Visit us at w w w. s y n g r e s s . c o m Syngress is committed to publishing high-quality books for IT Professionals and delivering those books in media and formats that fit the demands of our customers. We are also committed to extending the utility of the book you purchase via additional materials available from our Web site.
SOLUTIONS WEB SITE To register your book, visit www.syngress.com/solutions. Once registered, you can access our
[email protected] Web pages. There you may find an assortment of valueadded features such as free e-books related to the topic of this book, URLs of related Web sites, FAQs from the book, corrections, and any updates from the author(s).
ULTIMATE CDs Our Ultimate CD product line offers our readers budget-conscious compilations of some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to extend your reference library on key topics pertaining to your area of expertise, including Cisco Engineering, Microsoft Windows System Administration, CyberCrime Investigation, Open Source Security, and Firewall Configuration, to name a few.
DOWNLOADABLE E-BOOKS For readers who can’t wait for hard copy, we offer most of our titles in downloadable Adobe PDF form. These e-books are often available weeks before hard copies, and are priced affordably.
SYNGRESS OUTLET Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt books at significant savings.
SITE LICENSING Syngress has a well-established program for site licensing our e-books onto servers in corporations, educational institutions, and large organizations. Contact us at
[email protected] for more information.
CUSTOM PUBLISHING Many organizations welcome the ability to combine parts of multiple Syngress books, as well as their own content, into a single volume for their own internal use. Contact us at
[email protected] for more information.use. Contact us at
[email protected] for more information.
This page is intentionally left blank
Tony Piltzecker
Technical Editor
Jesse Varsalone Robert J. Shimonski Kelly Brown Jan Kanclirz Ron Barrett Mitch Garvis
Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media® and Syngress® are registered trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY 001 002 003 004 005 006 007 008 009 010
SERIAL NUMBER HJIRTCV764 PO9873D5FG 829KM8NJH2 BPOQ48722D CVPLQ6WQ23 VBP965T5T5 HJJJ863WD3E 2987GVTWMK 629MP5SDJT IMWQ295T6T
PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 The Real MCTS/MCITP Exam 70-620 Prep Kit
Copyright © 2008 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN 13: 978-1-59749-233-1 Publisher: Andrew Williams Acquisitions Editor: David George Technical Editor: Tony Piltzecker Project Manager: Gary Byrne Cover Designer: Michael Kavish
Page Layout and Art: SPI Copy Editors: Audrey Doyle, Michelle Huegel, Mike McGee, Adrienne Rebello Indexer: SPI
For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and Rights, at Syngress Publishing; email
[email protected].
Technical Editor Tony Piltzecker (CISSP, MCSE, CCNA, CCVP, Check Point CCSA, Citrix CCA), author and technical editor of Syngress Publishing’s MCSE Exam 70-296 Study Guide and DVD Training System and How to Cheat at Managing Microsoft Operations Manager 2005, is an independent consultant based in Boston, MA.Tony’s specialties include network security design, Microsoft operating system and applications architecture, and Cisco IP Telephony implementations.Tony’s background includes positions as Systems Practice Manager for Presidio Networked Solutions, IT Manager for SynQor Inc., Network Architect for Planning Systems, Inc., and Senior Networking Consultant with Integrated Information Systems. Along with his various certifications,Tony holds a bachelor’s degree in business administration.Tony currently resides in Leominster, MA, with his wife, Melanie, and his daughters, Kaitlyn and Noelle.
v
Contributing Authors Ron Barrett (MCP, CCNA, Citrix CCA) is a technology professional/ author specializing in network infrastructure and emerging technologies. For the past nine years he has worked in various capacities for several major financial firms and dot-coms. Ron has also worked as a technical author the last seven years while holding the post of IT director for a financial services firm in Manhattan, NY. He also has been a member of CPAmerica for the past four years, holding the posts of vice-chairman and chairman of the Technology Executive Committee. Now turning his attention full-time to writing and technical education, he is currently developing training clips for ClipTraning.com. Ron is the coauthor of the newly released Administrator’s Guide to Microsoft Office Servers 2007 (Sams, 2007). “I would like to thank my wife, Alicia, and my children, Ronald and Emma, for all their support and patience.” Kelly Brown is a CTT+ certified Senior Computer Forensic Professional at Computer Science Corporation with over 9 years’ experience in the information technology field. Mr. Brown is an Instructor and Curriculum Developer at CSC and holds a Bachelor of Science Degree in Computer Networking. Prior to teaching, Mr. Brown worked as an information security professional employed by IBM in the Security, Privacy, and Wireless Division Federal Sector conducting network and database audits, reporting information assurance and compliance activities, and conducting annual security awareness training. Mr. Brown has extensive field experience as a Senior Systems Engineer responsible for the successful development, implementation, and administration of numerous companies’ networks in the private sector. Jan Kanclirz Jr. (CCIE #12136 - Security, CCSP, CCNP, CCIP, CCNA, CCDA, INFOSEC Professional, Cisco WLAN Support/ Design Specialist) is currently a senior network consulting architect at MSN Communications out of Colorado. vi
Jan specializes in multivendor designs and post-sale implementations for several technologies such as VPNs, IDS/IPS, LAN/WAN, firewalls, client security, content networking, and wireless. In addition to network design and engineering, Jan’s background includes extensive experience with open source applications and operating systems such as Linux and Windows. Jan has contributed to the following Syngress book titles either as a technical editor or author: Managing and Securing Cisco SWAN, Practical VoIP Security, How to Cheat at Securing a Wireless Network, Microsoft Vista for IT Security Professionals, and How to Cheat at Microsoft Vista Administration. In addition to his full-time position at MSN Communications, Jan runs a security portal, www.MakeSecure.com, where he dedicates his time to security awareness and consulting. Jan lives in Colorado, where he enjoys outdoor adventures such as hiking Colorado’s 14ner peaks. Robert J. Shimonski (MCSE, etc) is an entrepreneur, a technology consultant, and a published author with over 20 years of experience in business and technology. Robert’s specialties include designing, deploying, and managing networks, systems, virtualization, storage-based technologies, and security analysis. Robert also has many years of diverse experience deploying and engineering mainframes and Linux- and Unix-based systems such as Red Hat and Sun Solaris. Robert has indepth work-related experience with and deep practical knowledge of globally deployed Microsoft- and Cisco-based systems and stays current on the latest industry trends. Robert consults with business clients to help forge their designs, as well as to optimize their networks and keep them highly available, secure, and disaster free. Robert is the author of many information technology-related articles and published books, including the best-selling Sniffer Network Optimization and Troubleshooting Handbook, Syngress (ISBN: 1931836574). Robert is also the author of other best-selling titles, such as Security+ Study Guide and DVD Training System (ISBN: 1931836728), Network+ Study Guide & Practice Exams: Exam N10-003 (ISBN: 1931836426), and Building DMZs for Enterprise Networks (ISBN: 1931836884) also from Syngress. Rob’s current book offerings include the newly published Vista for IT Security Professionals, Syngress (978-1-59749-139-6), as well as vii
being a series editor on the new Windows Server 2008 MCITP series from Syngress publishing. Robert can be found online at www.shimonski.com. Jesse Varsalone (A+, Linux+, Net+, iNet+, Security+, Server+, CTT+, CIW Professional, CWNA, CWSP, MCT, MCSA, MSCE 2000/2003, MCSA/MCSE Security, MCSD, MCDBA, MCSD, CNA, CCNA, MCDST, Oracle 8i/9i DBA, Certified Ethical Hacker) is a Computer Forensic Senior Professional at CSC. For four years, he served as the Director of the MCSE and Network Security Program at the Computer Career Institute at Johns Hopkins University. For the 2006 Academic year, he served as an Assistant Professor of Computer Information Systems at Villa Julie College in Baltimore, Maryland. He taught courses in networking, Active Directory, Exchange, Cisco, and forensics. Jesse’s previous publications include Microsoft Forefront Security Administration Guide by Syngress Publishing. Jesse holds a bachelor’s degree from George Mason University and a master’s degree from the University of South Florida. He currently lives in Columbia, Maryland, with his wife, Kim, and son, Mason.
viii
Contents Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Chapter 1 Microsoft Vista: An Overview . . . . . . . . . . . . . . . . . . . . . . . . . 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 New Look/Feel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 User Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 IPv6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Wireless Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Windows Imaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Improved Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Complete PC Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 BitLocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 PatchGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Security Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Digital Rights Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . 50 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Chapter 2 Installing Windows Vista . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preparing a New PC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Comparing Editions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Bit vs. 64 Bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing Windows Vista . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Partitioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Post-Install Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
57 58 58 59 62 64 66 67 77 85 88 ix
x
Contents
Upgrading to Windows Vista Business Edition . . . . . . . . . . . . . . . . . . . . . . 91 Assessing Your Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Using Upgrade Advisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102 Backing Up Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 The User State Migration Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 Upgrading from Windows XP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112 Troubleshooting Installation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Addressing Hardware Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Addressing Application Incompatibility . . . . . . . . . . . . . . . . . . . . . . . .121 Addressing Licensing Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123 Other Troubleshooting Tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .127 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131 Chapter 3 Configuring Windows Vista . . . . . . . . . . . . . . . . . . . . . . . . 133 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134 Configuring Windows Aero . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134 Working with Parental Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .141 Configuring Parental Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144 Web Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145 Which Part of the Internet Can the User Visit . . . . . . . . . . . . . . .146 Allow and Block Specific Web Sites . . . . . . . . . . . . . . . . . . . . . .147 Block Web Content Automatically . . . . . . . . . . . . . . . . . . . . . . .149 Time Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152 Game Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154 Program Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161 Activity Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163 Configuring Internet Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166 Home Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171 Pop-up Blocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173 Privacy Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 Local Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175 Configuring Network Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 Using the Network and Sharing Center . . . . . . . . . . . . . . . . . . . . . . .180 Managing Wired Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . .186 Managing Wireless Connections . . . . . . . . . . . . . . . . . . . . . . . . . . .186
Contents
IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191 IP v6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192 Troubleshooting Network Connectivity . . . . . . . . . . . . . . . . . . . . . . .194 Using Network Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194 Other Troubleshooting Methods . . . . . . . . . . . . . . . . . . . . . . . . . . .195 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .199 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203 Chapter 4 Configuring the Vista Security Features . . . . . . . . . . . . . . 205 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206 User Account Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .207 Understanding User Account Control . . . . . . . . . . . . . . . . . . . . . . . . .209 Configuring User Account Control . . . . . . . . . . . . . . . . . . . . . . . . . . .210 Disabling User Account Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . .218 Configuring the Security Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221 Windows Defender. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227 Windows Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .236 The Windows Firewall with Advanced Security . . . . . . . . . . . . . . . .238 Windows Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .244 Using Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247 Configuring BitLocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .250 BitLocker Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .255 Enabling BitLocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .259 Configuring Local Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264 Configuring the Encrypted File System . . . . . . . . . . . . . . . . . . . . . . . . . .265 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .269 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .270 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .272 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .273 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .276 Chapter 5 Microsoft Vista: Windows Mail . . . . . . . . . . . . . . . . . . . . . . 277 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278 Comparing Windows Mail with Outlook Express . . . . . . . . . . . . . . . . . . .278 Database Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .280 Loss Prevention and Identities. . . . . . . . . . . . . . . . . . . . . . . . . . . . .283 Secure Out of the Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288
xi
xii
Contents
Phishing Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .297 Scanning from the Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .297 Working with Filtered Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299 Program Improvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .302 Junk Mail Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .305 SmartScreen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .305 Configuring Junk E-mail Options . . . . . . . . . . . . . . . . . . . . . . . . .306 Working with Junk Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .312 Instant Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314 Basic Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314 Searching from within Instant Mail . . . . . . . . . . . . . . . . . . . . . . . . .317 Searching for Messages outside of Windows Mail . . . . . . . . . . . .319 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .325 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .327 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .331 Chapter 6 Configuring Windows Applications . . . . . . . . . . . . . . . . . . 333 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .334 Configuring Windows Sidebar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .336 Configuring Sidebar Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340 Gadgets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .344 Adding New Gadgets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .347 Adding a New Gadget . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357 The Live.com Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358 Using Other Sidebars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .359 Apple’s Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .359 Yahoo! Widgets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .361 Google Desktop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .362 Configuring Windows Calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369 Basic Windows Calendar Options . . . . . . . . . . . . . . . . . . . . . . . . . .370 Deploying Windows Calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375 Sharing Calendars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381 Publishing Calendars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .382 Importing and Exporting Windows Calendar Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .386 Configuring Windows Meeting Space . . . . . . . . . . . . . . . . . . . . . . . . . . . .387 Using Meeting Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390 Preparing Windows for Meeting Space . . . . . . . . . . . . . . . . . . . . . .390
Contents
Configuring Windows Fax and Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . .401 Configuring Fax Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .405 Configuring Fax Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . .408 Configuring Scanning Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .411 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .414 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .416 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .423 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .427 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .432 Chapter 7 Windows Vista Mobility . . . . . . . . . . . . . . . . . . . . . . . . . . . 433 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .434 Working with Mobility Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .435 Brightness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .436 Volume . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .438 Battery Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .439 Working with Power Plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .440 Changing Standard Power Plan Settings . . . . . . . . . . . . . . . . . . . . . . . .441 Power Buttons and Password Protection on Wakeup . . . . . . . . . . . . . . .443 Creating a Custom Power Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445 Wireless Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445 Setting Up an Ad Hoc Wireless Network. . . . . . . . . . . . . . . . . . . . . . .446 Improved Ad Hoc Networking Security . . . . . . . . . . . . . . . . . . . . . . .450 External Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .451 Sync Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .451 Presentation Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .452 Configuring Mobile Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .452 Creating a Mobile Device Partnership . . . . . . . . . . . . . . . . . . . . . . . . .452 Mobile Device Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .454 Connection Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .454 End a Partnership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .455 Main Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .455 Programs and Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .456 Add/Remove Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .457 Pictures, Music, and Video . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .457 Pictures/Video Clips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .457 Pictures/Video Import Settings . . . . . . . . . . . . . . . . . . . . . . . . .457 Add Media to Your Device from Windows Media Player . . . . . . .458 File Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458 Mobile Device Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .459
xiii
xiv
Contents
Installing and Using Mobile Device Center . . . . . . . . . . . . . . . . . . . . .460 Configuring Tablet PCs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .460 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .461 Handwriting Recognition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462 Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .463 Other . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .463 Tablet Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .464 Troubleshooting Mobility Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465 Common Mobility Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .466 Working with Logs and Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 Opening the Event Viewer Console. . . . . . . . . . . . . . . . . . . . . . . . . . .469 Event Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472 Using Custom View Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .474 Diagnosing and Repairing Network Connection . . . . . . . . . . . . . . . . .474 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .477 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .477 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .479 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .480 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .483 Chapter 8 Troubleshooting Windows Vista . . . . . . . . . . . . . . . . . . . . . 485 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486 Troubleshooting Media Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486 Windows Media Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .487 Audio Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .487 Media Extenders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .488 Recording TV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .490 Media Player . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .491 Troubleshooting Performance Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . .494 Manage Startup Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .496 Adjust Visual Effects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .496 Adjust Indexing Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .498 Adjust Power Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .498 Open Disk Cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .499 Advanced Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .499 Configuring Ready Boost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .499 Other Performance Issue Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .500 Using Diagnostic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .501 Advanced Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .501 Generating a System Health Report . . . . . . . . . . . . . . . . . . . . . . . .501
Contents
Reliability and Performance Monitor . . . . . . . . . . . . . . . . . . . . . . .502 Event Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .504 Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505 Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506 Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508 Other Built-in Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508 Memory Diagnostic Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508 Problem Reports and Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . .508 Summary of Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .511 Exam Objectives Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512 Exam Objectives Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . .514 Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516 Self Test Quick Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .520 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521 Chapter 1: Microsoft Vista: An Overview . . . . . . . . . . . . . . . . . . . . . . . . . .522 Chapter 2: Installing Windows Vista . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .526 Chapter 3: Configuring Windows Vista . . . . . . . . . . . . . . . . . . . . . . . . . . .530 Chapter 4: Configuring the Vista Security Features . . . . . . . . . . . . . . . . . .535 Chapter 5: Microsoft Vista: Windows Mail . . . . . . . . . . . . . . . . . . . . . . . . .540 Chapter 6: Configuring Windows Applications . . . . . . . . . . . . . . . . . . . . .545 Chapter 7: Windows Vista Mobility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .554 Chapter 8: Troubleshooting Windows Vista . . . . . . . . . . . . . . . . . . . . . . . .560 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
xv
This page is intentionally left blank
Foreword
This book’s primary goal is to help you prepare to take and pass Microsoft’s exam number 70-620, Configuring Microsoft Windows Vista Client. Our secondary purpose in writing this book is to provide exam candidates with knowledge and skills that go beyond the minimum requirements for passing the exam, and help to prepare them to work in the real world of Microsoft computer operating systems.
What Is MCTS Exam 70-620? Microsoft Certified Technology Specialist (MCTS) Exam 70-620 is both a standalone test for those wishing to master Windows Vista client configuration and a requirement for those pursuing certification as a Microsoft Certified Information Technology Professional (MCITP) for Windows Server 2008 or as a Customer or Enterprise Support Technician. Microsoft’s stated target audience consists of IT professionals with at least one year of work experience with Tier 1 or Tier 2 customer support in a variety of environments, including medium-sized or large companies. However, not everyone who takes Exam 70-620 will have this ideal background. Many people will take this exam after classroom instruction or self-study as an entry into the networking field. Many of those who do have job experience in IT will not have had the opportunity to work with all of the technologies covered by the exam. In this book, our goal is to provide background information that will help you to understand the concepts and procedures described even if you don’t have the requisite experience, while keeping our focus on the exam objectives. xvii
xviii Foreword
Exam 70-620 covers the basics of installing, configuring, maintaining, and troubleshooting Windows Vista Client, including security, connectivity, mobility, and Vista applications. The book includes the following task-oriented objectives: ■
Installing and Upgrading Windows Vista This includes identifying hardware requirements, performing clean installations, upgrading to Vista from previous Windows versions, upgrading from one edition of Windows Vista to another edition, troubleshooting installation issues, and installing and configuring Vista drivers.
■
Configuring and Troubleshooting Post-Installation System Settings This includes troubleshooting post-installation configuration issues, configuring and troubleshooting Windows Aero, configuring and troubleshooting parental controls, and configuring Internet Explorer.
■
Configuring Windows Security Features This includes configuring and troubleshooting user account control, configuring Windows Defender, configuring Dynamic Security for IE7, and configuring security settings in Windows Firewall.
■
Configuring Network Connectivity This includes configuring networking using the Network and Sharing Center, troubleshooting connectivity issues, and configuring Remote Access.
■
Configuring Applications Included with Windows Vista This includes configuring and troubleshooting media applications, configuring Windows Mail, configuring Windows Meeting Space, configuring Windows Calendar, configuring Windows Fax and Scan, and configuring Windows Sidebar.
■
Maintaining and Optimizing Systems That Run Windows Vista This includes troubleshooting performance issues, troubleshooting reliability issues using built-in diagnostic tools, configuring Windows Update, and configuring Data Protection.
■
Configuring and Troubleshooting Mobile Computing This includes configuring Mobile Display Settings, configuring Mobile Devices, configuring Tablet PC software, and configuring Power Options.
www.syngress.com
Foreword
xix
Path to MCTS/MCITP/ MS Certified Architect Microsoft certification is recognized throughout the IT industry as a way to demonstrate mastery of basic concepts and skills required to perform the tasks involved in implementing and maintaining Windows-based networks. The certification program is constantly evaluated and improved, and the nature of information technology is changing rapidly. Consequently, requirements and specifications for certification can also change rapidly. This book is based on the exam objectives as stated by Microsoft at the time of writing; however, Microsoft reserves the right to make changes to the objectives and to the exam itself at any time. Exam candidates should regularly visit the Certification and Training Web site at www.microsoft.com/learning/mcp/ default.mspx for the most updated information on each Microsoft exam. Microsoft currently offers three basic levels of certification on the technology level, professional level, and architect level: ■
Technology Series This level of certification is the most basic, and it includes the Microsoft Certified Technology Specialist (MCTS) certification. The MCTS certification is focused on one particular Microsoft technology. There are 19 MCTS exams at the time of this writing. Each MCTS certification consists of one to three exams, does not include job-role skills, and will be retired when the technology is retired. Microsoft Certified Technology Specialists will be proficient in implementing, building, troubleshooting, and debugging a specific Microsoft technology.
■
Professional Series This is the second level of Microsoft certification, and it includes the Microsoft Certified Information Technology Professional (MCITP) and Microsoft Certified Professional Developer (MCPD) certifications. These certifications consist of one to three exams, have prerequisites from the Technology Series, focus on a specific job role, and require an exam refresh to remain current. The MCITP certification offers nine separate tracks as of the time of this writing. There are two Windows Server 2008 tracks, Server Administrator and Enterprise Administrator. To achieve the Server Administrator MCITP for Windows Server 2008, you must successfully complete one Technology Series exam and one Professional Series exam.
www.syngress.com
xx
Foreword
To achieve the Enterprise Administrator MCITP for Windows Server 2008, you must successfully complete four Technology Series exams and one Professional Series exam. ■
Architect Series This is the highest level of Microsoft certification, and it requires the candidate to have at least 10 years’ industry experience. Candidates must pass a rigorous review by a review board of existing architects, and they must work with an architect mentor for a period of time before taking the exam.
NOTE Those who already hold the MCSA or MCSE in Windows 2003 can upgrade their certifications to MCITP Server Administrator by passing one upgrade exam and one Professional Series exam. Those who already hold the MCSA or MCSE in Windows 2003 can upgrade their certifications to MCITP Enterprise Administrator by passing one upgrade exam, two Technology Series exams, and one Professional Series exam.
Prerequisites and Preparation There are no mandatory prerequisites for taking Exam 70-620, although Microsoft recommends that you meet the target audience profile described earlier. Preparation for this exam should include the following: ■
Visit the Web site at www.microsoft.com/learning/exams/70-620.mspx to review the updated exam objectives.
■
Work your way through this book, studying the material thoroughly and marking any items you don’t understand.
■
Answer all practice exam questions at the end of each chapter.
■
Complete all hands-on exercises in each chapter.
■
Review any topics that you don’t thoroughly understand.
■
Consult Microsoft online resources such as TechNet (www.microsoft. com/technet/), white papers on the Microsoft Web site, and so forth, for better understanding of difficult topics.
www.syngress.com
Foreword ■
Participate in Microsoft’s product-specific and training and certification newsgroups if you have specific questions that you still need answered.
■
Take one or more practice exams, such as the one included on the Syngress/Elsevier certification Web site at www.syngress.com/certification.
xxi
Exam Day Experience Taking the exam is a relatively straightforward process. Prometric testing centers administer the Microsoft 70-620 exam.You can register for, reschedule or cancel an exam through the Prometric Web site at www.register.prometric.com.You’ll find listings of testing center locations on these sites. Accommodations are made for those with disabilities; contact the individual testing center for more information. Exam price varies depending on the country in which you take the exam.
Exam Format Exams are timed. At the end of the exam, you will find out your score and whether you passed or failed. You will not be allowed to take any notes or other written materials with you into the exam room. You will be provided with a pencil and paper, however, for making notes during the exam or doing calculations. In addition to the traditional multiple-choice questions and the select and drag, simulation, and case study questions, you might see some or all of the following types of questions: ■
Hot area questions, in which you are asked to select an element or elements in a graphic to indicate the correct answer.You click an element to select or deselect it.
■
Active screen questions, in which you change elements in a dialog box (for example, by dragging the appropriate text element into a text box or selecting an option button or checkbox in a dialog box).
■
Drag and drop questions, in which you arrange various elements in a target area.
Test-Taking Tips Different people work best using different methods. However, there are some common methods of preparation and approach to the exam that are helpful to many test-takers.
www.syngress.com
xxii
Foreword
In this section, we provide some tips that other exam candidates have found useful in preparing for and actually taking the exam. ■
Exam preparation begins before exam day. Ensure that you know the concepts and terms well and feel confident about each of the exam objectives. Many test-takers find it helpful to make flash cards or review notes to study on the way to the testing center. A sheet listing acronyms and abbreviations can be helpful, as the number of acronyms (and the similarity of different acronyms) when studying IT topics can be overwhelming. The process of writing the material down, rather than just reading it, will help to reinforce your knowledge.
■
Many test-takers find it especially helpful to take practice exams that are available on the Internet and with books such as this one. Taking the practice exams can help you become used to the computerized examtaking experience, and the practice exams can also be used as a learning tool. The best practice tests include detailed explanations of why the correct answer is correct and why the incorrect answers are wrong.
■
When preparing and studying, you should try to identify the main points of each objective section. Set aside enough time to focus on the material and lodge it into your memory. On the day of the exam, you should be at the point where you don’t have to learn any new facts or concepts, but need simply to review the information already learned.
■
The value of hands-on experience cannot be stressed enough. Exam questions are based on test-writers’ experiences in the field. Working with the products on a regular basis—whether in your job environment or in a test network that you’ve set up at home—will make you much more comfortable with these questions.
■
Know your own learning style and use study methods that take advantage of it. If you’re primarily a visual learner, reading, making diagrams, watching video files on CD, etc., may be your best study methods. If you’re primarily auditory, classroom lectures, audiotapes you can play in the car as you drive, and repeating key concepts to yourself aloud may be more effective. If you’re a kinesthetic learner, you’ll need to actually do the exercises, implement the security measures on your own systems, and otherwise perform hands-on tasks to best absorb the information.
www.syngress.com
Foreword xxiii
Most of us can learn from all of these methods, but have a primary style that works best for us. ■
Although it may seem obvious, many exam-takers ignore the physical aspects of exam preparation. You are likely to score better if you’ve had sufficient sleep the night before the exam and if you are not hungry, thirsty, hot/cold or otherwise distracted by physical discomfort. Eat prior to going to the testing center (but don’t indulge in a huge meal that will leave you uncomfortable), stay away from alcohol for 24 hours prior to the test, and dress appropriately for the temperature in the testing center (if you don’t know how hot/cold the testing environment tends to be, you may want to wear light clothes with a sweater or jacket that can be taken off ).
■
Before you go to the testing center to take the exam, be sure to allow time to arrive on time, take care of any physical needs, and step back to take a deep breath and relax. Try to arrive slightly early, but not so far in advance that you spend a lot of time worrying and getting nervous about the testing process. You may want to do a quick last-minute review of notes, but don’t try to “cram” everything the morning of the exam. Many test-takers find it helpful to take a short walk or do a few calisthenics shortly before the exam to get oxygen flowing to the brain.
■
Before beginning to answer questions, use the pencil and paper provided to you to write down terms, concepts, and other items that you think you may have difficulty remembering as the exam goes on. Then you can refer back to these notes as you progress through the test. You won’t have to worry about forgetting the concepts and terms you have trouble with later in the exam.
■
Sometimes the information in a question will remind you of another concept or term that you might need in a later question. Use your pen and paper to make note of this in case it comes up later on the exam.
■
It is often easier to discern the answer to scenario questions if you can visualize the situation. Use your pen and paper to draw a diagram of the network that is described to help you see the relationships between devices, IP addressing schemes, and so forth.
www.syngress.com
xxiv Foreword ■
When appropriate, review the answers you weren’t sure of. However, you should change your answer only if you’re sure that your original answer was incorrect. Experience has shown that more often than not, when test-takers start second-guessing their answers, they end up changing correct answers to the incorrect. Don’t “read into” the question (that is, don’t fill in or assume information that isn’t there); this is a frequent cause of incorrect responses.
■
As you go through this book, pay special attention to the Exam Warnings, as these highlight concepts that are likely to be tested. You may find it useful to go through and copy these into a notebook (remembering that writing something down reinforces your ability to remember it) and/or go through and review the Exam Warnings in each chapter just prior to taking the exam.
■
Use as many little mnemonic tricks as possible to help you remember facts and concepts. For example, to remember which of the two IPsec protocols (AH and ESP) encrypts data for confidentiality, you can associate the “E” in encryption with the “E” in ESP.
Pedagogical Elements In this book, you’ll find a number of different types of sidebars and other elements designed to supplement the main text. These include the following: ■
Exam Warning These sidebars focus on specific elements on which the reader needs to focus in order to pass the exam (for example, “Be sure you know the difference between symmetric and asymmetric encryption”).
■
Test Day Tip These sidebars are short tips that will help you in organizing and remembering information for the exam (for example, “When preparing for the exam on test day, it may be helpful to have a sheet with definitions of these abbreviations and acronyms handy for a quick last-minute review”).
www.syngress.com
Foreword ■
Configuring & Implementing These sidebars contain background information that goes beyond what you need to know from the exam, but provide a “deep” foundation for understanding the concepts discussed in the text.
■
New & Noteworthy These sidebars point out changes in Windows Server 2008 from Windows Server 2003, as they will apply to readers taking the exam. These may be elements that users of Windows Server 2003 would be very familiar with that have changed significantly in Windows Server 2008 or totally new features that they would not be familiar with at all.
■
Head of the Class These sidebars are discussions of concepts and facts as they might be presented in the classroom, regarding issues and questions that most commonly are raised by students during study of a particular topic.
xxv
Each chapter of the book also includes hands-on exercises in planning and configuring the features discussed. It is essential that you read through and, if possible, perform the steps of these exercises to familiarize yourself with the processes they cover. You will find a number of helpful elements at the end of each chapter. For example, each chapter contains a Summary of Exam Objectives that ties the topics discussed in that chapter to the published objectives. Each chapter also contains an Exam Objectives Fast Track, which boils all exam objectives down to manageable summaries that are perfect for last-minute review. The Exam Objectives Frequently Asked Questions section answers those questions that most often arise from readers and students regarding the topics covered in the chapter. Finally, in the Self Test section, you will find a set of practice questions written in a multiple-choice format that will assist you in your exam preparation These questions are designed to assess your mastery of the exam objectives and provide thorough remediation, as opposed to simulating the variety of question formats you may encounter in the actual exam.You can use the Self Test Quick Answer Key that follows the Self Test questions to quickly determine what information you need to review again. The Self Test Appendix at the end of the book provides detailed explanations of both the correct and incorrect answers.
www.syngress.com
xxvi Foreword
Additional Resources There are two other important exam preparation tools included with this study guide. One is the CD included in the back of this book. The other is the concept review test available from our Web site. ■
A CD that provides book content in multiple electronic formats for exam-day review Review major concepts, test day tips, and exam warnings in PDF, PPT, MP3, and HTML formats. Here, you’ll cut through all of the noise to prepare you for exactly what to expect when you take the exam for the first time. You will want to use this CD just before you head out to the testing center!
