In-Cider Knowledge: Windows Vista

Power And Money

Sat, 17 Feb 2007 09:27:24 GMT

There is one big thing about Vista that many people aren't even considering: the Power Management settings, now assignable by Group Policy.

Back in about 2001, I was still young and fresh faced at the University of Edinburgh. One of my early tasks in the job was to look after the Lab Update service. This was a server running a custom built service which was, basically, an extreme version of WSUS for the Windows NT age. Every night at 11pm, it would go through each machine in our labs and download any new updates, any new applications (deployed using snapshots from the much-missed PictureTaker), use cacls to update security settings and download the virus updates. The problem was, in my eyes at the time, was the service kicked off at 11pm and would not finish updating all the machines till almost 3am. Back then, my biggest concern was, "what if something major kills the server in those 4 hours?". I really wanted to shorten the time it took.

After going back to the drawing board, I rewrote large parts of the delivery mechanism for the server. It was, effectively, a massively parallel system by the time I had finished with it. The server would kick off processes all over the place and would just act to control everything. I expect better results, but even I was staggered by it when it started to consistently update every machine in 18 minutes. Night after night. Going from 4 hours to 18 minutes is a somewhat reasonable success!

After this, I started to delve into NT's innards and started reading about the Hardware Abstraction Layer (HAL). Up till then, there was no easy way to switch off a PC, especially with out lab update service kicking off at 11pm and so, pretty much every machine was on 24 hours a day. When reading about the HALs, I came across the fact the HAL in NT does not support any software power management, but there was a APM-compliant HAL. I started to play with it and soon got it working. In todays terms, it was massively foolhardy - the lab update service would simply overwrite the existing Hal.Dll and reboot, and that would cause hell in OSes of today like XP or Vista. However, the result was spectacular - I could, remotely, send an shutdown-and-turnoff command to machine and switch off banks of computers very quickly. Let me be clear, at the time, there was no real altruistic motive here: I was doing this because being able to send a command and then watch an entire lab of hundreds of machines going "boof, boof, boof" one by one as they switch themselves off was REALLY COOL.

These ideas soon merged in my head. Why run the lab update service at 11pm? If a lab closed at 5pm, why not run the lab update service at 5:15 and then, send the shutdown-and-turnoff command at 6pm. I rewrote the schedulers and go it working. Again, nothing that altruistic, just thinking, look at what I can do! It was only after that, that it hit me. I had to write a report about this and started thinking electricity costs. I emailed the labs boss and asked him if he had figured for how much it costs to run a machine, run a lab, etc. He gave me a startling about of figures. The upshot was, in many labs, I was saving them way over half of their electricity costs - tens of thousands of pounds. With the price of electricity today, that would be in 6 figures. On only less-than-1500 machines. Not bad for something I did for coolness value.

The point of this post is not to stroke my ego but to point out, if you have machines that are used only 9am-5pm - 8 hours a day, they are not being used for the other 16 hours. There is a whole ton of money to be saved by adopting good, strict power management policies. And that is something that Vista does really well. Obviously, its not just about money but the environment. The tech industry has been, frankly, f-ing appalling by routinely ignoring what is happening to our planet and that attitude has got to change. Do it. And plant a tree, or some other hippy stuff!

So...Vista...but first, XP's not finished!

Fri, 16 Feb 2007 01:13:04 GMT

My recent post about such and such security not working on Vista might have made it look like this is the typical Systems Administrator's life - work on XP and then as soon as Microsoft delivers a new (long overdue) baby, drop XP and work on Vista. Actually, things couldn't be more different.

I was talking to another administrator the other day from another University and I said I wouldn't be able to get back to development work on my firefox project until I had done...and then I listed a whole bunch of things I had to do. After that conversation, I had a long hard look at these things. There are a few notables like preparing the clients and migration tools for the new eDiary we are rolling out and, the biggie, Internet Explorer 7. IE7 will take a few weeks of thorough testing in an isolated environment, trying different plugins that we feature, but then it needs configuring for its release and then passed to the Intranet services guys and gals to test their services. It then needs to be rolled out in a managed way as to not hurt people, and also placate the many devolved areas of the University who may still need to test their own services with it. Its around this time I am glad I took the extra time and effort to set up the WSUS with proper groups set up, so I can allow IE 7 to certain groups but not All Computers (I recommend that method!).

The situation with XP and Vista is like a classic logic puzzle: if supporting and maintaining XP takes 100% of your time, where does the time to do Vista come in? At the moment, its looking like my current project workload for services on XP will take me to the June, and then I go into summer development mode - updating all the software and plugins and everything to the versions we intend to support for the next academic year. I then promised I'd (finally) get a look at Office 2007 after the summer and have also promised to look at some development work and and and....I can't see much Vista work being done this entire year. I understand this is what many systems administrators are going through.

