu, point to New, and then click Key. Type SyncConflictHandling, and then press ENTER
4. Right-click SyncConflictHandling, point to New, and then click Expandable String Value. Type the path of the network share as the value name (for example \\servername\share)
5. Right-click the value name, and then click Modify. In the Value data box, enter a value listed in the table below, and then click OK

The possible values for SyncConflictHandling and a description of each value is listed is this table:

When added to the Registry, it will look something like this:

To test that the policy is working update a file at multiple locations when the file is offline (for example, delete the file in one location, but make changes to it in the other location). Connect back to the network and initiate a synchronisation operation (via Sync Centre) for the network share. Windows will trigger a conflict in the synchronisation process when it synchronises the file. Your policy should kick in and Sync Centre should automatically handle the conflict.

Implementing a Policy

So which policy should you implement? This will depend on the share and the type of client machine. Based on the descriptions of the possible values, the default policy is 5, which requires the user to manually resolve conflicts.

In most cases, laptops have a one to one relationship with a user and it will be their primary device. Those machines could then use a policy of 1 (keep the local state) thus preferring changes made on the laptop rather than other computers. Of course, what’s right for me might not be right for you, so I recommend testing and be certain of your choice before implementing.

To deploy the policy you could use a script or a tool such as Group Policy Preferences:

1. Create a Group Policy Object and apply it to a laptop OU or open an existing GPO that applies to your laptops
2. Navigate to Computer Configuration / Preferences / Windows Settings / Registry
3. Create a new registry item – HKLM should be the default Hive, add Software\Microsoft\Windows\CurrentVersion\NetCache\SyncConflictHandling to the Key Path
4. In Value Name, enter the UNC path to the share you want to apply the policy to
5. Change Value Type to REG_EXPAND_SZ
6. Enter a numeric value from 0 to 7 (1 or 2 would be most common)
7. Repeat for each share you want to manage

Continuing the App-V User Data Directory as my example, I’ve hosted this on a network share and I want to ensure that the laptop copy always wins any conflict resolution. Therefore I’m using a value of 1 to ensure that in the event of changes on both the laptop and another machine, the changes on the laptop will be written back to the network.

Conclusion

This feature should be extremely useful for scenarios, including the App-V User Data Directory example I’ve used here; however it’s disappointing to find so little documentation given that it’s been available since Windows Vista. It would be great to see this feature expanded upon in later releases including Group Policy support (rather than GP Preferences) as well as the ability to implement rules that can control conflict handling for file types.

Configuring an Automatic Resolution Policy for Offline Files in Windows 7 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

With some suggestions about the confusion this screen will cause, disabling the update might be the best way to prevent the support calls this is sure to generate.

For administrators who are controlling update delivery with WSUS, you should be able to prevent deployment by not approving it; however you can also control display of the browser choice window with the following registry value:

• Key: HKLM\Software\BrowserChoice
• Value: Enable (REG_DWORD)
• Enabled: 1, Disabled 0

To deploy during a Windows build, use the following command (or instead deploy with your favourite tool, e.g. Group Policy Preferences):

REG ADD HKLM\Software\BrowserChoice /v Enable /t REG_DWORD /d 0 /f

More information in this knowledgebase article: Information about the Browser Choice update for system administrators who are in managed environments that are under a Volume Licensing program.

Disable the EU Browser Choice screen is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

What’s always interesting to me is what is in the latest service packs that will directly benefit Terminal Servers. The table below lists all of the hotfixes in SP2 that directly relate to Terminal Services, and it’s quite the list. So it’s time to get testing and deploying:

Windows Server 2008 SP2: What’s in it for Terminal Servers? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

To do that, open the System event log and find any events from source ‘Power-Troubleshooter’ that indicate that the system has returned from sleep mode – similar to this:

In my case, the network adapter was the problem. I think my router is sending some weird packets around the network. I can’t fix the source of the problem (it’s a pretty basic router), but I can configure the network adapter to prevent it from waking the computer.

Open the properties of the adapter in Device Manager and either untick ‘Allow the device to wake the computer’ or tick ‘Only allow a magic packet to wake the computer’ and the computer will stay in sleep mode.