■
Web-based practice exams Just visit us at www.syngress.com/ certification to access a complete Windows Vista Client concept multiple-choice review. These remediation tools are written to test you on all of the published certification objectives. The exam runs in both “live” and “practice” mode. Use “live” mode first to get an accurate gauge of your knowledge and skills, and then use practice mode to launch an extensive review of the questions that gave you trouble.
www.syngress.com
Chapter 1
MCTS/MCITP Exam 620 Microsoft Vista: An Overview Exam objectives in this chapter: ■
User Interface
■
Networking
■
Windows Imaging
■
Security
■
Search
Exam objectives review: ˛ Summary of Exam Objectives ˛ Exam Objectives Fast Track ˛ Exam Objectives Frequently Asked Questions ˛ Self Test ˛ Self Test Quick Answer Key 1
2
Chapter 1 • Microsoft Vista: An Overview
Introduction This chapter will introduce the primary features found in Microsoft Windows Vista, the latest Microsoft desktop operating system. Microsoft released Vista to the general public in early 2007, and today you can find it in many different systems and configurations, including laptops, desktops, tablets, and multimedia systems, among others. Vista is Microsoft’s first major complete operating system redesign since Windows 95. Many components and features have been completely engineered from the ground up to work only with Vista. Although Microsoft isn’t known for its industry-leading innovations, it is very adept at monitoring the industry and identifying which technologies the IT community is accepting. Then it will either purchase companies for their technologies or engineer competing technologies into its base operating systems. You can find evidence of this throughout Vista. In the past, Microsoft engineered operating systems that would allow vendors to easily create their own software that would function on several versions of the OS. This practice had many benefits as well as many drawbacks. For instance, it was beneficial in terms of compatibility, but a limitation in terms of security and reliability. As previously stated, Vista is an entirely new product. Therefore, vendors and software manufacturers will have to create new software that is capable of running on Vista. This completely new branch of operating system has allowed Microsoft to implement many needed features and security additions from the start.
User Interface The user interface, also known as the UI or GUI, is the first obvious change the user will notice about Vista compared to other Windows versions. Microsoft has added many new features and enhanced existing ones to help you maneuver around the system and become more productive. Microsoft offers five different versions of Vista to U.S. customers to meet the demands of different types of users: Home Basic, Home Premium, Business, Enterprise, and Ultimate. To give users the most out of Vista visually, Microsoft has published the following recommended hardware requirements. Systems that do not
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
meet these requirements can still run Vista, but the visual experience will be reduced. Recommendations are lower for the Home Basic version because it doesn’t have the same visual options available as the other versions. ■
1 GHz 32-bit (x86) or 64-bit (x64) processor
■
1 GB of system memory
■
40 GB hard drive with at least 15 GB of available space
■
Support for DirectX 9 graphics with: ■
WDDM driver
■
128 MB of graphics memory (minimum)
■
Pixel Shader 2.0 in hardware
■
32 bits per pixel
■
DVD-ROM drive
■
Audio output
■
Internet access
Microsoft has also improved Windows Explorer to provide Vista users with many more options and features for navigating the system. For instance, you can select any of the folders in a path to quickly navigate to other folders (as shown in Figure 1.1).
TEST DAY TIP Pencil and paper are provided during all exams. Before starting the exam, it can be beneficial to write notes about the topics with which you may be having more trouble. Study those areas before entering the test facility, jot down your notes on the paper provided, and then begin the test. This will allow you to concentrate on the current question without worrying about remembering those tougher, more technical details.
www.syngress.com
3
4
Chapter 1 • Microsoft Vista: An Overview
Figure 1.1 Navigating with Windows Explorer
Windows Explorer also can dynamically change available options depending on the type of template associated with a folder. For instance, a folder configured with the Pictures and Videos template will provide different options than a folder configured with the Music Icons template. Vista does this via automatic folder type discovery. Vista will attempt to detect what is the best folder type for the files types that are contained within the folder.
Head of the Class… Automatic Folder Discovery in Vista Although Vista’s automatic folder discovery feature can be an additional benefit to users, sometimes it may not detect the folder type the user wants. Continued
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
For instance, sometimes when a user sets his desired folder type, Vista will automatically attempt another discovery on the folder at a later time, and will reset the folder. You can disable automatic folder discovery to prevent this from happening, but you must edit the Registry to do so. Always use caution when editing the Registry because it’s possible to render the system useless. It’s always important to remember that, when in a domain environment, any of these types of settings can be pushed down to the workstation from the domain controllers (DCs). Many administrators will set up policies to handle different types of tasks and configurations that need to be applied to the workstation. Setting up these policies can seem like an advanced task to newer administrators, but many of the domain policy configurations are only Registry settings that have been pushed down to the workstation.
EXERCISE 1.1 APPLYING
A
TEMPLATE
TO A
NEW FOLDER
This exercise will walk you through applying a Music Details template to a new folder. This allows you to create a music folder anywhere on the system, and can be used to enhance performance on systems with multiple hard drives. This exercise will assume you have a secondary hard drive installed and configured as the D: drive. 1. Open Windows Explorer and navigate to the D: drive. 2. Click Organize | New Folder. 3. Provide the new folder with a folder name—for example, New Music. 4. Highlight the new folder and click Organize | Properties. 5. Click the Customize tab. 6. From the drop-down menu under “What kind of folder do you want?” select Music Details. 7. Click OK to apply the setting and close the properties windows.
New Look/Feel The user interface can utilize two different modes depending on the user’s hardware specs: Windows Vista Aero or Windows Vista Basic. Vista will attempt to configure www.syngress.com
5
6
Chapter 1 • Microsoft Vista: An Overview
the Aero Glass effects if the hardware meets the requirements. If the hardware does not meet the minimum required specs to run the Aero Glass effects, Vista will automatically scale back its visual effects to give the user the best visual experience possible for the hardware. This ability to scale back allows all users to receive the best user interface possible for their current hardware. The main feature in Vista’s new look is its transparency. Items behind the windows will show through the outer edges of the windows. Figure 1.2 shows the Window Color and Appearance window. You can easily change these options to meet your preference for visual effects.
Figure 1.2 Vista’s Color and Transparency Options
Windows Vista Aero is the new high-end theme for Windows Vista, and is the default theme. Vista Aero is available in all versions of Vista except for Vista Home Basic. The word Aero has been said to stand for Authentic, Energetic, Reflective, and Open. It offers a much more relaxed and softer feel over other standard interfaces. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
TEST DAY TIP Use the exam to take the exam. Many topics are covered in each exam. Therefore, it’s not uncommon for a question to have an answer to a question written in the scenario of another question.
Microsoft has changed each component within Vista to match this overall look. Things such as buttons, radio buttons, wizards, task dialogs, the Control Panel, icons, fonts, and user notifications have been synced to give the same overall user experience. One of the primary new additions to Vista is its sidebar, shown in Figure 1.3, which you can customize to hold whatever gadgets you require. The sidebar is located on the right side of the desktop. Many different gadgets have customizable settings and configurations.You can download new gadgets and install them directly from the Microsoft Web page. Figure 1.3 The Vista Sidebar
www.syngress.com
7
8
Chapter 1 • Microsoft Vista: An Overview
User Access Control User Access Control (UAC) is a new feature in Vista that is aimed at helping to improve security at the desktop level. In previous versions of Windows, local users were added to the local Administrators group. This allowed users to change system settings and install software. The UAC has been implemented by default in Vista. This allows users to run with fewer rights to the system, while also being given the option to override those defaults to allow administrative functions to run on the system. To help improve compatibility with applications that haven’t been updated with UAC-compatible components, Vista provides the option to run applications as an administrator. To run an application as an administrator, you right-click the application and then you select Run as Administrator. This is necessary because even when you log on to Vista with an administrator account with UAC enabled, the account is actually running with the same security access rights as a standard user. In previous versions of Windows, the philosophy was that all users were administrators, and software vendors manufactured software that required administrative privileges even if they weren’t conducting any administrative functions. The UAC component is forcing a much needed change in the thought process of many vendors by making them update their software to function correctly with the least level of rights necessary. Vista with UAC enabled (the default) responds differently if the logged-on user is an administrator than it does if the logged-on user is a standard user. This is because when you log on to the system with an administrative account, you are actually receiving two different Security Identifiers (SIDs): one with full administrative rights and the other with standard user access. Therefore, when an administrative task needs to take place, a user logged on with a standard account will have to provide the username and password of an administrator account to complete the task. While logged on under an administrator account, the user only needs to provide consent to pass along the administrator SID for the task to complete. Microsoft still recommends using the more secure method of running Windows primarily with a standard user account. UAC runs with the built-in UAC elevation component. The elevation component is called the credential prompt when running as a standard user. The credential prompt (see Figure 1.4) allows the user to input administrative credentials to perform administrative tasks.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Figure 1.4 The Credential Prompt
When you are running Vista with an administrative account with UAC enabled, the elevation component is referred to as the consent prompt (see Figure 1.5). This allows members of the local Administrators group to perform administrative tasks by providing approval for those tasks. Figure 1.5 The Consent Prompt
www.syngress.com
9
10
Chapter 1 • Microsoft Vista: An Overview
Networking As with nearly every current operating system today, networking capability is essentially a requirement versus a marketable feature. Vista supports the latest in networking technology that provides useful features not found in previous versions of Windows. Many businesses need to collaborate to be productive. In the past, businesses were required to set up and install expensive systems (such as Microsoft Live Meeting) to accomplish any type of meeting collaboration, or store files on a network-accessible share or use USB thumb drives to share files. To overcome these limitations, Vista offers a feature called Windows Meeting Space, which allows you to create a meeting on Vista at any time that other people can join. This makes it simple to share files and ideas with others throughout the organization’s network, at local hotspots, or even in an ad hoc wireless network. You can use Vista Home Basic Edition to join a meeting, but you can’t use it to create a new meeting. You can use the Windows Meeting Space peer-to-peer application to share files, programs, and even the entire desktop with up to nine other workstations. Each meeting participant can share files by adding them to the meeting as handouts. As these files are edited, changes are replicated to all users in the meeting. Once the final version of the file is completed, everyone can save a copy to his or her local hard drive. The moderator of the meeting can even delegate control over his or her machine to allow others to take control and make changes, while the other participants watch from their own screens.
EXAM WARNING Microsoft exams use exercises to assist in verifying that the tester can display hands-on knowledge in applying configurations. There are always many ways to accomplish the same tasks in Windows. It is always best to use the menu bar options rather than the right-click options. This will help to ensure consistency and provide a higher probability that the question is marked as correct.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
EXERCISE 1.2 CREATING A WIRELESS AD HOC MEETING SPACE MEETING We have discussed some of the primary benefits to using Windows Meeting Space. One of the nice features of Meeting Space is the ability to easily create a wireless ad hoc meeting for others to join. This is a nice added benefit because you can set up a meeting anywhere, without depending on any other networking technologies (although all members joining the wireless ad hoc meeting will need a wireless network device). To set up a meeting that other wireless-capable Vista users can join, follow these steps: 1. Click Start Menu | All Programs | Windows Meeting Space. The screen shown in Figure 1.6 will be displayed, and Meeting Space will automatically begin to search for available meetings. Automatically searching for available meetings makes it much easier for other people to find and join your meeting.
Figure 1.6 Launching Windows Meeting Space
www.syngress.com
11
12
Chapter 1 • Microsoft Vista: An Overview
2. Click Start a new Meeting. Then type in the desired meeting name and a strong password for the new meeting. 3. Click the Options button to display the screen shown in Figure 1.7. Under Network options, click Create a private ad hoc wireless network, verify the country or region, and then click OK.
Figure 1.7 Meeting Space Options
4. Click the green arrow button (shown circled in Figure 1.8) to create the meeting with the selected options.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Figure 1.8 Creating a Meeting
5. Now the meeting will have been created and a screen similar to the one shown in Figure 1.9 will be displayed. From this area, you can share an application or the entire desktop, invite others to the meeting, and add handouts to the meeting.
Figure 1.9 A Meeting Space Test Meeting
www.syngress.com
13
14
Chapter 1 • Microsoft Vista: An Overview
6. To share the entire screen, click Share a program or your desktop. A confirmation window will be displayed (see Figure 1.10). Click OK to continue.
Figure 1.10 The Confirmation Window
7. The next window will allow you to select what you want to share with others in the meeting (see Figure 1.11). Highlight Desktop and click Share. This may cause the background to go black to help increase performance, and the screen to flicker. This is normal and should be expected.
Figure 1.11 Starting a Shared Session
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
8. Once your entire desktop is shared for others to view, your screen should look similar to the one shown in Figure 1.12. At this point, you have the option to allow others to take control of your desktop and make changes.
Figure 1.12 Sharing a Desktop
IPv6 Vista includes support for IPv6 and is already installed and enabled by default. IPv6 is the next-generation Internet Protocol (IP) protocol suite that is intended to replace the current IPv4 that was designed in the latter part of the 1970s. IPv6 has been designed to address many of the issues inherent with the current IPv4 suite. www.syngress.com
15
16
Chapter 1 • Microsoft Vista: An Overview
The next-generation Transmission Control Protocol/Internet Protocol (TCP/IP) suite, IPv6, overcomes many of the pitfalls of IPv4 and has the following enhancements: ■
Large address space IPv4 addresses are 32-bit, but IPv6 uses a 128-bit address space to provide a massive increase in available addresses. IPv6 has 340,282,366,920,938,463,463,374,607,431,768,211,456 (3.4 × 1038) available IP addresses that are globally routable.
■
Extension headers IPv6 has streamlined headers that support hierarchical routing infrastructures and provide faster Internet routing than IPv4.
■
Stateless auto-configuration IPv6 has the built-in ability to autoconfigure network settings. This is not to be confused with IPv4’s Automatic Private IP Addressing (APIPA). APIPA uses only a specific range of addresses and doesn’t provide any routable information (subnet mask/ gateway). IPv6 is able to get this information from a router on the network or from a Dynamic Host Configuration Protocol (DHCP) v6 service.
■
Enhanced security The standards of IPv6 provide protection against address and port scans as well as higher security by supporting Internet Protocol Security (IPSec) for protecting network traffic with encryption.
When IPv4 and IPv6 are both enabled and configured, IPv6 is the preferred TCP/IP suite. This is important to note because this means that when making a network query, the next-generation TCP/IP stack will try to communicate first and then fall back to IPv4 if it fails. The IPv6 preference allows applications that are IPv6-enabled to take advantage of the features and benefits of IPv6.
EXERCISE 1.3 CONFIGURING IPV6
IN
VISTA
This exercise will walk you through manually configuring IPv6 on a Vista machine using the GUI. 1. Click Start | Control Panel | Network and Sharing Center. 2. On the left, click Manage network connections. 3. Highlight the connection for which you want to configure IPv6.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
4. Click Organize | Properties. 5. Highlight Internet Protocol Version 6 (TCP/IPv6) and click Properties (see Figure 1.13).
Figure 1.13 Local Area Connection Properties
The screen shown in Figure 1.14 will be displayed. This screen will allow you to manually configure all IPv6 settings for this network connection. Multiple IPv6 addresses, gateways, and DNS settings can be configured on each network device.
www.syngress.com
17
18
Chapter 1 • Microsoft Vista: An Overview
Figure 1.14 TCP/IPv6 Properties
Wireless Improvements Microsoft developed Vista with wireless technology in mind and has deeply integrated it into the operating system.Vista has many security enhancements built in to help both users and administrators protect their data and networks.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
In the past, it was thought that one of the steps in securing a wireless network was to configure the wireless access point (WAP) to not broadcast the wireless network Service Set Identifier (SSID). The reasoning behind this idea was that if a network was hidden, it would be harder to find and exploit. This is a common misconception, and Microsoft recommends not using this method because other software tools can easily be used to discover all necessary information about a “hidden” access point anyway. Also, the clients that are configured to connect to the non-broadcasting access point are much more vulnerable. This is because for a client to connect to a non-broadcasting (hidden) WAP, it must search for the SSID by broadcasting the network name and other configuration information. Therefore, broadcasting the SSID is actually more secure than not broadcasting it. The major risk in this scenario is that an attacker could set up a workstation to pretend to be the WAP to which the client is trying to connect. Once the victim in connected to the attacker, the attacker would serve as a proxy by sending and receiving data that is requested from the victim system. This would make it nearly impossible for the victim to know that he or she is even connected to the attacker. Then the attacker could capture all unencrypted data passing through the system: Web pages, passwords, e-mails, IM chats, and so on. Microsoft has responded to this threat by changing the way Vista finds and connects to wireless networks. It designed Vista to be as passive as possible. This means Vista prevents any information from being broadcast that doesn’t specifically need to be to function effectively. You can now configure wireless profile settings to indicate whether a wireless network is configured as a broadcast or nonbroadcast network, as shown in Figure 1.15. The option “Connect even if the network is not broadcasting” tells Vista whether the wireless network is configured to broadcast. If this option is selected, Vista will send out broadcast beacons trying to locate that access point even when not in range. For wireless access points that are configured to broadcast the SSID, this option will not be selected and Vista will not send out any broadcast.
www.syngress.com
19
20
Chapter 1 • Microsoft Vista: An Overview
Figure 1.15 Home Wireless Network Properties
Another important option is “Connect automatically when this network is in range”. Because you can configure Vista not to automatically connect to the network when in range,Vista will not send out probe requests searching for the nonbroadcast access point. Therefore,Vista’s wireless auto-configuration will send probe requests only for access points that are configured with both options: connect automatically and nonbroadcast. This greatly reduces the potential for valuable information to be disclosed to possible attackers. Unlike previous Windows versions, Vista will display the nonbroadcasting access point in the “Connect to a network” window with the name Unnamed Network,
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
allowing you to provide the proper SSID, as shown in Figure 1.16. Once you have entered and verified the proper SSID, you will be prompted for the appropriate authentication credentials. Figure 1.16 Connecting to a Network
The next major improvement is that Vista will never automatically connect to an unencrypted network. Each time Vista is to be connected to an unsecured network, you must manually select the unsecured network, and you will be prompted with the dialog box shown in Figure 1.17, alerting you of the security risks associated with connecting to that particular wireless network. Each time you want to connect to the unsecured wireless network, you will have to accept the risk and click Connect Anyway to make the connection.
www.syngress.com
21
22
Chapter 1 • Microsoft Vista: An Overview
Figure 1.17 The Security Risk Dialog Box
In a domain environment, it is possible for the administrator to push out wireless policy configurations to the workstations using Group Policies. These policies contain settings for the SSID, whether the WAP is set to broadcast, security configurations, and more. It is much easier for administrators to utilize Group Policies than to configure each workstation individually.
Windows Imaging Deploying a new operating system can be a daunting task for many administrators. The complexity of creating, managing, and testing individual images for each deployment platform can drastically add to the time and cost of deploying the new operating system. In Vista, Microsoft has made many improvements in its deployment technology to help lower the total cost and improve reliability and manageability. This section will discuss some of the major improvements that Vista offers over previous versions, utilities, and methods. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Improved Deployment Vista’s major goal was to vastly reduce the required number of images and to better assist in maintaining those images. To help with this, Microsoft modularized Vista to make it easier to customize and deploy by basing the installation on a file-based disk imaging format called Windows Imaging Format (WIM) as well as making deployment enhancements to the core operating system. Vista has been designed to be more modular than previous systems. Even the English language is considered an optional component separated from the core operating system. This prevents the need for individual images for each language that may be required for global corporations, thus vastly lowering the cost. This modular method also allows for easier additions of device drivers, service packs, and updates. Also, it makes it easier to enable optional Windows components. The greater reliability is enhanced because making changes to certain modules won’t affect or interfere with the other modules. The new WIM is another great improvement and provides many benefits to administrators. The new image is hardware–independent, so organizations can use only one image for many different hardware requirements. Another great benefit is that this file format can be mounted and edited using Windows Explorer to add, change, and edit files and folders from within the image. Also, the images can be serviced offline for adding and removing optional components, drivers, and updates without the need to create a whole new image. These improvements greatly reduce the time necessary to create and manage images that are to be used to deploy Vista.
Configuring & Implementing… Imaging Vista 32-Bit and 64-Bit Operating Systems Even though WIM can support many different hardware requirements in a single image file, the 32-bit and 64-bit images are not compatible with each other. Therefore, the two different platforms will require separate image files.
Vista also has moved to a single XML-based answer file for use with remote and unattended installations. This can make the install faster and less prone to errors www.syngress.com
23
24
Chapter 1 • Microsoft Vista: An Overview
compared to previous methods that required the use of multiple files for unattended installs. This also provides the ability to automate more of the desktop and deployment process. Vista is designed to perform faster installations than previous versions of Windows by using a new image-based operating system setup. Another improvement is the upgrade process. When possible, it’s a best practice to perform a completely new installation versus and an upgrade procedure. However,Vista provides a cleaner upgrade by basically performing a new full operating system installation that is followed with a migration of user settings, applications, and documents. ImageX is the new Vista tool used to create and manage actual WIM files. ImageX is a command-line utility that is used to mount the images for offline editing, preventing the need to create a new image from the source system. The image file can be shared from a distribution point and either invoked by the user or pushed to the desktop by administrators. Vista uses the Windows System Image Manager to make customizing and automating the installation process much easier and more reliable. Users can add, delete, or modify optional components including service packs, updates, device drivers, and languages in an already-existing image file, simply by creating or editing the XML-based unattended configuration file. Now that we have discussed some of the tools used to create and customized the installation process, let’s look at some technologies that you can use to deploy the Vista desktop operating system: ■
Multiboot options You have many boot options, such as CD/DVD, hard disk, and the Preboot eXecution Environment (PXE) boot.
■
Secure remote deployment options Vista can be remotely installed onto a desktop.
■
Windows Deployment Services (WDS) WDS is the new name for the updated version of the Microsoft Remote Installation Service (RIS) and will provide for the management, storage, and deployment of the images. This method uses the PXE boot option.
■
The upgrade This method will upgrade to the Vista desktop while preserving the user’s data, applications, and settings.
Complete PC Backup We all know about the necessary evil of backups. When we are working on projects, doing homework, e-mailing friends, and so on, it seems like one of those things we www.syngress.com
Microsoft Vista: An Overview • Chapter 1
never have the time to do, so we just put it off until later. Backing up data never seems important until your life depends on it. Only then do you realize that the last time you successfully completed a backup was when you first got your shiny new system. Microsoft has tried to alleviate some of the pain of doing backups by making the process much less complicated and very streamlined. Microsoft provides a few ways to help you safeguard your data and Complete PC Backup is one of the main features. This backup solution is available in the Business, Enterprise, and Ultimate versions of Vista. Figure 1.18 displays the Backup and Restore Center found in the Control Panel, which is where the Complete PC Backup can be created or restored.
TEST DAY TIP Don’t waste time on questions to which you do not know the answers. Use the mark option and come back to such questions after you’ve completed the exam. If you still don’t have any idea how to answer them, simply give it your best guess. Never leave any questions blank.
Figure 1.18 The Backup and Restore Center
www.syngress.com
25
26
Chapter 1 • Microsoft Vista: An Overview
You can use Complete PC Backup to back up the whole system in case of a hardware failure. This backup method includes all user settings, installed applications, Registry settings, files, and so on. When a backup is performed, the data will be stored in a virtual hard disk (.vhd) image to the destination drive. You can then save the backup to CDs/DVDs, attached storage (external USB hard drives), and network shares. The first time Complete PC Backup runs, it does a full backup. Every backup after that is differential. This means all backups after the first backup will back up only the changes that have been made to data since the previous backup, making backups much faster. This doesn’t mean that any information from the first backup is lost, because it’s still backing up all the data on the system.You can still restore data from the first full backup or any other backup. This is because Microsoft uses the Volume Shadow Copy Service to complete PC backups. The data that changed will be backed up and the delta data will be moved to the shadow copy storage area. Great effort has also gone into restoring data. You can easily restore data by using the Windows Recovery Environment (Windows RE), which you can find by booting to the installation CD. Vista’s Complete PC Backup does not back up Microsoft Outlook .ost files in the backup image. Sometimes restoring .ost files can be problematic. Because you can regenerate .ost files from the Exchange server, Microsoft decided to omit this file type from the Complete PC Backup process.
Security Security is always a huge issue for individuals, small companies, and large organizations. With new threats and vulnerabilities constantly changing, Microsoft has made many improvements to Vista’s security features to help overcome these concerns.
BitLocker Everyone has heard the new reports about laptops being stolen, temporarily misplaced, or lost. The data stored on the hard drive can be retrieved by means other than through the operating system. Things such as bootable CDs or USB keys can be used to bypass the operating system and get directly to the information stored on the physical media without the need to know any passwords. Once the operating system has been bypassed, all the files on the drive can be viewed, edited, or copied. The best safeguard to defend against this security issue is encryption. BitLocker is Microsoft’s answer to providing better security by encrypting the data stored on the drive’s operating system volume, and is available only in the www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Enterprise and Ultimate versions of Vista. This new security feature in Vista goes a long way toward helping users and organizations protect their data. You can set up BitLocker in the following configurations: ■
TPM only In this configuration, only the hardware microchip is used to protect the data stored on the drive. The Trusted Platform Module (TPM) stores the encryption key and verifies that there have been no changes to the hard drive.
■
TPM and USB flash drive In this configuration, the TPM will still verify the validity of the hard drive, but in addition, part of the encryption key is stored on the USB flash drive. The USB flash drive is required each time the computer starts.
■
TPM and PIN This configuration is also a two-layer security approach. After successful verification of the drive, you will be required to enter the correct PIN for the start process to continue.
NOTE It is important to create a recovery password in case there are any hardware failures that may prevent the system from booting. Things such as motherboard failures and USB flash drive failures, where applicable, will affect the system. If a hardware failure occurs, the only way to recover the data is through the recover mode, and a recovery password is required. There are no other ways to restore the data without the recovery password.
The default configuration for BitLocker is to be used in conjunction with a TPM. The TPM is a hardware microchip embedded into the motherboard that is used to store the encryption keys. This protects the hard drive even if it has been removed from the computer and installed into another computer. You can also use BitLocker on systems that don’t have the TPM hardware manufactured on the motherboard. You can do this by changing the BitLocker’s default configurations with either a Group Policy or a script. When you use BitLocker without a TPM, you must store the key on a USB flash drive and insert the USB flash drive into the computer for the system to boot. www.syngress.com
27
28
Chapter 1 • Microsoft Vista: An Overview
New & Noteworthy… BitLocker Vulnerabilities BitLocker is a new security feature in Vista. As with all security technology, some people are working on creating vulnerabilities or ways around this security, so you must always be aware that new threats are coming out all the time. Therefore, BitLocker is just another technical challenge to many hackers in the world. To use a BitLocker-enabled system, the key must be stored in RAM while the system is up and running. Universities have found that when a system is shut down, it’s possible to retrieve the key from RAM for up to several minutes, giving a hacker complete control over the entire system and all files stored on the drive. The main way to avoid this, of course, is to never leave a system unattended in an unsecured area in the first place. The next step is to completely shut down the system so that the RAM can be allowed to fully discharge. When Vista is used in a domain environment, it is important for the domain administrators to be able to retrieve the information stored on a system in case of any emergency or other type of event. In a case where a user isn’t able to work or is asked to leave the company, the information on the hard drive still needs to be accessed and recoverable. Active Directory domains in Server 2003 and 2008 provide administrators with the safeguard to set up Group Policies and have the BitLocker key backed up and stored in Active Directory on the servers. We will cover BitLocker in greater detail later in this book.
