Application Compatibility Blog

Patch Tuesday: November 2009

greg.lambert@gmail.com (Greg Lambert) — Thu, 12 Nov 2009 16:22:00 +0000

The November Patch Tuesday update from Microsoft follows the largest patch and security update in Microsoft’s history. This month there are six updates to Office, Active Directory and Microsoft’s Office application suite.

These six updates have a low impact, bar one patch to Excel which may cause compatibility issues for some applications. The main cause for concern here is that Excel is a primary if not essential element to many environments. For example most banking, trading floor and insurance platforms. Therefore any change must be tested rigorously.

Whilst there are few applications in our sample that are affected, the ChangeBASE AOK team recommends that the Excel update (MS09-067) requires particular attention in any environments where there is a significant dependency on this,

We have included a brief snap-shot of some of the results from our AOK Software that demonstrates some of the potential impacts on Microsoft Office deployments with the following picture.

Testing Summary

MS09-063 : : Marginal impact and negligible testing profile
MS09-064 : : Marginal impact and negligible testing profile
MS09-065 : : Marginal impact and negligible testing profile
MS09-066 : : Marginal impact and negligible testing profile
MS09-067 : : Moderate impact and negligible testing profile
MS09-068 : : Marginal impact and negligible testing profile

Patch Name	Total Issues	Matches Affected	Reboot	Rating
Microsoft Security Bulletin MS09-063	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-064	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-065	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-066	<1%	<1%	YES	Important
Microsoft Security Bulletin MS09-067	1%	1%	YES	Important
Microsoft Security Bulletin MS09-068	<1%	<1%	YES	Important

Legend:

	No Issues Detected
	Potentially fixable application Impact
	Serious Compatibility Issue

Security Update Detailed Summary

MS09-063	Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565)
Description	This security update resolves a privately reported vulnerability in the Web Services on Devices Application Programming Interface (WSDAPI) on the Windows operating system. The vulnerability could allow remote code execution if an affected Windows system receives a specially crafted packet. Only attackers on the local subnet would be able to exploit this vulnerability.
Payload	Wsdapi.dll
Impact	Critical – Remote Code Execution

MS09-064	Vulnerability in License Logging Server Could Allow Remote Code Execution (974783)
Description	This security update resolves a privately reported vulnerability in Microsoft Windows 2000. The vulnerability could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter.
Payload	Llscustom.dll
Impact	Critical – Remote Code Execution

MS09-065	Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947)
Description	This security update resolves several privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font. In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted embedded fonts that are used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince the user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the attacker's site.
Payload	Win32k.sys, W32ksign.dll
Impact	Critical – Remote Code Execution

MS09-066	Vulnerability in Active Directory Could Allow Denial of Service (973309)
Description	This security update resolves a privately reported vulnerability in Active Directory service, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The vulnerability could allow denial of service if stack space was exhausted during execution of certain types of LDAP or LDAPS requests. This vulnerability only affects domain controllers and systems configured to run ADAM or AD LDS.
Payload	Adamdsa.dll
Impact	Important – Remote Code Execution

MS09-067	Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)
Description	This security update resolves several privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Excel.exe
Impact	Important – Remote Code Execution

MS09-068	Vulnerability in Microsoft Office Word Could Allow Remote Code Execution (976307)
Description	This security update resolves a privately reported vulnerability that could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Winword.exe
Impact	Important – Remote Code Execution

Microsoft TechEd EMEA: A few days in Berlin

greg.lambert@gmail.com (Greg Lambert) — Wed, 11 Nov 2009 17:30:00 +0000

It's going to be a super quick post today.

I have been working the Converter Technology (http://www.convertertechnology.com/) stand and the Getronics stands at the Microsoft TechEd exhibition all day and now have to do my day job (in the evening.)

I just thought that I would post some of the images of the stand and include some of the great people working with us.

These chaps are from Converter Technonology who automatically scan for "document" level compatibility issues and fix them... which sounds kinda familiar doesn't it?