Related links:

• A computer that is running Windows Vista appears to sleep and then immediately wake
• Controlling which devices will wake the computer out of sleep

My Windows box has insomnia is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Here’s a side-by-side comparison:

Start Menu in Windows 7 7057 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Based on a comment by a ‘softie, I believe that the new icon is about branding the Remote Desktop Services in Windows Server 2008 R2:

Remote Desktop Connection in Windows 7 7048 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Check out Command Prompt sporting the Consolas font:

Command Prompt in Windows 7 7048 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Given that Windows 7 Enterprise edition will be a superset of Home and Professional, being able to remove these components will be especially welcome for organisations deploying Enterprise edition .

AeroXperience has more on removing Internet Explorer 8 which apparently only removes the IEXPLORE executable; however completely removing Internet Explorer would break compatibility with many applications, so I think calls for being able to remove all traces of IE are just un-realistic.

What’s removable in Windows 7 7048 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ve had some issues with Google Chrome (1.0.154.48) running on Windows 7 x64, but thanks to these two links, it’s now working great.

To get Chome working you’ll need to add switches to your Chrome shortcut. Most people look to be getting good results by adding the ‘–in-process-plugins’ switch but my experience has been mixed. I’ve found that adding ‘–no-sandbox’ as well as worked. So your shortcut should look something like this:

C:\Users\Aaron\AppData\Local\Google\Chrome\Application\chrome.exe --no-sandbox --in-process-plugins

Google Chrome on Windows 7 x64 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In most cases I will just remove this menu item completely. To do that, the quick and dirty method is just to delete HKEY_CLASSES_ROOT\Briefcase from the registry. However, if you are one of those 10 people here’s how to make it pretty.

First up, I have a Windows Vista style icon for the Briefcase. I can’t remember where I originally got it from but you can download it here:

Extract this icon to a local folder – I usually place custom icons in C:\Windows\Media. Then change the following three registry values to “%SystemRoot%\Media\Briefcase.ico” (without the quotes):

Once you have updated the registry (you may have to logoff and back on to see the changes), Briefcase will look much smarter:

If you want to script this change, here are the command lines to do it:

REG ADD HKCR\Briefcase\DefaultIcon /ve /d ^%SystemRoot^%\Media\Briefcase.ico /t REG_EXPAND_SZ /f
REG ADD HKCR\Briefcase\ShellNew /v IconPath /d ^%SystemRoot^%\Media\Briefcase.ico /t REG_EXPAND_SZ /f
REG ADD HKCR\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\DefaultIcon /ve /d ^%SystemRoot^%\Media\Briefcase.ico /t REG_EXPAND_SZ /f

“Fixing” Windows Briefcase is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Usually you can prevent Windows from playing this sound by setting the Start Navigation event to None; however in Windows 7 it comes back whenever you change themes.

If you want to remove the sound completely, you’ll need to delete the wav file. To do that, run the following commands from an elevated command prompt:

TAKEOWN /f "%SystemRoot%\Media\Windows Navigation Start.wav" /a
CACLS "%SystemRoot%\Media\Windows Navigation Start.wav" /E /G Administrators:F
DEL /Q "%SystemRoot%\Media\Windows Navigation Start.wav"

These commands will work on Windows Vista and Windows 7.

Eliminate the Windows Start Navigation sound is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

If you want to hide this account, it’s a simple registry value addition:

1. Open Registry Editor and navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
2. If it does not already exist, create a key named SpecialAccounts
3. Below the SpecialAccounts key create another key named UserList
4. Create a new DWORD value (DWORD32 on x64) inside UserList named __vmware_user__ (the name of the account we want to hide) and ensure the value is 0
5. Close Registry Editor and you are done – no need to reboot or logoff

To add this value a little quicker, paste the following command into an elevated command prompt and it will add the value for you

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v __vmware_user__ /d 0 /t REG_DWORD /f

This link has some detail on what the __vmware_user__ account is used for.