PatchGuard PatchGuard is a kernel patching safeguard for Windows x64 systems that is a major security feature and motivator to switch to 64-bit systems. These features are found only in the x64 editions of Vista and were first introduced in Windows Server SP1 x64 and XP Pro x64. PatchGuard programmatically prevents any third-party vendor from patching the kernel from undocumented means. Only patches that are authorized and originated by Microsoft are allowed to make direct changes to the kernel. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Microsoft discourages vendors from making kernel-level changes in 32-bit systems, but does not programmatically prevent this. This is because 32-bit software has been around for a long time and is already fully entrenched in the market. Making this change to these systems would break many of the software packages in use today because of compatibility issues. The introduction of 64-bit systems provided Microsoft with an opportunity to introduce this new security feature with much less impact on the community. Previously in 32-bit system, vendors would use these undocumented means to replace or extend the functionality of the kernel. This could potentially have a negative effect on the system by reducing its reliability, performance, and stability. With the virus, Trojan, and malware communities always becoming more advanced in their techniques, this isn’t an optimal configuration for system security or reliability. By allowing the kernel to be updated only by its tested and approved code, Microsoft has greatly improved system security. Some of the system structures PatchGuard prevents include the following: ■
Changing the system service tables
■
Changing the interrupt descriptor table (IDT)
■
Changing the global descriptor table (GDT)
■
Using kernel stacks not allowed by the kernel
■
Patching any part of the kernel
Security Center The Windows Security Center in Vista puts some of the primary security settings into one easy-to-use and manage window. Figure 1.19 shows the Windows Security Center windows. The Windows Security Center can monitor third-party software and alert you when a security setting should be adjusted or if software is out-of-date. Previous versions would notify the user of an issue for third-party software that needed to be addressed, but then it was up to the user to find that application and figure out how to make the suggested changes. Vista has improved that scenario by linking to the third-party software in question and recommending suggestions on how to remedy the situation. For example, when the Windows Security Center notices that some third-party antivirus software is out-of-date, a button will be displayed allowing you to easily update the virus definitions. Once the virus definitions are successfully updated, the Windows Security Center will display that they are up-to-date. Monitoring the status of third-party applications greatly improves www.syngress.com
29
30
Chapter 1 • Microsoft Vista: An Overview
Vista usability. You are no longer required to manually check the status in each software package. The Windows Security Center is capable of monitoring the following components (see Figure 1.19): ■
Firewall settings
■
Vista Automatic Updates settings
■
Antivirus software status
■
Antispyware or malware protection
■
Internet Explorer 7 security settings
■
UAC settings
Figure 1.19 The Windows Security Center
TEST DAY TIP Use the mark option during the exam. That is, mark any question you are not 100% sure is correct. At the end of the exam, go back and check your marked answers. Unmark questions as you review your answers. Because you will know how many questions you are confident about, this can give you a decent idea of how well you will score on the exam. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
The firewall is used to prevent network access to local ports on your system. The firewall settings built into Vista (see Figure 1.20) allow you to customize firewall rules to your needs or requirements. The Windows Security Center monitors the status and settings of the firewall and is capable of monitoring not only the Vista firewall but also third-party software firewalls. The Windows Security Center will notify you if there are any issues with your firewall that you may need to address. Figure 1.20 The Vista Firewall Settings
EXERCISE 1.4 VERIFYING THAT THE FIREWALL ALLOWS FILE AND PRINTER SHARING One of the primary features of any modern operating system is the ability to share files and resources from one machine to another across the network. In this exercise, you will verify that file and printer sharing www.syngress.com
31
32
Chapter 1 • Microsoft Vista: An Overview
is enabled in the Vista firewall configurations. This will allow others on the network access to these ports. 1. Open the Windows Security Center by navigating to Start | Control Panel | Security Center. 2. Click on Windows Firewall on the left-hand side of the screen. 3. In the next screen, click Change Settings. 4. Click on the Exceptions tab. 5. Search for File and Printer Sharing and verify that the item is checkmarked.
System and application updates are just another critical component to ensuring the security and reliability of any system. New vulnerabilities are constantly being discovered and released to the public. All applications from all vendors (Word, Adobe Acrobat, Mozilla Firefox, etc.) are affected by these security risks. Therefore, continuous monitoring of system and application updates is critical throughout the lifespan of a system. In the older days of system maintenance, each patch or update had to be manually downloaded and installed and many of these patches had to be installed in a certain order to be fully effective. Microsoft has designed the Windows Update Service to help take the manual work out of maintaining and updating a system, thus allowing anyone to be able to easily and effectively keep his or her system updated and protected from emerging threats. The Windows Update Service can also monitor, download, and install updates for other common software packages. Therefore, it manages not only key system updates, but also applications such as Microsoft Office and Internet Explorer. Many customizable options are available for Windows Update, as shown in Figure 1.21. The recommend setting is to download and “Install updates automatically”. This option does allow you to define the best time to actually the updates and may best be suited for regular users who just want the system to take care of itself (although this may not be the desired setting in all environments because many updates require the system to be rebooted to take effect). Servers or even workstations with online availability that users rely on heavily relied may be better suited to the next option, “Download updates but let me choose whether to install them”. This setting allows the system to go ahead and download available updates in the background while still giving you the options of what to install, and when. This also lets you test these updates in a lab environment before pushing them out to the entire network. Microsoft always recommends testing all www.syngress.com
Microsoft Vista: An Overview • Chapter 1
patches and service packs in a testing environment before implementing them in a production systems. The next option, “Check for updates but let me choose whether to download and install them”, is good for areas that may have less bandwidth (see Figure 1.21). Then you can see what’s available and choose whether to download and install them individually. The setting that is not recommended is “Never check for updates”. This option will fully disable the Windows Update Service.
Figure 1.21 Checking for Updates
The next section of the Windows Security Center concerns malware protection. This section is for monitoring and configuring antivirus applications and the Windows Defender service, as shown in Figure 1.22. The combination of the two provides another layer of security to your system. The Windows Security Center can easily display the current status of your antivirus software. For example, www.syngress.com
33
34
Chapter 1 • Microsoft Vista: An Overview
Figure 1.22 shows that avast! antivirus software is installed, activated, and currently up-to-date. Figure 1.22 also shows the status of the Windows Defender spyware and malware protection.
Figure 1.22 Malware Protection
Malware is malicious software that is designed specifically to harm your computer. Malware can appear in the form of spyware or adware. Spyware monitors your system via a keylogger or some other method and may report back to other machines over the Internet. Spyware is capable of exposing any personal data to unworthy sources, such as usernames, passwords, bank account information, and so on. Adware displays unwanted ads in the hope that you will want to purchase what is being displayed. The attacker can also profit just from the number of users that view the pop-up ad. Vista provides Windows Defender to allow you to scan for these malicious applications on your machine. Figure 1.23 shows the results of a completed scan.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Figure 1.23 The Results of a Windows Defender Scan
The “Other security settings” area provides information about the current security settings of Internet Explorer and the UAC, as shown in Figure 1.24. Selecting “Internet security settings” as displayed in Figure 1.24 will take you to the Security tab of the Internet Options for Internet Explorer. Here you can accept the default security setting or adjust the settings to your needs.
www.syngress.com
35
36
Chapter 1 • Microsoft Vista: An Overview
Figure 1.24 Other Security Settings
The Windows Security Center also lets you configure the way you are notified of any security issues. After clicking “Change the way Security Center alerts me”, as in Figure 1.25, you are taken to a screen that allows you to choose the way you prefer to be notified. Figure 1.25 Security Notification Options
Figure 1.26 shows the screen that will be displayed along with the available notification options. The recommended method is to do both: Notify me and display an icon. The “Yes, notify me and display the icon” option is referring to the balloon action for the icons. This means a balloon will be shown over the security icon alerting you of the event. The next option, “Don’t notify me, but display the icon,” is self-explanatory. The final selection, “Don’t notify me and don’t display the icon”, is not recommended, for obvious reasons. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Figure 1.26 Options for Receiving Security Notifications
Digital Rights Management Digital Rights Management (DRM) is a technology that media content providers can use to ensure that their media is protected. These providers can choose to add DRM protection to their media to help prevent their content from being used illegally. Digital content providers can use Microsoft Windows Media Rights Manager to create content that is securely encrypted. When a customer purchases a file, he or she must also get the license that contains the key to unlock the file. If the user doesn’t have a valid license for the media, the user will be directed to a site where he or she can purchase a valid license. This doesn’t prevent the content from being transferred, but it does prevent it from being utilized by unauthorized users. Content providers can not only protect their content from being played but also set some rules regarding how the content can be used. Here are some of the restriction options that are available to these providers: ■
The number of times the content can be played (from one to unlimited)
■
The license start and expiration dates
■
The portable devices that can be used to play media www.syngress.com
37
38
Chapter 1 • Microsoft Vista: An Overview ■
Whether the content can be burned to a CD
■
The required security level of the software playing the media
DRM provides many benefits to content providers as well as their customers. The provider has a tool he or she can use to help fight against content piracy and illegal distribution. The user is assured that the content is in its original form, as intended by the provider, and has the satisfaction of knowing that he or she has legally purchased the media.
New & Noteworthy… Companies Dropping DRM Many digital content management companies have began to offer DRMfree content because consumers have made it clear that they simply prefer unprotected media over protected media.
Search Your computer system can be an excellent tool to accomplish many personal and business tasks—anything from creating and editing images and video for pleasure to creating spreadsheets or custom applications for business purposes. Over time, a system naturally stores all these valuable files and resources. But how much value does a file hold if it can’t be found? Microsoft has added a very valuable user feature in Vista: the dynamic search capabilities called Instant Search. With Instant Search, you can find your files much more easily and quickly than you can in any previous version of Windows. Instant Search is designed to be fast and somewhat intelligent. The intelligence comes from its ability to display different types of results based on which search area is used. Instant Search is located in the Start menu, Windows Explorer, and other places. Probably the first location you will notice this Instant Search feature in Vista is the Start menu, as shown in Figure 1.27. You use the Start menu to find different applications installed on a system. Therefore, the Instant Search found in the Start www.syngress.com
Microsoft Vista: An Overview • Chapter 1
menu will display results that are found in the Start menu with a higher priority, shown at the top of the list, and then will expand to other files as the search criteria entered are more specific. Figure 1.27 Vista’s Instant Search
Figure 1.28 shows an example of this extended searching capability. As you can see, you can find and display other resources on the local machine, such as programs, favorites, and e-mails. Figure 1.28 shows an Instant Search for the word windows. As the word windows is being spelled out, the search is already displaying search results. This makes it easier to find files in cases where you may not know the whole filename. Notice all of the different types of results that are displayed. www.syngress.com
39
40
Chapter 1 • Microsoft Vista: An Overview
Figure 1.28 Extended Searching
Figure 1.29 shows Instant Search in Windows Explorer. This search capability allows you to search for documents within the current folder quickly and easily. It’s important to note that the searches are based on the contents in the file. For example, if a Word document or text file also contains the search criteria in the body of the document and not just in the filename those files will also be displayed. Also, searching within the contents of the file makes it possible to find files even if you don’t know what the actual filename may contain. Simply knowing what data is in a file that you are looking is all the information you need to be able to quickly and easily find those important files. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Figure 1.29 Windows Explorer’s Instant Search
After you click Start | Search, the next screen shown in Figure 1.30 will be displayed. This allows you to edit your search based on more advanced criteria and other options. You can also get to these advanced options in any other Windows Explorer window by starting a search in the Instant Search bar; simply click Search Tools | Select Search Pane. The Search pane is the toolbar that holds the Advanced Search button. Then click the down arrow to display the advanced search options. You can choose to quickly search indexed locations (discussed later in this section), or select a custom location or any other available options. Figure 1.30 Editing a Search in Windows Explorer
www.syngress.com
41
42
Chapter 1 • Microsoft Vista: An Overview
Vista also makes it easy to add other information to a file to help find important files. Depending on the type of file, the available editable options will change. All file types will allow you to add tags, as shown in Figure 1.31. To add this information, or to edit any other information, simply highlight the file and make the desired changes to the tag. Once the information is entered, click the Save button to commit the changes to the file. If you want to make the same change to multiple files, simply highlight all the files you want to change, make the change, and then click Save. This makes it easy to change information on multiple files in one quick and easy step. Figure 1.31 Vista’s Available Editable Options
Another interesting search option is the ability to save searches. It may not sound interesting at first glance. But it’s interesting that the searches act more like folders. Saved searches by default will be saved in the Searches folder. When you click on the saved search, it will display the results of that search similar to a separate folder containing those results. The primary notable difference in this view is the Folder column category. Deleting a file from this view will delete the file in the stored location as well. www.syngress.com
Microsoft Vista: An Overview • Chapter 1
TEST DAY TIP Be cautious when changing your answers. Statistically, your first answer is most likely to be the correct answer.
We’ve taken a look at some of the options available for searching files, folders, and applications in Vista. Now let’s take a look at what makes all of this possible. This key ingredient in Vista is its use of indexing. Indexing is what makes all of these searches able to provide fast and reliable results. Indexing not only saves the filenames and locations, but also indexes the contents within all the files in the folder selected to be indexed. To open the indexing options go to Start | Control Panel | Indexing Options. Figure 1.32 will be displayed, showing the default indexed locations. Figure 1.32 Indexing Options
www.syngress.com
43
44
Chapter 1 • Microsoft Vista: An Overview
EXERCISE 1.5 REBUILDING
THE
SEARCH INDEX
IN
WINDOWS VISTA
Indexing is a great way to speed up local searches. It also lets you quickly find files based on the files’ contents. Over time, the speed of the searches may naturally degrade or the results may become less accurate. To solve these problems it may be necessary to regenerate the search index. This will cause the data currently in the index to be flushed out and a new, fresh index will be populated. This may not be a mandatory task, but is a good idea for regular PC maintenance. Depending on many factors, system performance may be degraded during index regeneration. Therefore, you may want to start this process at the end of the day so that it can run while the system isn’t in use. 1. Navigate to Start | Control Panel | Indexing Options. Figure 1.32 will be displayed. 2. Click the Advanced tab and then click Continue to any User Access Control windows. The next screen will be displayed (see Figure 1.33).
Figure 1.33 Advanced Indexing Options
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
3. Click the Rebuild button. 4. A confirmation pop-up box will be displayed (see Figure 1.34). Carefully read this message and click OK when finished. The index rebuilding process will be started and will run in the background. It’s possible to continue working while the index is running, but performance may be degraded.
Figure 1.34 The Confirmation Pop-Up Box
www.syngress.com
45
46
Chapter 1 • Microsoft Vista: An Overview
Summary of Exam Objectives Windows Vista is the latest of the Microsoft desktop operating systems, and it features many new and useful tools not found in any previous version of Windows. The hardware requirements to take full advantage of the features built into Vista have increased like never before. Many systems in use today will simply not be able to utilize all of the features or will need to be upgraded. Vista has improved the functionality found in Windows Explorer to help users maneuver folders and find files much more quickly and easily. The automatic indexing of files and folders has made it possible for results to be dynamically displayed as the user inputs the search criteria. Vista also automatically determines what templates to use for each folder by assessing what type of files are contained within each folder. This makes it possible for Windows Explorer to dynamically change its buttons depending on the content in the folder. This means that a folder with images will have different options than a folder that holds videos. Vista provides two different visual modes, which the system determines automatically based on its hardware capabilities. The available modes are Vista Aero and Vista Standard. This allows systems that have older hardware to be able to still load and use Vista. At the same time, it allows systems with more powerful hardware to utilize the more advanced Aero effects. Both modes provide a customizable sidebar that offers many features directly on the desktop. Vista has introduced User Access Controls (UAC) to improve desktop security. The UAC has helped to increase overall security by forcing the way developers integrate software into the system. Vendors need to create software that will run with only the level of access rights that are required to successfully accomplish their tasks. Another great security improvement is that even administrator accounts run using standard user rights by providing the account with an administrative key and a standard user key. When an administrative task needs to be performed under an administrator account, the UAC notifies the user with a pop-up message requesting the user to allow the use of the administrative key to accomplish the task. When a standard user requests an administrative task, the user must provide credentials for an administrator account before the task will be completed. Microsoft has built many networking improvements into Vista. Widows Meeting Space provides an easy way for users to collaborate anywhere. The improvements in Vista’s wireless ad hoc networking make it easy for a user to create a meeting and allow others to connect to the network. This allows for easy file sharing and distribution as well as screen sharing. Screen sharing can share the entire desktop or an individual application with the ability for others in the meeting to take control, www.syngress.com
Microsoft Vista: An Overview • Chapter 1
vastly improving the collaborative abilities of the group. Also, IPv6 is installed by default, which adds many new security features at the network level. The convenience of wireless networking doesn’t come with many security risks and concerns. Microsoft has addressed many of these concerns by improving and enhancing its wireless networking options and abilities. One major difference is that Vista will not automatically connect to any wireless access point that isn’t secured, thus preventing accidental association and mitigating the risks of man-inthe-middle attacks against wireless users. Vista also allows for more detailed wireless configuration profiles. This includes whether the wireless access point is configured to broadcast its SSID. Enterprise organizations need to be able to easily deploy Vista to workstations if they are to replace their current systems. Microsoft understands this necessity and has improved and simplified its deployment process. Vista introduces a more manageable imaging file format that is capable of holding many different image configurations in one file, which greatly decreases its management requirements and lowers the total cost of ownership. Vista has also improved and simplified the way users back up and restore their data by providing a feature called Complete PC Backup. A full backup is completed the first time the backup is executed, and incremental backups are performed from there on. This reduces the space required to perform backups and simplifies the restore process. These backups create .vhd (virtual hard disk) files. It’s important to know that this backup file is not encrypted even if BitLocker security is enabled. BitLocker is a drive encryption technology used to protect data stored on the hard drive. BitLocker can utilize the hardware TPM built into the motherboard to provide greater security, or you can configure it to use a PIN and/or USB flash drive. In domain environments, you can back up the BitLocker key to Active Directory. We have entered a new era with the introduction of 64-bit systems. PatchGuard is an improvement to security that is integrated only into 64-bit systems. Microsoft has introduced this new feature which forces vendors to create drivers that don’t directly affect the kernel and must be approved by Microsoft. This greatly reduces the risk of malicious code taking total control over the entire system. Microsoft has put forth a great deal of effort into system security. The Windows Security Center is another example of this. The Windows Security Center consolidates many security configurations and adds the ability to monitor system settings as well as third-party applications such as antivirus software. You also can configure Windows Update to automatically download and install important updates and security patches. www.syngress.com
47
48
Chapter 1 • Microsoft Vista: An Overview
Exam Objectives Fast Track User Interface ˛ Vista is capable of scaling back the visual experience based on the hardware
that the system is installed on. ˛ Video cards that support DirectX 9 are required to run Vista Aero. ˛ Windows Explorer has been updated to dynamically change based on the
type of folder template displayed.
Networking ˛ Windows Meeting Space is a peer-to-peer application that you can use to
share files, programs, and even the entire desktop with up to nine other workstations. ˛ Vista includes support for IPv6, and it is already installed and enabled by
default. ˛ Vista prevents any information from being broadcast that doesn’t specifically
need to be to function effectively.
Windows Imaging ˛ The Windows Imaging format is the new file-based imaging format
In Vista. ˛ Vista has moved to XML-based answer files for remote and unattended
installations. ˛ Complete PC Backup is used to back up and restore the entire system.
Security ˛ BitLocker is Microsoft’s whole-drive encryption software. ˛ PatchGuard is the kernel patching safeguard for 64-bit Windows Vista
versions. ˛ Digital Rights Management is used to protect media content providers as
well as their customers.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Search ˛ Vista has implemented many new search capabilities and features. ˛ Advanced search allows you to easily search for data within files. ˛ The new indexing feature allows for much faster search results.
www.syngress.com
49
50
Chapter 1 • Microsoft Vista: An Overview
Exam Objectives Frequently Asked Questions Q: What is the main benefit to Windows Meeting Space over Microsoft Live Meeting?
A: Windows Meeting Space is a peer-to-peer calibration technology that can be initiated in any location.
Q: Searching for files on my computer is very fast. Why does it take longer to search for files stored on the network?
A: Vista only indexes files that are stored on your local machine. Therefore, searching for files over a network connection will always be noticeably slower than on the local machine.
Q: Which wireless security is more secure: WEP or WPA? A: WPA is much more secure than WEP. WEP was the first attempt at trying to add a level of security to the wireless network and can be hacked with 100% success. WPA is much more secure and the primary key to its level of security depends on a strong password. Never use a password that you can find in any dictionary.
Q: In Microsoft Windows operating systems there are many ways to accomplish the same tasks. What is the best way to accomplish tasks for the purposes of taking the certification exam?
A: It’s always best to use the menu bar on the tasks-based questions. Q: I have a media file that uses Digital Rights Management. How can I remove the DRM protection from the file?
A: It’s impossible to remove the DRM protection from any file that has been created with it.
Q: I use Vista x64; does that mean my system is more secure than 32-bit systems? A: Yes, 64-bit Vista utilizes security features that can’t be implemented into 32-bit systems.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Q: I want to use BitLocker but my motherboard doesn’t have a TPM. Is it still possible to enable BitLocker?
A: Yes. The default BitLocker configurations will have to be modified to use a USB flash drive.
Q: My wireless network connection isn’t stable and keeps connecting and disconnecting. What can I do to fix this problem?
A: There could be interference from any number of sources. The first thing to try is to change the channel that is used. Try changing it to channel 1, 6, or 11.
www.syngress.com
51
52
Chapter 1 • Microsoft Vista: An Overview
Self Test 1. Steve is trying to set up a home network and wants to make sure his connection is secured. What security setting on the wireless access point will most likely make his laptop less vulnerable to attacks while he’s away from home? A. Set up MAC filtering so that only his laptop can access his network B. Enable SSID broadcasting on the access point C. Disable the wireless network card D. Enable WPA2 with AES encryption 2. Christina was working from home on her proposals when her hard drive crashed. She had completed a Complete PC Backup of her computer just the day before. She replaced the hard drive with a new one and completed a restore from her last full backup. When she goes into Outlook to view her e-mail, there’s nothing there. Even though she restored from a full backup, why doesn’t she have any of her e-mails? A. The backup didn’t complete successfully. B. Christina mistakenly performed a partial backup and not a full backup. C. A full PC backup doesn’t back up the Outlook .ost file. D. The new drive was defective and didn’t restore successfully. 3. Valerie has been working on some proposals for the past several months. She has noticed that when she searches for a file on her computer, the searches are slow and the results aren’t displaying files that she knows should be shown. What is most likely the cause of the problem? A. The search settings aren’t set to search within the files. B. The file she is looking for isn’t in the path to be indexed. C. She’s is searching in the wrong location. D. The search index needs to be regenerated. 4. Susan has just installed Vista on a new machine. She isn’t able to get the Aero visualizations to work properly, even though the system is fully functional. What could be the possible reason for the Aero effects to not be activated? A. Susan didn’t enable the Aero effects after the install completed.
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
B. The hardware doesn’t meet the minimum requirements necessary for Aero effects. C. The installation wasn’t completely successful. D. Susan doesn’t have an updated monitor. 5. Jordan successfully opens a Command Prompt window. He tries to execute commands that aren’t running correctly. What could be the cause of the problem? A. He is mistyping the commands. B. The Command Prompt Setup Wizard hasn’t been completed. C. He needs to open the command prompt with administrator privileges to be able to run the commands that he’s trying to execute. D. Automatic Updates hasn’t been set up. 6. Tim has been delegated the task of putting together the conference room in preparation for a very important meeting with clients to pitch a new ad campaign that is to take place in 30 minutes. A requirement for the meeting is that everyone will need access to the latest versions of the project files. What would be the best solution for Tim to set up? A. Microsoft Live Meeting B. Net Meeting C Lotus Sametime D. Windows Meeting Space 7. John set up a secured wireless network using WPA, and his neighbor has a wireless network that is unsecured. Is it possible for John to accidentally connect to this neighbor’s wireless network if his wireless network goes down? A Yes, Windows is known for accidental association issues. B. No, Vista will not automatically connect to an unsecured wireless network. C Yes, Windows will connect to any access point that it finds. D. No, only because John has not previously connected to that network. 8. Jane is setting up a new local network. The primary concern is security and all machines will be running Vista. What is the primary security reason for running IPv6?
www.syngress.com
53
54
Chapter 1 • Microsoft Vista: An Overview
A. The security of IPv6 supports IPSec. B. AES encryption is built into the protocol. C. 3DES is the default security standard. D. IPv6 has the ability to implement Blowfish encryption. 9. Complete PC Backup and been used to safeguard the data stored on the local machine. By design, what is Complete PC Backup not going to back up? A. The Registry B. Custom desktop settings C. Installed applications D. The Outlook .ost mail file 10. Kelly would like to verify the security level of his Vista workstation. What could Kelly do to accomplish this? A. Rename the administrator account B. Disable the guest account C. Configure BitLocker to protect the data D. Check the status of the configuration in the Windows Security Center
www.syngress.com
Microsoft Vista: An Overview • Chapter 1
Self Test Quick Answer Key 1.
B
6.
D
2.
C
7.
B
3.
D
8. A
4.
B
9.
D
5.
C
10.
D
www.syngress.com
55
This page is intentionally left blank
Chapter 2
MCTS/MCITP Exam 620 Installing Windows Vista
Exam objectives in this chapter: ■
Preparing a New PC
■
Installing Windows Vista Business Edition
■
Upgrading to Windows Vista Business Edition
■
Troubleshooting Installation Issues
Exam objectives review: ˛ Summary of Exam Objectives ˛ Exam Objectives Fast Track ˛ Exam Objectives Frequently Asked Questions ˛ Self Test ˛ Self Test Quick Answer Key 57
58
Chapter 2 • Installing Windows Vista
Introduction The installation of Microsoft Windows Vista is not a difficult process; however, the installation process of Windows Vista is vastly different compared to the other operating systems in the Microsoft family. The methods used to deploy and install Windows 2000, XP, and 2003 were closely intertwined. All three of those operating systems had many other features in common, such as using the same boot files. Windows Vista uses a completely different installation process, and is very different from installing Windows 2000, XP, and 2003. As you complete the steps to install Windows Vista, you will notice how different the installation process is from previous Microsoft operating systems. After a successful installation, you will also notice how Windows Vista is unlike any operating system Microsoft has ever released in the past. Welcome to a platform unlike anything you have ever seen from Microsoft! For Windows XP, 2000, and 2003 users, it will certainly take some time to adjust to all of the new features of Vista. Some features such as the Windows Firewall with Advanced Security, Parental Controls, BitLocker, and User Account Control are not in any previous versions of Windows. Other features have been redesigned, such as the Network and Sharing Center, Event Viewer, and the Backup and Restore Center. Some of the familiar features from previous operating systems, such as the Registry, still exist, however. In summary, expect quite a steep learning curve when migrating to Vista from a previous version of a Microsoft operating system.
Preparing a New PC In the stages leading up to the release of Vista, manufacturers coined two phases, Vista Ready and Vista Capable. Tables 2.1 and 2.2 explain the difference between these two distinctions. Basically, a Vista Capable logo on a PC means the machine will run Vista, but will not be “capable” of using all of the features, such as Aero Glass. A PC with a Vista Ready designation would be a higher-end machine that would be able to run Vista and utilize most of the new features of the operating systems. Table 2.1 Characteristics of a PC Meeting the Vista Capable Designation Feature
Requirement
Processor
At least an 800 MHz CPU
Memory
512 MB of RAM
Graphics
A graphics card that will support DirectX 9
www.syngress.com
Installing Windows Vista • Chapter 2
TEST DAY TIP Know the difference between a Vista Capable and Vista Ready PC. Vista Capable machines usually just meet the minimum hardware requirements to run Vista.
Table 2.2 Characteristics of a PC Meeting the Vista Ready Designation Feature
Requirement
Processor
At least a 1 GHZ CPU
Memory
1024 MB of RAM (1 GB of RAM)
Graphics
A 128 MB graphics card that will support DirectX 9
Storage capacity
40 GB of hard drive space (15 GB free space)
Notice in the tables that a Vista Capable machine requires at least 512 MB of RAM, while a Vista Ready machine will need a full gigabyte of RAM. However, from my experience, neither of those amounts will be sufficient for Vista. One of the reasons to consider Vista for your platform is the eye candy—meaning graphics. Given this capacity, though, you will be severely limited unless you have a video card with at least 128 MB of RAM. To get good performance from a system running Vista, a large amount of RAM and a high-end video card are a must. Whether your PC is designated Vista Capable or Vista Ready, you will still experience a significant system slowdown if you are upgrading your system from Windows XP. Vista requires significantly more RAM, tons more disk space, and a high-end graphics card. Tools provided by Microsoft, such as the Upgrade Advisor, can help you make an informed decision about whether you have to upgrade components in your current PC or purchase a new higher-end model.
Hardware Requirements Windows Vista already has a reputation for being a resource hog, especially on mobile computers. Many current computers in homes and businesses do not have enough horsepower to run any version of Windows Vista. If a machine does meet the minimum requirements, it is unlikely it will perform well unless components are upgraded. In many cases, end users may have to abandon their current PCs and buy entirely new systems. www.syngress.com
59
60
Chapter 2 • Installing Windows Vista
Before someone makes a decision to get rid of their current PC and purchase a new one, however, they can download Upgrade Advisor from Microsoft at www.microsoft.com/windows/products/windowsvista/buyorupgrade/upgradeadvisor .mspx. Upgrade Advisor will tell the user which devices and programs need to be upgraded. The minimum hardware requirements for Vista, as listed on the Microsoft Web site, are an 800 MHz CPU, 512 MB of RAM, a hard disk with 15 GB of free space, and a video card with support for SVGA graphics. Microsoft also lists the recommended system requirements for Vista on its Web site. The recommended requirements will also depend on which version of Vista you choose to run. Home Basic needs slightly less horsepower than Home Premium—Microsoft recommends 512 MB of RAM and a 32 MB video card for Home Basic. For all other versions of Vista (besides Starter), Microsoft recommends at least 1 GB of RAM and a video card with 128 MB of RAM. In my experience, a system that meets or slightly exceeds the minimum or even recommended requirements for Vista does not perform well. Having a high-end video card, 1 to 2 MB of additional RAM, and a Dual Core will help the performance of Windows Vista. Tables 2.3 and 2.4 list the recommended hardware requirements for the corresponding versions of Windows Vista. More details about the recommended requirements needed for Vista can be found at the Microsoft Web site at www.microsoft.com/ windows/products/windowsvista/editions/systemrequirements.mspx.
Table 2.3 Hardware Recommendations for the Home Basic Edition of Windows Vista Feature
Recommendation
Processor
1 GHz processor
Memory
512 MB of system memory
Storage capacity
20 GB hard drive with 15 GB of free space
Graphics
Video card with 32 MB of graphics memory
Other
DVD drive
www.syngress.com
Installing Windows Vista • Chapter 2
Table 2.4 Hardware Recommendations for the Home Premium, Business, and Ultimate Versions of Windows Vista Feature
Recommendation
Processor
1 GHz 32-bit (x86) or 64-bit (x64) processor
Memory
1 GB of system memory
Storage capacity
40 GB hard drive with 15 GB of free space
Graphics
Video card with 128 MB of graphics memory (minimum)
Other
DVD drive
EXAM WARNING Know what the recommended hardware requirements are for the different versions of Vista. Watch for scenario questions that describe a certain set of hardware that may not meet the installation requirements for certain versions of Vista.