Will post properly once I am back in the UK.

MS09-054: IE8 Security Update - Updated

greg.lambert@gmail.com (Greg Lambert) — Thu, 05 Nov 2009 21:25:00 +0000

October 2009 saw the biggest Microsoft security update - both in terms of breadth and depth of patches delivered and bugs fixed.

However, we have seen three updates to this October Security update over the past few weeks.

On October 14, Microsoft offered up a workaround for a problem with MS09-056, then corrected several errors in MS09-062 last week.

The company also revised an August update, MS09-043, last week to correct a patch-detection error that may have left some corporate users who receive updates via Windows Server Update Services (WSUS) un-patched.

Now, the Internet Explorer (IE) 8 Patch MS09-054 was updated on November 3rd with a binary level revision of the security files.

From our last AOK Patch Tuesday assessment, here are the details for this patch.

MS09-054	Cumulative Security Update for Internet Explorer (974455)
Description	This security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Iecustom.dll, Browseui.dll, Cdfview.dll, Danim.dll, Dxtmsft.dll, Dxtrans.dll, Iepeers.dll, Inseng.dll, Jsproxy.dll, Mshtml.dll, Msrating.dll, Mstime.dll, Pngfilt.dll, Shdocvw.dll, Shlwapi.dll, Urlmon.dll, Wininet.dll, Browseui.dll, Cdfview.dll, Danim.dll, Dxtmsft.dll, Dxtrans.dll, Iepeers.dll, Inseng.dll, Jsproxy.dll, Mshtml.dll, Msrating.dll, Mstime.dll, Pngfilt.dll, Shdocvw.dll, Shlwapi.dll, Urlmon.dll, Wininet.dll, Iecustom.dll
Impact	Critical – Remote Code Execution

We at the AOK Patch team were pretty concerned about this patch and rated it an AMBER due to the number of application overlaps and the potential for impacts on the target Operating system. We have re-run the reports for this patch and the updated BITS do not materially impact the results. However, the AOK team still recommends that this patch requires extensive testing prior to deployment.

For reference, I have included the RAG status for all of these patches in this blog posting;

Patch Name	Total Issues	Matches Affected	Reboot	Rating
Security Bulletin MS09-050	<1%	<1%	YES	Critical
Security Bulletin MS09-051	<1%	<1%	YES	Critical
Security Bulletin MS09-052	<1%	<1%	YES	Critical
Security Bulletin MS09-053	<1%	<1%	YES	Critical
Security Bulletin MS09-054	1%	1%	YES	Critical
Security Bulletin MS09-055	<1%	<1%	YES	Critical
Security Bulletin MS09-056	<1%	<1%	YES	Critical
Security Bulletin MS09-057	<1%	<1%	YES	Critical
Security Bulletin MS09-058	<1%	<1%	YES	Critical
Security Bulletin MS09-059	<1%	<1%	YES	Critical
Security Bulletin MS09-060	1%	1%	YES	Critical
Security Bulletin MS09-061	1%	1%	YES	Critical
Security Bulletin MS09-062	11%	<1%	YES	Critical

And, for all those not rabidly following the AOK "Language of Life", we use Red, Amber and Green to colour our world. So, here is a legend for these results.

Legend:

	No Issues Detected
	Potentially fixable application Impact
	Serious Compatibility Issue

5x5x5 Migration Issues: App-V 4.x to 4.6

greg.lambert@gmail.com (Greg Lambert) — Mon, 02 Nov 2009 08:19:00 +0000

Well,

This is the third part of my by three part blog - and, it looks like I might have to add another piece - meaning that, this is really the 3rd part of a 4 part blog post ... oops

As mentioned in the previous two postings, we need to get applications working on Windows 7 and App-V: together. Meaning getting an application successfully deployed and running on a App-V client running on top of Windows 7.

