Offer details:
Dates: January 13, 2010 – June 30, 2010.

Details: You must register, obtain a voucher code, schedule, pay, and take the first and (if necessary) the retake exam before June 30, 2010.

Applicable exams: This offer applies to all Microsoft Learning IT professional, developer, project management, and Microsoft Dynamics exams, including academic exams. Visit the Learning Catalog and search for your next exam

Eligible countries and regions: This is a worldwide offer that is available at Prometric test centers only.

Note Only one Second Shot voucher is available per purchased exam.

Notice that the deadline for taking the first time and retake is the same – June 30th 2010. Previously the first exam had an earlier deadline and the retake had an extra month or so if you were taking one.

Most folks are feeling the pinch to some extent, or may have already suffered from downsizing or outright closure of their company. If this makes you feel like you don’t want to shell out on exams right now, at least this can help you to take out some of the risk if you are not sure you are ready. I even know people who treat this like a free chance to get to see what the actual exam is like – a dress rehearsal to help prepare for the real thing, in a way. If they fluke a pass along the way then even better for them, I suppose. Of course, if you are between jobs then maybe now is a good opportunity to use your time to hone the skills you probably already have to a large degree, get yourself some qualifications and be in a stronger position to get back into the job market when things improve.

I really must get round to taking 70-293 to complete my MCSE and then probably 70-620 Vista client exam before it becomes completely obsolete, and also because it is still one of the electives for the “Microsoft Certified IT Professional – Applications for Microsoft Dynamics CRM 4.0” qualification for which I passed the core MB2-631 and 632 exams. It looks like they are not going to swap out the requirement to allow the Windows 7 client exams instead at the moment, and may not do at all once CRM 5.0 gets out of the stable later this year.

What will you use the second shot for? What exams have you been planning, intending, promising yourself to take for a while and not getting round to?

Group policy settings for Windows Vista sp1, Windows 7, 2003 sp2 2008, 2008 R2

Group policy settings for Internet Explorer 8 are also available (on a different page).

Note that the latest files are all in Excel 2007 format so if you are not yet using Office 2007 or 2010TP you would need to install the Office compatibility pack to allow you to view these on a previous version of Office, or the Excel 2007 viewer (+ service pack 2 as well) to view them (but not be able to edit or save changes). Both of these downloads are free.

Hat tip to Jeremy Mosokowitz at GPAnswers.com

Overall I like the way the Office exams work – the real application (minus the help!) running in the top half, and the questions at the bottom. Each question has a few tasks to complete, and you are measured on the end result, not how you got there.

This is a much better test of real-world ability to use the software than any multiple-choice questions can ever hope to be. Yes, it means that you could take a few wrong turns, and click on some irrelevant buttons before finding the thing you were looking for, but you can do that in real life too. The exam is limited to 50 minutes, so you can only afford to do this on a handful of questions, and you need to be able to make up the time on other questions by reading it once and going straight to the correct feature or function.

For the MOS 2003 exams I had a few minutes to spare for every subject except Excel where I had to rush the last question in the last few seconds. This time round I finished all of them early, and Excel had the fewest questions and left me the most remaining time -19 minutes out of the 50 allowed, the rest between 11 and 15. The Outlook exam had a few technical hitches: in three scenarios, things which were referred to in the questions simply did not exist in the mock environment provided, but using the “reset” feature in each case reloaded and everything was fixed. Frustrating, but at least the reset button did the trick, so bear this in mind if you run into similar problems.

The Word, Excel and PowerPoint exams had several questions using the new formatting tools – style galleries, themes, colour schemes were all covered, as you would expect since these are the backbone of the new approach to making richer, more visual documents. MS also want to make sure you got the hang of using the options for making documents more secure and collaborating with colleagues – make sure you know how to prepare a document by stripping out metadata, protect a sheet/book in Excel, mark a file as final, manage comments and track changes. Outlook did not really have any surprises, and covered the whole breadth of email, contacts, calendaring, tasks, and the options to customise the environment (things like signatures and email format).