Hiding the vmware_user account in Windows 7 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

To see what was going on I used Process Explorer to see the differences in privileges between a standard process and an elevated Registry Editor. Here’s Notepad running with my standard token:

And here’s REGEDIT running with the elevated token. As you can see, the difference is the SeLoadDriverPrivilege privilege:

I use TrueCrypt to protect data on one of my USB thumb drives. TrueCrypt, of course, loads a driver when you mount an encrypted disk, and some time back I had been attempting to avoid the UAC prompt involved with mounting the encrypted disk. Sure enough when I took a look in the Local Security Policy editor (SECPOL.MSC), I had given the Users group the ability to Load and unload device drivers:

Removing the right for the Users group, didn’t help me with TrueCrypt, but at least now I can open REGEDIT (which I use far more often) without a UAC prompt.

Troubleshooting an Extraneous UAC Prompt is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The Application Compatibility List for IT Professionals is a Microsoft Office Excel-based spreadsheet containing software applications which have earned the status of “Certified for Windows Vista” or “Works with Windows Vista.” 

Additionally, this list contains applications with a status of “Compatible.” “Compatible” means that the application has been reported by the publisher as compatible with, or supported on, Windows Vista. These applications have not gone through the Microsoft Windows Vista Logo Program. 

The Application Compatibility List for IT Professionals is current as of July 31,2008 and published as of the Date Published..

Windows Vista Application Compatibility Downloadable List is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Beta Information

This article discusses a beta release of a Microsoft product. The information in this article is provided as-is and is subject to change without notice.

No formal product support is available from Microsoft for this beta product. For information about how to obtain support for a beta release, see the documentation that is included with the beta product files, or check the Web location where you downloaded the release.

INTRODUCTION

This Microsoft Knowledge Base article will be updated with more information about Windows Server 2008 Service Pack 2 (SP2) and Windows Vista Service Pack 2 (SP2) when the information becomes available. Currently, the product release notes and related information about Windows Server 2008 SP2 and Windows Vista SP2 are not available.

Information about Windows Server 2008 SP2 and Windows Vista SP2 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

This location in the UI replaces the Documents folder as the top level navigation tool but it essentially gives you a view of the user profile (%USERPROFILE%). As such, this location cannot be redirected to the network, so it would be advantageous to prevent users from adding data to this folder – otherwise you will need to manage that data. Leaving it inside the roaming profile is probably not the best solution.

Fortunately, Microsoft provide a Group Policy setting that will prevent users from adding files to to this location:

• User Configuration / Policies / Administrative Templates / Windows Components / Windows Explorer / Prevent users from adding files to the root of their User Files folder

When this policy is enabled users will see this behaviour when attempting to copy files into their User folder:

This works well for Explorer but unfortunately I’m struggling to find applications that honour this setting, with Office Communicator and even Windows Live Messenger 9 the biggest culprits so far. These applications create a Tracing folder that is used for diagnostic logging. These keys control where the log is created:

• HKCU\Software\Microsoft\Tracing\uccapi\WindowsLiveMessenger\FileDirectory
• HKCU\Software\Microsoft\Tracing\uccp\Communicator\FileDirectory
• HKCU\Software\Microsoft\Tracing\WPPMedia\WPPFilePath
• HKCU\Software\Microsoft\Tracing\WPPMedia\Debug\WPPFilePath

For each key I’ve changed %USERPROFILE% to %APPDATA% (scripted of course..)

So as we rollout Windows Vista, I’m going to have to keep an eye on more applications but I think I could be in for a losing battle.

Keeping The Windows Vista User Folder Clean is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Compatibility View mode will ensure those internal web applications don’t break. Intranet sites are displayed Compatibility View mode by default.