This blog posting relates to the challenges facing administrators who have existing App-V packages (client versions 4.1 and 4.2) which were probably sequenced on Windows XP who will need to migrate these packages to the App-V client 4.5. In fact, though the most recent client version of App-V is 4.5 CU1, we really should be planning for clients to deploy to version 4.6, which is expected to be released Microsoft to production soon. Thus, I have tailored our results of the SFT package analysis to take client 4.6 issues into account as well.

With the updated release of Microsoft App-V 4.5 (and also relating to the update CU1 and 4.6 BETA), there has been a number of significant architectural changes that impacted how applications are sequenced. As a result, the sequencing practices are now different for versions for App-V 4.2 and later versions. As included in the release notes App-V 4.5, there are now several core components which may generate application compatibility issues with App-V applications including;

.NET Installation Components
Microsoft Internet Explorer Components
Microsoft MSI Installer Redistributables
Core Operating System (OS) components
Installation artefacts (settings left-over from MSI Installation processes)

In addition, to these issues, it appears that empty directories (or folders) that are captured as part of the sequencing process are causing the App-V VFS to crash on certain clients. We have not fully analysed this issue yet - however, I have included the results for our AOK "Empty Directory Check" Plugin for illustrative purposes.

I am really surprised by the results. And, by means of qualifying the results, this is really a preliminary analysis of these App-V SFT file types. The AOK Plugins may need to be refined or seriously modified based on some real empirical evidence of client issues. That said, all of the manual testing of each of these "classes" of issues did match the AOK Plugin results.

I am going to spend some time analysing these results but it looks like the big issues are .NET and IE integrations issues with a surprisingly high number of SFT packages with empty directories - something that is known to crash the Microsoft App-V client sub-system. Maybe some more thought is required here.

To help out with explaining what we are actually looking for in each App-V SFT file, I have included some brief "snippets" of the AOK Plugin descriptionsincluded in this particular report. Each description should give you an idea of the things that we are looking for in each application package, and the reason why we are looking there.

Darwin Descriptors Registry Check

This AOK Plugin will analyse each selected and loaded application for the following Registry key HKEY_CLASSES_ROOT\extfile\shell\Open\command within each application package. If a Darwin descriptor registry key has been raised, and AMBER Issue will be flagged by the AOK application.

Empty Directory Check

This AOK Plugin will analyse each loaded and selected application package and ensure that the loaded MSI or SFT file does not contain any non system empty directory table entries. This Plug-in will raise an AMBER issue if these types of directories are detected in an application package.

Internet Explorer Integration Analysis

This AOK Plugin analyses each loaded and selected application package for file entries that are included as part of the Microsoft Internet Explorer 6 (IE6) redistribution package. This Plug-in will raise an AMBER issue if these files are detected in an application package.

Known DLL File Check Analysis

This AOK Plugin will analyse loaded and selected application packages for file level entries that match the list of Microsoft Known DLL's. The DLL's contained within this list will not support SxS isolation or any other Microsoft redirection technology. This AOK Plugin will generate AMBER results.

Microsoft .NET Sequenced Component Analysis

This AOK Plugin analyses each loaded and selected application package for file entries that are included as part of the Microsoft Windows .NET redistribution package. This Plug-in will raise an AMBER issue if these files are detected in an application package. Due to the Operating System and .NET installation requirements, if older versions (.NET 1.X and 2.X) are included in a sequenced package then application runtime issues may arise.

Windows Installer Redistributable Analysis

This AOK Plugin analyses each loaded and selected application package for file entries that are included as part of the Microsoft Windows Installer redistribution package. This Plug-in will raise an AMBER issue if these files are detected in an application package.

Sequencer Registry Exclusion Analysis

This AOK Plugin analyses each loaded and selected application package for file entries that are not fully captured as part of the Microsoft App-V sequencing process. This Plug-in will raise an AMBER issue if these registry settings are detected in an application package.

The final blog posting in this series will analyse some of the results and attempt to match these results to real world scenarios and possible application compatibility issues.