I felt all the Office exams were a little bit biased towards the new features, when you consider the overall breadth of the applications. As an upgrade from MOS 2000 or 2003 this would make sense, but someone taking a Microsoft application exam for the first time might be frustrated when they are not asked anything to test their knowledge of lots of other core areas. I only had two very simple tasks to do with charts, for example, which is hardly stretching their capabilities (of course you could get 20 in-depth chart questions, since every exam is different). At least I had some questions on Excel formulas this time, for the MOS exam I had none at all – which just shows how varied the exams can be, I suppose.

MCAS Vista is a slightly different exam format, using a simulation environment closer in style to the MCP technical exams than the Office ones. This means that you often can’t do things in many different ways, which allows you to quickly realise when you have tried an incorrect option as you get an error saying that feature is not available in the simulation. The simulation takes a few seconds to reload in between questions, but the clock stops during this period. Again, the best way to get through the exam in the time will always be to know the subject thoroughly so you can go straight to the right answer.

On the Vista exam there were also some straight multiple choice questions, which were generally quick to complete, but I guess they represent fewer marks than the tasks which have several steps to them. A couple of questions nearly caught me out as they referred to functionality which would be very different in a domain environment than in a workgroup network. Just be aware that this exam is geared more towards end users, home enthusiasts and people in smaller businesses who look after the systems in addition to their main job. If you are an IT support professional, then this could still be a suitable qualification, but it is more likely that the Vista Technical Specialist (MCTS exam 70-620) will be more relevant to your needs.

Right, now I just need to update the Office 2007 training and profile pages on my website and LinkedIn to show my five new MCAS qualifications!

In a recent blog post, Mark explains in great detail the file copy process in Vista, why it changed radically from XP and how this impacted real and perceived performance of this basic function. He goes on to explain how some of this has been changed and remedied in Vista Service Pack 1. He makes it clear that some of the code design choices have to be compromises between making things faster in different situations, and that in most cases Vista <> Server 2008 filecopying will be faster using the chosen algorithms than they would be with different choices, or using XP or server 2003 for example.

Copying a file seems like a relatively straightforward operation: open the source file, create the destination, and then read from the source and write to the destination. In reality, however, the performance of copying files is measured along the dimensions of accurate progress indication, CPU usage, memory usage, and throughput. In general, optimizing one area causes degradation in others. Further, there is semantic information not available to copy engines that could help them make better tradeoffs. For example, if they knew that you weren’t planning on accessing the target of the copy operation they could avoid caching the file’s data in memory, but if it knew that the file was going to be immediately consumed by another application, or in the case of a file server, client systems sharing the files, it would aggressively cache the data on the destination system.

The article is also a useful working example of how Process Monitor can help you to see what your machine is really up to. On the same subject, Mark gave a great Tech Ed presentation in Barcelona with some real-world demonstrations of how to use a variety of Sysinternals tools and utilities to detect, find and fix all sorts of system issues. A video of that talk entitled “The Case of the Unexplained…Live!” can be viewed here (it’s just over an hour long).

Download the Group Policy Settings Reference for Server 2008 in Excel 2007 (.xlsx) or older version (.xls) format.

Interestingly, this also includes 9 settings which are only available for Windows Vista service pack 1 (which also RTM’d last week). All of these are to do with controlling security settings for terminal services (RDP) sessions, including a setting I will find particularly useful to control whether a session can be established when the server cannot be authenticated.

This policy setting allows you to specify whether the client will establish a connection to the terminal server when the client cannot authenticate the terminal server. If you enable this policy setting, you must specify one of the following settings:

Always connect, even if authentication fails: The client connects to the terminal server even if the client cannot authenticate the terminal server.

Warn me if authentication fails: The client attempts to authenticate the terminal server. If the terminal server can be authenticated, the client establishes a connection to the terminal server. If the terminal server cannot be authenticated, the user is prompted to choose whether to connect to the terminal server without authenticating the terminal server.

Do not connect if authentication fails: The client establishes a connection to the terminal server only if the terminal server can be authenticated.

If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the terminal server when the client cannot authenticate the terminal server.

This latest reference describes in detail 2,746 group policy settings, including the full explain text, which ones need a reboot, and to which operating systems they can be applied. This is up from the 2,494 which were available when Vista released to manufacture.

