Scott Bussinger's questions

There's a dialog in the "Internet Options" control panel applet if you go to the Security Tab, highlight "Local Intranet" and press "Sites" that looks something like

[X] Automatically detect intranet network
    [ ] Include all local (intranet) sites not listed in other areas
    [ ] Include all sites that bypass the proxy server
    [ ] Include all network paths (UNCs)

I'd like to script these settings using PowerShell (or a batch file for that matter). I can't seem to find any documentation on doing that though. I found where they are persisted to the registry, but just changing the registry settings doesn't seem to work so I'm assuming there's some additional work to be done and a more official API for this.

Thanks for any help!

A client site is having hard-to-diagnose issues related to their network. While working on the problem, I ran the command "net statistics workstation" on one of the computers. I got the following data covering approximately a week of activity:

Bytes received                               23791085485
Server Message Blocks (SMBs) received        22410645
Bytes transmitted                            8962989188
Server Message Blocks (SMBs) transmitted     22410618
Read operations                              4481436
Write operations                             2275694
Raw reads denied                             0
Raw writes denied                            0

Network errors                               0
Connections made                             629
Reconnections made                           990560
Server disconnects                           40    

Sessions started                             0
Hung sessions                                0
Failed sessions                              0
Failed operations                            22
Use count                                    1212
Failed use count                             198

I'm thinking the very large number of "Reconnections made" (almost a million of them, so almost 2 per second for a week) should be telling me something about what's going on with this network. What precisely does that number represent and what does it indicate? How about the other numbers?

Thanks for any help!

Say you have a computer with the system drive encrypted by BitLocker and you're not using a PIN so the computer will boot up unattended. What happens if an attacker boots the system up into the Windows Preinstallation Environment? Will they have access to the encrypted drive?

Does it change if you have a TPM vs. using only a USB startup key?

What I'm trying to determine is whether the TPM / USB startup key is usable without booting from the original operating system. In other words, if you're using a USB startup key and the machine is rebooted normally then the data would still be protected unless an attacker was able to log in. But what if the hacker just boots the server into a Windows Preinstallation Environment with the USB startup key plugged in? Would they then have access to the data? Or would that require the recovery key?

Ideally the recovery key would be required when booted like this, but I haven't seen this documented anywhere.

I have a workstation on a domain that's displaying the UAC (User Account Control) prompt for executing a program and I can't figure out why (I don't want it running with administrator privileges).

It's a Windows 7 workstation and Windows Server 2003. None of the other workstations are exhibiting this symptom (logging in with the same user account). The EXE file is on a mapped network drive. In the shortcut's Compatibility properties, the "Run this program as an administrator" is NOT checked. There's no manifest on the application requesting administrative privileges (and none of the other workstation are getting prompted).

What other Windows settings can trigger the UAC prompt for an executable?

Can anyone make a suggestion for the best way to log connections and disconnections from Windows workstations to a Windows Server 2003 file share?

We're having some issues with workstations that have a drive mapped to a server that seem to work fine for awhile and then suddenly appear to get disconnected from the server (with files open). Needless to say this causes some data corruption and error messages.

It would help me to troubleshoot the problem if we could somehow monitor and log the session connections and disconnections, to attempt to correlate the connectivity issues with what actions the user is taking at the time and what the server is doing. I just haven't been able to find a way to do this. Specifically I'm talking about the same information that is displayed in the Computer Management control panel applet in the "System Tools|Shared Folders|Sessions" page.

Thanks!

I've seen several brief articles on the Microsoft Lync server (formerly Office Communications Server) that talk about replacing PBX's, but in reading some press releases and websites I'm not finding it clear exactly what Lync actually does and doesn't do.

Can someone please tell me if Lync can perform the same functions and replace a linux-based Asterisk PBX? I've got an existing Asterisk PBX and VOIP phones I'd love to switch to a Windows-based system. I'd be looking for normal PBX functionality (e.g. voicemail, autoattendent).

Thanks!

I'm experimenting with setting up our company laptops with Win7 and BitLocker. There's no TPM available so I'm using the USB startup key option. In my testing I put the encryption key on a MemoryStick flash card and it's working fine.

To test test the system, I copied the encryption key to a USB flash drive and BitLocker doesn't see it there. I tried copying the files to an SD flash card and that worked, so I'm thinking that BitLocker must be remembering the drive to find the key and not just searching all available drives. Is that correct?

Is there any way to change where BitLocker looks for the key?

Also, am I correct in thinking that there's no reason I can't keep numerous startup keys on a single flash disk? I'd like to have a sort of "Master" key that works on any laptop for easier maintainence and as a backup (we're not currently using Active Directory).