One important thing to note about the minimum requirements is the amount of hard drive space needed for the operating system. Previous versions of Microsoft Windows often required less than 1 GB of hard disk space. Not only is Windows Vista a resource hog, it is also a disk hog. Windows Vista takes up a lot of disk space for many reasons, including its Page File Size (needed to complement the large amount of RAM), the Volume Shadow Copy service, and the load of thumbnails required to enhance the user experience. On a positive note, it is difficult to find a hard disk that is less than 80 GB in the store anyway, so the 15 GB required for the operating system is really only a consideration if older equipment is being utilized. I would also recommend using SATA drives instead of IDE drives since disk transfer rates will increase and your Windows Experience Index will be higher.
www.syngress.com
61
62
Chapter 2 • Installing Windows Vista
Comparing Editions Before purchasing and installing Vista, it’s important to determine which version will best suit the needs of you or your company. Six versions of Windows Vista are available, including Starter, Home Basic, Home Premium, Business, Enterprise, and the Ultimate edition. The Starter version is not available for purchase in the United States, has the least amount of features, and was designed primarily to be used in third-world markets. The Ultimate edition has the most features but is the most expensive, retailing initially for almost $400. However, today Microsoft has significantly reduced the price of the Ultimate edition to be more competitive.
EXAM WARNING Know the six versions of Vista and be able to articulate their various features. Remember that the Starter edition is not for sale in the United States, Japan, or Europe—it is designed for countries where technology is an “emerging market.”
Most home users will purchase either the Home Basic or Home Premium editions of Windows Vista. These operating systems were designed for the home user and, for that reason, cannot join a domain. These versions are similar in functionality to XP Home; however, this time Microsoft decided to have two versions: a scaled-down Home Basic; and Home Premium, which offers more features. The main difference between the two seems to be that Home Basic can’t use the Aero Glass feature and some of the advanced Media features. The Aero feature of Vista improves the overall visual experience for the end user with features such as translucent windows and smoother icons. Aero Features such as Windows flip, Windows 3-D flip and DreamScence are discussed in Chapter 3. Both Home versions include the Windows Firewall and Defender protection mechanisms, and both (as well as the Starter edition) offer Parental Controls that allow the administrative account to set up content, site, and game restrictions for other users of the machine. Interestingly, these parental control features are not available on any other version of Windows Vista except the Ultimate edition, which includes features from all the versions.
www.syngress.com
Installing Windows Vista • Chapter 2
Most businesses will choose to use the Business or Enterprise editions of Windows Vista. These are really the only versions that are suitable for work environments; none of the other versions of Vista have the feature that allows them to join a domain. The Enterprise edition is more expensive and has more features than the Business edition, but is only available via Software Assurance. It also comes with BitLocker, as well as additional licenses that can be used for Virtual PC. BitLocker is a security mechanism that allows users to encrypt volumes so data can be protected. The most likely reason Parental Controls are not included with either of these editions is that they are more likely to be used in the workplace, and companies typically already have measures in place to control and monitor Internet usage. The Ultimate edition of Vista is for the home or business users who want all of the features available in all of the versions. The Ultimate edition includes Parental Controls, BitLocker, Aero, and all of the advanced media features. Ultimate users also have the ability to download Ultimate Extras, which include Texas Hold’Em and Dream Scene. Dream Scene lets you use a full motion background as your desktop. Though Windows Ultimate does have every available feature, its cost has kept some consumers away. As the price continues to drop, however, more users (especially those wanting every available feature) will likely migrate towards Vista Ultimate.
New & Noteworthy … Windows Vista Home Basic N and Windows Vista Business N Two versions of Vista—Home Basic and Business—have an N after their names, meaning they do not include Media Player. The fact that these versions cannot be bundled with Media Player is due to a ruling by a European Union. Windows XP can not be upgraded to these N versions. More information about the ruling can be found at the following link: http://www.news. com/Microsoft-changes-Vista-over-antitrust-concerns/2100-1016_3-6125560. html?tag=st.ref.goo
www.syngress.com
63
64
Chapter 2 • Installing Windows Vista
32 Bit vs. 64 Bit AMD and Intel, two of the largest manufacturers of central processing units, have both been selling 64-bit processors for a number of years now. Sixty-four-bit processors offer a number of advantages over their 32-bit counterparts, such as faster speed and the capability to handle more memory. Handling more memory was less of an issue with Windows XP than it is for Vista. Windows Vista requires eight times the RAM that XP did to meet the minimum system requirements. (XP required a minimum of 64 MB of RAM, while Vista requires a minimum of 512 MB.) There is also, unfortunately, a 3 GB limitation for memory in 32-bit versions of Vista. Faster processing from a 64-bit CPU will also help deal with some of Vista’s intensive graphic processes, such as Aero Glass and Dream Scene. The first 64-bit Operating System offered by Microsoft was Windows 2000 Advanced Server 64-bit Limited edition. Both of the next two operating systems released—XP and 2003—were offered in both 32- and 64-bit versions. Although 64-bit versions have been offered for XP and 2003, only a small percentage of customers elected to purchase them. It should not come as a surprise that Microsoft offers Vista in both 32- and 64-bit versions. Unlike in the past, the 64-bit version will account for a larger percentage of overall sales of Vista compared to that of previous Microsoft operating systems. This is because a large amount of computers are currently shipping with 64-bit processors, so now companies like Dell can bundle the 64-bit version of Vista with them. There has been discussion that Vista could be the last client operating system released that has a 32-bit version. Only time will tell if Windows 7 will be released in both 32- and 64-bit versions. If a computer has a 64-bit processor, the user can choose to install either the 32- or 64-bit version of Windows Vista. On a PC with a 32-bit processor (such as a Pentium IV4), only the 32-bit version of Vista can be installed. One advantage of using the 64-bit version of Vista over its 32-bit counterpart is that it is more secure because it only allows the installation of digitally signed drivers. As you can see in Figure 2.1, 32-bit versions of Vista still allow unsigned drivers to be installed. Microsoft most likely chose to allow 32-bit versions to use unsigned drivers for backwards compatibility reasons.
www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.1 Installing an Unsigned Driver (32-Bit Editions Only)
The fact that the drivers need to be digitally signed also means that less drivers are available for the 64-bit editions of Vista. While many people will balk at the idea of having a driver digitally signed before using it, I have seen cases where unsigned drivers caused unexpected and undesired results. In the past, I’ve dealt with customers whose computers rebooted when they were trying to shut down. The problem in several cases turned out to be a piece of hardware they installed with an unsigned driver.
EXAM WARNING Note that the 32-bit version of Vista does allow the installation of unsigned drivers, while the 64-bit version does not. This is important to know for the exam and for when you are working in the field.
www.syngress.com
65
66
Chapter 2 • Installing Windows Vista
Installing Windows Vista Even though Installing Vista is a bit different than installing prior Microsoft operating systems, it is a very straightforward process. One unique thing about Vista is that many of the installation DVDs distributed by Microsoft actually have all six versions of Windows Vista. When you get to the operating selection screen, as shown in Figure 2.2, you are requested to select the version of Vista you purchased.
Figure 2.2 The Vista Edition Selection Screen
When you install Vista, your product code will obviously only match up with the version you purchased. However, a user can actually install Vista without entering the product code and use the operating system for 30 days, as shown in Figure 2.3. After 30 days, the operating system enters a reduced functionality mode. There exists a documented “feature” that Microsoft has acknowledged, however, wherein users can “re-arm” their system a certain number of times to extend the initial 30-day period.
www.syngress.com
Installing Windows Vista • Chapter 2
Some say this feature is present to help legitimate customers deal with activation issues, if any were to arise. More information about this process is available at http://windows secrets.com/comp/070215#story1. Figure 2.3 A Prompt during the Install if Users Fail to Enter Their Product Codes
EXAM WARNING Know that Vista can be installed without a product code and used for 30 days. After the 30-day period, it enters a reduced functionality mode. The operating system will only come out of the reduced functionality mode if a product code is entered and Vista is activated. (Unless Vista is “re-armed.”)
Partitioning If you do not plan to set up a dual boot, you can choose to either use your full drive as a single partition, or divide the drive into more than one partition. Some people choose to use a single-drive single-partition implementation because it is simple. Others choose to divide a physical drive into a system and data partition. This way, if the OS partition becomes corrupt or the OS needs to be reinstalled, the separate data partition will remain intact.
www.syngress.com
67
68
Chapter 2 • Installing Windows Vista
New & Noteworthy … The GUID Partition Table I know that since the days of DOS you have been lead to believe there can either be only four primary partitions on a drive or three primary partitions and one extended. This rule of thumb even applied to users creating partitions on a Linux system. Well, the days of those constraints are ending—the GUID Partition Table (GPT) allows for 128 partitions. To utilize the GPT (and have 128 partitions), your system needs to support EFI, Extensible Firmware Interface. A few notes on GPT: When you open Disk Management and initialize a disk, Vista will ask if you want to use MBR or GPT. A warning will appear stating that if GPT is used, prior operating systems may not be able to read the disk. It also recommends that GPT only be implemented on systems with 64-bit processors, though it can be used on a system with a 32-bit CPU.
If you are installing the Enterprise edition or Ultimate editions of Windows Vista, I recommend you set up your partitions so BitLocker can be easily implemented. If you instead choose to use a single partition, repartitioning all of the clients running Vista later may result in a big headache. While there is a BitLocker Drive Preparation Tool, the tool can not be easily downloaded unless you are running the Ultimate edition of Vista. Keep in mind that new laws and regulations are coming that will require companies (especially those working in conjunction with the United States Department of Defense) to encrypt data. I cannot recall a case where a network administrator was fired for using too much security.
www.syngress.com
Installing Windows Vista • Chapter 2
Head of the Class BitLocker In order to implement BitLocker, a small unencrypted boot partition of about 1.5 GB is needed. If this partition is not created before the installation, the user will have to modify the disk so the separate small partition is created. It is easier to implement if the partition is created prior to install.
EXERCISE 2.1 USING THE DISKPART TOOL ON THE VISTA DVD TO PARTITION A DISK FOR BITLOCKER PRIOR TO INSTALLING THE ENTERPRISE OR ULTIMATE EDITION OF VISTA Warning: All data will be deleted on the drive when you use the DiskPart partitioning tool. 1. Boot up using the Windows Vista Installation DVD. 2. Press Enter at the Windows Setup screen. 3. Select English (or another language) as the language to install, and then click Next. 4. Click the Repair Your Computer option, as shown in Figure 2.4.
www.syngress.com
69
70
Chapter 2 • Installing Windows Vista
Figure 2.4 Selecting the Repair Your Computer Option during Install
5. Select Command Prompt from the System Recover Options Screen. At the command prompt, type diskpart. Then type select disk 0 list partition 0 If it says there are no partitions on this disk to show, skip to step 6. If there are partitions, complete the following steps: Warning: ALL DATA ON THE DISK WILL BE DESTROYED! Select partition 1. Delete the partition. You should receive the message that DiskPart successfully deleted the selected partition. Repeat this process for all partitions on this disk. 6. Type create partition primary size=2047 (this will be the boot partition). www.syngress.com
Installing Windows Vista • Chapter 2
7. Type create partition primary (this will be the main data partition, later to be the encrypted data volume). 8. Type list partition to list the two created partitions. Type list volume. You should see volume 0, volume 1, and their associated drive letters (most likely c: and e:). The file systems are currently listed as RAW and need to be changed to NTFS. This will be done thru formatting in the next step. Type exit to leave the Diskpart sub-menu. 9. format c: /q Press y to acknowledge that all data will be destroyed. Press enter for the volume label. format d: /q Press y to acknowledge that all data will be destroyed. Press Enter for the volume label. Type exit to leave the command prompt. 10. Select the Restart button, as shown in Figure 2.5.
Figure 2.5 Selecting the Command Prompt System Recovery Option
www.syngress.com
71
72
Chapter 2 • Installing Windows Vista
11. Press the spacebar (or any key) to boot to the Windows Vista Installation DVD. 12. Select English (or other language) as the language to install. 13. Click Install Now. 14. Input your product key number and select Next. 15. Select the version of Windows you have installed from the selection menu. (In this case, Windows Vista Ultimate or Enterprise edition.) 16. Accept the License Agreement. 17. Click Custom for the type of installation. 18. Select Disk 0, Partition 2 for the place where Windows will be installed, and then click Next. 19. Finish the installation of Windows. The DiskPart command line tool is really needed only if you are planning to implement BitLocker. If you are not planning to use BitLocker or your version of Vista does not support it anyway, you can use the GUI partitioning tool during the Windows Vista installation to partition your drive. In general, using the GUI tools is always a bit easier. The interface used to partition disks during the installation of Windows NT, 2000, 2003, and XP can be described as draconian at best. The GUI interface used for partitioning disks in Vista is much easier to use, and more intuitive as well.
EXERCISE 2.2 USING THE VISTA INSTALLATION GUI PARTITIONING TOOL TO SET UP A SINGLE PARTITION OR MULTIPLE PARTITIONS Warning: All data will be deleted on the drive when you use the Vista installation disk partitioning tool. 1. Boot to the Windows Vista Installation DVD. (Press any key—such as the spacebar—to boot to the DVD.) 2. Press Enter at the Windows Setup [EMS Enabled] screen, as shown in Figure 2.6.
www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.6 The Windows Vista Setup Screen
3. Select English (or other language) as the language to install and then click Next. 4. Click the Install Now button. 5. Enter the product key number if you have it available. (Note: The onscreen keyboard can be launched, if needed, by clicking the keyboard icon to the right of the Product Code box.) 6. Uncheck the Automatically Activate Windows When I Am Online option (if you prefer to activate it on your own) and then click Next. 7. If you did not input the product key number in step 4, click No to the question, Do You Want To Enter The Product Key Now?, as shown in Figure 2.3. 8. Select the version of Windows you have purchased from the list, as shown in Figure 2.2.
www.syngress.com
73
74
Chapter 2 • Installing Windows Vista
9. Check the box labeled I Have Selected The Edition Of Windows That I Purchased and click Next. 10. On the License Agreement page, verify that the Microsoft Software License Terms indicate the correct version of Vista you have purchased. 11. Read over the entire License Agreement carefully. If you accept the terms, check the box titled I Accept The License Terms and click Next. 12. At the What Type Of Installation Do You Want screen, select Custom. Notice that upgrade is disabled. This is because we are conducting a clean installation and we did not launch the DVD from within the Windows XP operating system, as mentioned in Figure 2.7.
Figure 2.7 A Windows Vista Type of Install Screen with the Upgrade Option Disabled
www.syngress.com
Installing Windows Vista • Chapter 2
13. The Where Do You Want To Install Windows screen is the interface where partitions can be deleted, formatted, and created. Before Windows can be installed, a large enough NTFS partition must be created and selected as the destination. Previous Windows Operating Systems, such as 2000, XP, and 2003 gave the user a choice between FAT32 or NTFS. Vista must be installed on an NFTS partition. Warning: ALL DATA ON THE DISK WILL BE DESTROYED! 14. If prior partitions exist, they may be formatted with the NTFS file system. This is done by clicking the Format button, reading the warning label, and clicking the OK radio button. If there are no prior partitions, you will see an “unallocated space” designation. A new partition can be created by clicking New, specifying the size, and clicking Apply, and then clicking Format, reading the warning label, and clicking the OK radio button. Note: If your disk is not showing up at this screen, drivers can be loaded here. Once again, loading drivers for disks in this location is a much easier process compared to adding them during an XP, 2000, or 2003 install. 15. You can configure your disk using multiple options, including using a single partition (as shown in Figure 2.8) or using multiple partitions (as shown in Figure 2.9). After you have decided which partition you will be installing Vista on, select the partition where you wish to install the OS and then click Next.
www.syngress.com
75
76
Chapter 2 • Installing Windows Vista
Figure 2.8 Using a Single Partition to Install Windows Vista
Figure 2.9 Using Multiple Partitions, One for Vista, the Other a Data Volume
www.syngress.com
Installing Windows Vista • Chapter 2
Licensing In order to combat piracy, all copies of Vista, including volume license copies, require activation. Activation was also required in Windows XP and 2003, but unlike in Windows Vista, it was not required for volume license copies (also known as Corporate editions). The Volume Licensing scheme used by Windows XP and Server 2003, in which activation was not required, was referred to as Volume Activation 1.0. Windows Vista Business and Enterprise edition (and Server 2008) use Volume Activation 2.0, which still requires them to be activated. So, all copies of Windows Vista will require activation. The technical guide to Volume Activation 2.0 can be downloaded from the following link: www.microsoft.com/downloads/details. aspx?FamilyId=9893F83E-C8A5-4475-B025-66C6B38B46E3&displaylang=en. The requirements of Activation 2.0 have led Microsoft to develop new tools to manage these licenses. Companies using Vista Business or Enterprise edition will need to obtain one of two new volume license key types, a Key Management Service Key or a Multiple Activation Key. While most network administrators are not thrilled about the idea of activating volume license versions of Vista, this will serve as a deterrent to people who have used volume license copies illegally in the past. The two ways to activate Multiple Activation Keys (MAKs) from Microsoft are using either Independent Activation or Proxy Activation. Independent Activation will require each Workstation running the Business or Enterprise edition of Vista to be activated. Proxy Activation will not require each workstation to contact Microsoft and be activated. Instead, by connecting one computer to Microsoft servers, several machines running either the Business or Vista Enterprise edition can be activated. In order to take advantage of proxy activation, the Volume Activation Management Tool (VAMT) 1.0 needs to be downloaded from Microsoft via the following link: www. microsoft.com/downloads/thankyou.aspx?familyId=12044dd8-1b2c-4da4-a53080f26f0f9a99&displayLang=en.
TEST DAY TIP Have a good understanding of the different volume License Key Types, Key Management Service Keys, and Multiple Activation Keys. Remember that all copies of Vista, including these types of Volume License Copies, must be activated. Vista and Server 2008 use Activation 2.0, which is different than the Activation (1.0) used by XP and 2003. With Activation 1.0, Volume License Copies did not have to be activated. www.syngress.com
77
78
Chapter 2 • Installing Windows Vista
Configuring & Implementing … Companies with Activations There have been several reports of companies with legitimate copies of Vista having problems with their software ‘deactivating’ during the business week. This is a major inconvenience for companies that have purchase legitimate copies of software; it is a serious problem when employees who are trying to get their work done have their operating systems enter a reduced functionally mode. The negative publicity regarding these events, many of which can are posted on the web, are extremely detrimental to the sales of Vista. If the administrator knows that their volume license copies of XP do not ever need to be activated, they may be more hesitant to deploy Vista to their company’s workstations.
To use a Key Management Service (KMS) Key, your company must have at least 25 computers running Vista. Information about your licensing will be sent to Microsoft though the KMS Server. Setting up the Key Management Server is not difficult. It does, however, require a server running 2003 SP1 or later with the Domain Name System (DNS) service installed.
EXERCISE 2.3 SETTING UP PROXY ACTIVATION FOR YOUR MAK KEY BY USING VOLUME ACTIVATION MANAGEMENT TOOL (VAMT) 1.0 Prerequisites: A MAK Volume License Key from Microsoft for either the Business or Enterprise edition of Vista. 1. Download the Volume Activation Management Tool (VAMT) 1.0 from Microsoft at the following link: www.microsoft.com/ downloads/thankyou.aspx?familyId=12044dd8-1b2c-4da4-a53080f26f0f9a99&displayLang=en. 2. Right-click VAMT.zip and select Extract All. www.syngress.com
Installing Windows Vista • Chapter 2
3. Click Next, and then click Finish. 4. The extracted VAMT folder holds two files: a Word document and an MSI file. Read over the Word file. Double-click the MSI file. A window should appear, as shown in Figure 2.10. Click Next.
Figure 2.10 The Volume Activation Management Tool (VAMT) 1.0 Setup Screen
5. Click Next on the Welcome screen. 6. Read over the license, click I Accept The Terms Of The Agreement if you agree, and then click Next. 7. Accept the default installation location, or change it. Click Next. 8. Click Install. 9. Click Finish. 10. Select Start | All Programs | Volume Activation Management Tool (32-bit) | Volume Management Activation Tool. 11. Select Action | Add Computers, as shown in Figure 2.11. www.syngress.com
79
80
Chapter 2 • Installing Windows Vista
Figure 2.11 Volume Activation Management Tool
12. Give a name to the computer group (required). You can search for the computers by manually entering the names or IP addresses, searching for them in Active Directory, or searching for them in a workgroup. For the manually entered name or IP address, you need to type in computer names or IP addresses separated by commas, as shown in Figure 2.12. Click OK when finished.
Figure 2.12 Manually Adding Computers in the Volume Activation Management Tool
www.syngress.com
Installing Windows Vista • Chapter 2
13. The list will be populated with the computers you have searched for or manually entered. There are a total of five columns that detail information about each machine in the list, including Computer Name, Key Type, License Status, Grace Expiration Date, and Status of the last action. 14. If the information is accurate, click File from the menu bar and then click Save. 15. When you are ready to activate the computers, select Action from the menu bar and choose Proxy Activate, as shown in Figure 2.13.
Figure 2.13 Performing MAK Proxy Activation with the Volume Activation Management Tool
16. Select the manage MAKs radio button. 17. Click Add, type in your MAK product key, put in a description (required), and click the Validate radio button when finished. 18. After validation, check the boxes preceding Install MAK, get the Confirmation ID from Microsoft, apply the Confirmation ID, and click Activate. 19. Verify the License Status is correct for all Vista machines activated via the MAK proxy activation.
www.syngress.com
81
82
Chapter 2 • Installing Windows Vista
EXERCISE 2.4 SETTING UP A KEY MANAGEMENT SERVER TO MANAGE YOUR VISTA BUSINESS OR ENTERPRISE EDITION KMS KEYS Prerequisites: A server with Windows 2003 SP1 or later, running DNS. A KMS Volume License Key from Microsoft for either the Business or Enterprise edition of Vista. 1. Download the Key Management Server from Microsoft at the following link: www.microsoft.com/downloads/details.aspx? familyid=81D1CB89-13BD-4250-B624-2F8C57A1AE7B&display lang=en. 2. Right-click KMSW2K3_EN-US_x86.zip and select Extract All. 3. Click Next, and then click Finish. 4. There are two files in the extracted KMSW2K3_EN-US_x86 folder: a Word document and an executable file. Read over the Word file. Double-click the executable file. A Key Management Service for Windows Server 2003 window should appear, as shown in Figure 2.14. Click Next.
Figure 2.14 The Key Management Server for Windows Server 2003 Setup Screen
www.syngress.com
Installing Windows Vista • Chapter 2
5. Read over the license, click Agree if you agree, and then click Next. 6. Open a command prompt and type slmgr.vbs -ipk PRODUCT KEY. 7. Next, at the command prompt, type slmgr.vbs –ato. You should see a pop-up box, as shown in Figure 2.15.
Figure 2.15 A Privacy Statement Warning from Microsoft
8. Click Yes if you agree to the terms. 9. At the command prompt, type the command slmgr.vbs /dli. This will determine if the Key Management System is active. 10. The Key Management System can be stopped and started in the Services Console. To get to the Services Console, type services.msc in the Run box. The service is listed under Software Protection Platform, as shown in Figure 2.16.
www.syngress.com
83
84
Chapter 2 • Installing Windows Vista
Figure 2.16 The Software Protection Platform Service
11. The Key Management System for Windows can be uninstalled in the Control Panel, under the Add/Remove Programs applet, as shown in Figure 2.17.
www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.17 Removing the Key Management Service for Windows 2003
Post-Install Configuration After installation of Windows Vista is complete, you will be prompted to create a user, give the user a password, and be allowed to type a hint (optional), as shown in Figure 2.18. The first user created on the system is created during this process, and that user is a member of the Administrators group. The built-in Administrator account is actually disabled, so it might be a good idea to try to remember the password you assign for the user you create. If a person tends to be forgetful, there is a place where a password hint can be added. If you forget the password, and that account is the only one enabled on the system, you need to either reinstall or use a tool to break your password. Keep in mind that many password-cracking utilities do not work on Vista, because it stores the passwords using NTLM hashes by default, instead of LanMan hashes.
www.syngress.com
85
86
Chapter 2 • Installing Windows Vista
Figure 2.18 Creating the First User—an Administrative Account— after Installation
After the initial user account has been created, the Help Protect Windows Automatically screen appears, as shown in Figure 2.19. The top choice, use recommended settings, will install both important and recommended updates. The middle selection, install important updates only, will only install security and other important security updates. The final selection, Ask Me Later, is a refreshing choice for the person who has just finished installing Windows and does not want to make any other significant decisions at this point. Windows will warn you again later that your computer is “at risk.” There is also a link on the bottom of this screen that can be clicked if a user wants more information about these three choices. www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.19 The Windows Vista Protection Center
The third screen after the install asks for time and date settings. As someone who lives on the East Coast, I have always found it annoying that I have to switch this from the default of Pacific Time to Eastern Time. Although this is understandable, given the location of Microsoft’s corporate headquarters, I am sure everyone else outside of the Pacific Time Zone also shares my pain. The fourth screen asks the user to choose the location of their computer as either work, home, or public. The public location will have stricter firewall settings compared to the home and work choices. The fifth screen says thank you; however, you are still not finished with the installation process. The system will reboot again with a message that your computer is being configured. When you log in to the system for the first time, Vista will indicate to you that your desktop is being prepared. After installing Vista, I would recommend installing anti-virus software. Microsoft does have an anti-virus software called OneCare, and it currently offers a free 90-day www.syngress.com
87
88
Chapter 2 • Installing Windows Vista
trial version. It is available for download at the following link: http://onecare.live.com/ standard/en-us/default.htm?sc_cid=mscom_ads. Microsoft also offers ForeFront whixh is a suite of security protection tools, including anit-virus, for Enterprise level networks. If you purchase an anti-virus solution, make sure Vista is listed as a supported operating system. Many anti-virus solutions (and other programs for that matter) will not function properly on Windows Vista. I have been using a version of Norton with Vista (32-bit), and it has worked extremely well so far. If you have the 64 bit version of Vista, getting anti-virus software can be a bit more tricky. Microsoft has locked the 64-bit kernel down with a technology called Patchguard. With Patchguard in place, Microsoft has locked down key kernel components that many companies anti-virus software packages need to access. By locking down certain components of the Kernel via Patchguard, Microsoft has stirred-up a lot of controversy and is battling with companies such as Symantec. More information about this topic can be found at the followinf link: www.symantec.com/enterprise/security_ response/weblog/2006/08/assessment_of_vista_kernel_mod.html. After you have anti-virus software installed, and your definitions are up-to-date, check the Windows Update site [Pearl (Start) | All Programs | Windows Update] and download all critical and important updates. More information can be found about patching your system in the next section. Many people turn off User Account Control after initially installing Vista. The directions for this are covered in the UAC section in Chapter 4. Microsoft does not recommend this, but users who are comfortable with XP, 2000, or 2003 will have to get use to the frequent UAC prompts every time they attempt to launch a task that requires administrative privileges.
Patching One unique thing about Vista is that all copies, including illegal copies will be permitted to receive updates. With Windows XP and 2003, some product codes were “flagged,” and computers with these were not permitted to receive updates. With most previous distributions of Windows, getting Windows updates was as easy as clicking Start and going to Windows Updates. Microsoft has shifted gears in the past few years and asked that consumers themselves religiously patch their systems. If you choose not to patch your system, you are usually given warnings that your computer “may be at risk.” To set your options for patching, click the Pearl (Start), select All Programs, and choose Windows Update. You can also get to this screen by going to the Control Panel, and selecting Windows Update. (Note: The icon is present under the Classic Control Panel View Only.) www.syngress.com
Installing Windows Vista • Chapter 2
Vista’s Windows Updates Settings has four options to choose from. The recommended option, as shown in Figure 2.20, is Install Updates Automatically. Even though this option is recommended by Microsoft, with this option the end user is not permitted to select which updates they will be installing. For the advanced user, Download Updates But Let Me Choose What To Install may be the better option. This way you can decide what you want to install from the list of available updates. If you only want to download the updates you will be installing, you can choose the Check For Updates But Let Me Choose Whether To Download And Install Them selection. If you do not want to download any updates ever, choose the Never Check For Updates option. As you can see in Figure 2.21, that setting is not recommended by Microsoft. If this selection is made, you will receive pop-up messages that indicate your computer may be at risk.