There is also one additional security setting for Vista SP1 and Server 2008 which will “Allow UIAccess applications to prompt for elevation without using the secure desktop”. This is intended for use when (for example) an administrator is providing Remote Assistance and may need to be able to provide credentials for a UAC prompt through their interactive desktop, whereas normally this prompt only appears on the secure desktop and is unavailable to anyone except someone at the keyboard in front of the machine. There are other settings relating to this which help to define which applications can be considered to have UIAccess which were already available in prior versions.

Read more about the release of Service Pack 1 for Vista here. The short version is that it won’t be available to actually download until mid-March

One of the benefits likely to get most press will be the changes to how Microsoft enforce their licencing through the “Windows Genuine Advantage” (WGA) programme which requires the software to be activated in order to continue using the full functionality. This has been held back from all the beta versions and will only take effect in the final released version. Paul Thurrott discusses this at his SuperSite for Windows:

First, Microsoft is disabling the two most common exploits that exist today for bypassing product activation in Vista … Pirate Windows users utilizing one of these hacks will see their systems return to the intended state–typically a grace period countdown–once SP1 is installed.

The second change is more dramatic. … If the product activation period expires, for example, Vista moves into Reduced Functionality Mode (RFM), where the user can only access the IE Web browser for 60 minutes at a time before being logged out; … Non-Genuine State (NGS), occurs when an activated copy of Vista fails a Web-based validation check, such as when you attempt to download software from the Microsoft Web site. In this case, certain features–like Windows Aero and ReadyBoost–are completely disabled, while others–like Windows Update and Windows Defender–work in limited ways only.

Beginning with SP1, RFM and NGS are a thing of the past.

Improvements to the software itself generally focus on performance and stability, but it does also improve on driver support and providing better APIs for third-party products such as anti-virus and desktop search (partly due to complaints that vendors were being “locked out” and could not develop products on an equal footing with Microsoft themselves).

One area which should be much better is the slow copying of files (even within a disk) which has plagued some systems. I will run some test copies of sets of large and small files and once I have the service pack installed I’ll post some results on how much performance gain I get.

There were various articles announcing Vista sp1, including one on the official Vista team blog which managed to say lots about all the good stuff and conveniently forget some things like the removal of the very useful GPMC, which is only mentioned in the whitepaper (and later reported on by various bloggers and journalists of varying degrees of credibility).

I have to admit that reading whitepapers can sound pretty dull, particularly when they relate to something I can’t download yet. I tend to think “I’ll read it nearer the time, once I have actually downloaded <whatever> and can apply what I am reading”. On this basis it is easy for people to overlook this announcement amid the other marketing hype.

In my mind there are two key questions here:
Firstly, I know there is supposed to be a new enhanced version of GPMC available at some point, but will it be available in time for the Beta testers? Or even for the final release of sp1? This remains unanswered at the moment, and is crucial. If it is available, it lessens the impact considerably.

Secondly, why take a retrograde step to remove something which is already in there? This second question is the one which most other commentators have addressed.

Jeremy Moskowitz, MVP for Group Policy makes some valid points on a post entitled “Vista + SP1 = Gbye GPMC” in his blog (sorry but I can’t find a way to link to the specific post):

Today, the GPMC is part of Vista. That’s great. One less thing to load.
But what’s also (now) true is that if you install SP1 for Vista (not yet available) the GPMC will be uninstalled. Why?

Because this allows for something that I’ve personally advocated for. That is, when new goodies are ready to be launched in Group Policy land, let’s GET IT OUT THE DOOR. And it used to be this way. The GPMC was a simple download and simple install. When bugs were found in the GPMC, that meant it was a quick fix to jam the fixes in, and re-upload the file for the masses.

But now (today) the GPMC is part of the Longhorn and Vista operating systems. Is this good? Not really, in this one dude’s opinion. Because what if some new whiz bang feature is suddenly available? Then you’ll have to wait until MAYBE an operating system service pack, or at worst a full operating system revision until it’s updated.