• It’s also really simple for users to enable Compatibility View with the Compatibility View button
• There are more than 100 new Group Policy settings added for Internet Explorer 8
• DEP is turned on by default for Internet Explorer 8. DEP helps to improve security for ActiveX controls
• You can enforce the SmartScreen Filter to block access to malicious sites and downloads. Great for those laptop users accessing the Internet outside of your network
• Loosely-Coupled IE and Automatic Crash Recovery will help make happy users
• Developer tools are included to help your devs work with their web sites
• Internet Explorer 8 can be slipstreamed into your Windows XP/2003 or Windows Vista/2008 images for faster deployment

For complete information on IE 8 for the enterprise check out this document: Windows Internet Explorer 8 Beta 2: Technology Overview for Enterprise and IT Pros. You might also be interested in the Windows Internet Explorer 8 Beta 2 Release Notes as well as the Internet Explorer Administration Kit 8 Beta (direct link to the Internet Explorer Administration Kit 8 installer).

Update: Mary-Jo Foley has more details on IE 8 features for the Enterprise.

Get Ready Now To Deploy Internet Explorer 8 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

By default, Windows Server 2008 includes several server roles. Server Manager enables integration of additional roles and features that are available from the Microsoft Download Center and from Windows Update Web sites as optional updates to Windows Server 2008. One role that is available as an update is Windows Server Update Services (WSUS) 3.0 with Service Pack 1 (SP1). This update for Server Manager in Windows Server 2008 fully integrates WSUS 3.0 SP1 into Server Manager. This update lets you use the Server Manager snap-in and wizards to install, configure, and manage WSUS 3.0 SP1.

You can read about the update via the knowledge base article and then download the update for Windows Server 2008 32-bit or Windows Server 2008 64-bit.

WSUS Update for Server Manager in Windows 2008 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Windows AIK User’s Guide and Unattended Setup Reference (Documentation Update 1)

This documentation update includes revised content that addresses known help issues, workarounds, and other changes. These files replace the release-to-manufacturing (RTM) .chm files.

Download the ZIP file and extract to %ProgramFiles%\Windows AIK\Docs\CHMs to replace the installed files. All of the new content is highlighted so it’s easy to see what’s new:

WAIK Documentation Updates is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Windows could not search for new updates
Error(s) found: Code 80092026

Then un-related to Windows Update, a code-signing certificate issued from an internal certificate authority, reporting:

The cryptographic operation failed due to a local security option setting

Both issues fixed by deleting the following registry key:

HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer

I’m unsure of what the cause is, presumably it’s got something to do with the way Windows Vista handles certificate revocation and status checking.

Windows Update 80092026 plus Certificate Crypto Operation Failed is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

First a quick background on what we’re trying to solve. By default, Windows Explorer will place network locations (mapped drives and UNC paths) with a period (.) in the path, into the the Internet zone. This means that when users access files from these locations, they will see security warnings like these:

These warnings attempt to ensure users are aware of the potential risks when opening files from un-trusted locations. You can make a location trusted by adding it to the Local Intranet or Trusted Sites zones. This is exactly what you would do via script, Group Policy or some other workspace management tool, for your internal network locations, so that users do not see these prompts. However, a bug exists where drives mapped to these network locations are not placed into the right zone.

If you map a drive to a UNC path that that includes two or more periods in the name you will see that the network drive is marked as being in the Internet zone even though you may have added the location to the Local Intranet zone. In my example here, I’ve mapped drive S: to \\dc.dev.local\Apps, and as you can see, it’s in the Internet zone:

If I open the same location via a UNC path you will see that Explorer sees it as being in the Local Intranet zone:

Oddly enough, if I map a network drive to a path with only a single period on that path, the detection process works correctly and the location is seen as Intranet. In the example here, I’m mapping a drive to the same location as the previous two screen shots, but via a DFS path – \\dev.local\Public\Apps that redirects to \\dc.dev.local\Apps.

This issue is addressed in the following knowledge base article:

Windows Internet Explorer 7 may not correctly recognize the zone to which a network resource belongs when you access the resource by using a mapped drive in Windows Vista or in Windows XP with Service Pack 2

The article details a hotfix that is available for Windows Vista and Windows XP Service Pack 2 and the issue has been addressed in Windows Vista Service Pack 1 and Windows XP Service Pack 3. For Windows Server 2003 the issue is fixed in the latest cumulative security update for Internet Explorer. To install the fix when deploying this update you need to use the QFE switch:

IE7-WindowsServer2003-KB950759-x86-ENU.exe /B:SP2QFE

To enable the fixed behaviour for each of the operating system versions, including Vista SP1 and XP SP3, you also have to add the following registry value. See the KB article for more details.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESPECT_ZONEMAP_FOR_MAPPED_DRIVES_KB929798]
"*"=dword:00000001

For anyone who can’t yet deploy Windows Vista SP1 or Windows XP SP3, you may be able (I haven’t tested) to deploy the IE cumulative security update instead of the hotfix.