Figure 2.20 Windows Updates Settings for Vista
www.syngress.com
89
90
Chapter 2 • Installing Windows Vista
Figure 2.21 The Windows Vista Update Screen (as of January 22, 2008)
As of January 22, 2008, there were 45 important updates, 38 optional updates, and two Windows Ultimate Extras. Thirty-four of the 38 optional updates are language packs, and Microsoft only recommends installing the language packs; it is not required. All of the important updates are labeled with a KB prefix. Some of the recommended updates also have that KB extension, which stands for Knowledge Base. Each of the Security Updates labeled with the KB extension has a corresponding Microsoft Vulnerability Number associated with it. For example, the Security Update labeled KB942624 is associated with the MS07-063 vulnerability. The two digits following the MS represent the year in which the vulnerability was published. The ending three-digit number that follows the dash represents the order in which Microsoft published the vulnerability that year. For example, MS07-063 was the 63rd Microsoft vulnerability to be published that year. A first-year vulnerability report was just released by Jeff Jones a Microsoft Security Strategy Director, in his security blog on Technet.Vista actually faired pretty well in the report, compared to operating systems from other companies (as well as compared to Windows XP). According to the report, as seen in Figure 2.22,Vista had fewer www.syngress.com
Installing Windows Vista • Chapter 2
vulnerabilities (36) than comparable versions of Red Hat, Ubuntu, and MAC OS X. The report can be downloaded from the following link: http://blogs.technet.com/ security/attachment/2772991.ashx. Despite having less than 40 vulnerabilities, it is a good idea to stay cognizant of security issues, vulnerabilities, and flaws related to Windows and Windows Vista. The Web site www.securityfocus.com/vista will list vulnerabilities as they are discovered. Figure 2.22 A Windows Vista Security Vulnerability Report
(Source: Jeff Jones’ Security Blog on Technet)
Upgrading to Windows Vista Business Edition If you are currently running Windows XP and want to upgrade to the Business edition of Vista, several steps should be taken before you begin. The first thing must be an assessment of your current computer. It is imperative to find out not only if the hardware is compatible with Vista, but what applications might not work after an upgrade. It’s also a good idea to read Internet forums that discuss both the benefits and disadvantages of switching to Windows Vista for your operating system. Since Microsoft stands to gain the most financially if you choose to upgrade to Vista, they provide a plethora of information and tools that can help assist in your decision. Microsoft offers plenty of information regarding the features of all of the editions of Vista. They also offer two useful tools: Windows Vista Upgrade Advisor and the Windows Vista Hardware Assessment tool. These tools will provide you with valuable information related to both the hardware and software issues you may experience after upgrading to Vista. Once you have made the decision to upgrade, other tools, such as the User State Migration Tool, will assist you in retaining your settings and environment. www.syngress.com
91
92
Chapter 2 • Installing Windows Vista
Finally, Microsoft offers a way to use Vista without actually going through the installation. They have a “test drive” program where you visit their Web site and get to examine and evaluate Vista’s features. By visiting the following Web address—www. windowsvistatestdrive.com/enterprise.aspx?btype=3—you are able to log on (with any valid e-mail address) and use Vista. To use the site, you must have JavaScript, IE6, or later, and the following ActiveX control—Virtual Server VRMC Advanced Control—from Microsoft. Once logged in to the test drive Web site, your screen should resemble Figure 2.23. It includes both videos and various “test drive” scenarios. Figure 2.23 The Windows Test Drive Selection of Videos and Test Drive Scenarios
The test drive scenario lets you test many of the features discussed in this book, such as User Account Control and BitLocker. Basically, you are logging in to a virtual machine on a remote site hosted for Microsoft by Exsilio Consulting and testing some of Vista’s features, as shown in Figure 2.24. It will be obvious after using this that Microsoft has gone out of their way to make consumers and businesses excited about using Vista. www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.24 A Windows Test Drive Virtual Machine Scenario
The other option for consumers who want to “try before they buy” is to utilize Microsoft’s Virtual Hard Disk Test Program. A Virtual Hard Disk with the Ultimate edition of Vista and Office 2007 is available for free download at the following link: www.microsoft.com/downloads/details.aspx?FamilyID=C2C27337-D4D1-4B9B926D-86493C7DA1AA&DisplayLang=en. The Virtual Machine lets users test the Ultimate edition of Windows Vista and Office 2007 for 30 days. The downside to this is that you have to download the Virtual Machine as 18 separate WINRAR files, as shown in Figure 2.25, and then unpack them. Let’s hope the people that plan to partake in this test drive are using broadband connections. Also, you cannot test the BitLocker feature in Virtual PC, so use the online Windows Test Drive program if you want to get a better look at that feature. Having said all this, you do have to admire Microsoft’s initiative, even if none of the test drive programs it offers are suitable for your company.
www.syngress.com
93
94
Chapter 2 • Installing Windows Vista
Figure 2.25 Windows Virtual Machine Test Drive Programs
Assessing Your Hardware If you are planning to upgrade your system from Windows XP to Vista, you will need to be able to analyze your current PC. The first thing you need to evaluate is whether your hardware even meets the minimum requirements to run Windows Vista. It is a waste of time to go out and purchase a new piece of software, only to be warned that your system does not meet the minimum requirements for installation. If you do not feel like taking the time to do an inventory of your machine’s hardware, Microsoft provides you with two valuable tools: Upgrade Advisor and the Hardware Assessment Tool, which will inventory your hardware and advise you of any issues. Upgrade Advisor, which will be discussed in the next section, is designed for an individual to use on a single PC. The Vista Hardware Assessment Tool will analyze the hardware of up to 25,000 PCs on a network and provide recommendations to the user about components that need to be upgraded. The tool is free from Microsoft and can be downloaded at the following link: http://www.microsoft.com/downloads/thankyou. aspx?familyId=67240b76-31484e49943d4d9ea7f77730&displayLang=en&hash=ohAr 4r%2fcCuNEG9IsVgfpLcVL9AnJ5Oz7%2fask8Hy1ZJmWNvxc84WeNVGlLl1PPeK B0pGlsn7suLdEHZaGxKWEMg%3d%3d. www.syngress.com
Installing Windows Vista • Chapter 2
Note that the Windows Vista Hardware Assessment Tool requires Microsoft Word and Excel from Office 2003SP2 or Office 2007.
EXERCISE 2.5 USING THE WINDOWS VISTA HARDWARE ASSESMENT TOOL Prerequisites: .NET 2.0 Framework, Word and Excel 2007 or 2003 SP2 SQL Express edition or an Internet connection (so it can be downloaded) Microsoft Installer 3.1 1. Download the Windows Vista Hardware Assessment Tool from Microsoft. 2. Double-click Windows_Vista_Hardware_Assessment_Setup.exe. 3. Click Next on the Welcome To The Windows Vista Hardware Assessment Setup Wizard screen, as shown in Figure 2.26.
Figure 2.26 The Windows Vista Hardware Assessment Setup Screen
www.syngress.com
95
96
Chapter 2 • Installing Windows Vista
4. Read the Microsoft Software License Terms and click I Accept The Terms Of The License Agreement (if you agree), and then click Next. 5. Click Next at the Installation Path C:\Program Files\Windows Vista Hardware Assessment. (You can change the installation path if you wish to do so.) 6. Select Download and Install, and then click Next. 7. Read the Microsoft Software License Terms for the Microsoft SQL Server 2005 Express edition, click I Accept The Terms Of The License Agreement (if you agree), and then click Next. 8. Click Install on the Installation Summary Screen. 9. Wait for the SQL Express edition to be downloaded and installed, and for the Windows Vista Hardware Assessment to be installed, as shown in Figure 2.27.
Figure 2.27 The Installing the Windows Vista Hardware Assessment Screen
10. Click Finish on the Successful Installation screen. 11. On the Welcome To The Windows Vista Hardware Assessment Wizard screen, as shown in Figure 2.28, click Next. www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.28 The Windows Vista Hardware Assessment Setup Screen
NOTE You will need local administrative privileges on each machine you are inventorying. You will also need to enable the remote administration and file and print sharing exceptions on the computers you are planning to inventory. The details for these procedures are explained if you click the Getting Started button, as shown in Figure 2.28.
12. Give the Inventory database a name (for example, Syngress), and then click Next. 13. On the Actions To Perform screen, as shown in Figure 2.29, leave the default three check boxes checked and check the Use Simple Network Management Protocol box if the SNMP agent is running devices on your network. www.syngress.com
97
98
Chapter 2 • Installing Windows Vista
Figure 2.29 The Windows Vista Hardware Assessment Action to Perform Screen
14. On the Computer Discovery Page, select the appropriate options that fit your network. The first two options, Use The Windows Networking Protocol and Use The Active Directory Domain Services are checked by default. You can leave them checked or uncheck them depending upon your network setup. Other options available include Import Computer Names From A File, Scan A Range Of IP Addresses, and Manually Enter Computers Names And Credentials. After the appropriate options have been selected, click Next. 15. On the Windows Networking Protocols screen, select the workgroups and domains from the list to include in the inventory. Then, click Next. After Vista has been installed, the Windows Experience Index can be used to check if any of the components in your system require upgrading. The Experience Index examines five parameters, which can be rated from 1 to 5.9, with one being the lowest possible score. Note: Ratings of 6 and above are reserved for future components. www.syngress.com
Installing Windows Vista • Chapter 2
Vista looks at five parameters to determine the Windows Experience Index score, including processor, RAM, graphics, gaming graphics, and primary hard disk. The processor rating is determined by the number of calculations per second it can handle. The RAM rating is based on the number of memory operations per second. Having a large amount of RAM with a high peak transfer rate will increase the rating for memory. The Graphics rating is based on the desktop performance for Windows Aero, while gaming graphics are rated based on 3D business and gaming graphics performance. If your graphics card does not support DirectX 9 (DX9) graphics or have a WDDM driver (Windows Vista Display Driver Model), your score will be lower than 2.0. The primary hard disk rating evaluates the disk transfer rate. SATA drives will have a higher numeric rating than IDE drives because they have a higher transfer rate. The SATA drive in my system, as shown in Figure 2.30, is rated as a 5.7, which is almost the highest rating available.
Figure 2.30 The Windows Experience Index
www.syngress.com
99
100
Chapter 2 • Installing Windows Vista
Unfortunately, a very low rating for one component can cause your overall score to be low. As shown in Figure 2.30, three of the five components have decent to high ratings, but the fact that both graphics and gaming graphics are rated as 1 brings down the overall Windows Experience Rating to a score of 1.
New & Noteworthy… The Windows Experience Index in Virtual PC, VMware, and Parallels I have yet to see anyone be able to achieve a high enough graphics score to utilize the Aero feature in Microsoft Virtual PC, VMware, or Parallels. This is obviously a disadvantage of using Vista in a virtual environment; not enough horsepower for all of the eye candy associated with Vista.
In summary, the Windows Experience Index is useful for consumers who may want to know which component is “holding their machine back.” It serves as a gauge for consumers (and gamers), so they are better able to maximize their performance. The Experience Index also gives consumers the ability to make a more informed decision regarding their PC purchase. Someone looking to purchase a new machine with Windows Vista installed can use the Windows Experience Index to make an informed decision about a PC that they are purchasing. Finally, the Windows Experience Index can be evaluated by financial decision makers within companies that are not getting the desired performance from their machines. The numbers in the Index may help sell upper management on the fact that certain components need to be upgraded, as opposed to simply trying to explain to them that “the computer is slow.”
www.syngress.com
Installing Windows Vista • Chapter 2
EXERCISE 2.6 USING
THE
VISTA WINDOWS EXPERIENCE INDEX
1. Click the Pearl (start), right-click Computer, and select Properties. 2. Under the heading System, find Windows Experience Index, which is listed next to Rating, as shown in Figure 2.31. (Note: If the computer has yet to be rated, it will say Unrated. Otherwise, a score will be listed.)
Figure 2.31 Accessing the Windows Experience
3. Click the Rate This Computer button. 4. Click Continue To The User Account Control Box when prompted (if it is turned on). 5. Click Update My Score. (Note: It may take a while before you receive the score of your system.) www.syngress.com
101
102
Chapter 2 • Installing Windows Vista
Using Upgrade Advisor Upgrade Advisor from Microsoft will inform you which hardware and software components may need to be upgraded in order to run Windows Vista on your PC. Upgrade Advisor is a great tool because it makes you aware of software and hardware issues prior to the installation of Vista, as evidenced in Figure 2.32. If an individual learns that critical hardware or software will not operate after an upgrade to Windows Vista, they may decide to purchase a newer PC or they may decide to keep their current operating system. Certain software packages have updates that will allow them to work in Vista. Checking a manufacturer’s Web site for information regarding compatibility with Vista is never a bad idea. In some cases, unfortunately, older versions of software will not operate in Vista, and the consumer will be required to purchase a newer version of the software. This is also the case for consumers stuck with a piece of hardware that will not function in Vista. One of the individuals I do support for has a printer that will not work in Vista. When I checked the manufacturer’s Web site for more information, they claimed they would not be releasing a driver for Vista for that printer model. In cases such as this, consumers need to weigh the costs and benefits of upgrading to Vista versus the price of upgrading new software and hardware. Figure 2.32 A Report of System Issues before a Decision Is Made to Upgrade to Vista Business Edition
The output of Microsoft Windows Vista Upgrade Advisor is easy to read, and can be saved as a Web page. Don’t be surprised if your output is five to six pages long, especially if you have been running XP for more than a few years. The report will indicate if there are issues with hardware or software that must be dealt with prior to the installation of Vista. In the example report shown in Figure 2.33, a system issue must be addressed before the PC can be upgraded to Vista. In this case, the user’s PC does not have the required free space to install Vista. Many older laptops have relatively small hard drives, so in this case the user may want to get a larger hard drive, get an additional hard drive, or buy a new laptop. In Figure 2.34, it explains that the user will need a DVD-ROM drive prior to upgrading to Vista. Upgrade Advisor is reporting the need for a DVD-ROM because the Vista installation disk comes on a DVD, not a CD. Some older laptops or PCs may www.syngress.com
Installing Windows Vista • Chapter 2
not have DVD Drives, so this could be an issue. However, the installation can still be accomplished successfully if a network drive is mapped to a computer that is sharing out its DVD drive. Figure 2.33 A Windows Vista Business Task List – Things to Do before Installing Vista
www.syngress.com
103
104
Chapter 2 • Installing Windows Vista
Figure 2.34 A Windows Vista Business Task List – Things to Do before and after Installing Vista
The output of Upgrade Advisor will also display issues with programs that must be dealt with prior to upgrading to the Business edition of Windows Vista. In the output of the report (the one shown in Figure 2.34), the user is warned that the version of Nero must be uninstalled prior to upgrading to Windows Vista. The report says that the program can then be reinstalled after upgrading, but the application software might not function properly. If there are any issues with software after upgrading, check the manufacturer’s Web site. Upgrade Advisor will also inform users of system and software issues that will need addressing after upgrading to Vista. Figure 2.34 indicates that the user will www.syngress.com
Installing Windows Vista • Chapter 2
need to upgrade their video card if they want to utilize the Aero feature of Vista. In Figure 2.35, the user is warned that his mouse will not function after upgrading to Vista. Figure 2.35 also provides an extensive list (I actually had to omit some of the output) of programs that might have “minor compatibility issues” after upgrading to Vista. If any of the programs in Upgrade Advisor are critical to your job, check the manufacturer’s Web site for additional details or documentation. Figure 2.35 A Windows Vista Business Task List – Programs with “Minor” Compatibility Issues
www.syngress.com
105
106
Chapter 2 • Installing Windows Vista
Backing Up Data Before upgrading any system to Vista from Windows XP, you should always back up the system data. This is a standard practice I have adhered to for years as I have migrated from one Microsoft operating system to another. There are several reasons for doing this, including the fact that it is possible to format or delete partitions (which may include your data) during the installation process. Another good reason to back up your data before you upgrade is that there is always a possibility you will be dissatisfied with your new operating system and may want to revert to your previous one. You can utilize the Windows backup program, NTBackup, to back up your data. NTBackup, as shown in Figure 2.36, has some advanced capabilities, but it is traditionally used to simply back up files and folders you select. Regardless of whether NTBackup or a third-party application is used, backing up your data in some form always makes sense. If you feel that NTBackup is too difficult, you can always just burn documents, MP3s, and video files to a DVD, or save them to a USB stick or other USB mass storage device. The only thing you really need to complete backups is some time and additional media. If things were to go wrong, and you failed to back up any data, you would be stuck either using computer forensic tools to try to recover your data or paying a lab to try to recover your files. Even though computer forensic tools have become more advanced over recent years, there is never a guarantee your data will be recovered. So, backing up data is always a good idea, especially when upgrading your operating system.
www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.36 Using NTBackup to Designate Files to Be Backed Up
New & Noteworthy… The “Ultimate Backup” When the Ultimate edition of Vista is backed up, a Virtual Hard Disk (VHD) file is created. You can import and read that file in Microsoft Virtual PC.
The User State Migration Tool The Windows User State Migration Tool (USMT) Version 3.0.1 is used to migrate settings from previous operating systems to a Windows Vista system. The tool can be downloaded from Microsoft at www.microsoft.com/downloads/details. aspx?FamilyId=799AB28C-691B-4B36-B7AD-6C604BE4C595&displaylang=en. www.syngress.com
107
108
Chapter 2 • Installing Windows Vista
The benefit this tools provides is that unique settings from users’ profiles can be “loaded” to a network share and then “reloaded” back to that workstation or another machine after the upgrade process. If a computer develops “complications” during an upgrade process, or profile settings need to be loaded to a newer PC, USMT will ensure that a number of unique settings can be retained. The settings that can be retained using USMT 3.0.1 include user settings, computer settings, file and folder settings, and application settings. This version of USMT includes the ability to migrate the Access Control Lists of files. Version 3.0.1 of USMT also is able to migrate files using the encrypted file system (EFS). Unlike previous versions of USMT, which were based on .ini (initialization) files, USMT 3.0.1 is XML-based.
EXERCISE 2.7 INSTALLING THE WINDOWS USER STATE MIGRATION TOOL (USMT) VERSION 3.0.1 1. Prior to upgrading, download the USMT Version 3.0.1 from Microsoft at the following URL: www.microsoft.com/downloads/ details.aspx?FamilyId=799AB28C-691B-4B36-B7AD-6C604BE4C595 &displaylang=en. 2. Double-click the InstallUSMT301_x86.msi file. The Welcome To The User State Migration Tools Version 3.0.1 Setup Wizard screen should appear, as shown in Figure 2.37. Click Next.
www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.37 The User State Migration Tool (USMT) Version 3.0.1 Setup Screen
3. Read the License Agreement and click I Agree (if you agree to it), and then click Next. 4. On the Confirm Installation screen, click Next. 5. Click Close after you see the message that the User State Migration Tool (USMT) Version 3.0.1 has been successfully installed. 6. There will not be any program to launch from the Program Files menu, only a Help file. The User State Migration Tools are really just command-line tools used to load and unload profiles. The two main tools utilized are scanstate and loadstate. Run these two tools from the C:\Program Files\USMT301 Directory. 7. The scanstate command is used to copy the profile settings to a network share. Table 2.5 shows some scanstate switches. For a complete listing of switches for scanstate, type scanstate /? from the C:\Program Files\USMT301 directory. The syntax is Syntax: loadstate <StorePath> [options]. www.syngress.com
109
110
Chapter 2 • Installing Windows Vista
Table 2.5 Some of the Switches that Can Be Used with scanstate Switch
Function
StorePath
Indicates where the settings are stored.
/targetxp
Optimizes ScanState when the destination computer is running Windows XP. You should use this option with /genconfig and when you create a store.
/genconfig:FileName
Generates a Config.xml file. You cannot specifiy <StorePath>. The only other options are that you can specify are /I, /v, /l, and targetxp.
/o
Overwrites any existing data in the store.
/p
Generates a space-estimate file called USMTSIZE. TXT that is saved in the store. This option does not collect the user state. You must also specify /nocom press.
/localonly
Specifies that only files that are stored on the local computer will be migrated.
/efs:abort|skip|de cryptcopy|copyraw
abort: Fails if Encrypting File System (EFS) files are found. skip: Ignores all EFS files. decryptology: Decrypts and copies files if possible. Fails if the files cannot be encrypted.
copyraw:
Copys encrypted EFS files.
/encrypt
Encrypts the store. You must also specify /key or /keyfile.
/key:KeyString
Specifies the key.
/keyfile:FileName
Specifies the location and name of a .txt file that contains the key.
/nocompress
Specifies that the store is not compressed.
8.
The loadstate command is used to copy the profile settings from a network share. Table 2.6 shows some loadstate switches. For a complete listing of switches for loadstate, type loadstate /? from the C:\Program Files\USMT301 directory. The syntax is loadstate <StorePath> [options].
www.syngress.com
Installing Windows Vista • Chapter 2
Table 2.6 Some of the Switches that Can Be Used with loadstate Switch
Function
StorePath
Indicates where the settings are stored.
/lac[:Password]
Creates disabled local accounts if they do not already exist on the destination computer. Password is the password for the created accounts. An empty pass word is used by default.
/lae
Enables local accounts created by /lac. You must also specify /lac.
/q
Allows LoadState to run without administrative credentials.
/mu:[OldDomain\] OldUserName:[New Domain\]NewUserName
Specifies a new user name. For local users, specify OldUserName and NewUserName. Wildcard characters are not allowed.
/md:OldDomain: NewDomain
Specifies a new domain for the user(s). OldDomain can contain wildcard characters (* or ?).
/decrypt
Specifies that the store is encrypted and needs to be decrypted. You must also specify /key or /keyfile.
/key:KeyString
Specifies the key.
/keyfile:FileName
Specifies the location and name of a .txt file that contains the key.
/nocompress
Specifies that the store is not compressed.
TEST DAY TIP The User State Migration Tool (USMT) Version 3.0.1 is XML-based, not based on INI files, like previous editions of the USMT. Scanstate and Loadstate are the two main tools utilized with the USMT. Remember that Version 3 will copy Access Control Lists and files and folders using EFS (Encrypting File System).
www.syngress.com
111
112
Chapter 2 • Installing Windows Vista
Upgrading from Windows XP Upgrading from XP to Vista is a relatively straightforward and simple process. As mentioned earlier, before you consider upgrading a machine, use Windows Vista Upgrade Advisor to uncover any compatibility issues. After using Upgrade Advisor, you need to decide which version of Vista you will use. This really depends on the version of Windows XP you are currently running. (Note: No versions of Windows 2000 or 2003 can be upgraded to Vista.) Table 2.7 explains the possible upgrade paths. XP Home edition actually has the most (four) upgrade options. Table 2.7 Upgrade Paths for the Different Versions of Windows XP XP Version
Upgrade Option
XP Home edition
Vista Home Basic, Home Premium, Business, or Ultimate
XP Media Center edition
Vista Home Premium or Ultimate
XP Home Professional
Business or Ultimate
TEST DAY TIP Keep in mind the upgrade paths from the different versions of Windows XP to the different versions of Vista. Remember, XP Professional can not be upgraded to Home Basic or Home Premium. Even though they are newer, these operating systems cannot join a domain. So, in a way, going from XP Professional to Vista Home Basic or Premium would be like downgrading.
EXERCISE 2.8 UPGRADING FROM WINDOWS XP PROFESSIONAL TO WINDOWS VISTA BUSINESS EDITION 1. While in the Windows XP operating system, insert the Windows Vista Installation DVD in the drive. The Install Windows screen with the Vista logo will appear on your screen. Choose Install Now. www.syngress.com
Installing Windows Vista • Chapter 2
2. On the Get Important Updates For Installation screen, as shown in Figure 2.38, you can choose to download the latest updates if you have an Internet connection. If you do not have an Internet connection or do not want to download the latest updates at this time, select Do Not Get Updates.
Figure 2.38 Updates Can Be Downloaded Prior to Upgrading Windows to Vista
3. Type in your product key number or click Next if you do not have one. Hint: The Automatically Activate Windows When I Am Online check box is checked by default. Uncheck it if you want to manually activate Windows yourself when you are ready. If you do not type in a product key number, you will be warned. Click No to continue without entering a product key number. www.syngress.com
113
114
Chapter 2 • Installing Windows Vista
4. Select the version of Vista you have purchased. Do not choose Business N or Home Basic N. Windows XP Professional can not be upgraded to either of these two versions of Vista. Check the box labeled I Have Selected The Version Of Vista That I Have Purchased and then click Next. 5. Read the Microsoft Software License Terms and then check the box if you agree to the terms. 6. Select Upgrade, as shown in Figure 2.39.
Figure 2.39 Upgrading from Windows XP to Windows Vista
7. You may receive a warning at the next screen that your system has potential issues with applications and devices. You can click the link to receive more information or click Next. If you click the link, you will receive a report similar to the one in Figure 2.40 that warns of potential hardware and software issues after the upgrade. Click Next to continue the upgrade. www.syngress.com
Installing Windows Vista • Chapter 2
Figure 2.40 A Compatibility Report during the Windows Vista Installation Process
8. A screen should appear indicating that Windows is being upgraded. As shown in Figure 2.41, notice that the line at the bottom says the upgrade may take several hours to complete.
www.syngress.com
115
116
Chapter 2 • Installing Windows Vista
Figure 2.41 The Upgrading Windows Screen during a Windows Vista Installation
9. After the installation has completed, perform the post installation tasks. 10. Patch your system by getting all of the latest critical updates from Windows.
EXERCISE 2.9 VIEWING THE FOLDERS ON A SYSTEM UPGRADED FROM WINDOWS XP PROFESSIONAL TO WINDOWS VISTA 1. Click the Pearl (start), and then click Computer. 2. Double-click C:. www.syngress.com
Installing Windows Vista • Chapter 2
3. Notice that the Documents and Settings folder appears to be gone, as shown in Figure 2.42. The Documents and Settings folder has been replaced with the Users folders. If you doubleclick the Users folder, you will see all of the User’s profiles. If you try to enter any user folder other than your own, you will be warned that you do not have permission to access that folder, even if your account has administrative rights. This is because User Account Control is turned on after you upgrade to Vista. (If this was a custom install over an existing version of Windows (without formatting), you would see a folder called Windows. old. Your previous operating system’s files would be located in that folder.)
Figure 2.42 The Users Folder Replaces the Documents and Settings Folder
4. Click the Back button to return to the Local Disk (C:) menu, as shown in Figure 2.42. 5. Click the Organize button (on the left hand of the menu pane), as shown in Figure 2.42, and select the folder and search options. Click the View tab to show hidden files and folders, as shown in Figure 2.43. 6. Click the button that shows hidden files and folders, as shown in Figure 2.43. Remove the check from the box labeled Hide Protected Operating System Files (Recommended), as shown in Figure 2.43. www.syngress.com
117
118
Chapter 2 • Installing Windows Vista
Figure 2.43 The View Tab of Folder Options
Notice that the Documents and Settings Folder is now present and appears to be a link. If you attempt to click the link, you will receive an Access Is Denied message. (Even if your account has administrative privileges.) Microsoft describes it as a junction point. Even though Microsoft decided to reorganize the folder structure, they needed this junction point to be present so legacy software written from earlier versions of Windows could still be installed.
www.syngress.com
Installing Windows Vista • Chapter 2
Troubleshooting Installation Issues A number of factors can cause an installation to fail. Using Windows Vista Upgrade Advisor can alert you to issues you need to address prior to installation, such as insufficient available disk space. Whenever you are installing any operating system on a PC, always verify that the computer meets the minimum hardware requirements. If you continue to have problems trying to get Vista Installed, check the PC manufacturer’s Web site. In the past, I have spent hours troubleshooting installation issues, only to later find out that the motherboard was incompatible with a certain flavor of an operating system. Also, examine your Vista DVD carefully. If there are scratches or marks on the DVD, it can cause the installation to fail. Also, check the label on your Windows Vista DVD to see if you purchased the 32-bit or 64-bit version of Vista. If you purchased a 64-bit version of Vista, make sure your PC has a 64-bit processor. If the PC only has a 32-bit processor, you cannot install the 64-bit version of Vista.You can, however, install a 32-bit version of Vista on a computer with a 64-bit operating system. Sometimes settings in the BIOS can be the culprit when you are performing an installation and Windows cannot locate any hard disks in your system. With the specific motherboard we have at our company, we need to use the “compatible” SATA setting or we will have issues with the DVD and hard disks being recognized. Tweaking BIOS settings can often help solve issues with installations. Check the manufacturer’s Web site to get more information about how your BIOS settings can be adjusted. There may also be firmware updates for the BIOS that you need to download and install on to your system to use Vista. Finally, if you are receiving a certain error message during the installation process, use Microsoft’s Web site or Google to see if you can get more information about what is causing the installation to fail.
Addressing Hardware Issues Using Windows Vista Upgrade Advisor can alert you to potential hardware issues. After installation has completed, check Device Manager to see if any of your hardware devices are lacking drivers. If any drivers have a problem, a small yellow triangle will appear next to the device’s name, as shown in Figure 2.44.
www.syngress.com
119
120
Chapter 2 • Installing Windows Vista
Figure 2.44 Device Manager Indicating a Hardware Problem
One of the most common hardware issues with Vista is that the video card is not able to use the Aero feature. If Aero is not working properly and you have a high-end video card in your system, check the manufacturer’s Web site for an updated driver. If you are using the 64-bit version of Vista, all drivers need to be digitally signed. The signed driver requirements of the 64-bit version of Vista will mean that some older hardware will not operate on Windows Vista. Microsoft provides information about hardware compatibility for both the 32- and 64-bit versions of Vista on their Web site at http://winqual.microsoft.com/hcl/.
EXERCISE 2.10 CHECKING THE DEVICE MANAGER FOR HARDWARE PROBLEMS 1. Click the Pearl (Start button). 2. Right-click Computer and select Manage. 3. Click Continue To The User Account Control Box (if you are prompted). 4. Click Device Manager. 5. Click the + in front of the devices to see if any pieces of hardware are having compatibility issues. www.syngress.com
Installing Windows Vista • Chapter 2
6. If the device has a yellow triangle (indicating there is a problem), like that shown in Figure 2.44, right-click the device and select Update Driver Software. 7. As shown in Figure 2.45, two options are present: Search Automatically or Browse Manually. If you have the driver and know where it is, choose Browse Manually. Otherwise, select Search Automatically for updated driver software. If Search Automatically is selected, a wizard may appear, asking if you want to search online.