5x5x5 App-V Application Compatibility Issues: Part 2

greg.lambert@gmail.com (Greg Lambert) — Thu, 29 Oct 2009 09:27:00 +0000

As promised in my last blog posting, the focus of this post will be review the results of our analysis on App-V application compatibility issues for Windows 7.

So, just to recap. We are analysing issues for existing App-V application packages that are running fine (i.e. well enough) on Windows XP with the App-V client and now need to be moved over to the Windows 7 desktop platform. The challenge here is trying to determine what sequenced applications under App-V will experience application compatibility issues when run on Windows 7.

So, not all of our standard AOK Windows 7 compatibility tests will be an issue. I have removed our installation logic and MSI Installer Custom Action checks from the results as they do not apply to this sample set as the source packages are not MSI files but Sequenced SFT files

And, here are the Top 5 issues that you might encounter when migrating App-V sequenced packages are moved to Windows 7.

As you already know, Microsoft's App-V platform does not solve OS level compatibility issues, but solves application-level conflict issues. Just because an App-V application works great on Windows XP, unfortunately it does not mean that the sequenced package will work on Windows 7 or Server 2008 platforms.

So, quickly reviewing these results. It looks like the most common issues will be legacy Help File (HLP files) and Hard-Coded References as potential configuration issues and the un-signed driver issues will definitely cause issues on Windows 7 64-bit platforms.

I will do a full review (and some aggregation) of these results in the final post in this series. To give some idea of the ideas behind each report, I have included a brief description of the some of the AOK Plugins that were included in the results.

Legacy Help File Scan

This platform compatibility Plugin scans application packages for Microsoft legacy Help file formats (HLP) and makes them compatible and usable from within Vista and Windows 7.

Hard Coded References Scan

This AOK Plugin analyses each loaded and selected application package for hard coded values of folder paths. Any hard coded paths found that can be represented by an MSI Installer property will be replaced with the property.

Un-Signed Driver Analysis

This AOK Plugin analyses each loaded and selected application package and will identify each driver (DRV or SYS file) contained within the package that does NOT contain file level Signed or Certificate information. Due to the new requirements for Windows 7, all driver binaries must be digitally signed. If an application is installed on Windows 7 64-bit and it contains unsigned drivers, then the application will fail to load that driver and the application may fail to execute or behave unexpectedly.

Legacy Control Panel Applet Scan

As part of the platform compatibility scan for Windows Vista, all legacy Control Panel Applets (CPL files) are highlighted. These highlighted control panel applets should be removed or upgraded to Vista compatible versions.

TCP-IP WFP - IPX-SPX Scan

The Windows Vista networking stack has been completely rewritten. Instead of the dual stack model that exists in Windows XP or Windows Server 2003 (to support IPv4 and IPv6), it implements a new architecture whereby there is a single transport and framing layer that support multiple IP layers. This means that specific legacy protocols are no longer supported. In this case, the now deprecated SPX/IPX protocol.

Top 5x5x5 Microsoft App-V Issues

greg.lambert@gmail.com (Greg Lambert) — Wed, 28 Oct 2009 15:44:00 +0000

This is going to be a 3-part blog focusing on the some of the application compatibility challenges in getting applications to work on the Microsoft App-V virtualization platform.

The three parts of this rather large blog post will include the following analysis;

The Top-5 application "pure" App-V compatibility issues
The Top-5 application compatibility issues for App-V on Windows 7 clients
The top-5 App-V 4.1 to 4.5 migration issues

There is a lot of analysis going on within ChangeBase with over 5,400 applications in a number of formats in this particular analysis sample.

As part of this compatibility review we are analysing the following application file formats;

Microsoft Setup Executables (EXE's)
WinInstall Setup Files
Installshield Installation packages (EXE and ISS)
Wise Installation packages (WSI, WSE and EXE)
MSI Application packages (MSI, MST, MSP)
Microsoft App-V files (SFT )

As part of this analysis, we loaded over 5000 applications into our AOK tool-set and run a number of our Microsoft App-V compatibility reports.

