I had a hand in rolling out Forefront Endpoint Protection (FEP) for a customer recently. Some of our clients did not get FEP installed even though the SCCM client was installed and working correctly, and they had all prerequisites present and had successfully received the advertisement and downloaded the files from the distribution point (DP). It turned out that these clients were already running Microsoft Security Essentials (MSE), which FEP does not detect or uninstall. The solution was to manually uninstall MSE first and then wait for the next installation attempt from the SCCM client.

For future reference; these are the Anti-Malware products that FEP can detect and uninstall before it installs itself:

• Symantec Endpoint Protection version 11
• Symantec Corporate Edition version 10
• McAfee VirusScan Enterprise version 8.5 and version 8.7
• Trend Micro OfficeScan version 8.0 and version 10.0
• Forefront Client Security version 1 including the Operations Manager agent

If you want to troubleshoot FEP deployments here are som interesting logfiles:

• %WINDIR%%TEMP%FEP-ApplyPolicy-%COMPUTERNAME%.log
• C:Documents and SettingsAll UsersProgramdataMicrosoftMicrosoft Security ClientSupportEppSetup.log
  (This folder also contains other interesting files regarding the FEP install.)

An overview of all SCCM 2007 logfiles is available here: http://technet.microsoft.com/en-us/library/bb892800.aspx

You copy a desktop.ini file into a folder to customize and maybe localize it. You have correctly set the file’s attributes to Hidden, System and Read-Only, but still your customizations do not work. To make it work you need to set the Read-Only or System flags on the folder where the desktop.ini file resides. As I am sure you know, folders cannot be read-only, neither can they “remember” your settings so that all new files placed in the folder become read-only as well. So this flag is purely to tell Windows that this is a special folder and that it should look for a desktop.ini file inside it.

To change the attributes from the command line type:

attrib +R +S <your folder>

From PowerShell:

Set-ItemProperty <your folder> -Name Attributes -Value “ReadOnly,System”

It took me a while to figure this out so hopefully someone can make use of this info.

Here is a link to another issue where your desktop.ini customizations do not work:

• The Desktop.ini file does not work correctly when you create a custom default profile

I wanted to reinstall a Lenovo X1 portable computer. While preparing to wipe the machine I used ProduKey from NirSoft to extract the product keys for the installed software. This particular machine was sold with an OEM license, for which the product key was affixed under the machine. I quickly noticed that the key printed on the label did not match the one extracted from the machine with ProduKey. That meant that the machine was BIOS or OEM activated.

I now had two choices; I could bring the OEM activation with me over to my new install or just use the key printed on the sticker. The last option would have been the easiest, but that’s not how I roll. So how to “extract” the OEM activation?

A friend of mine had previously gone through just this scenario with a bunch of HP machines so I knew that the activation was dependent on a digital certificate, distributed by Lenovo with the machine and signed by Microsoft. Unfortunately the certificate file had been deleted by Lenovo setup. But the Lenovo recovery partition (Q:) included a WIM file called cdrivebackup.wim. This WIM was used by the recovery system to reinstall the machine in the event a failure occurred. It probably included the needed certificate. But first I had to make the contents of the recovery partition visible so I could easily copy the files to another computer and mount the WIM. This was accomplished by these two commands:

• echo y | icacls “Q:*” /grant Administrators:F /T
• attrib -R -A -S -H “Q:” /S /D

I then copied the entire contents of the Q drive to a memory stick and mounted the WIM with DISM on another computer:

• dism.exe /Mount-Wim /WimFile:h:LenovoRecoveryFactoryRecverycdrivebackup.wim /index:1 /MountDir:D:wimmount /ReadOnly

Now it was time to try and find the certificate (software license certificate have an xrm-ms extension):

• dir d:wimmount*.xrm-ms /s

This command yielded many files but only the one called lenovo.xrm-ms in the d:wimmountswworkOEM was of interest. I copied the file to a memory stick and proceeded to wipe the machine and reinstall Windows 7. After Windows 7 was installed I created a new folder under %windir%system32oem and copied the certificate into it. Now I could install the certificate and product key;

• cscript %windir%system32slmgr.vbs -ilc %windir%system32oemlenovo.xrm-ms
• cscript %windir%system32slmgr.vbs -ipk 237XB-GDJ7B-MV8MH-98QJM-24367

Now, the product key is kind of interesting. This key will be accepted as a valid key by Windows, but will not be able to activate the machine without the certificate file. It’s kind of like a KMS client key, but instead of a KMS Host it needs a certificate. As far as I can tell this key is Lenovo specific so I hope I haven’t infringed on any copyrights etc. by posting it here.

Morgan

Here is a quick script to just install, or install and enable the Windows 7 Remote System Administration Tools (RSAT) for Windows 7 with Service Pack 1. I created it for use with the software deployment functionality in System Center Configuration Manager, but it is not limited to that.

' InstallRSAT.vbs

' v 1.0 (15.06.2011)

' by Morgan Simonsen, Atea

' 

' Detects system architecture, and installs and enables RSAT for Windows 7 with SP1, depending on submitted arguments.

'

' Usage:

' InstallRSAT.vbs <Install|InstallAndEnable>

'

' Install: just install RSAT, must be manually enabled

' InstallAndEnable: install and enable RSAT (all components)

'

' If no arguments are submitted; Install will be used.

'

' Arguments are CASE SENSITIVE!!!