Figure 2.45 Fixing Hardware with a Device Driver Problem
Addressing Application Incompatibility One of the biggest hurdles to using Windows Vista has been the fact that applications from third-party vendors failed to work properly after the initial release. Many companies have worked diligently to update their software. Check the manufacturer’s Web site and the forums for the latest patches. When Vista was initially released, we found that many applications would not function properly. However, we have found that over time more applications have been rewritten to work with Windows Vista. www.syngress.com
121
122
Chapter 2 • Installing Windows Vista
Using Upgrade Advisor can alert you to potential software issues that may arise after you upgrade to Windows Vista. Another useful tool within Vista that helps you to run legacy applications is the compatibility mode feature, which was also available in Windows XP. If you have a program that was written for Windows 98, and you are trying to install it and the installation fails, try installing the program using the Compatibility Mode feature. We have had pretty good success using the compatibility mode feature in Windows. When you have been using Windows as long as wehave, you start to accumulate a large amount of older applications. To use the compatibility mode feature, as seen in Figure 2.46, right click on the executable file, go to properties and select the compatibility tab, as seen in Figure 2.46. Sometimes, you will be able to have success using applications written for legacy operating systems. Figure 2.46 Compatibility Mode for Software
www.syngress.com
Installing Windows Vista • Chapter 2
Addressing Licensing Issues Several things can be done to address issues with licensing and activation. First off, when asked at the Windows Vista Selection screen, make sure you pick the correct version of Vista you purchased. The product code will only work for the particular version of Vista you purchased. If you are unable to activate the copy of Vista you purchased, contact Microsoft. Activation does not have to be done over the Internet; you can contact a representative from Microsoft and activation can be handled over the phone. If you are reinstalling Vista, and significant hardware changes have been made to your PC, Windows Vista might not activate. If you are having activation issues with a legitimate copy of Windows Vista you purchased, contact Microsoft. For corporations dealing with activating multiple copies of Vista, using KMS and Proxy Activation make sense. If a Key Management Server is up and running in your environment, the command slmgr.vbs /dli will determine if the Key Management System is active. If using a MAK volume license key, the Volume Activation Management Tool (VAMT) will let you know which PCs in your infrastructure have been activated. Finally, if you are having large-scale problems with activation and need to fix the problem fairly quickly, the rearm procedure can buy you some extra time. More information about rearming (a documented “feature” of Vista) can be found on the Web.
Other Troubleshooting Tips Several times I have had issues with PCs that have Vista installed in a dual boot configuration. Sometimes these dual boot systems between Windows XP and Windows Vista, or between Windows 2003 and Vista, will not boot. Putting the Vista Installation DVD in the drive has actually fixed the problem. If inserting the DVD fixes the problem, then the installation can most likely be repaired by booting to the Windows Vista DVD and choosing the start-up repair option. The Windows Installation DVD will also allow you to perform a system restore and a complete Windows PC backup restore.
EXERCISE 2.11 USING THE WINDOWS VISTA INSTALLTION DVD TO REPAIR PROBLEMS THAT PREVENT WINDOWS FROM STARTING 1. Boot to the Windows Vista Installation DVD. 2. Press Enter at the Windows Setup screen. www.syngress.com
123
124
Chapter 2 • Installing Windows Vista
3. Select English (or another language) as the language to install and then click Next. 4. Click the Repair Your Computer option. 5. On the System Recovery Options screen, click Next. 6. Select Startup Repair on the System Recovery Options screen, as shown in Figure 2.47.
Figure 2.47 The Startup Repair System Recovery Option
www.syngress.com
Installing Windows Vista • Chapter 2
Summary of Exam Objectives Windows Vista is vastly different than previous operating systems released by Microsoft. It comes in six versions: the Starter, Home Basic, Home Premium, Business, Enterprise, and Ultimate editions. Home Basic and Home Premium were designed for home use, while the Business and Enterprise editions were created with the workplace in mind. The Ultimate edition contains features from all the versions, including the BitLocker feature. The installation of Vista is different from the installations of Windows 2000, XP, and 2003. Windows Vista also uses Activation 2.0, which requires all copies of Vista, including volume license copies, to be activated. The Windows XP Home edition can be upgraded to Home Basic, Home Premium, Business, or Ultimate. Windows XP Professional can be upgraded to Business or Ultimate. Microsoft has provided consumers with a number of tools, such as Upgrade Advisor, that will indicate if potential hardware or software problems could arise before or after an installation. After its initial release, many issues concerning hardware and third-party software compatibility with Vista came to light. As a result, many companies have since released updates (often found on their Web sites) that will allow their hardware or software to function properly in Vista.
Exam Objectives Fast Track Preparing a New PC ˛ Examine your PC to see if it meets the minimum requirements for Vista.
Those requirements are an 800 MHz CPU, 512 MB of RAM, a hard disk with 15 GB of free space, and a video card with support for SVGA graphics. ˛ Run Microsoft Upgrade Advisor on the PC to determine possible
hardware- and software-related issues. ˛ If you are installing the Enterprise or Ultimate editions of Vista and plan to
implement BitLocker, create a small partition of at least 1.5 GB. This partition is needed for the unencrypted boot information needed to load the system.
Installing Windows Vista Business Edition ˛ If you are upgrading a large number of PCs, the Windows Vista Hardware
Assessment Tool can be used to inventory up to 25,000 computers.
www.syngress.com
125
126
Chapter 2 • Installing Windows Vista
˛ A Key Management Server (KMS) can be used if the company has a KMS
volume license and at least 25 computers running the Vista Business (or Enterprise) edition. ˛ If you choose to use the Business edition of Vista, keep in mind that
neither Parental Controls nor BitLocker can be implemented. Parental controls are available in all versions of Vista except Business and Enterprise editions, and BitLocker is only available in the Enterprise and Ultimate editions.
Upgrading to Windows Vista Business Edition ˛ Back up all critical files and folders. The recommended minimum files
and folders are important documents; data, music, and video files; Internet Explorer favorites; and any other critical files you have on your XP system. ˛ Make sure the Upgrade option is not grayed out and disabled when
attempting to upgrade your system from a prior version of Windows XP. If the option is grayed out, this could be due to the fact that the Vista install DVD needs to be inserted while XP is running or an upgrade from your version of XP to that version of Vista is not supported. ˛ Both XP Home and XP Professional can be upgraded to the Business
edition of Windows Vista. Windows XP Media Center cannot be upgraded to Windows Vista Business edition.
Troubleshooting Installation Issues ˛ Check the motherboard manufacturer’s Web site for any issues related to
Vista and any recommended changes to firmware updates to the BIOS. ˛ The Vista Installation DVD can be used to repair problems with the
operating systems. Options such a System Restore, Startup Repair, and Windows Memory Diagnostics can be run from the Vista Installation DVD. ˛ Verify that the minimum hardware requirements have been met and that
the PC’s hard drive has enough available disk space.
www.syngress.com
Installing Windows Vista • Chapter 2
Exam Objectives Frequently Asked Questions Q: How many editions of Vista are there? A: There are six editions of Vista: Starter, Home Basic, Home Premium, Business, Enterprise, and the Ultimate edition.
Q: What is the function of the Windows Experience Index? A: The Windows Experience Index looks at five parameters (Processor, RAM, Graphics, Gaming Graphics, and Primary Hard Disk Ratings) to determine your system’s score (from 1.0 to 5.9), with 1.0 being the lowest overall score.
Q: What is Volume Activation 2.0? A: Vista and Server 2008 use Activation 2.0, which is different than the Activation (1.0) used by XP and 2003. With Volume Activation 2.0, all copies of Vista, including volume license copies, need to be activated.
Q: What types of volume license keys are offered with Windows Vista? A: The different volume license key types offered with Windows Vista are Key Management Service Keys and Multiple Activation Keys. All copies of Windows Vista, including volume license copies, must be activated.
Q: Do I need to have more than one partition if I am planning to use BitLocker? A: No. BitLocker only requires a separate small partition for the unencrypted boot information needed to load the system.
Q: What is Windows Vista Upgrade Advisor? A: Windows Vista Upgrade Advisor gives users information about potential hardware and software issues that could arise after they install Vista on their system.
www.syngress.com
127
128
Chapter 2 • Installing Windows Vista
Q: What are the minimum requirements for the Business edition of Vista? A: The minimum requirements for Windows Vista Business are a 1 GHz 32-bit (x86) or 64-bit (x64) processor, 1 GB of system memory, a 40 GB hard drive with 15 GB of free space, and a video card with 128 MB of graphics memory (minimum).
Q: What happened to the Documents and Settings folder? A: Users’ profiles are now stored in the Users folder. The Documents and Settings folder still exists as a link for legacy purposes, and is referred to by Microsoft as a junction point.
www.syngress.com
Installing Windows Vista • Chapter 2
Self Test 1. What is the Documents and Settings folder in Vista referred to as? A. A symbolic link B. A folder no longer present C. A junction point D. An NTFS system file 2. Which versions of Vista lack Parental Controls? A. Basic and Home Premium B. Starter and Ultimate C. Enterprise and Ultimate D. Business and Enterprise 3. What is the recommended minimum amount of RAM needed to use Vista Home Premium? A. 1024 MB B. 512 MB C. 128 MB D. 256 MB 4. On which versions of Vista can BitLocker be implemented? A. Home Basic and Home Premium B. Starter and Ultimate C. Enterprise and Ultimate D. Business and Enterprise 5. What is the minimum amount of RAM needed to use Vista Home Basic? A. 1024 MB B. 512 MB C. 128 MB D. 256 MB
www.syngress.com
129
130
Chapter 2 • Installing Windows Vista
6. What are the two main tools utilized with the User State Migration Tool (USMT) Version 3.0.1? A. loadstate and convert B. scanstate and loadstate C. convert and scanstate D. UAC and convert 7. What is the name of the backup program built into Windows XP that can be utilized before a user upgrades their PC? A. Ghost B. System Restore C. Volume Shadow Copy D. NTBackup 8. Which version of Vista will not be for sale in developed technology markets such as Europe or Japan? A. Ultimate B. Home Basic N C. Business N D. Starter 9. Which versions of Vista were designed to satisfy a settlement between Microsoft and the European Union? A. Home Basic and Home Premium B. Starter and Ultimate C. Enterprise and Ultimate D. Business N and Home Basic N 10. XP Home edition can be upgraded to which versions of Vista? A. Home Basic B. Ultimate C. Home Premium D. Business
www.syngress.com
Installing Windows Vista • Chapter 2
Self Test Quick Answer Key 1.
C
6.
B
2.
D
7.
D
3. A
8.
D
4.
C
9.
D
5.
B
10. A, B, C, and D
www.syngress.com
131
This page is intentionally left blank
Chapter 3
MCTS/MCITP Exam 620 Configuring Windows Vista Exam objectives in this chapter: ■
Configuring Windows Aero
■
Working with Parental Controls
■
Configuring Internet Explorer
■
Configuring Network Settings
Exam objectives review: ˛ Summary of Exam Objectives ˛ Exam Objectives Fast Track ˛ Exam Objectives Frequently Asked Questions ˛ Self Test ˛ Self Test Quick Answer Key 133
134
Chapter 3 • Configuring Windows Vista
Introduction If you are a fan of high-end graphics and a feature-rich desktop, then Vista is a good choice for an operating system platform. Windows Vista is known for its eye candy; however, the high end graphical capabilities require a large amount of computing horsepower. Many of the computers currently running Windows XP will need to have components, such as the RAM and video card, upgraded or replaced. The Upgrade Advisor, a free download from Microsoft, will warn you if components will not be suitable for the high-end demands of Windows Vista. In many cases, individuals will need to purchase entirely new systems to run Windows Vista. Unless their computer has a high-end motherboard that supports a large amount of RAM and a quick expansion bus, they will need to replace the motherboard or buy a new high-end system. While buying a new system to accommodate the hardware demands of Vista may make sense for individuals such as highend gamers, it may not make sense for companies who may have to replace hundreds or thousands of computers. While eye candy and a feature-rich environment are nice features, they may not be needed or necessary for people to perform daily tasks. Vista has more than just an improved graphical interface; it greatly improves the security and features related to Windows networking. Several features are included within Vista to make using wireless networks more secure. There are also enhancements to the Internet Explorer browser that will give the end user a more satisfying and enjoyable browsing experience. Finally, Microsoft has added a Parental Control feature on the Ultimate and two Home editions of Vista which will assist parents limiting their children’s access to Web sites.
Configuring Windows Aero One of the major improvements to the desktop in Windows Vista is the Aero Glass feature. Aero provides the user with several robust features including a translucent interface, detailed icon animations, and smoother graphics. Some of the features of the Aero package include taskbar thumbnails, Windows flip, and “flip 3D.” The Starter and Home Basic versions do not include the Aero Glass feature. Computers with the Business, Ultimate, Home Premium, and Enterprise editions of Vista that have lower-end graphics cards will also not be able to use the features that are part of the Aero package. In order to use the Aero feature of Vista, the correct driver needs to be installed for your video card. Many of the drivers included with the Vista installation DVD are not current. Check Windows Update and the manufacturer’s Web site to www.syngress.com
Configuring Windows Vista • Chapter 3
make sure you have the latest driver for your video card. After you have updated your system with the latest video, activating the Aero feature is a simple process. To activate Aero on a supported Vista system, right-click on the desktop, select Personalize, click on Window Color and Appearance and select Aero from the top of the list, as seen in Figure 3.1.
Figure 3.1 Configuring Windows Vista to Use Aero Glass
If Windows Aero is not displayed in the list, your graphics card may not support it, or you may need to update your graphics card. Note: If you are using the Home Basic edition of Vista, you will only see Windows Vista Basic at the top of the list because Aero is not supported. www.syngress.com
135
136
Chapter 3 • Configuring Windows Vista
Once you have selected Windows Aero for your appearance settings, there are eight colors to choose from including default, graphite, blue, teal, red, orange, pink, and frost. Transparency is enabled by default, but can be turned off by removing the check in front of enable transparency. With Windows Aero, you can enjoy a robust graphics experience that was not available in previous versions of Windows. Aero will provide users with translucent windows and smooth icons. Other features of Aero that will improve the user experience are “Windows flip” and “Windows 3D-flip.” In previous versions of Windows, you could use the Alt and Tab keys to switch to different running applications. In previous versions of Windows, however, only a generic icon was shown to launch the applications such as Microsoft Word, Media Player, or Paint. The Windows flip feature of Aero will also allow you to scroll through open applications, but instead of generic icons, thumbnails of the actual application are displayed. The Windows 3-D flip feature of Aero will allows users to scroll through a three-dimensional view of open applications, as seen in Figure 3.2. Figure 3.2 Windows Aero 3-D Flip
www.syngress.com
Configuring Windows Vista • Chapter 3
TEST DAY TIP Know the key combinations that allow you to scroll though the flip and 3-D flip features of Aero. The Alt and Tab keys are used to scroll through the flip. The Windows Button and Tab keys are used to scroll through the 3-D flip.
If you have the Ultimate Edition of Vista, there is one more feature that can be utilized once Aero has been enabled on your system. Windows DreamScene is a feature which will allow you to use full motion videos as your desktop background. DreamScene is part of the Ultimate Extras, which are only available for download by users with the Ultimate Edition of Vista. To download the Ultimate Extras, select the Windows Update applet from the control panel and click on Windows Ultimate Extras, as seen in Figure 3.3. Figure 3.3 Downloading Windows DreamScene, a Windows Ultimate Extra
www.syngress.com
137
138
Chapter 3 • Configuring Windows Vista
Once this Ultimate Extra has been downloaded, Windows DreamScene Content will become one of the background choices for your desktop, as seen in Figure 3.4.
Figure 3.4 Selecting a Windows DreamScene Background as Your Desktop
If you attempt to use a DreamScene background and Windows Aero is not enabled, you will be warned to configure Aero first before using DreamScene Content. There are eight DreamScene videos that come packaged with the Ultimate Extra download, including a waterfall, a Windows logo, moving flowers, rain, a stream, and a few others. You can also download other videos that can be utilized as DreamScene backgrounds. Movie files with MPEG and WMV extensions can be utilized. Several Web sites offer videos that can be downloaded and used as DreamScene content. The site www.winmatrix.com/forums/index.php?showtopic=12435 has several High Definition (HD) DreamScene videos. Download the videos to the %systemroot%\ Web\Windows DreamScene directory.You can also just browse to a video file with the correct extension, right-click and select set as desktop background. www.syngress.com
Configuring Windows Vista • Chapter 3
While Windows DreamScene is a great feature which enhances the user experience and gives new life to the desktop, it does demand a certain amount of your CPU’s resources. Be careful to monitor your CPU consumption before and after you add DreamScene content to your desktop. You can use either task manager or the CPU gadget, as seen in Figure 3.5, to monitor your CPU usage.
Figure 3.5 The CPU Meter Gadget
A DreamScene background can be paused if necessary by right-clicking on the desktop and selecting Pause DreamScene. If you wish to resume the DreamScene video, right-click on the desktop and select Play DreamScence. In summary, the Windows Aero features of Vista can be utilized best on a system that has a high-end graphics card. If you notice that after Aero has been turned on, your computer’s performance has degraded to the point where it is almost no longer functional, you may want to consider turning the feature off. You may also want to turn off the Aero feature if you are using a laptop and you feel that Aero is draining too much of your battery power. While the Aero feature will enhance the user experience, it is not a requirement of using Vista.
EXERCISE 3.1 ENABLING AERO GLASS
IN
WINDOWS VISTA
1. Right-click on the Desktop and choose Personalize. 2. Click Windows Color and Appearance from the list, as seen in Figure 3.6. www.syngress.com
139
140
Chapter 3 • Configuring Windows Vista
Figure 3.6 Windows Personalization Screen
3. Select Windows Aero from the list (see Figure 3.1) and click Apply. 4. Holding the Windows key down and clicking the Tab key will allow you to use the Windows 3-D flip feature, as seen in Figure 3.2.
New & Noteworthy… Using Aero in Virtual PC, VMware, and Parallels I have yet to see anyone be able to get the Aero feature to work in Microsoft Virtual PC, VMware, or Parallels. This is obviously a disadvantage of using Vista in a virtual environment; not enough graphics card memory to use the Aero feature of Vista.
www.syngress.com
Configuring Windows Vista • Chapter 3
Working with Parental Controls Parental Controls are a new feature within all versions of Windows Vista except the Business and Enterprise editions. The reason Parental Controls were likely excluded from the Business and Enterprise editions is these versions tend to be utilized in corporations that may have Internet usage policies in place. Also, the Parental Controls were designed to be enforced on children; if these controls are used on adults there could be privacy issues, as Web usage and behavior is being tracked. They allow an administrative account to set restrictions on what Web sites standard users can visit. Parental Controls can only be applied to standard accounts; they can not be applied to administrative accounts. If someone tries to apply Parental Controls to an administrative account, they will be warned that Parental Controls can only be applied to standard users. The system will then display a pop-up box, as seen in Figure 3.7, and ask if the administrative account should be changed to a limited user account.
Figure 3.7 Parental Controls Can Not Be Applied to Administrative Accounts
If the user clicks No, the account will remain an administrative account. If the user clicks Yes, the account will immediately be demoted to a standard user. There must, however, be one administrator left on the system. If you try to demote the last enabled administrative account, you will be prompted to create a new separate user. Any user who has administrative rights can be demoted to a standard user, except the built-in administrator. The built-in administrator account will not show up in the Parental Controls list. Another important feature related to Parental Controls and the administrative accounts is a blank administrative password. A blank administrative password will in www.syngress.com
141
142
Chapter 3 • Configuring Windows Vista
effect render Parental Controls useless. If the Parental Control applet is accessed, and an administrative account with a blank password exists, you will receive a warning, as seen in Figure 3.8.
Figure 3.8 Parental Controls Fail When Administrative Accounts Have Blank Passwords
If parental controls are enabled on standard users, they will be asked for permission to access a Web page. Once users click on the link that says Ask an administrator for permission, as seen in Figure 3.9, they will receive a User Account Control Box that displays a list of administrative accounts on the computer.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.9 Parental Controls Blocking Access to a Web Page
If one of the administrative accounts happens to have a blank password, the user just needs to click on that administrative account then click Ok. The standard user will then be presented with a dialog box, as seen in Figure 3.10, which will permit him or her to add this site to the allowed site list. Figure 3.10 Adding a Web Site to the List of Allowed Sites
www.syngress.com
143
144
Chapter 3 • Configuring Windows Vista
While it may seem obvious that blank passwords would subvert restrictions such as Parental Controls, average users may not be aware of the problems. Leaving the default administrative account password blank in home systems is a common practice. With Vista, there are several inherent dangers in doing this. If an administrative password is left blank, a standard user can easily bypass the Parental Controls. Another problem is that users could in fact log in as the administrative account, turn off their Parental Control features, and delete their activity logs. Be aware that there are utilities for free download that will allow users to enable the administrative account and blank the password. Kids seem to be well aware of ways that allow them to bypass restrictions; parents are often clueless that such methods exist.
New & Noteworthy… The Days of Blank Passwords Are Now Over If you have a blank password on the Administrative Account, then Parental Controls will fail. Standard users under Parental Control restrictions will be able to use the administrative account with a blank password to add every site they choose to their list of allowed sites.
Configuring Parental Controls The Parental Control feature can be accessed by clicking on the Parental Control applet in the Control Panel. When Parental Controls are turned on, the four settings that can be configured are Web Restrictions, Time Limits, Game Ratings, and Program Limits. Once Parental Controls are enabled, as seen in Figure 3.11, activity reporting can also be turned on for the corresponding user account. Activity Reports, which are covered in the next section, will give detailed information about computer usage.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.11 Turning Parental Controls on in Windows Vista
Vista is the first Microsoft operating system to offer Parental Controls. There has been a lot of publicity over incidents regarding the exploitation of minors over the Internet. The Parental Control feature included with Vista will be a useful tool to assist parents in preventing children from accessing Web sites with inappropriate content. However, parents should not solely rely on the Parental Controls of Vista to protect their children. Parents need to educate their children about the dangers of Internet usage and make them aware of safe practices. Parents will also need to monitor activity logs to become familiar with the computer usage of their children. Parents should also discuss any aspects of the activity log reports that concern them with their children.
Web Restrictions The Windows Vista Web Filter feature of Parental Controls, as seen in Figure 3.12, will allow granular control of a standard user’s Internet browsing. The Windows Vista Web Filter will work for any Internet Browser installed on the system; the filters will apply to browsers other than Internet Explorer, such as Firefox or Mozilla.
www.syngress.com
145
146
Chapter 3 • Configuring Windows Vista
The four main categories under Web Restrictions are Which Parts of the Internet can the User Visit, Allow and Block Specific Web Sites, Block Web Content Automatically, and Block File Downloads, as seen in Figure 3.12. Figure 3.12 The Web Restrictions of Parental Controls
Which Part of the Internet Can the User Visit The first category of the Web Filters is Which part of the Internet can the User Visit, as seen in Figure 3.13. If the Allow all websites and content radio button is selected in the first category, then all of the corresponding choices are grayed out and no other selection can be made in any of the following three categories. The Allow all
www.syngress.com
Configuring Windows Vista • Chapter 3
websites and content selection will also give that user free reign of the Internet. If the Block some websites or content radio button is selected, settings can be applied to the additional categories on the page.
Figure 3.13 First Section of Parental Control Web Filter
Allow and Block Specific Web Sites The second section of the Web Filters list is the Allow and block specific web sites category, as seen in Figure 3.14. If the Only allow websites which are on the allow list radio button is selected, the user will be permitted to visit only the sites on the allowed list.
Figure 3.14 Second Section of Parental Control Web Filter
The Edit the Allow and block list link in this section will allow the administrator to add Web sites to a blocked or allowed list, as seen in Figure 3.15. If a site is on the allow list, the user will be able to access that site regardless of other settings made in the Web Filters section. If a site is added to the blocked list, users will not be able to access it unless an administrator gives explicit permission for them to browse the site. When the users attempt to go to the Web site, they will be warned that Windows Parental Controls has blocked access to the site, and in order to access that site, an administrator will need to grant them permission.
www.syngress.com
147
148
Chapter 3 • Configuring Windows Vista
Figure 3.15 Adding Sites to the Allowed or Blocked List
Allowed and blocked lists can also be imported and exported. The web site http://urlblacklist.com has a large list of categories of sites that can be blocked. However, the files are not in the correct format so they can be imported into Vista’s Parental Control Block lists. Files in the proper format will have a WebAllowBlockList extension. The format of the file, as seen in Table 3.1, gives allowed sites an AllowBlock value of 1 and blocked sites a value of 2.
Table 3.1 Format of a WebAllowBlockList File for Vista Parental Controls <WebAddresses>
http://winforensics.com/ http://moveon.org/
www.syngress.com
Configuring Windows Vista • Chapter 3
Block Web Content Automatically If sites are not exclusively blocked or allowed in the block and allow list, the Block Web Content Automatically category will determine what sites the standard user will be able to browse. In the Block Web content automatically category, as seen in Figure 3.16, restriction levels are High, Medium, None, and Custom. The High restriction level setting will block all Web content except Web sites approved for children. The Medium restriction level will block unratable content and Web content in the categories of mature content, pornography, drugs, hate speech, and weapons. The None category will not block any Web content. If None is selected as the Web Restriction level, only sites on the blocked sites list will be blocked. The Custom restriction level allows the administrator to block 11 different categories, including mature content, pornography, drugs, alcohol, tobacco, sex education, gambling, bomb making, hate speech, weapons, and unratable content. Figure 3.16 The Block Web Content Automatically Section of the Web Filter
www.syngress.com
149
150
Chapter 3 • Configuring Windows Vista
Configuring & Implementing… Web Content Blocking Web Content Filtering is not always 100% reliable. Create an additional account with the same restrictions you are placing the user’s subject to Parental Control Settings. Log in as that user and browse the Internet to test how effective the content filters are. The final section of the Web Filters allows the administrator to block users from file downloads. If this radio button is checked, the users will not be able to download any files from the Internet. They will receive a Parental Control warning, as seen in Figure 3.17, when they attempt to download a file from a Web site.
Figure 3.17 Parental Controls Blocking a Download
EXERCISE 3.2 ADDING WEB SITES TO THE BLOCKED LIST FOR A USER UNDER PARENTAL CONTROLS 1. Open the Control Panel and click on the User Accounts applet. 2. Click Manage another User Account. (Click Continue if you receive a User account Control pop-up box.)
www.syngress.com
Configuring Windows Vista • Chapter 3
3. Click Create a new Account. 4. Under the Name the account and choose an account type box, type Child and select Standard user, as seen in Figure 3.18.
Figure 3.18 Creating a Standard User in Vista
5. Click on the Child account in the list of accounts. 6. Click Create a Password. 7. Type the password of syngress and confirm the password of syngress, then click the Create password radio button, as seen in Figure 3.19.
www.syngress.com
151
152
Chapter 3 • Configuring Windows Vista
Figure 3.19 Giving the Standard User Account a Password
8. Close the User Accounts applet and open the Parental Controls applet from the Control Panel. (Click Continue if you receive a User account Control pop-up box.) 9. Click on the Child user. Turn Parental Controls on. 10. Click on the Windows Vista Web Filter link. 11. Click the Edit the Allow and Block list link. 12. Under the Allow or Block specific websites list, type in the URL of the site you wish to block, then click the Block radio button. Click OK three times and close Parental Controls.
Time Limits Time Limits are another setting that can be configured in the Parental Controls. Time restrictions, as seen in Figure 3.20, can be set for when a user is allowed to use the computer.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.20 Time Restrictions on When a Standard User Can Use the Computer
If users attempt to log on during a time that they are restricted from computer use, they will receive a message that they are unable to log on to the computer due to a time restriction, as seen in Figure 3.21. If they are logged on during the period when their time restriction starts, their screen will become black, and they will be logged off immediately (without warning). There is, however, a Parental Control icon which will display how much time they have left on the system if they hover over it. They can also double-click on the Parental Control icon in the Taskbar and view their time restriction and other Parental Control settings. In summary, time restrictions can be an effective tool at limiting a minor’s daily use of the computer. Figure 3.21 Time Restrictions Preventing a User from Logging On to Vista
www.syngress.com
153
154
Chapter 3 • Configuring Windows Vista
Configuring & Implementing… Changing the Time in the BIOS I set some time restrictions on my son’s account and tried to log on as him and was unsuccessful. I adjusted the time in the BIOS to a time when logon was permitted for Mason. The next thing I saw, Mason was at the welcome screen and enjoying a session in Windows.
EXERCISE 3.3 CONFIGURING TIME RESTRICTIONS FOR A USER UNDER PARENTAL CONTROLS 1. Open the Parental Controls applet form the Control Panel. (Click Continue if you receive a User account Control pop-up box.) 2. Click on the Child user. Turn Parental Controls on. 3. Click on the Time Limits link. 4. Highlight the Times that you wish to restrict the user from logging on to use the computer. 5. Click OK twice and close Parental Controls.
Game Ratings The content of some video games on the market has caused quite a bit of stir lately. Windows Vista is the first operating system from Microsoft to offer filters to block games by name or with specific ratings and content. The three main sections of Game Controls within Parental Controls are Can the user play games, Block (or allow) games by rating and content types, and Block (or allow) any game on your computer by name (see Figure 3.22). If the No radio button is selected in the first section, Can the user
www.syngress.com
Configuring Windows Vista • Chapter 3
play games, no games can be played on the system by that user and all other sections in Games Controls will be inaccessible. If the Yes radio button is selected, other filters on the machine, such as blocking games by name or by specific ratings and content, can be configured.