Is there a replacement for the old SysInternals NewSID utility that will work for Windows 7?

I found out the hard way that NewSID will totally hose a Windows 7 setup (BSOD on reboot). Apparently the same problem occurs for Windows Server 2008 R2. They've officially announced that NewSID will be retired in November, possibly because of this issue.

I'm aware of SYSPREP, but it's not a clean replacement in my case so I was hoping that there was another utility similar to NewSID that worked with Windows 7. Reworking our system to use SYSPREP will be ugly and slower as well. Is there another alternative?

I'm loving the new Boot-to-VHD feature in Win7! But I'm wondering if anyone has any thoughts on how to change the drive letter (while booting from a VHD file) of the drive that's hosting the VHD boot file.

I have multiple hard drives/partitions and I'd like the drive letter mappings to be as similar as possible when booting from the physical drive and when booting from a VHD. By default, the physical host drive is showing up as drive D: when booting from the VHD file and I'd like to change it to something like "X:" so the other mappings can be the same in either case. The typical method of changing the drive letter using the Disk Management tool from the control panel doesn't work, I assume because the drive is currently being used (obviously the VHD file I'm booted from is open).

Anyone have any bright ideas on how perhaps I could set up the system to change the drive letter on automatically on the next boot? This isn't a critical need of course, but I thought I'd see if anyone had any ideas. Thanks!

I'm experimenting the Trinity Rescue Kit (TRK) http://trinityhome.org/Home/index.php?wpid=1&front_id=12 and it's ability to clone hard disks to many computers at one time using multicast techniques. Quite cool software! All of the computers are identical and are running with gigabit ethernet cards connected to several interconnected gigabit switches on a single subnet.

I'm having an issue with the multicasting speed. If I just have the master computer and write to a single slave computer, I can image the slave computer's hard disk at over 300 mbps! But if I try to write to several of the computers at the same time the tranfer rate drops to just under 10 mbps.

The hardware and software is identical in each case and any individual slave computer gets the same 300 mbps transfer. Something about actually trying to use two or more multicast clients at the same time appears to cause it to negotiate down to the very slow 10 mbps speed.

My question is what controls the speed of a multicast broadcast? How is it adjusted? What can affect it? There are quite a few other devices attached to the switches in the office, can a client not involved with the multicast broadcast affect the speed? I couldn't seem to find any good references on the practical use of multicast so I'd appreciate some links if you have some.

Thanks!

Does it seem to anyone else that the Windows 7 command processor (CMD.EXE) is really slow starting up?

I ran this test from a command line (ntimer is a timing utility from the Windows server resource kit and you can just leave it out if you don't have it installed):

ntimer cmd /c for /l %a in (1,1,100) do @cmd /c rem

All it's doing is shelling out a new CMD.EXE 100 times. On my x64 Win7 base system that takes about 2.3 seconds to run. Running this is in an x86 Win7 virtual machine it takes about 5.6 seconds. Interestingly enough, in the VM using the old 16 bit command processor COMMAND.COM the same test takes less than 1 second.

Why so slow for CMD.EXE? I expected performance similar to what I saw with COMMAND.COM in the VM. The ratio of speeds for CMD.EXE between the raw machine and the VM seems reasonable, but the absolute speed is way slow. Anyone have any thoughts on this? Thanks!

I noticed this because I was doing a software build and the execution time went from 15 minutes in my old XP VM to 30 minutes in my new Win7 VM. The build process uses the GNUMAKE utility and does LOTS of shelling out to the command processor.

P.S. I asked this originally over on stackoverflow.com, but they suggested I go here.

I'm just tweaking out my new Windows 7 laptop and wanted to disable the automatic Java updating (and thus kill the silly jusched.exe background process), but I can't seem to get it to actually turn it off.

I found the Java Control Panel applet and found the settings on the Update tab that should control it. I can turn them off, apply them, and close the dialog successfully. But if I just open the dialog backup again right away, I see that the changes weren't actually made. I've tried it numerous times and it just doesn't take. What's up with that?

I also tried to disable the icon in the system tray and got the same effect. Changing the size of the Temporary Internet Files cache work however.

Any ideas? Thanks!

Is there a simple utility to log terminal server use? I'd like to be able to do some simple monitoring of our terminal server and don't seem to be able to find any good way to do it. I'd want to track logins, session durations, disconnections, and failed login attempts. Ideally it'd just be something simple for a dashboard-style review to make sure everything's cool and there's no problems.

It'll have to be free (or very inexpensive) as this is just a lightly used terminal server with limited use. I'd have thought there'd be something built into Windows to track this, but if there is I can't find it.

Thanks!