'Enable/disable debugging

strDebug = 0

Set objWSHShell = WScript.CreateObject("WScript.Shell")

Set objFSO = CreateObject("Scripting.FileSystemObject")

'Get script arguments

Set objArgs = WScript.arguments

If objArgs.Count = 0 Then

    ' No arguments submitted, defaulting to install (and not enable)

    strInstallAction = "/Install"

Else

    strInstallAction = objArgs.item(0)

    Select Case strInstallAction

        Case "/Install"

            'Install action selected

        Case "/InstallAndEnable"

            'InstallAndEnable action selected

        Case Else

            'Invalid argument submitted; quitting!

    End Select

End If

strScriptPath = objFSO.GetParentFolderName(WScript.ScriptFullName)

'Determine CPU Architecture

strComputer = "."

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\" & strComputer & "rootcimv2")

Set colProcessors = objWMIService.ExecQuery("Select * from Win32_Processor")

For Each objProcessor in colProcessors

    strProcessorArchitecture = objProcessor.Architecture

Next

'strProcessorArchitecture = objWSHShell.ExpandEnvironmentStrings("%PROCESSOR_ARCHITECTURE%")

strWinDir = objWSHShell.ExpandEnvironmentStrings("%WINDIR%")

strWUSA = strWinDir & "system32wusa.exe"

strDISM = strWinDir & "system32dism.exe"

strx86Package = strScriptPath & "Windows6.1-KB958830-x86-RefreshPkg.msu"

strx64Package = strScriptPath & "Windows6.1-KB958830-x64-RefreshPkg.msu"

Select Case strProcessorArchitecture

    Case "0"

        strProcessorArchitectureHumanReadable = "x86"

        strLogFile = chr(34) & strWinDir & "LogsRSAT Install (" & strProcessorArchitectureHumanReadable & ").log" & Chr(34)

        objWSHShell.Run (strWUSA & " " & strx86Package & " /quiet /norestart /log:" & strLogFile),0,True

        If strInstallAction = "/InstallAndEnable" Then

            Call EnableRSAT()

        End If

    Case "9"

        strProcessorArchitectureHumanReadable = "x64"

        strLogFile = chr(34) & strWinDir & "LogsRSAT Install (" & strProcessorArchitectureHumanReadable & ").log" & Chr(34)

        objWSHShell.Run (strWUSA & " " & strx64Package & " /quiet /norestart /log:" & strLogFile),0,True

        If strInstallAction = "/InstallAndEnable" Then

            Call EnableRSAT()

        End If

    Case Else

        'Unknown architecture; quitting!

End Select

Function EnableRSAT()

            objWSHShell.Run (strDISM & " /Online /Enable-Feature " &_

            "/FeatureName:IIS-LegacySnapIn " &_

            "/FeatureName:IIS-IIS6ManagementCompatibility " &_

            "/FeatureName:IIS-WebServerManagementTools " &_

            "/FeatureName:IIS-WebServerRole " &_

            "/FeatureName:IIS-Metabase " &_

            "/FeatureName:RemoteServerAdministrationTools " &_

            "/FeatureName:RemoteServerAdministrationTools-ServerManager " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-CertificateServices " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-CertificateServices-CA " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-CertificateServices-OnlineResponder " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-DS " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-DS-SnapIns " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-DS-AdministrativeCenter " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-DS-NIS " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-LDS " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-AD-Powershell " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-DHCP " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-DNS " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-FileServices " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-FileServices-Dfs " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-FileServices-Fsrm " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-FileServices-StorageMgmt " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-HyperV " & _

            "/FeatureName:RemoteServerAdministrationTools-Roles-RDS " & _

            "/FeatureName:RemoteServerAdministrationTools-Features " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-BitLocker " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-Clustering " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-GP " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-LoadBalancing " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-SmtpServer " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-StorageExplorer " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-StorageManager " & _

            "/FeatureName:RemoteServerAdministrationTools-Features-Wsrm"),0,True

End Function

Function Debug(data)

    If strDebug = 1 Then

        WScript.Echo data

    End If

End Function

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }

Can the computername in Windows 7 be more than 15 characters?

Yup!

A new tool is being offered through Windows Update; the System Update Readiness (SUR) Tool. It is designed to help diagnose and fix issues that are preventing Windows updates or Service Packs from installing correctly. According to the documentation it is only offered to systems that are experiencing one of the conditions that the tool could resolve. (How it can determine this without first running is beyond me.) The tool runs on Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2. Like the monthly Windows Malicious Software Removal Tool (WMSRT), it runs a onetime scan of your system to determine if it is experiencing one of the issues it can detect and fix. A log of this activity is written to %SYSTEMROOT%LogsCBSCheckSUR.log. As of this writing the tool is presented in Windows Update as System Update Readiness Toll for Windows 7 for x64-based Systems (KB947821) [February 2011]. This leads me to beleive that it will be updated and offered in new “versions” further on.

You can also download the tool manually and run it, check the first link below.

On one system I experienced an error when trying to install Windows Server 2008 R2 Service Pack 1; An unknown error has occurred; error code 0x800f0818. I ran the SUR Tool and it detected an error in the %SYSTEMROOT%ServicingPackages folder, which it was able to repair. After that SP1 installed successfully.

One strange thing to note in this case was that I was installing SP1 through Windows Update, and both SP1 and the SUR tool were selected for install. For some reason the SP1 install ran first and failed, then the SUR tool ran and repaired the error that prevented the Service Pack from installing. Should have been the other way around.

More info:

• What is the System Update Readiness Tool?
• Description of the System Update Readiness Tool for Windows Vista, for Windows Server 2008, for Windows 7, and for Windows Server 2008 R2