Darren Mar-Elia (another GP MVP) wrote a very extensive post about the Vista sp1 release, specifically pointing out lots of errors in one of the many articles about sp1. In it he takes up the same idea as Jeremy:

Back when GPMC first shipped, out-of-band of the OS, I’m sure Microsoft heard complaints that it should be in the OS, since it became such a crucial part of managing GP for many shops. So, they went and did the most logical thing – they put it in the box in Vista.

But to do that resulted in GPMC having to become part of the behemoth that is the Operating System release cycle at MS. This has obvious limitations if you know how glacially things move within MS when it comes to OS revs. Once inside the OS, they could no longer rev the GPMC and make enhancements to it on their own schedule.

However, I can’t see that the GPMC is so tightly integrated to the operating system as to prevent an update independently of the service pack cycle. The GP processing engine, sure (although making that its own process in Vista outside of winlogon should help with any patches that are needed). But the GPMC is an application. It does nothing until invoked by the user. I realise that it can still use shared code, but does it, in fact?

Anyway, if the GPMC so woven into the fabric of the OS that it can’t be independently tested and upgraded, how are they managing to take it out so easily? Surely that is contradictory?

Other OS components installed by default have upgrades made available periodically, the most obvious being Internet Explorer and Media Player. MS have claimed for a long time that both of these are fundamental components of the OS and it would not be possible to ship Windows without them unless it was severely crippled. This has been the basis of its defence in previous anti-competitive practices (antitrust) lawsuits. Microsoft just spent three years appealing a decision by the EU courts that ruled they had to produce a version of Windows XP without Media Player (which they have subsequently done for both XP and Vista)

Darren goes on to say:

But, with GPMC installed on every desktop, any joe user with normal non-administrative rights in the domain can open GPMC and view the settings on any GPO they have read access to! Further, they can also backup all GPOs that they have read permissions on, to, say, their USB keys

Technically true, and echoed by others. However, this overlooks the fact that to run GPMC on Vista in a default configuration the user requires local admin rights on their domain account (the local admin account won’t be able to access the domain policies, only the local ones). So yes, if you have domain users with local admin rights on their machines, they could run GPMC as described and take a copy of your policies. I’ll ignore for a moment the lack of security inherent with that model (because I accept there may be users who have a second account for doing admin things occasionally via a runas or UAC).
My question is this: surely a user sophisticated and malicious enough to do what Darren suggests would also be able to take the trivial step of installing GPMC if it was not already on their machine?

If they don’t have local admin rights they could still take a copy of the files for the policies they have read access to by going directly into the sysvol share. This would then take more effort to interpret than a GPMC report but they could easily restore them into another domain (in a virtual machine, say) in the same way you would have done before GPMC.

As a counter to this, surely we should be advising people to take more care in the creation of their Group Policies? It is very easy to ignore the security filtering for most purposes if you have designed your AD to enable you to target your policy links exactly where you need them. However, it may be prudent to remove “authenticated users” from the security filter (or via the delegation tab) and add back in only those groups who actually need to receive each policy.

You could start by having a security group for all computer accounts and another for users if you are following recommended practice of keeping the two types of settings separated and only enabling one ‘half’ of the policy. This would immediately secure your computer policies against the sort of access that we are concerned with here, including via sysvol. More granular groups would be ideal, but would increase the overhead of managing things.

So, I remain to be convinced that having GPMC pre-installed actually makes anything less secure than it already is. I am also unconvinced that it needs to be removed in order for independent updates to take place, as that would imply it was very tightly integrated in the OS, which would imply it could be quite hard to take out of the codebase, which seems to me a little contradictory.

I’ll just have to live without it, or install the enhanced version as long as it is available soon enough. It just still seems illogical.

Share this post :

I was pleasantly surprised to learn this, and it means I don’t have to wait for sp1.

OK, some of you must be thinking I have been hiding under a rock if I did not already know this, but I have found no mention in two books on Vista security (by Mark Minasi / Byron Hynes, and Jesper Johansson / Roger Grimes), nor another fat volume about Vista generally, nor a tome on Windows command line administration.

On the contrary, there are lots of misleading phrases that Bitlocker only encrypts the system volume (because they are trying to stress that it does not encrypt the boot volume, I guess), and even mention that if you use EFS for the additional volumes, and the EFS keys are on the system volume which is Bitlocker encrypted, then this is as good as Bitlocking the whole lot anyway. I can see the logic of that, but a little aside to say that you can use Bitlocker directly would have been helpful.