Figure 3.22 Game Controls Feature of Parental Controls
The second section in the Games Control section is the Game Restrictions subcategory which allows you to block games with certain content and ratings. Several groups have developed rating systems to allow consumers to make informed decisions about purchasing games and software that are appropriate for certain age groups. By default in Vista, the Entertainment Software Rating Board, or ESRB, rating system is used. If you want to change the game rating system from the default of ESRB, click the Select a games rating system under Tasks when Parental Controls is launched. A list of ratings systems and links to their corresponding Web sites will be displayed, as seen in Figure 3.23.
www.syngress.com
155
156
Chapter 3 • Configuring Windows Vista
Figure 3.23 Choosing a Game Rating System in Parental Controls
Some of the other choices include the Computer Entertainment Rating Organization and the Pan European Game Information rating systems. The first section of Game Restrictions, as seen in Figure 3.24, allows the administrator to either block or allow games if they are unrated by the ESRB (or other rating system used). There are six ESRB categories, including Early Childhood, Everyone, Everyone 10+, Teen, Mature, and Adults Only. When an ESRB rating is selected, all of the categories located above that rating in the chart will also be allowed. For example, if a rating of Teen is selected, games in the Everyone 10+, Everyone, and Early Childhood will also be allowed (see Figure 3.24). Note: The ESRB rating defaults to Adults Only, so be sure to change this setting if you are configuring the Game Restrictions section for a minor.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.24 Game Restrictions by ESRB Rating
The Block these types of content section in the Games Restrictions section will block games with certain content, even if the game has an allowed rating. There are thirty-three different types of content that can be blocked, including blood, language, nudity, sexual themes, and violence. A complete list of some of the available content restrictions can be seen in Figure 3.25.
www.syngress.com
157
158
Chapter 3 • Configuring Windows Vista
Figure 3.25 Complete List of Game Content That Can Be Blocked in Game Restrictions
www.syngress.com
Configuring Windows Vista • Chapter 3
The final category of the Games Control section of Parental Controls is Games Overrides. A list of games that come on the system with Vista is displayed. The default setting is for games to be allowed or blocked based on their User Rating Setting. All of the Microsoft Games fall under the Everyone rating category except Texas Hold ‘Em, which has a Teen rating. This user’s ESRB rating is set to Everyone, so users are not allowed to play the game based on their User Setting Rating, as seen in Figure 3.26. You can override this setting by selecting the Always Allow radio button for this game. Always Block can also be used for a particular game, and this setting will block the game even if it is allowed under their ESRB User Rating Setting. Figure 3.26 Game Overrides Section of Game Controls
When users log on and open Games from the Start menu, the games they are not allowed to play will be displayed with a restricted icon, as seen in Figure 3.27. The Windows games that they are allowed to play will be displayed with their normal icon. www.syngress.com
159
160
Chapter 3 • Configuring Windows Vista
Figure 3.27 The Effect of Game Overrides Settings Applied to a Standard User
EXERCISE 3.4 CONFIGURING GAMES OVERRIDES FOR A USER UNDER PARENTAL CONTROLS 1. Open the Parental Controls applet from the Control Panel. (Click Continue if you receive a User account Control pop-up box.) 2. Click on the Child user. Turn Parental Controls on. 3. Click on the Game Controls link. 4. Click the Block or Allow specific games link. 5. Find Solitaire on the list. Select the Always Block radio button. The status should then turn to Can not play, as seen in Figure 3.28. Click OK three times and close Parental Controls.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.28 Blocking Solitaire with the Game Overrides Section of Game Controls
Program Limits The final section of Parental Controls is Program Limits, or Application Restrictions, which will allow and block any programs on the computer. The default setting of the Application Restrictions is that the user can use all programs. If the Child can only use the programs I allow radio button is selected, every program on the computer will be populated in a list, as seen in Figure 3.29. If a program does not show up in the list for any reason, you can browse to the program, select it, and allow or block it. In order for a child to use a program, the box in front of the application name needs to be checked, as seen in Figure 3.29. For convenience, Microsoft offers Check All and Uncheck All radio buttons (see Figure 3.29). If Check All is utilized, you can search though the list, find the programs you do not want the child using, and uncheck them. If Uncheck All is used, you can search though the list and check only the application you want them to run. www.syngress.com
161
162
Chapter 3 • Configuring Windows Vista
Figure 3.29 Application Restrictions Settings of Parental Controls
Once users log on and attempt to launch an application that is blocked, they will receive a message that states Parental Controls has blocked this program, as seen in Figure 3.30. They will not be allowed to use the program unless an administrator provides them with permission.
EXAM WARNING Know all the features of Parental Controls, including time restrictions and the Activity logs. It is a new feature of Vista, so it will likely be well emphasized on any exam covering Vista.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.30 Windows Parental Controls Has Blocked a Program
In summary, Parental Controls will assist parents in protecting their children from being exposed to certain types of content. While the Parental Controls are very effective at reducing exposure to inappropriate content and material, they are by no means full proof. Parents also need to educate their children about the dangers and risks associated with using the Internet. It is also a good idea for parents to monitor their children’s Internet usage and monitor the activity reports.
Activity Reports Activity Reports can be turned on if Parental Controls are enabled for a particular standard user account. Accounts in the Administrators group cannot have parental controls or activity reporting enabled. Activity Reports can be collected on any of the four Parental Control settings that are enabled, including web filters, log-on times, games played, and applications that were run. The Activity report, as seen in Figure 3.31, is capable of providing information about Web Browsing, System, Applications, Gaming, Email, Instant Messaging, and Media.
TEST DAY TIP Activity Reports are only valid for the last seven days. They will not keep track of anything standard users did more than seven days ago.
www.syngress.com
163
164
Chapter 3 • Configuring Windows Vista
Figure 3.31 Activity Viewer for a User Subject to Parental Controls
www.syngress.com
Configuring Windows Vista • Chapter 3
The information in the Web Browsing section includes the top 10 Web sites visited, the most recent 10 Web sites blocked, Web overrides, file downloads, and blocked file downloads. The System section of the activity log will display the number of logons, the total log-on time, and the days that the logons occurred. The Applications section will give detailed information about which application ran while the user was logged on to the system. Keep in mind that some applications, such as Symantec Anti-Virus, may run without the user directly launching them. The Games Played section will display the names of the games that were played while the user was logged on to the computer. The Email, Instant Messaging, and Media sections will display information about those applications if the application the user is utilizing supports Parental Controls. The Activity logs only keep records of what happened in the last seven days. For this reason, activity logs need to be viewed somewhat frequently. If you would like to print a copy of the activity report, click the Generate Report link located in the top left corner of the Activity Viewer, as seen in Figure 3.31. You will be able to save the report as a Web page, which can then be printed out or viewed with Internet Explorer. The Family Safety Options setting will remind you to review the reports daily, weekly, or never. The default setting for Family Safety options is weekly. The Family Safety options of Parental Control, as seen in Figure 3.32, can be configured under Tasks in Parental Controls when the Control Panel applet is launched. If you choose weekly or daily, a pop-up box will display in the task bar reminding you to read the Activity reports.
Figure 3.32 Family Safety Options of Parental Controls
www.syngress.com
165
166
Chapter 3 • Configuring Windows Vista
EXAM WARNING Parental Control Activity Logs are cleared in the Event Viewer, not in the Parental Control section of the Control Panel. The log that needs to be cleared is located in the Windows Logs | Microsoft | Windows | Parental Controls section of the Event Viewer.
Configuring Internet Explorer Windows Vista comes bundled with Internet Explorer 7. Unlike the Internet Explorer 7 that can be utilized on XP and 2003,Vista’s Internet Explorer is able to run in a “Protected Mode” or sandbox. What running in protected mode means is that the default behavior of the version of Internet Explorer that comes with Vista runs with a “low integrity” level. The standard user runs with a medium integrity level. In Vista, processes running at lower integrity levels, such as Internet Explorer, are not permitted to interact with processes running with higher integrity levels. In this case, Internet Explorer is running at a low integrity level and cannot interact with the regular user running at a standard integrity level. Taking steps to make browsing with Internet Explorer much safer is an important component in the steps to make Vista a more secure operating system.
EXAM WARNING Be aware that Internet Explorer is in Protected Mode by default, and run with a low integrity level in Windows Vista. This feature is not available in XP or 2003.
Some of the biggest vulnerabilities in previous versions of Windows operating systems have been due to Internet Explorer. Part of the reason Internet Explorer has been such an easy target for the authors of malware and spyware is that users traditionally browse the Internet when they are logged into the system as administrator. The Vista operating system uses several techniques to prevent these browser-based
www.syngress.com
Configuring Windows Vista • Chapter 3
problems that plagued other Microsoft operating systems in the past. For one,Vista utilities a new protection mechanism called User Account Control. When users browse to Web sites using Vista, programs cannot be installed without the express consent of the user.Vista’s User Account Control will prompt them for permission before any type of program is installed to the system. Unless users do not read the UAC warning, they will now be cognizant that a program is being installed. In prior Microsoft operating systems, programs were often installed during browsing sessions, and users were unaware that anything had been done to their systems. The other technique that Vista utilizes is to run Internet Explorer with “low integrity.”Vista’s Windows Integrity Control (WIC) feature will not allow interaction of objects that have higher “integrity levels.” As long as the user leaves Internet Explorer running in Protected Mode, which is the default, programs that attempt to launch will not be able interact with users, who run at the higher “medium integrity level.” If a user disables Internet Explorer’s protected mode or User Account Control, the system can be subject to the same risks as previous Microsoft operating systems were.
TEST DAY TIP There are six levels of integrity in Vista including Untrusted, Low, Medium, High, System, and Installer. Be able to explain what the different levels are for and know at what levels some of the most common processes run.
When Internet Explorer is opened in Vista, you will notice the menu bar seen in Internet Explorer 6 has been removed by default. To add the menu bar back into Internet Explorer 7, click the word Tools and select Menu bar from the list. This will display the traditional menu bar that has been utilized in all of the previous versions of Internet Explorer, as seen in Figure 3.33. To go to a Web site, just type the address of the Web site in the address bar, and click on the right-facing arrow (formally the Go button). Once you are at a Web site, the arrow for the go button becomes a refresh button. As soon as you begin typing again, the symbol will turn back to a right-facing arrow.
www.syngress.com
167
168
Chapter 3 • Configuring Windows Vista
Figure 3.33 Adding the Menu Bar to Internet Explorer 7
Internet Explorer 7 comes with a search bar in the top right of the browser, as seen in Figure 3.34. It defaults to Live Search from Microsoft; however, you can also use a list of different search engines. To select a different provider, click the arrow to the right of the search bar, as seen in Figure 3.34, and select Find More Providers. Some of the other search providers that can be selected include AOL, Google, Yahoo, Ask, and Lycos. You can also create your own by providing a link to different search engines not on the list. Figure 3.34 Adding a Different Search Provider to the Internet Explorer 7 Menu Bar
To add a Web site you are visiting to your list of favorites, click the yellow star icon with the plus in front of it.You can then create it in your favorites folder by clicking Add, as seen in Figure 3.35. Alternatively, you can click the new folder radio button, and add that sub-folder to the favorites menu. To recall your favorites, www.syngress.com
Configuring Windows Vista • Chapter 3
click the yellow star, then drop down to your favorite page from the list. If you want to import or export favorite pages, click File from the menu bar, select Import and Export, and a wizard will launch. The Wizard will allow you to import and export not only favorites, but cookies and RSS feeds as well. This is a convenient feature when you have several favorites in Internet Explorer on one machine.You can export the favorites and save the bookmark.htm file to a USB thumb drive, then import that file to another machine using the wizard.
Figure 3.35 Adding Favorites to Internet Explorer 7
The Quick Tabs button, as seen in Figure 3.36, will be displayed directly next to Add Favorites if more than one tab is open. If you click on the Quick Tabs button, all of the pages in your tabs will be displayed at once as a series of smaller windows, as seen in Figure 3.36 You can then click on any of the pages to access that page in full-screen mode. On the right-hand side of the menu bar after the tabs are the Home, RSS feeds, Print, Page, and Tools buttons. The Page button will allow you to save a Web page, zoom, and change the text size. From the bottom of the Tools menu, you can access Internet Options. The Internet Options menu has the traditional seven tabs, including General, Security, Privacy, Content, Connections, Programs, and Advanced.
www.syngress.com
169
170
Chapter 3 • Configuring Windows Vista
Figure 3.36 Quick Tabs in Internet Explorer 7
EXERCISE 3.5 FINDING A DIFFERENT SEARCH PROVIDER FOR INTERNET EXPLORER’S SEARCH BAR 1. Open Internet Explorer. 2. Click the arrow to the right of the search bar, as seen in Figure 3.34, and select Find more providers. 3. Select Google from the list of Web Search Providers. 4. Check the box that states Make this my default search provider, and click the Add Provider radio button, as seen in Figure 3.37.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.37 Configuring a Different Search Provider for Internet Explorer 7
Home Pages Internet Explorer 7 in Vista allows the user to set multiple home pages. The tabbed browsing feature of Internet Explorer will allow the additional home pages to be displayed within each tab. To configure your system to have more than one home page, go into the Control Panel and click on the Internet Options applet. To create home page tabs, type the URL of each Web page on its own line in the Home Page box, as seen in Figure 3.38. Once you have finished adding all of the URLs for all of the home page tabs, click Apply, then click the OK radio button.
www.syngress.com
171
172
Chapter 3 • Configuring Windows Vista
Figure 3.38 Configuring Multiple Home Pages for Internet Explorer 7
Open Internet Explorer, and you will see all of the home pages on the various tabs, as seen in Figure 3.39. Click on the tab with the home page you want to access.
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.39 Internet Explorer 7 in Vista with Multiple Home Pages
Pop-up Blocker Internet Explorer comes with a highly configurable pop-up blocker that is fairly effective at stopping pop-up advertisement boxes. To access the settings of the pop-up blocker, open Internet Explorer, click on the triangle to the right of Tools, find Pop-up Blocker in the list, and select Pop-up Blocker Settings. On the Pop-up Blocker Settings page, as seen in Figure 3.40, you can add Web sites for which you want to allow pop-ups. If you would like a sound to be played and information bar to appear when a pop-up box is displayed, check each corresponding box, as seen in Figure 3.40. The three filter levels for pop-ups you can choose from are High, Medium, and Low. The High setting will block all pop-ups from all sites, and the combination of Control and Alt keys can be used to allow a pop-up. A Medium pop-up blocker setting will block most automatic pop-ups. A Low setting will allow pop-ups from secure sites.
www.syngress.com
173
174
Chapter 3 • Configuring Windows Vista
Figure 3.40 Pop-up Blocker Settings for Internet Explorer 7
Privacy Settings Privacy Settings can also be accessed by opening Internet Explorer, clicking on the triangle to the right of Tools, and selecting Internet Options. The Privacy tab allows the selection of six settings including Block All Cookies, High, Medium High, Medium, Low, and Accept all Cookies. Microsoft provides a description of each setting for the Internet zone. Some sites will not function correctly unless you allow a cookie. Another feature of Internet Explorer 7 is the ability to delete sensitive information that is stored on the local computer during browsing sessions. This can include Temporary Internet Files, Cookies, History, Form Data, and Passwords. All of this information can be deleted in one convenient place, as seen in Figure 3.41. When www.syngress.com
Configuring Windows Vista • Chapter 3
a user chooses to Delete All, and selects the option to also delete files and settings stored by add-ons, zeros are actually written to the index.dat file. This makes it difficult for computer forensic investigators to recover any traces of Internet Browsing from the system. This is, of course, a tremendous positive from a privacy standpoint, but a negative as far as the law enforcement and computer forensics community is concerned. Figure 3.41 Deleting Information Stored by the Internet Explorer Browser
EXAM WARNING Be familiar with all of the new settings of Internet Explorer 7. Many people have been using IE7 on Windows XP and Server 2003 for some time, and are used to some of the new features. Keep in mind that Internet Explorer 7 in Vista runs with low integrity in a Protected Mode. This is not true of IE7 in Windows XP or Server 2003.
Local Policies To configure local policies for Internet Explorer, type gpedit.msc at the start search box. To reach the local Policies for Internet Explorer, click User Configuration | www.syngress.com
175
176
Chapter 3 • Configuring Windows Vista
Windows Settings, and find Internet Explorer Maintenance. There are five categories under Internet Explorer Maintenance, as seen in Figure 3.42, including Browser User Interface, Connection, URLs, Security, and Programs. Be careful when setting policies here because they will affect every user on the machine. The Browser User Interface allows you to set a custom title, logo, or bitmap in Internet Explorer. The Connections section allows you to configure proxy server settings. The URLs section allows you to configure home pages and favorites. The Security section allows you to configure content ratings and Authenticode settings. The Programs section of Internet Explorer Maintenance allows you to manage items such as the default browser and HTML editor. Figure 3.42 Configuring Local Internet Explorer Policies
EXERCISE 3.6 CONFIGURING
A
LOCAL POLICY
FOR INTERNET
EXPLORER
1. Type gpedit.msc in the start search box. (Click Continue if you receive a User account Control pop-up box.) 2. Find Internet Explorer Maintenance under User Configuration | Windows Settings. 3. Double-click on Browser User Interface. 4. Double-click on Browser Title.
www.syngress.com
Configuring Windows Vista • Chapter 3
5. Check the box that says Customize Title Bars, as seen in Figure 3.43. In the browser Title Bar Text field, type SYNGRESS, as shown in Figure 3.43. Click OK, and close the Group Policy Object Editor. Open Internet Explorer. Your Browser Title Bar should say Windows Internet Explorer provided by SYNGRESS.
Figure 3.43 Changing the Browser Title Bar
Configuring Network Settings The Network section of Windows Vista has been completely revamped. Network settings in Vista are now managed in the Network and Sharing Center. In previous Microsoft operating systems such as Windows 2000, XP, and 2003, network settings were configured in My Network Places. The Network and Sharing Center, as seen in Figure 3.44, has many new features not available in My Network Places.
www.syngress.com
177
178
Chapter 3 • Configuring Windows Vista
Figure 3.44 The Network and Sharing Center of Windows Vista
The Sharing and Discovery section of the Network and Sharing Center, as seen in Figure 3.44, has six sections that can be configured, including Network Discovery, File Sharing, Public Folder Sharing, Printer Sharing, Password Protected Sharing, and Media Sharing. The settings in these sections allow for more granular controls of sharing in Vista than were offered in previous Microsoft operating systems. When Network Discovery is turned on, your computer can see other computers and devices on the network, and those devices will be able to see your computer. When File Sharing is turned on, your shared items can be accessed by people on the network. The Printer Sharing component of Sharing and Discovery will allow people on the network to use printers you are sharing. If you turn on Password Protected Sharing, only people with a computer account on your system will be able to access your shares and shared devices. Public Folder Sharing and Media Sharing are two features that are new to Vista. When Public Folder Sharing is enabled, people on the network can access files in www.syngress.com
Configuring Windows Vista • Chapter 3
the Public folder located in the Users folder. Media Sharing will allow other network users to access shared picture, music, and videos. The Media Sharing has several advanced settings, as seen in Figure 3.45. The user can choose to share media with a certain star and parental ratings. Media from your Vista can also be shared with an Xbox 360 that is connected to your network.
TEST DAY TIP Know your way around the Network and Sharing Center very well. It is a new feature of Vista, so it will likely be well emphasized on any exam covering Vista.
Figure 3.45 Media Sharing Component of Vista’s Sharing and Discovery
www.syngress.com
179
180
Chapter 3 • Configuring Windows Vista
Using the Network and Sharing Center The Network and Sharing Center is a one-stop shop which provides six links for user to complete tasks, including View Computers and Devices, Connect to a Network, Manage Wireless Networks, Setup a Connection or a Network, Manage Network Connections, and Diagnose and Repair. The Network and Sharing Center offers a more centralized approach to managing network functions than pervious Microsoft operating systems did. The View Computers and Devices link, as seen in Figure 3.46, will allow you to see other computers on the Network and browse through any accessible shares.You can also add a printer or a wireless device from here, as well as re-access the Network and Sharing Center. Figure 3.46 Viewing Computers and Devices from the Network and Sharing Center
The Connect to a Network section will allow you to connect to dial-up and VPN or wireless networks. Notice that the wireless networks with an access point are displayed with different icons than ad hoc networks, as seen in Figure 3.47. An ad hoc wireless network is a network that does not use an access point. Networks with access points are said to run in infrastructure mode. Any unsecured wireless networks will be displayed in the list with an exclamation point, as seen in Figure 3.47. Windows Vista will warn you when you attempt to connect to an unsecured wireless network that information sent might be visible to others. I can tell you from the personal experience I have of auditing wireless networks that your information will www.syngress.com
Configuring Windows Vista • Chapter 3
be visible to anyone using a sniffer program, unless you are visiting a secure Web site. On the bottom of the Connect to a Network page, there is a link to take you back to the Network and Sharing Center as well as a link to set up a connection or network.
Figure 3.47 Viewing Computers and Devices from the Network and Sharing Center
The Manage Wireless Networks link, as seen in Figure 3.48, will only appear in the task pane if your system has a wireless card. The Add button will allow you to add a network in the range of the computer, manually create a network profile, or create an ad hoc network. The Adapter properties tab will allow you to change settings, such as IP Address, on the wireless card. The profile type tab will let you choose between all-user and per-user. The all-user setting means everyone who uses the computer will have the same wireless settings. The per-user means each user will have different wireless settings for their profiles. www.syngress.com
181
182
Chapter 3 • Configuring Windows Vista
Figure 3.48 Managing Wireless Networks from the Network and Sharing Center
The Set up a Connection or Network link from the left hand of the Network and Sharing Center task pane will allow you to set up a VPN, wireless, or dial-up connection, as seen in Figure 3.49. When you click the Set up a Connection or Network link, there are six options, including Connect to the Internet, Set up a wireless router or access point, Manually connect to a wireless network, Set up a wireless ad hoc (computer-to-computer) network, Set up a dial-up connection, and Set up a VPN connection. Many users need to utilize this wizard to set up a VPN connection to their company when they are working from home. Gamers can set up an ad hoc network to use multi-player games without the need for a wired LAN. An article that describes gaming over ad hoc networks can be downloaded from the following link: http://softwarecommunity.intel.com/isn/downloads/mobility/Gaming_Over_Ad-Hoc_Peer-to-Peer_Networks_WP.pdf
www.syngress.com
Configuring Windows Vista • Chapter 3
Figure 3.49 Setting up a Connection or Network from the Network and Sharing Center
The Manage Network Connections link on the tasks pane in the Network and Sharing Center will show you the status of your network interfaces. The Manage Network Interfaces section, as seen in Figure 3.50, will allow you to perform several tasks on your network devices, including enabling, disabling, diagnosing, renaming, viewing the status, and changing settings. If you want to change your IP Address or MAC Address, this can be done by clicking on the interface and selecting Change settings of this connection selection from the menu bar.
www.syngress.com
183
184
Chapter 3 • Configuring Windows Vista
Figure 3.50 Managing Network Connections in the Network and Sharing Center
The Diagnose and Repair link will attempt a probe to see if you are able to connect to the Internet. If Windows is able to connect to the Internet without any problem, the Diagnose and Repair will inform you that Windows did not find any problems with your Internet Connection, as seen in Figure 3.51. If a problem is found, Diagnose and Repair will inform you that the computer is unable to communicate with the Microsoft Web site. The Windows Network Diagnostics message will then give suggestions to try to f ix the problem. Figure 3.51 Windows Network Diagnostics in the Network and Sharing Center
In summary, the Network and Sharing center is a redesigned feature for Vista that allows users to easily manage their Network settings from one convenient location. Networking is playing a more vital role in home networks today. The Network and Sharing Center simplifies network administration of computers. As more devices start to become networked with our home computer systems, such as video game consoles, simplifying the way devices can be networked together is even more important to the consumer. www.syngress.com
Configuring Windows Vista • Chapter 3
EXERCISE 3.7 SETTING UP
AN AD HOC
WIRELESS NETWORK
1. Open the Network and Sharing Center from the Control Panel. 2. Click the Set up a Connection or Network link in the left-hand pane. 3. In the Choose a connection option, select Set up a wireless ad hoc network, then click the Next radio button. 4. Click Next at the Set up a wireless ad hoc network screen. 5. For Network Name, type AD-HOC. Choose a Security type: If you choose open, no key is needed. If you choose WEP or WPA2, enter the network key you want to use. You can check the display characters box to display the key in plain text. Click Next. 6. You should see a screen that says The AD-HOC Network is ready to use, as seen in Figure 3.52.
Figure 3.52 Setting up an Ad Hoc Network
www.syngress.com
185
186
Chapter 3 • Configuring Windows Vista
Managing Wired Connections Managing Ethernet connections in Vista is similar to managing wired connections in Windows XP and 2003. Start by clicking on the Network and Sharing Center in the Control Panel. Click the Manage Network Connections link from the list in the task pane. All Ethernet network connections are displayed with an RJ-45 connection at the bottom, as seen in Figure 3.53. In contrast, wireless connections are displayed with green bars indicating signal strength. To check any network parameters, click on the device and select Change settings of this connection. Figure 3.53 Wired and Wireless Connections: Large Icon View
Managing Wireless Connections One major improvement of Vista over XP and 2003 is more control over your wireless settings. There were two major security issues with wireless on previous Microsoft operating systems. One issue was connecting to unsecured networks automatically and the other issue was firewall settings that might leave a user vulnerable in a hotspot. Windows XP systems have a bad habit of automatically connecting to wireless networks within their range. Although the default wireless settings of XP can be changed, the fact that it connects to unsecured networks by default is somewhat disturbing. Another limitation of XP (and 2003) is the fact that your firewall settings will remain the same when migrating from your home network to www.syngress.com
Configuring Windows Vista • Chapter 3
a hotspot. This is extremely alarming if the user happens to have open shares with sensitive documents. While this example may seem far-fetched, it is very common for users to have open shares on their systems at work or home and go to a hotspot. A malicious user at the hotspot could access files in any of your shares. And, if there is no password on the administrative account, that malicious user may even be able to access the administrative shares. To manage wireless connections in Vista, open the Network and Sharing Center in the Control Panel. Click on the Manage Wireless Networks link from the list in the task pane. Clicking the Add button will give you a menu of three items, including Add a network that is in range of the computer, Manually create a network profile, and Create an ad-hoc network. The Add a network that is in range option in Manage Wireless Connections will display a list of networks that are broadcasting their Security Set Identifier (SSID). Along with each network displayed will be information about whether the network has security enabled or if it is unsecured.Vista will warn you if you connect to an unsecured network that your information may be visible to others. Unless you are on a secure site, people using sniffing tools such as Wireshark will be able to capture all of your plain text data. Microsoft recommends using WPA2 if your equipment will support it. A list of other wireless recommendations made by Microsoft is included in the following TechNet article: http://technet.microsoft. com/en-us/library/bb727047.aspx. It is common knowledge among wireless security experts that Wifi Protected Access version 2 (WPA2) with Advanced Encryption Standard (AES) encryption and a very difficult Passphrase should be used on wireless networks. Although Wired Equivalent Privacy (WEP) or WPA with Temporal Key Integrity Protocol (TKIP) is better than nothing, these security mechanisms can be defeated. The Manually create a network profile option in Manage Wireless Networks can be utilized if a network is not broadcasting its SSID. Turning off the broadcast of the SSID will help to prevent people from connecting to your network. If you are not broadcasting the SSID of your access point, users will not see the network in their list of available networks to connect to in Windows XP or Vista. While turning off the broadcast of the SSID will help increase the security of your wireless, it will not prevent hackers with the right tools from getting the information. Even if the access point is not broadcasting the SSID, security measures such as the use of WPA2 with AES encryption and a strong Passphrase should also be utilized. The Create an ad-hoc network is the final option when adding a network in Manage Wireless Networks. The ad hoc network will allow a group of computers to network without an available access point. In Vista, you can set up an ad hoc www.syngress.com
187
188
Chapter 3 • Configuring Windows Vista
network with no encryption, WEP, or WPA2, as seen in Figure 3.54. WPA2 is recommended, and your WPA2 Passphrase can be from 8 to 63 characters long. Numbers, symbols, and uppercase and lowercase letters can all be utilized in the Passphrase. Note: It can be up to 64 characters long if you only use the characters 0-9 and letters A-F. The characters can be displayed for you in plain text if you check the Display characters check box, as seen in Figure 3.54.
Figure 3.54 WPA2 Passphrase for an Ad Hoc Network Set up in Windows Vista
With Vista, there is a strange option that is displayed after you set up an ad hoc network. After you finish setting up an ad hoc network, you are asked if you wish to set up Internet Connection Sharing, as seen in Figure 3.55.
www.syngress.com
Configuring Windows Vista • Chapter 3
TEST DAY TIP The Vista operating system supports open, WEP, and WPA2 encryption schemes. WPA2 is the strongest encryption method to use. Microsoft does not recommend connecting to open wireless networks in Vista.
Figure 3.55 Internet Connection Sharing with Ad Hoc Network Set up
The reason that this is most likely recommended by Microsoft, as seen in Figure 3.55, is that users connecting to this network will receive an IP Address of 192.168.0.X from the DHCP Service that coincides with enabling Internet Connection Sharing. If ICS were not enabled, users would receive an Automatic Private IP Address, or APIPA. Automatic Private IP Addresses are in the 169.254.X.X range. Normally, users do not have Internet access when they are setting up an ad hoc network. However, if users have more than one network card in their systems, www.syngress.com
189
190
Chapter 3 • Configuring Windows Vista
it could be possible. The danger here, however, is if the user provides a gateway to the Internet for other users, the person could potentially be providing illegal Internet services for others connecting to the wireless network.
EXERCISE 3.8 CHANGING FROM A PRIVATE TO A PUBLIC NETWORK LOCATION 1. Open the Network and Sharing Center from the Control Panel. 2. Click the Customize button. 3. Under Location type, select Public, then click the Next radio button as seen in Figure 3.56 (Click Continue if you receive a User account Control pop-up box.) Click Close.