I filtered out the results somewhat and have included the TOP-5 application compatibility issues that we generally experience when packaging or sequencing (the packaging methodology for App-V) for the App-V platform.

And, here are the results;

Top 5 App-V Compatibility Issues

Note: This distilled report was tuned for the App-V 4.2 deployment environment. Not the most recent release (4.5 CU1 with all public hot fixes). I will generate second table for 4.5 CU1 and 4.6 BETA in the third part of the blog posting.

To give a brief explanation of some of the results I have included some brief descriptions of the reports that were run against this portfolio of over 5000 application packages and installation routines;

No Shortcut Check

This AOK Plugin analyses each selected and loaded application to ensure that each application package contains at least one shortcut. This is required as part of the compatibility requirements for some Virtualised environments.

Non Supported Reboot Requirements

This AOK report analyses each loaded and selected application to identify if a reboot is required. As part of the application packaging process, some applications may require a reboot of the installation machine. Due to the nature of the virtualised environment installation process, some elements of the reboot process may not be captured and under some conditions the process may fail completely.

Hard Coded References Scan

This AOK Plugin analyses each loaded and selected application package for hard coded values of folder paths.

Non Supported Drivers

Due to the nature of the App-V Installation process drivers are not able to be installed in the application bubble. These drivers may also cause application installation and functionality issues for both Citrix and Terminal Services as they rely on Windows 2003 and Windows 2008 server environments.

Non Supported Service Installations

Due to the nature of virtualization technologies, access to the local machine environment is not always viable or available. Machine level services require full access to the machine and may require access to pre-boot operating level services.

If you are wondering about the title, my 5x5x5 view of the world takes into account;

App-V Virtualization technologies
Microsoft Windows 7 application compatibility issues
App-V 4.x to 5.4 migration issues

The next stage of this report should be available in the next few days....

A useful list of App-V KB Articles

greg.lambert@gmail.com (Greg Lambert) — Tue, 27 Oct 2009 13:12:00 +0000

A friend of mine and a App-V specialist has pointed out a number of Microsoft Knowledge Base articles relating to a number of configuration and application compatibility issues with the latest releases of the App-V client and sequencer.

I thought I would distill and publish these KB articles and links in a single place for easy reading (and finding)

App-V RTM Hotfix Rollup 2

http://support.microsoft.com/kb/959834

The following issues are fixed in the hotfix package:

Empty virtual directories may become inaccessible. This behavior causes later file operations on that virtual directory to fail and to generate the following error message:

File Not Found

When you try to run ArcGIS as a virtual application, ArcGIS may stop responding on some systems.
When you use Symantec Endpoint Protection, and the Application and Device Control feature is enabled, virtual applications may not start and may generate the following error message:

The application failed to initialize properly (0xc000007b)

When you try to run SmarTerm Essentials as a virtual application, SmarTerm Essentials may not start because it cannot validate its license.

App-V RTM Hotfix Rollup 3

http://support.microsoft.com/kb/961473

The following issues are fixed in the hotfix package:

When you add or remove a user from an Active Directory security group that is used to control access to an application, App-V does not correctly publish the application after a domain controller refresh. For example, the user does not see the new application if the following conditions are true:

The user is added to a security group.
The user is removed from the security group, but the user does not log off and then log back on. In this case, the application is not removed.

The Microsoft Application Virtualization for Terminal Services client intermittently generates a 0xA stop error.
Empty virtual directories may become inaccessible. Therefore, later file operations on that virtual directory fail. When this problem occurs, you receive the following error message:

File Not Found

When you run ArcGIS as a virtual application, ArcGIS stops responding on some systems when you start ArcGIS.
When you use Symantec Endpoint Protection with the Application and Device Control feature enabled, virtual applications cannot start. Additionally, you receive the following error message:

The application failed to initialize properly (0xc000007b)

When you run SmarTerm Essential as a virtual application, SmarTerm Essential cannot validate its license. Therefore, SmarTerm Essential does not start.