Fixing Windows Explorer security warning prompts is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Quite often users see these prompts in environments where files are opened from UNC paths (think mapped drives or redirected folders) on Distributed File System namespaces. If you have this scenario (which I think you should be) because you are doing something like redirecting Start Menus, you can disable these prompts for your internal network locations.

Ideally you would do this by deploying specific Intranet zone settings (as in the screenshots below) or adding your internal sites to the Intranet zone via a script, Group Policy (Preferences or Internet Explorer Maintenance) or your tool of choice.

There’s a heap of information on how this stuff works at these links:

• Description of how the Attachment Manager works in Windows XP Service Pack 2.
• Configure the Attachment Manager in Windows XP SP2
• Intranet site is identified as an Internet site when you use an FQDN or an IP address
• You might even need to look into this hotfix, this hotfix or even this hotfix if things aren’t working as expected.

But all of that is not really the point of this post. I stumbled across a really simple method of telling Windows to avoid those checks and just open the files – create the environment variable SEE_MASK_NOZONECHECKS and set it to 1. You can set this as system environment variable but it appeared to be a little more consistent if set as a user environment variable. Not recommended for wide scale deployment but useful none the less.

Avoiding Explorer’s Security Warning Prompts is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In my demo environment, I have configured 200Mb quota for all users’ home drives. If you look at the drive properties under Windows XP you will see the complete capacity of the remote disk including used and free space with no indication that any quotas are in place.

The same disk properties dialog in Windows Vista shows only the capacity, used and free space that match the disk quota set for that user.

The Computer view in Windows Explorer shows similar information:

A simple change but if you are using disk quotas, its fantastic user experience.

Disk Usage Display Improvement In Windows Vista is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Windows’ greatest strength and weakness is the ecosystem that Microsoft has built around it and I think that OEM’s aren’t doing enough to give consumers the best Windows experience. OEMs should be brought to task for much of Vistas’ failings in its first 12 months.

Anyway that’s a topic for another day, here’s what this post is about – If you are troubleshooting slow performance in Windows Vista, there are some knowledgebase articles that were published last month and are worth referring to for assistance:

• How to troubleshoot performance issues with standby, hibernate, and resume in Windows Vista
• How to troubleshoot performance issues during startup in Windows Vista
• How to troubleshoot performance issues in Windows Vista

Troubleshooting Windows Vista Performance KBs is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Folder redirection does not work correctly after you restart a computer that is running Windows Server 2008 or Windows Vista

The article has some detail about why this happens:

Windows Server 2008 and Windows Vista use the Well-Known folders feature to determine the location of folders in the user profile. By using this feature, Windows redirects Well-Known folders to other locations as needed. Specifically, Windows Explorer queries the Well-Known folder GUID. This query returns the actual folder location, whether on a hard disk drive or on a remote server.

Windows Explorer optimizes Well-Known folder lookups by caching the Well-Known folders and their locations. Queries are performed against the cache, and the location is then returned to the application or to Windows Explorer.

When you use folder redirection, you receive the folder redirection settings from Group Policy. This process cannot occur unless the Workstation service has started. If the Workstation service has not started, the Well-Known folder cache is unavailable. This causes queries for redirected folder locations to fail. Additionally, the cache remains unavailable until the next update. By default, this cache is updated every 12 minutes (after the cache is first initialized and built during logon).

No Redirected Folders? Just Wait Longer is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

You will usually see this on the properties of files you have downloaded from the Internet but it also manifests itself in other file copies too, such as copying a ZIP file to a server. The inbuilt Windows ZIP tool won’t open ZIP files marked like this at all, even if you click Unblock.