The Vista Resource Kit, however, does cover it, I now find (starting on page 527). A quick bit of Googling and the right page of the FAQ turned up this:

Will BitLocker encrypt more than just the operating system volume?

BitLocker provides a user interface for the encryption of the entire operating system volume, including Windows system files and the hibernation file. You can optionally use Encrypting File System (EFS) in Windows Vista to protect other volumes. The EFS keys are stored by default in the operating system volume. Therefore, if BitLocker is enabled for the operating system volume, all data that is protected by EFS is also indirectly protected by BitLocker. Additionally, advanced users can encrypt local data volumes using a command-line interface (manage-bde.wsf).

So, a bit of cscript manage-bde.wsf -? and we are on our way. But that’s for another day.

David Overton posted an article about what’s coming in the first service pack for Vista. In it he links to and quotes this BetaNews article which says:

the service pack will uninstall the Group Policy Management Console (GPMC) and GPEdit.msc will edit local Group Policy by default

So where did they get this important bit of information? It’s not in the Vista Team blog announcement, nor the extensive interview with Jon DeVaan, senior vice president of the Windows Core Operating System division at Microsoft.

It is in fact buried in the middle of the White Paper about the Vista sp1 Beta release, a document you may not have bothered to read in detail unless you are one of the lucky(?) 10,000 who will get to test this out. The relevant paragraph, in full, reads:

In addition to these changes, Windows Vista SP1 will change the tools that customers use to manage Group Policy. Administrators requested features in Group Policy that simplify policy management. To do this, the service pack will uninstall the Group Policy Management Console (GPMC) and GPEdit.msc will edit local Group Policy by default. In the SP1 timeframe, administrators can download an out-of-band release that will give them the ability to add comments to Group Policy Objects (GPOs) or individual settings and search for specific settings.

Now, I’m a bit of a zealot for good systems management (one of the original drivers for me writing this blog, and the idea for the name). I would also say I am an evangelist for Group Policy – particularly as one of the site admins for GPAnswers.com where there is a thriving community helping out people in difficulty over the intricacies of the subject.

I have heard lots of people say that adding GPMC into Vista “out of the box” was a good thing, and a few grumbling that there is no new version for XP/2003 yet, nor a downloadable version in case you break the built-in one (although that should be repairable in any case.

However, I have yet to hear of anyone saying they wish it was not there, and that it is too complex or gives too much power to someone. If you are one of these people, please let me know why you feel this way by leaving a comment. I hope to convince you of your error (told you I was an evangelist!)

The possible saving graces for me are these improved features which are discussed in the same white paper:

• BitLocker Drive Encryption encrypts extra local volumes. For example, instead of encrypting only drive C, customers can also encrypt drive D, E, and so on.
• Administrators can control the volumes on which to run Disk Defragmenter.

Both of these will be useful to me. I hope they make it through the Beta to the released version.

Spread the word :

Note: I certainly do not think these are necessarily big enough to merit an upgrade to Vista on their own. They are probably good enough to choose to have Vista on your next machine rather than sticking to your old ways and asking for XP to be installed. In a follow-up article I may discuss more of the technical reasons why Vista is worth having (and potentially upgrading to if those factors are important to you). Today’s list is built around things the everyday user will benefit from in their daily interactions.

This first one in this arbitrarily-ordered list: if I create a new folder in a Save dialogue it is opened after I do the initial rename of it. Simple, and so obvious in hindsight – if I create a new folder then almost always it is so I can save in there straight away. Very occasionally I might be doing it for later use, but this has to be less than 5% of the time, so this is a definite time saver (and avoids errors where you create a folder and then forget to open it before hitting the final Save button.