App-V CU1

http://support.microsoft.com/kb/963693

This cumulative update contains the following changes:

Support for Windows 7 Beta and Windows Server 2008 R2 Beta
App-V 4.5 CU1 addresses compatibility issues with Windows 7 Beta and Windows Server 2008 R2 Beta. Support will be provided for blocking issues that prevent App-V 4.5 CU1 from running in a test environment on pre-RTM versions of Windows 7. This change helps make sure that your virtual applications can run successfully in a test environment in which compatibility between App-V 4.5 Client and Windows 7 Beta is required.

Note Running App-V 4.5 CU1 on any version of Windows 7 or Windows Server 2008 R2 in a live operating environment is not supported.
Improved support for sequencing the Microsoft .NET Framework
App-V 4.5 CU1 addresses previous issues with sequencing the .NET Framework 3.5 and earlier versions on Windows XP Service Pack 2 (SP2) and later versions.

Customer feedback and Hotfix rollup
App-V 4.5 CU1 also includes a rollup of fixes to address issues that have been found in the App-V 4.5 RTM release. This cumulative update includes a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5.
In addition to stability improvements, this update addresses the following issues:

When you try to set the default value of a registry key by using the REGVALUE OSD element, you receive an error that the OSD file is formatted incorrectly.
When you try to open a small application package that has been compressed, it may not start, and you may receive a "0A-00000163" error. Typically, the application package is less than 1 megabyte (MB).
When you open a 16-bit application, you cannot access files in the virtual file system. This causes a start failure.

App-V CU1 Hotfix Rollup 1

http://support.microsoft.com/kb/969564

This Hotfix package addresses the following issue:

When you run the German version of Microsoft Application Virtualization 4.5, you cannot add or change attributes in the Open Software Descriptor (OSD) tab.

Note If you have the following issue, apply the Hotfix that is described in KB 969774:

App-V CU1 Hotfix Rollup 2

http://support.microsoft.com/kb/969774

This hotfix package addresses the following issues:

When the Microsoft Application Virtualization 4.5 client tries to perform a DC refresh over HTTP or over HTTPS on an IPv6 network, the DC refresh is not completed successfully.
If the %APPDATA% environment variable expands to a UNC path, virtual applications may not always start with application-specific failures.
In environments that have a trust relationship and mapped user accounts between Windows Domain and an MIT Kerberos realm, the Microsoft Application Virtualization 4.5 client cannot log on to a publishing server. Additionally, you receive error 8009030C. You can enable this fix by creating the registry value UseMITKerberos.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

Start Registry Editor
Locate and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Network

On the Edit menu, point to New, and then click DWORD Value.
Type UseMITKerberos, and then press ENTER.
On the Edit menu, click Modify.
Type 1, and then click OK.
Exit Registry Editor.

App-V CU1 Hotfix Rollup 3

http://support.microsoft.com/kb/971917

This hotfix package addresses the following issues:

When the App-V client tries to perform a publishing refresh over HTTP or HTTPS, the publishing refresh is not completed successfully. The publishing refresh is not completed successfully if a package contains pathnames that have Japanese characters. This problem occurs when the App-V client is running a Japanese version of Windows XP and has Internet Explorer 6 installed.
When you run a virtual application, Microsoft Access 97 generates error 1008 when Access 97 is moving temporary files.
When the Microsoft Application Virtualization 4.5 client tries to perform a publishing refresh over HTTP or over HTTPS on an IPv6 network, the publishing refresh is not completed successfully.
If the %APPDATA% environment variable expands to a universal naming conventions (UNC) path, application-specific failures do not always occur when you start virtual applications.
In environments that have a trust relationship and a mapped user account between Windows Domain and an MIT Kerberos realm, the Microsoft Application Virtualization 4.5 client cannot log on to a publishing server. Additionally, you receive error 8009030C.