Figure 3.56 Changing the Network Type to Public
www.syngress.com
Configuring Windows Vista • Chapter 3
IPv4 Vista still provides IP version 4 support, and IPv4 is installed by default. An IP version 4 address is a 32-bit logical address. The 32-bit logical address consist of four octets, each a number in range from 0 to 255. The IPv4 address space is divided into 5 classes, seen in Table 3.2. The first octet will determine which class the IPv4 address is a member of. Table 3.2 IP Address Classes Class
Range
Class A
1–126
Class B
128–191
Class C
192–223
Class D
224–239
Multicast
Class D
240–247
Experimental
To configure your IPv4 address, open the Network and Sharing Center from the Control Panel. Click Manage network connections from the task pane. Select the interface for which you want to adjust your IP address, and click the Change settings of this connection selection from the menu bar. Click Continue if you are prompted by User Account Control, and double-click Internet Protocol version 4 (TCP/IPv4), as seen in Figure 3.57.
EXAM WARNING Know that Vista has both the IPv4 and IPv6 protocols installed by default and that IPv6 is given preference.
www.syngress.com
191
192
Chapter 3 • Configuring Windows Vista
Figure 3.57 Internet Protocol Version 4 Properties (32-bit Address)
IP v6 Vista is the first Microsoft operating system to come with IPv6 installed by default. An IP v6 address is 128 bit logical address, and comes with an immense address space. There are many reasons for the move to IP version 6. One of the main reasons is the limited IP version 4 address space. While strategies like Network Address Translation (NAT) and Classless Inter-Domain Routing (CIDR) have cut down on the number of actual IP addresses needed, there still is an increasing demand for more IP address space. Network Address Translation hides internal IP Addresses and allows an entire company to have thousands of users utilize the Internet while using a single Public IP Address. This is due to the increasing number of people worldwide using the Internet and the number of new devices such as PDAs, cell phones, and Blackberry devices that now use IP addresses. Another reason for Microsoft to start migrating to www.syngress.com
Configuring Windows Vista • Chapter 3
IP v6 is because the United States Department of Defense has mandated a switch over to IPv6 for some of their systems by the year 2008. The United States Department of Defense is one of Microsoft’s largest customers, and meeting their needs and standards is important for that reason. The IP v6 address is given preference over the IP v4 in Vista. Internet Protocol version 4 can also be uninstalled, and Vista is able to run on a strictly IP v6 environment. Keep in mind that many routers on the shelves are not IP v6 compliant at this time, and some ISPs have not implemented an IP v6 infrastructure yet either. To statically configure an IP v6 address in Vista, open the Network and Sharing Center. Click the Manage Network Connections link from the left task pane. Select the interface for which you want to configure your IP v6 address, and click on the Change settings of this connection button from the menu bar. Note: Click Continue if you receive a User Account Control warning. Double-click on Internet Protocol Version 6 (TCP/IPv6). You should be at the IP v6 settings screen, as seen in Figure 3.58. Figure 3.58 Internet Protocol Version 6 Properties (128-bit Address)
www.syngress.com
193
194
Chapter 3 • Configuring Windows Vista
Troubleshooting Network Connectivity You can utilize the Windows Network Diagnostics to analyze network problems. The Windows Network Diagnostics will also tell you if there are no problems with your network settings. To use Windows Network Diagnostics, open the Network and Sharing Center from the Control Panel. Click Diagnose and Repair from Tasks in the left hand pane. Windows will indicate if it detects any problems with your system. If your system can not communicate with www.microsoft.com, a report, as seen in Figure 3.59, is generated. The report notifies you that a problem has been detected. Figure 3.59 A Windows Network Diagnostics Report
Using Network Map A new feature of Windows Vista gives a user the map. This map provides information about devices, such as gateways, on the local network. Hovering over any of the www.syngress.com
Configuring Windows Vista • Chapter 3
devices on the network map will indicate the name, IP addresses, and MAC address, as seen in Figure 3.60. To view the network map in Vista, open the Network and Sharing Center from the Control Panel, and then click the View Full Map link, located above the Internet. Figure 3.60 Using the Windows Network Map Feature in Vista
Other Troubleshooting Methods If the Windows Network Diagnostics does not report any problems, your computer should be able to connect to the Internet without a problem. If you receive a report, as seen in Figure 3.59, try all of the suggested steps to see if the problem can be fixed. Those steps include unplugging your cable modem and waiting for it to come back online. If you are connected to a gateway, try to ping the gateway. Use the network map, as seen in Figure 3.60, to find the IP address of the gateway on your network. Open a commend prompt by typing cmd in the start search box. Then type ping followed by the IP address of the gateway. An example would be ping 192.168.1.1. If you cannot ping the gateway, check the settings of your network interface in Vista and on the router. If you can ping the gateway, try pinging www.yahoo.com. If you are able to ping www.yahoo.com, your settings should be good and you should be able to access the Internet. If you are getting a message that the name cannot be resolved, it is most likely an issue with DNS. Check the DNS settings of your network interface in Vista and on the router. If all else fails, try rebooting the system. www.syngress.com
195
196
Chapter 3 • Configuring Windows Vista
Summary of Exam Objectives Windows Vista has many exciting new features that improve the user experience, including Windows Aero, which gives the user translucent windows and smoother cartoon-like icons. Features of Aero include Windows flip, Windows 3-D flip, and taskbar thumbnails. All of these features of Aero will enhance the visual experience of the user. Unfortunately, the Aero feature is not available in the Starter or Home Basic editions of Vista, or to users with any version of Vista with a low-end graphics card. For the Ultimate Edition of Vista, an additional feature of Aero called DreamScene is also available. DreamScene gives the user the ability to use a full motion desktop background. Even though Aero is a nice feature, it may slow your computer down or demand high CPU utilization. If you are a laptop user, power considerations may also be a reason that you might want to disable to Aero features. Windows Vista is the first Windows operating system to include Parental Controls. Parental Controls are available in all of the versions of Vista, except the Business and Enterprise Editions. Parental Controls allow parents to set Web filters, block games with the ESRB game rating system, configure time limits, and block access to programs within Windows. Parental Controls will not work if there is an administrative account of the system with a blank password. There are also activity logs, which only keep track of the user’s behavior in the last week. These logs can be saved in HTML format, printed, and deleted in the Event Viewer. Internet Explorer 7 will enhance the end user’s browsing experience. Features like an instant search box, tabbed browsing, quick tabs, and the ability to set multiple home pages simplify the browsing experience. The instant search box will allow you to search the Web, and a number of different search providers can be utilized. The tabbed browsing feature allows you to have several Web pages open in a single browsing session. The quick tabs feature allows you to see all of the home pages opened in your tabs on a single screen.You can then click on one of the pages and it will enter full-screen mode. The most important feature of IE7 in Vista is the protected mode setting, which is not available in XP or 2003. This feature will run Internet Explorer with low integrity which will make the browsing experience safer. The Network and Sharing Center is a centralized point on the Vista system that allows you to share out folders, printers, and your media. Other devices, such as gaming consoles, will be able to access the items you are sharing. A major improvement in Vista over XP is the fact that Vista does not try to automatically connect to unsecured networks.Vista also has firewall profiles for hotspots, known as Public, that lock down your shares, so unauthorized people will not be able to access them. www.syngress.com
Configuring Windows Vista • Chapter 3
Vista is much different than previous Microsoft desktop operating systems. It has better graphical features, such as Aero. It also has Parental Controls and activity logs that keep a record of user’s behavior.Vista allows you to utilize a protected mode when browsing so surfing the web is much safer. It has more secure networking features than previous Microsoft operating systems, such as a public firewall setting for hotspots. Overall,Vista has made substantial improvements over the shortcomings of previous Microsoft desktop operating systems.
Exam Objectives Fast Track Configuring Windows Aero ˛ If Windows Aero is not displayed in the Windows Color and Appearance
List, your video card may not support Aero. Check the manufacturer’s Web site to see if you have the latest driver. ˛ Use the Windows button and Tab keys to use the Windows 3-D flip. ˛ Use the Alt and Tab keys to use the Windows flip. ˛ DreamScene is only available as an Ultimate Extra.
Working with Parental Controls ˛ Administrative accounts should not have a blank password or Parental
Controls can be subverted. ˛ Activity Logs expire after 7 days. ˛ Administrative accounts cannot be subject to Parental Controls.
Configuring Internet Explorer ˛ Internet Explorer runs in protected mode in Vista by default. ˛ When in Protected Mode, IE runs with a Low integrity level. ˛ Quick Tabs allow all tab windows to be displayed on a single Web page.
www.syngress.com
197
198
Chapter 3 • Configuring Windows Vista
Configuring Network Settings ˛ The Network and Sharing Center is the central place for configuring
Network Settings. ˛ Vista implements a dual IP v4 and IP v6 stack, with IP v6 having priority. ˛ Vista has a feature which allows you to view a full map of the network. ˛ Vista has a media sharing feature which allows for the sharing of videos,
pictures, and music.
www.syngress.com
Configuring Windows Vista • Chapter 3
Exam Objectives Frequently Asked Questions Q: Can Vista connect to unsecured wireless networks? A: Yes, but you are warned that the information you send might be visible to others. Non-encrypted information sent over an unsecured wireless network can be viewed by people who run sniffer programs, such as Wireshark.
Q: Can WEP, WPA2, and open authentication be used in Vista when connecting to wireless networks?
A: WEP, WPA2, and open authentication can all be used in Vista. However, WP2 is recommended for security reasons.
Q: What are some of the benefits of using Aero in Vista? A: The benefits of using Aero in Vista include translucent windows, smoother icons, Windows Flip, Windows 3-D flip, and DreamScene.
Q: How frequently should the activity logs be viewed? A: After seven days, all of the information in the Activity logs gets erased. Q: Where can the Parental Control activity logs be cleared? A: The activity logs of Parental Controls can only be cleared in the Event Viewer. Q: Why can’t Parental Controls be used if an administrator has a blank password? A: If an administrator has a blank password, the standard user will be asked to give the username and password of an administrative account to access restricted pages. If the password is blank, they just click on the administrative account and they will be given access to the page.
Q: What level does Internet Explorer run at in Vista? A: By default, Internet Explore runs in a Protected Mode in Vista with a Low level of integrity.
Q: Does Vista support Internet Protocol Version 6? A: Yes,Vista supports both the IP v4 and IP v6 protocols, with IP v6 having priority. www.syngress.com
199
200
Chapter 3 • Configuring Windows Vista
Self Test 1. Which level of integrity does Internet Explorer run at in Protected Mode? A. High B. Medium C. Low D. System 2. Your colleague shows you his Windows Vista computer, and is demonstrating the DreamScene functionality. When you go back to your office, you attempt to enable DreamScene, but cannot find it as an option on your computer. What is the most likely cause for this? A. You are not running Windows Vista Home Premium Edition. B. You are not running Windows Vista Business Edition. C. You are not running Windows Vista Ultimate Edition. D. You have not downloaded and installed Windows Vista Service Pack 1. 3. You just purchased a new Windows Vista Ready Graphics Card for your system. You install the new card, but you are still not able to use the Aero feature of Vista. What should be done so you can utilize Aero on your system? A. Upgrade to the Home Basic Version of Vista. B. Download the latest Windows Ultimate Extras. C. Return the card to the store and get a different model. D. Check Windows Update or the manufacturer’s Web site for an updated driver. 4. You would like to demonstrate the Windows 3-D flip feature of Aero to some of your colleagues. What is the correct key combination to allow you to demonstrate this feature? A. Control + Alt + Delete B. Windows Start Key + R C. Alt + Tab D. Windows Start Key + Tab
www.syngress.com
Configuring Windows Vista • Chapter 3
5. You are giving a demonstration on the new features of Internet Explorer 7 to a group of your peers. You mention the new quick tabs feature, and one of the members of the audience asks for more elaboration on the subject. Which of the following statements best describes quick tabs? A. The quick tabs feature allows for multiple home pages. B. The quick tabs feature displays all open Web pages in a single window. C. The quick tabs feature allows you to find a list of search providers for the search bar. D. The quick tabs feature allows you to view and manage favorite Web sites. 6. What action will effectively disable the Parental Control settings of Windows Vista? A. Enabling the Administrative Account B. Creating an administrative account with a blank password C. Including a hint on for the administrator’s password D. Adding the user account with Parental Control settings to the administrator’s group. 7. Where can the activity logs of Parental Controls be cleared? A. The logs are cleared in the Parental Controls section of the Control Panel. B. For Security reasons, the logs cannot be cleared. C. To clear the activity logs of Parental Controls, click the Generate report link and export the log to an HTML file. D. The logs are cleared in the Event Viewer. 8. You used the Parental Controls feature of Windows Vista to set a time restriction on your child’s account.You have restricted them from using the computer after 7 p.m. What happens to this user when they are logged in as the clock strikes 7 p.m.? A. The user can remained logged on and keep working but will not be able to log on if they log off the computer. B. The user’s screen will turn black and the user will be immediately logged off at 7 p.m. without warning. C. The user will be warned to close all running applications and be logged off.
www.syngress.com
201
202
Chapter 3 • Configuring Windows Vista
D. The screen will lock at 7 p.m. and can only be unlocked by an account that has administrative privileges. 9. Your colleague and you both decided to purchase the same model of computer with the Ultimate Edition of Windows Vista. Both you and your colleague are using the Aero feature. Your colleague is also utilizing the DreamScene feature. When you go back to your office, you attempt to enable DreamScene, but cannot find it as an option on your computer. What is the most likely cause for this? A. You are not running Windows Vista Enterprise Edition. B. You need to upgrade your computer’s hardware. C. You have not downloaded the DreamScene Ultimate Extra. D. You have not downloaded and installed Windows Vista Service Pack 1 10. Describe the Transmission Control Internet Protocol Stack in Vista? A. Dual Stack, with preference being given to IP v4 B. Single Stack, with only IP v4 installed by default C. Dual Stack, with preference being given to IP v6 D. Single Stack, with only IP v6 installed by default
www.syngress.com
Configuring Windows Vista • Chapter 3
Self Test Quick Answer Key 1.
C
6.
B
2.
C
7.
D
3.
D
8.
B
4.
D
9.
C
5.
B
10.
C
www.syngress.com
203
This page is intentionally left blank
Chapter 4
MCTS/MCITP Exam 620 Configuring the Vista Security Features Exam objectives in this chapter: ■
User Account Control
■
Configuring the Security Center
■
Configuring BitLocker
■
Configuring Local Policies
■
Configuring the Encrypted File System
Exam objectives review: ˛ Summary of Exam Objectives ˛ Exam Objectives Fast Track ˛ Exam Objectives Frequently Asked Questions ˛ Self Test ˛ Self Test Quick Answer Key 205
206
Chapter 4 • Configuring the Vista Security Features
Introduction In the past, Microsoft developed a reputation for having operating systems that lack security and have a large number of vulnerabilities. Operating systems outside the Microsoft world, such as Macintosh, Linux, and UNIX, have traditionally had better reputations for implementing security. With the release of Server 2003, Microsoft embarked on a campaign of “trustworthy computing.” The idea behind trustworthy computing was that a consumer should have a reasonable expectation of security out of the box. Although Windows 2000 significantly improved on the stability issues related to the Windows 9.x series, it still lacked the security users needed during a time in which Internet usage and computer networking were beginning to explode. Two of the most glaring problems of Windows 2000 were the default security permissions on files and folders, and having services installed and running by default. When Server 2003 was released under the trustworthy computing initiative, file permissions were tightened and unnecessary services were not installed or enabled by default. Server 2003 actually gained a good deal of respect in the IT community as both a stable and secure operating platform. Although Server 2003 was a secure platform, the security layers implemented were not so restrictive as to prevent the operating system from being functional. Windows Vista is the most secure desktop operating system Microsoft has released to this date. Security permissions on files and folders have been locked down even tighter than on any previous versions of Windows.Vista also introduces a feature called User Account Control which will prevent users from unintentionally running tasks with administrative privileges. With the default out-of-the-box settings, even users with administrative rights will be prompted by a User Account Control box when they attempt to complete a task that requires administrative privileges. One of the biggest culprits of security-related issues with Windows operating systems has been Internet Explorer. Windows Vista includes a newly redesigned Internet Explorer 7 which runs in a protected mode. When users browse the Web, Internet Explorer 7 runs with low integrity so that spyware and malware infestations will be less likely. So, unlike Windows XP with IE7, Vista’s version of Internet Explorer 7 runs in a sandbox. The Enterprise and Ultimate editions of Windows Vista include BitLocker, a technology which allows for volume encryption. Unlike the Encrypted File System, which has been around since the release of Windows 2000 and allows users to encrypt single files or folders on a disk, BitLocker allows an entire volume to be encrypted. BitLocker has caused a bit of a stir in the law enforcement community. www.syngress.com
Configuring the Vista Security Features • Chapter 4
Without a back door, or the recovery key, there is no known mechanism to recover data from a system which has been shut down completely. And if BitLocker is used in conjunction with a trusted platform module chip, the hard drive becomes “tied” to that particular PC. This means that in cases where computers are seized by law enforcement, the entire PC will have to be shipped to the computer forensics lab. And there are no guarantees that law enforcement, or anyone else, for that matter, will be able to recover the data that resides on the BitLocker volume. In summary, although BitLocker has provided data security for users, it has caused concern among the law enforcement community and has changed certain computer forensics procedures. Windows Vista does have more security than any other operating system released by Microsoft. Although security is extremely paramount in this day and age, operating systems still need to be able to function. Many of the security enhancements make Vista a reliable platform for PCs. Some of the security features, such as User Account Control, may annoy users to the point that they disable those features. Once security features are disabled, the operating system will again become vulnerable. Windows has always been the most popular operating system choice for desktops because it has made using a computer easy for the average user. If the enhanced security features overwhelm the average user to the point where he or she cannot be productive,Vista will not be successful as an operating system. Computer security is critical to an operating system platform; however, use and functionality are just as important to the success of a particular operating system.
User Account Control User Account Control is a security mechanism in Windows Vista that is used to prevent users from unintentionally launching processes with administrative rights. If a user attempts to complete a task that requires administrative privileges, a User Account Control box, as shown in Figure 4.1, will pop up and ask for the user’s permission to continue before that task is performed. This is true even if the user’s account is a member of the Administrators group. One of the main goals of the User Account Control function is to prevent users from unknowingly launching applications with administrative rights. This will help to alleviate the installation of malware and spyware by unknowing users who browse the Internet with no regard for the applications they are unintentionally launching. The User Account Control feature will make users aware of the fact that an application is about to launch and will allow users to determine whether they want to let the application launch.
www.syngress.com
207
208
Chapter 4 • Configuring the Vista Security Features
Figure 4.1 The User Account Control Screen of Windows Vista
Although the User Account Control feature of Vista does help to prevent the installation of unwanted programs, it does have limitations. Many users tend to find the User Account Control prompts annoying when working with the Vista operating system over an extended period of time. If users are frequently performing tasks that require administrative privileges, they may become annoyed by the User Account Control feature. The unfortunate reality of the situation is that if users find that this feature cuts down on their productivity, they may turn it off. Once they have turned it off, their systems are less secure and applications may launch without their knowledge. The following list includes some samples of actions that will generate a User Account Control prompt: ■
Installing or uninstalling a program
■
Right-clicking on a program and choosing Run as Administrator
■
Clicking on Advanced System Settings in the System Properties
■
Clicking on the Properties on a local area connection in Network Connections
■
Opening an administrative command prompt
■
Clicking on Control Panel icons, including Add Hardware, BitLocker, Device Manager, iSCSI Initiator, and Parental Controls
www.syngress.com
Configuring the Vista Security Features • Chapter 4
Understanding User Account Control One of the dangers with Windows operating systems has always been the fact that users have traditionally logged in under an account with administrative credentials. In contrast, in the UNIX and Linux environments, users typically logged in under non-administrative credentials and switched to root when they needed to perform a task that required administrative rights. As a Microsoft Certified Trainer, it was interesting to see the evolution of Microsoft’s products with regard to the use of the administrative account. During the Windows NT courses, students were logged in as administrator “at all times”. As a matter of fact, there was no ability to use “run as” in a Windows NT environment. With the release of Windows 2000, the ability to use “run as” was an added feature. However, during the majority of the courses, students were logged in as an account with administrative rights. The “run as” feature was introduced in some of the Windows 2000 Microsoft Official Courses, but it was rarely used. Starting with Windows courses utilizing Server 2003, I noticed a major shift with Microsoft’s regard to the utilization of the administrative account. With almost all cases in the courses, the student logged in as an account without administrative rights and used “run as” when he or she needed to perform a task with administrative privileges. Vista, Microsoft’s latest iteration, takes things even a step further. By default, the administrative account is disabled in Windows Vista. The first user created after the installation process does have administrative privileges. However, the built-in administrative account is disabled, as shown in Figure 4.2. All versions of Windows also have the guest account disabled by default; Windows Vista is the only version to date that comes with the built-in administrative account disabled. Figure 4.2 The Administrative Account, Disabled by Default in Vista
www.syngress.com
209
210
Chapter 4 • Configuring the Vista Security Features
Configuring User Account Control You can configure the User Account Control feature from either the Group Policy Management Console or the Local Security Policy Management Console. To use the Group Policy Management Console type gpedit.msc in the Start Search or Run box. The User Account Control options are located under Computer Configuration | Windows Settings | Local Policies | Security Options. To use the Local Security Policy Management Console, click the Administrative Tools applet in the classic view of the Control Panel.You can also reach the Security Policy Management Console by typing secpol.msc in the Start Search or Run box. The User Account Control options are located under Local Policies | Security Options. Both the Group Policy Management Console and the Local Security Policy Management Console allow you to manage security options which fall under the subcategory of Local Policies. At the bottom of the list of the security options are nine specific settings related to User Account Control, as shown in Figure 4.3.
TEST DAY TIP Be familiar with the User Account Control Policies in the Local Security Policy and understand how they might affect the overall User Account Control settings of the machine.
Figure 4.3 The Nine User Account Control Settings That You Can Configure
www.syngress.com
Configuring the Vista Security Features • Chapter 4
All nine settings have detailed explanations regarding how system security will be altered. You can view these explanations by double-clicking on the security policy and clicking on the Explain tab, as shown in Figure 4.4.
Figure 4.4 Detailed Explanation of a Local Security Policy
www.syngress.com
211
212
Chapter 4 • Configuring the Vista Security Features
Some of the settings that can be configured include the ability to change how User Account Control will operate for administrative accounts. With Vista’s default settings, even the built-in administrator will be prompted for consent when attempting to complete tasks that require administrative rights. If the Admin Approval Mode for the Built-in Administrator is disabled, all processes launched by the administrator will launch with full administrative privileges. Enabling this Group Policy will not disable User Account Control on your machine; this setting only affects the behavior related to User Account Control with the built-in administrator account. The builtin administrator is, however, disabled by default, so the account would need to be enabled to utilize this policy. The procedure to enable the built-in administrator account is explained in Exercise 4.1.
EXERCISE 4.1 ENABLING THE BUILT-IN ADMINISTRATOR ACCOUNT
IN
WINDOWS VISTA
1. Click on the Start button (Pearl) and type lusrmgr.msc in the Start Search box. (Click Continue if you receive a User Account Control pop-up box.) 2. Double-click on the Users folder. Double-click the administrator account. 3. Uncheck the Account is disabled checkbox, as shown in Figure 4.5. 4. Close Local Users and Groups. Click on the Pearl, click on the arrow to the right of the lock, and choose Log off. The administrator account should now be listed at the login screen.
www.syngress.com
Configuring the Vista Security Features • Chapter 4
Figure 4.5 Enabling the Built-in Administrator in Vista
Disabling the Run All Administrators in Admin Approval Mode option will allow all users in the Administrators group to launch processes without being prompted for consent from a User Account Control warning box. However, if this setting is disabled, the purpose of User Account Control is, in fact, subverted. Disabling the Run All Administrators in Admin Approval Mode option will also require a reboot and will notify the Security Center that the machine’s overall security has been reduced. So, disabling the Run All Administrators in Admin Approval Mode option will turn off User Account Control in Vista. The three settings for the behavior of the elevation prompt for administrators in Admin Approval Mode are Prompt for consent, www.syngress.com
213
214
Chapter 4 • Configuring the Vista Security Features
Prompt for credentials, and Elevate without prompting. All three options for this security setting are shown in Figure 4.6. The Prompt for consent option setting, which is the default option, will ask the user to continue when he or she launches a task that requires administrative privileges. The Prompt for credentials option adds an additional layer of security by asking for the password for every task that requires administrative privileges to be run. The Elevate without prompting option will effectively disable User Account Control on Vista.
Figure 4.6 Settings for Elevation Prompt for Administrators in Admin Approval Mode
www.syngress.com
Configuring the Vista Security Features • Chapter 4
The setting behavior of the elevation for standard users has two options: Prompt for credentials and Automatically deny elevation requests. With the default setting of Prompt for credentials, all regular users will be required to provide the password of one of the administrative accounts on the machine when they attempt to launch a process that requires administrative rights. For this reason, it is a serious security risk to have an administrative account without a password. The Automatically deny elevation requests option will not permit standard users to ever launch applications that require administrative privileges, as shown in Figure 4.7.
Figure 4.7 Standard User Being Denied Elevation Request by Group Policy Settings
EXERCISE 4.2 CHANGING THE BEHAVIOR OF THE ELEVATION PROMPT FOR ADMINISTRATORS IN ADMIN APPROVAL MODE VIA GROUP POLICY SETTINGS NOTE The elevation prompt for administrators in Admin Approval Model will not disable User Account Control. This setting will require the administrative account to retype his or her password every time an administrative task is launched. This setting, in effect, adds an extra layer of security to your system. www.syngress.com
215
216
Chapter 4 • Configuring the Vista Security Features
1. Click on the Start button (Pearl), and type secpol.msc in the Start Search box. (Click Continue if you receive a User Account Control pop-up box.) 2. Select Local Policies | Security Options. Go to the bottom of the list and find the User Account Control: Behavior of the elevation prompt for the Administrators in Admin Approval Mode setting. 3. Double-click on the User Account Control: Behavior of the elevation prompt for the Administrators in Admin Approval Mode setting, and select Prompt for Credentials, as shown in Figure 4.8. This setting will require administrative accounts to enter their password before they launch a process requiring administrative rights. Requiring an administrative password for standard users to launch an administrative process is the default setting in Vista.
Figure 4.8 Admin Approval Mode: Prompt for Credentials
www.syngress.com
Configuring the Vista Security Features • Chapter 4
4. Close the Group Policy Settings screen. Click on the Start button (Pearl), and type cmd in the Start Search box to open a command prompt. Type gpupdate /force (this will refresh Group Policy). 5. Attempt to complete a task that requires administrative rights by clicking on the Pearl, right-clicking Computer, and selecting Properties. Click the Advanced System Settings tab under Tasks on the left side of the screen. You will be required to enter a password to complete any task that requires administrative privileges, as shown in Figure 4.9. This setting is similar to settings in UNIX and Linux, as users typically use the su command and type in a password when they launch a task that requires a privileged account. This User Account Control setting adds an additional layer of security to a system running Windows Vista.
Figure 4.9 Administrators in Admin Approval Mode Setting of Prompt for Credentials
www.syngress.com
217
218
Chapter 4 • Configuring the Vista Security Features
Disabling User Account Control You can disable the User Account Control feature from the User Accounts applet in the Control Panel. Microsoft does not recommend that you disable User Account Control. However, if User Account Control starts to interfere with productivity, you can turn it off. For example, the step of clicking Continue every time you need to perform a task with administrative rights can be somewhat time-consuming. Of course, the danger in turning off User Account Control is that you could unintentionally launch a process with administrative credentials. In our company, we turn off the User Account Control feature based on the end-user’s skill level. We turn off the User Account Control feature for our savvier users and keep the feature on for users who have less experience in using the Windows operating systems.
EXERCISE 4.3 TURNING OFF USER ACCOUNT CONTROL NOTE This exercise will put your computer’s security at risk.
1. Click on the Start button (Pearl), go to the Classic view of the Control Panel, and click on the User Accounts applet. 2. Click Turn User Account Control on or off, as shown in Figure 4.10. (Click Continue if you receive a User Account Control pop-up box.)
www.syngress.com
Configuring the Vista Security Features • Chapter 4
Figure 4.10 Turning User Account Control On or Off
3. Uncheck the box that states Use User Account Control (UAC) to help protect your computer, as shown in Figure 4.11.
Figure 4.11 Turning User Account Control Off
www.syngress.com
219
220
Chapter 4 • Configuring the Vista Security Features
4. Click OK, and then click Restart Now. If you turn off Vista’s User Account Control feature, you will be occasionally warned by the security center, as shown in Figure 4.12.
Figure 4.12 Warning That User Account Control Is Turned Off
5. Turn User Account Control back on in the Control Panel or in the Security Center by clicking the Turn on now radio button for User Account Control, as shown in Figure 4.13.
Figure 4.13 Turning User Account Control Back On in the Security Center
www.syngress.com
Configuring the Vista Security Features • Chapter 4
Configuring the Security Center You can access the Windows Security Center through the Control Panel or via the shield icon on the right-hand side of the task bar. The red shield icon with an X through the center will appear on the task bar only if Vista has detected what it perceives to be a security problem. A yellow shield will usually signify a warning that antivirus software has not been installed or detected by the system. Even if the Security Center indicates that a security problem is present on a system that may not actually be the case. Whether you have a security problem depends on your configuration and what third-party applications you may be using. The Windows Security Center, as shown in Figure 4.13, monitors four main components,