I used to DJ a lot, especially with house music (especially US house like Deep Dish and Tribal/Twisted Records). I would pride myself on the smoothness of my mixing - you'd have a song playing and gradually, smoothly bring in another record, at first faintly under the other record and then gradually it would fade in and the original song fade out. This mixing between the records could go on for over 2 minutes and the listener would be eased into the next song. I think this is similar to how XP and Vista will co-exist - at the moment, XP is supported but gradually, we'll test and support more and more group policies and applications in Vista. Meanwhile, you will gradually take the pedal off XP - maybe a new application will be Vista only or make a service only available to Vista boxes. Eventually, after a couple of years, XP will be switched off and Vista will become the only supported Windows platform. OK, honestly, that's the romantic explanation - in reality, it will probably be a bit of a carrot-and-stick situation (but will not so much carrot and a whole lot of stick! The mess Microsoft have made by making the Vista profiles not compatible with XP profiles will see to that!).

I'll blog about Vista and testing another time.

The Best Feature in Vista For System Administrators

Wed, 07 Feb 2007 23:09:26 GMT

...is: Fast User Switching. Huh? That's been there since XP. Yes, but what is great and brand new in Vista is, it now works in domains.

There are multiple areas where this should help. I really think that when testing applications with several different user account types (eg. staff account, student account, visitor account), this really helps, especially if you are trying to do identical tests. You do a test, fast switch to the next account, perform the same test, etc. This really helps you notice the small quirks you might not notice if you had to log in as one user, do all the tests, log out, log in as the next user...and so on.

The one time where I noticed how useful Fast Switching is, I was trying to figure out why a certain security policy was causing various services in Vista to fail to start. Services like Windows Time and the DHCP Client simply wouldn't start, saying "Access is Denied". The upshot of this was the machine wasn't seeing the network or anything, so accessing the machine's logs, file system and registry wasn't possible remotely. However, as with many who are roadtesting Vista, I keep my machine in a strictly embargo-ed, isolated OU in the Active Directory, so security by default wouldn't let me access it. Fortunately, before the services failed, I had enabled the local administrator account. So, what I did was Switch away from the account and log in as the administrator account.

By the way, as an aside, if you have a machine called BLAHBLAH, the login you'd usually use for a local account is "BLAHBLAH\administrator" (as the domain is the default context for logging in). A much faster way of logging into local accounts is to use .\ as in ".\administrator".

Anyway, as administrator, I could change various settings I obviously couldn't do as the other, non-administrator account. The error, "Access is Denied" made me wonder if this was a ACL permission issue. I first tried to start the DHCP Client service as administrator and it failed. I followed a hunch and went to the Services registry key (HKLM\System\CurrentControlSet\Services) and found the DHCP Client key. I figured, it was trying to start this service as Local Service. Therefore, maybe there was a permissions issue with Local Service and this key. It turned out to be correct - adding Local Service to the DHCP Client registry key with Full Permissions allowed me to switch back to the other account and the service started correctly (I should point out, this was tried very late on today, so as yet, haven't got an adequate explanation as to why Vista's playing up like this...).

However, the greatest advantage to systems administrators that Vista's Fast Switching gives is - it allows us to be a lot more secure. Let's face it, most administrators do the dice-with-death scenario of being logged in with their vastly powered login as they do their job, be that edit group policies, write scripts or whatever, and also have their email open and are usually browsing the web at the same time. I'm currently one of them, I have to admit! The problem is, one mistake, one dodgy email, one dodgy website exploiting one security hole, could expose your entire systems and network to hackers. So, why do we do this? Simply put, its far too inconvenient to constantly log in and out between your admin and non-admin account. With Fast User Switching, that entire scenario is solved, and there is simply no excuse for a systems administrator to be browsing the web and their email in the same session as their all-powerful accounts. For any IT Manager reading, your number one job for Vista is to make sure all your system admin guys and gals have a second, non-priviliged account!

A Vista View

Wed, 31 Jan 2007 00:26:05 GMT

So, its finally here - Windows Vista is released to the consumers of the world. The big question everyone is asking is: Is it worth the wait? As with most, its a decided yes and no.

From a usability standpoint, it is clear away better than XP. Everything feels a lot slicker and smoother, even on a relatively slower machine (less than 2GHz with 512Mb RAM), and when you move back to XP after using Vista, its really noticable. I really like the new embedded Start Menu, the breadcrumb bar is an excellent innovation on previous takes, Flip 3D actually works and the Search bar is great once you get used to using it. I was quite surprised by how good some of these features were, as some (especially the Search bar) were really, really, really awful in the early Beta 2 releases.

Under the hood, the security has definitely been tightened and things seem to hang together better. However, the default UAC setup is next to pointless as people will just learn to click through the security messages without reading them. I'd prefer if they came up less often but were tighter (require a password to continue). At least, again, this has been much improved over early beta releases.

From a systems administrator angle, though, Vista has a number of features I am pretty enthused about. The most significant of these is the new WIM file image format, and the excellent way it ties into a suite of Microsoft's other tools. It seems they have finally got serious about supporting the IT Professional, as opposed to attacking them (can it be any coincidence this all happened at the same time fat IT Professional-hating loser, Robert Scoble, left Microsoft?). There are a number of other boxes that Vista ticks from a systems admin angle, especially the ability to properly configure a lot more options (especially must-haves like Power Management), far better diagnostic tools (especially in the event viewer), better controls of Administrative Templates with the new ADMX format and vastly better, greater options to deploy (and to deploy, FAST).