Note You can resolve this problem by creating the UseMITKerberos registry value.

App-V CU1 Hotfox Rollup 4

http://support.microsoft.com/kb/973205

This hotfix package addresses the following issues:

When you apply a disk quota to the profile directories of an user and when the disk quota is near the limit, the App-V client leaks paged pool memory.
When run as a virtual application, a process that calls RegQueryMultipleValues experience unexpected errors or cannot start. For example, you receive error messages when you start or shutdown the Trapeze application and the application does not work correctly.
When a App-V client tries to perform a publishing refresh procedure over HTTP or HTTPS, the procedureis not completed successfully. Specifically, the procedure is not completed successfully if a package contains pathnames that have Japanese characters. This problem occurs when the App-V client is running a Japanese version of Windows XP and has Internet Explorer 6 installed.
When run as a virtual application, Microsoft Access 97 generates an error message 1008 when Access 97 is moving temporary files.
When a Microsoft Application Virtualization 4.5 client tries to perform a publishing refresh procedure over HTTP or over HTTPS on an IPv6 network, the procedure is not completed successfully.
When you expand a %APPDATA% environment variable to a universal naming conventions (UNC) path, application-specific failures occur when you start virtual applications.
In environments that have a trust relationship and mapped user accounts between a Windows Domain and an MIT Kerberos realm, the Microsoft Application Virtualization 4.5 client cannot log on to a publishing server. Additionally, you receive an error message 8009030C.

App-V CU1 Hotfix Rollup 5

http://support.microsoft.com/kb/973873

This hotfix package addresses the following issues:

It takes significantly longer to stream a package over the RTSPS protocol than to stream a package over the RTSP protocol.
When you use TrueCrypt for drive encryption, any attempts to mount an encrypted volume may generate a 0xA stop error.
The Microsoft Application Virtualization 4.5 client leaks paged pool memory. This problem occurs when you apply a disk quota to the profile directories of a user and when the disk quota is near the limit. .
A virtual application that calls the RegQueryMultipleValues function may experience unexpected errors or fail to start. For example, you receive error messages when you start or shutdown the Trapeze application. Then, the application does not work correctly.
When an Application Virtualization 4.5 client tries to perform a publishing refresh procedure over HTTP or over HTTPS, the procedure is not completed successfully. Specifically, the procedure is not completed successfully if a package contains pathnames that have Japanese characters. This problem occurs when the Application Virtualization 4.5 client has Windows Internet Explorer 6 installed and runs a Japanese version of Windows XP.
When it is run as a virtual application, Microsoft Office Access 97 generates an error message 1008 when Office Access 97 is moving temporary files.
When an Application Virtualization 4.5 client tries to perform a publishing refresh procedure over HTTP or over HTTPS on an IPv6 network, the procedure is not completed successfully.
When you expand a %APPDATA% environment variable to a universal naming conventions (UNC) path, application-specific failures occur when you start virtual applications.

Hope you found this as useful as I did.

And, many thanks to Justin Zarb - You can find him at: http://blogs.technet.com/virtualworld/

What Application Compatibility Problem: I mean, specifically...

greg.lambert@gmail.com (Greg Lambert) — Thu, 22 Oct 2009 13:44:00 +0000

I was reading a post on the Microsoft TechNet Application Compatibility forum today and noticed a post that reflected how I felt after reading a number of Program Compatibility Assistant (PCA) warnings.

An excerpt of the posting reads;

"I'm testing the Win7 Enterprise edition, and ran into a "known incompatibility" message when installing Norton Ghost 12. Feeling adventuresome (since it runs perfectly well with the RC1 version), I clicked "install anyway", downloaded the latest updates from Symantec (over 200 MB as I recall) and have been successfully running Ghost 12 ever since, just like I've been doing with the RC1 version (Win 7 32 bit version) since May. So my question is WHAT compatibility problem?"