Similarly, at number two another change which is actually very small, but made me think “that’s so simple, why did they not do it before?”. Cascading empty folders all the way to the bottom when the top one is opened. What do I mean by that? I often create folder structures which may not yet have files in them, either through scripts (maybe to create all the months to hold files when I come to them later in the year) or by copying folders from elsewhere (to replicate the locations of Excel workbooks within a client’s file system so that cross-references work for me). In previous versions of Windows if I wanted to open or save a file to these, I would have to tediously open every folder to get to the bottom of the tree. In Vista, if a folder contains only one folder and no files, then it automatically expands the child folder and so on down the tree until it reaches a file. Now, I know some people may not have quite so many single-branched directory trees as I seem to collect, but for me this is a great time saver and seems so obvious in hindsight.

Sticking with explorer, my third useful feature is that when I rename a file it does not select the extension. Great, I can just get on with typing my new filename without fiddling about first. In XP this was the issue that made it a hard choice on end-user machines between always showing file extensions (which risks them being altered in error) or not showing them which makes some explanations or troubleshooting take longer. I have one minor bone to pick with this feature, in that I often want to simply append something to a file name, such as _original or _old or just _1. My instinct is to select the file, press F2 (which selects the filename ready to edit) then press the right cursor to drop off the selection and land to the right of it (which is what would happen in most applications when something like a word or partial word is selected). Unfortunately it takes the cursor key too literally and moves one character over – to the other side of the ‘.’ and into the file extension part. So I have to then left arrow to get where I want to be. I hope this quirk of explorer is fixed to make life easy for us old-school keyboard pilots (or anyone who has given up using a pointing device on public transport).

A fourth improvement to explorer is that when I copy and paste a file in the same folder it gets renamed “Foo – copy” instead of the old XP form “Copy of foo” which took it out of the original filename order. This was particularly frustrating when dealing with big folders of digital photos, I would often copy an image in order to edit it without changing the original but I would have to scroll back up to find it, then rename it so I could see it next to the original so I could see which ones I had done. The new way makes far more sense to me. One frustration is that this behaviour only seems to be exposed through the Explorer GUI itself (the “file manager” bit if you see what I mean), so other applications may still use the old method. Notably, Picture Manager 2007 still has the old-style behaviour, which is pretty annoying. I guess this is because of the lack of cohesion between the different coding teams on Windows and Office – partly due to practicality of any communication between such huge teams, and partly down to the numerous lawsuits which pretty much require MS to work in Chinese Cubicles.

 Lastly for today, a tool which I first saw on the EVO tour in Leeds last November, demonstrated by James (or was it James?). Recently I have seen several people blog about it on the basis that it’s a great feature and no-one knows about it, meanwhile I’ve just been getting on and using it quietly, not realising how elite I was! So what is it? The snipping tool is used to take screenshots and is found under All Programs > Accessories (or of course just start typing “Sni…” in the Start Search box and it will find it). I find it really frustrating when people cannot remember (or have never been told) how to use Alt-PrtScr to grab a snaphot of the window which had focus and instead send an email or post a forum question with an entire desktop image for the sake of a one line error dialogue (made with just PrintScreen on its own). The snipping tool should help as it makes this much easier through a drop down menu (on the “New” button shown in the shot below) to choose a whole screen, one window, a rectangular section or a freeform shape. A window is really easy to select – when you hover over an open window it gets a red outline, you click anywhere in that window to grab it.

The freeform can be fun or just quick and arbitrary, or allow you to deliberately miss some important part of the screen out. To be honest, it’s the one which always gets used at demos, gets an “ooo” from the audience but is probably the least used in everyday work. Personally I’m a rectangles kind of guy - as Monica says on Friends, “if it’s not a right angle, it’s a wrong angle”. The Vista snipping tool has some other nice features like the pen, highlighter and eraser functions. The eraser only erases pen or highlighter items, not the underlying image, that you can remove by drawing over it with a broad pen (in white for example).

All of these are so much easier to use with a “real” mouse than a laptop touchpad, I am surprised they did not include a block drawing tool (more rectangles!) to make it easy to black out things like usernames, IP addresses or URLs to remove information you don’t want to share. Or if you just really don’t like Mondays.

Once snipped and edited, you can copy images to the clipboard using the usual Ctrl-C, save to a file or send on an email. If you close without saving you are even prompted to do so, and have several choices of formats – good ol’ windows bitmap (BMP) not being one of them as we move into the 21st century.

5 more great features coming to an article near you soon…