To banish this once and for all, enable the following setting in a domain GPO or the local Group Policy:

User Configuration / Administrative Templates / Windows Components / Attachment Manager / Do not preserve zone information in file attachments

This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (i.e. restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information Windows cannot make proper risk assessments.

A Group Policy refresh or logoff and back on will get this working for you on any new file downloads or copies. This comes with all of the usual warnings about opening stuff downloaded from the Internet – make sure you know where you got it from is trustworthy and scan it with AV first.

Description of how the Attachment Manager works in Windows XP Service Pack 2

Getting Rid Of That Unblock Button is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

SYMPTOMS
Consider the following scenario:

• On a Windows Vista-based computer, you redirect the Desktop folder to a network redirection folder.
• You enable the Always Available offline option to make the Desktop folder available offline.
• The computer is connected to a network that does not contain the redirection folder.
• You restart the computer, and then you enter your user credentials on the Welcome screen to log on to the computer.

In this scenario, you see a black screen for 30 to 120 seconds before the desktop or the Start menu appears.

Details here: After you log on to a Windows Vista-based computer that has the Desktop folder redirected, you see a black screen for 30 to 120 seconds before the desktop or the Start menu appears

Delay On Windows Vista With Redirected Desktop is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

PowerShell running directly on Windows Server Core – no need to wait for Windows Server 2008 R2…  If you look closely you can see how I got it working.

PowerShell on Server Core is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

First up, I would not rely on Offline Files as a method of fault tolerance. It will work as a solution for laptops operating disconnected from the network, but won’t provide effective fault tolerance. Offline Files are also not available on Terminal Server.

If you were to rely on Offline Files, you will have issues if the server the share is located goes down and can’t be restored. Using Group Policy to redirect user folders requires that the original source location is available if you ever want to change the redirection path. This is why DFS Namespace is a good match for folder redirection – the DFS path remains static, while the real path can change.

DFS Namespaces and DFS Replication offer a far better solution for fault tolerance and DFS is available in Windows 2000 Server and above. If you want FT without using a 3rd party solution take a look at DFS Replication.

I spent some time this evening to configure a redirected Start Menu for Windows Vista laptops in my test environment. Here’s my notes for recreating this setup and how it went:

This is very similar to redirected Start Menus for Terminal Servers with some minor differences.

Create a GPO linked to the OU that contains your target workstations and enable Group Policy loopback mode. You would generally target similarly configured workstations just like you would do for Terminal Servers. In my test environment I’m configuring this for Windows Vista, I’ve enabled a WMI filter on this GPO so that it only applies to Vista and above:

SELECT Version FROM Win32_OperatingSystem WHERE Version >= '6'

Edit the GPO and enable these settings (here’s the full GPO report):

• Computer Configuration / Administrative Templates / System / Group Policy / User Group Policy loopback processing mode
• User Configuration / Windows Settings / Folder Redirection / Start Menu / Basic (Redirect everyone’s folder to the same location) / Redirect to the following path: In my test environment, I’m using this DFS path: \\dev.local\Public\StartMenus\WindowsVista
• Grant user exclusive rights to Start Menu
• Move the contents of Start Menu to the new location
• Redirect the folder back to the local userprofile location when policy is removed
• User Configuration / Administrative Templates / Start Menu and Taskbar / Remove common program groups from Start Menu
• User Configuration / Administrative Templates / Network / Offline Files / Administratively assigned offline files: \\dev.local\Public\StartMenus\WindowsVista

The last setting will ensure that the Start Menu will be cached by the workstation and available to the user offline. Here’s my configured folder which has been cached locally:

Make sure you configure your Start Menus with access-based enumeration and the right permissions before users access them. If you don’t and users’ workstations cache the shortcuts, you might end up unavailable shortcuts looking like this:

Although I’ve only done some limited testing I think this solution would work quite well. One important thing to remember is that you will need to add your internal DNS domain to the Intranet zone (when using a domain-based DFS Namespace) otherwise users will be prompted with a trust dialog each time they run a shortcut from the Start Menu.

Providing Redirected Start Menus To Laptops is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.