On the downside, there are still a large number of the niggles you got with XP that remain in Vista. These are too numerous to mention, but if you go about your job and occasionally come across those little issues where you think "ahhh, that's a weird quirk in XP", its likely to be a weird quirk in Vista as well. Unfortunately, sometimes those quirks can be pretty terminal and require rebuilding the machine. There is no doubt that Microsoft have been in a hell of a rush to get Vista finished and its pretty disappointing they didn't spend more time looking at many of the components that were needing fixed (group policy processing, for instance). There are also a number of features that seem half-baked for the developer/IT Professional like myself. A good example is the Vista sidebar. It doesn't support the big guns of Microsoft's development for Vista: WPF or C#. Look at the excuses here: http://microsoftgadgets.com/forums/1/3125/ShowPost.aspx#3125. When the ENTIRE POINT of WPF was to make things like this, you can't half feel that there are a few people at Microsoft not taking pride in their work, and as such, mean that not so many people will be making these gadgets.

Another downer for Vista at the moment is the fact that Microsoft have all but confirmed that Service Pack 1 is coming out later this year. Longhorn Server (probably to be renamed "Windows Server 2007") is likely to ship at the same time. Its not too big a leap to see that, effectively, the Longhorn client and server codebase will be final then. As such, there is the possibility that updating to SP1 will cause some changes to Vista's behaviour. I'm really not sure that it should be something that people commit to using with a large number of users before then.

However, overall, there are a lot of things Microsoft could have done to Vista to make it a lot worse than it is, and it is amazing how much better the RTM version was over the Betas that came out only a few months earlier. Now, if Microsoft could keep up that pace...

Business Desktop Deployment 2007 Beta

Thu, 14 Sep 2006 23:18:03 GMT

BDD 2007 is one Microsoft's key components in the future deployment of Desktops, especially being phased in for Vista and Office 2007. I got an update from the beta today. I haven't had a chance to play with this new version yet but its shaping up nicely features-wise:

Business Desktop Deployment (BDD) 2007 Beta 2 is now available for download on Microsoft Connect. BDD 2007 provides end-to-end guidance and automation for large-scale deployment of Microsoft® Windows VistaT and the 2007 Microsoft Office system.

BDD 2007 Beta 2 has been updated to support Windows Vista RC1 and now includes guidance and automation for Zero Touch Installation (ZTI) using Microsoft Systems Management Server (SMS) 2003 as well as image creation of Microsoft Windows® XP desktop images.

BDD 2007 Beta 2 extends Beta 1 with the following key features:

Zero Touch Installation (ZTI) using SMS 2003 (requires OSD Update build 3726) in addition to Lite Touch Installation (LTI) when SMS 2003 is not in place.

Windows XP desktop image creation.

x64 hardware (running Windows XP or Windows Vista).

BDD Workbench installation of the Windows AIK during first use.

Windows Deployment Services images for Refresh, Replace, New, and Upgrade scenarios.

BDD Workbench now builds the set of files needed for SMS 2003 OS Deployment Feature Pack package creation.

Office 2007 deployment is integrated into the BDD Workbench to build the source share, create, and populate the application selection screens.

New OS source move feature-faster than copy when adding a new OS to Workbench and the source is the same drive-primarily added to enhance demos and training.

Application grouping with dependency checking.

Product ID key handling for Windows XP and Windows Vista deployment scenarios.

Removable media deploy points and better filtering to reduce media size.

Fewer restrictions on version mixing of newer WAIK and Vista releases. Version checks now performed and detected issues are displayed.

User State Migration Tool (USMT) update for Windows Vista RC1.

I'm not sure if this beta is still open for participation, but go see at http://connect.microsoft.com

I'll give you more on this once I've started working with it.

22 Minutes

Sat, 09 Sep 2006 08:19:44 GMT

I finally installed Vista RC1 on my home computer today.

There's a small problem with it though. It takes 22 minutes to boot! 22 minutes and 30 seconds to be exact.

It boots, goes through the Windows loading screen and then, the screen turns ominously black. And stays that way for 20 minutes before suddenly popping up with the Vista loading screen. Totally crap. I've done the correct thing and forwarded an issue with the correct tool to Microsoft, so hopefully it can be fixed. Weirdly, the last build I tried on my home machine, Beta 2, didn't have any of these problems.

What of Vista itself, once I get into the blasted thing? I'm actually quite impressed. Microsoft may well have pulled this monster out of the fire. Its fast, certainly faster than my XP partition. The drivers need a lot of work though. My pretty-standard 3com network card was not installed the first time it booted. This left me in total limbo because Windows suggested, as it always does, "contact the vendors website". NNNNGGGGGGGGG! Useful advice that, when you can't find a network, let alone the internet! I solved it only by pointing the add hardware wizard to search my C: drive, where XP lives. It then installed fine. For the normal non-techie person, this is simply not good enough. Get it sorted, Microsoft!

More musings later on...much later on (ie. I'm going to reboot!).