What is the compatibility problem here?

The question was well handled by another poster and moderator on the forum with the following response;

"There are a number of compatibility issues with Ghost 12 & Ghost 14 in Windows7... Creation of additional files/folders backups, control of recovery points deleted, One time virtual conversion to name but a few."

This is good information. Unfortunately, the current application compatibility infrastructure presented by Microsoft's PCA does not currently deliver this kind of useful knowledge. I use the term "Knowledge" as it does not supply enough information to allow you to make a decision.

The current PCA dialog and accompanying information does not give us enough information (should there be an advanced information option) to make a decision. As evidenced by the original issue poster

- he just decided to install anyways and see how things went for him.

You can find the Microsoft Application Compatibility forum here: http://social.technet.microsoft.com/Forums/en/w7itproappcompat

Thanks to Hula_Baluu for the great posting!

App-V: Ordering is an issue

greg.lambert@gmail.com (Greg Lambert) — Tue, 20 Oct 2009 12:36:00 +0000

Still on the path of researching application compatibility issues for App-V and associated virtualization technologies.

As part of the side-tracking, interesting bits of reading that I have picked on my way past IE6 and .NET installation issues, I have found that Microsoft's Dynamic Suite Composition (DSC) can cause a few issues as well.

The DSC issues in question are very well documented in the TechNet blog on DSC circular dependencies (see references below) and so, I will attempt to distil the three primary issues with DSC and application dependencies.

First, a brief introduction to App-V DSC and how to use it can be found here:

http://blogs.technet.com/softgrid/archive/2008/09/24/how-to-dynamically-suite-two-application-packages-using-app-v-4-5-and-dsc.aspx

Briefly, Dynamic Suite Composition is described as;

"Dynamic Suite Composition (DSC) provides a method for administrators to control which virtual applications will be combined to create a unified, virtual working environment for a single application set. To do this, DSC provides a way for the admin to specify mandatory or optional dependencies between separate virtual applications that allows each app to run within the same virtual space, or "bubble" as we call it. When this is used, when the primary virtual application is run on the client it will also launch the dependent virtual application within the same bubble, allowing the combination to run together in the same virtual environment."

The idea of Dynamic Suite Composition is great, as it allows applications to "talk" to each other across their respective virtualization/isolation bubbles. This solves a number of inter-dependency issues with applications like Microsoft Office and Adobe Reader.

Reading from the TechNet blog, the following scenario is illustrated;

"When package A depends on package B, a virtual environment (VE) is created at runtime that contains all the virtual resources from A and B’s packages, and changes to the VE are associated with A’s package when they are saved. When B depends on A, a second VE is created that also contains all the resources from A and B’s packages, but changes to the VE are associated with B’s package.

Now the problems.

With the above scenario you have two Virtual Environments. Which means twice the disk space and associated deployment and management over-heads.
"Bubble" load ordering is important as dependencies need to be loaded in the correct order.
Each will isolated bubble will save it's state individually. Meaning, that you may have shared application access, but user settings and application settings may differ on how you load, and the order you load your application virtualization bubbles.

Maybe its easier just to install the application locally?? If you have to worry about inter-dependencies, load ordering, undetermined application and user settings states, then are we any better of with App-V?

Thankfully, there is a solution to some of these issues with the Microsoft App-V LOCAL_INTERACTION_ALLOWED Tag.

Referencing from another TechNet blog;

"When local interaction is enabled via an OSD policy, named objects and COM objects are created in the global namespace rather than isolated inside a particular virtual environment. "

This allows the application to fully interact with the local Operating System and allows other App-V virtualization bubbles to fully interact with that bubble. This neatly solves the some of the conundrum's with isolation, integration and dependency management with App-V.

But be warned, Chris Lord finishes his great blog entry with the following caveat.

"enabling LOCAL_INTERACTION_ALLOWED can introduce application conflicts it is best that you only implement this if absolutely necessary "

So many issues with App-V , ... so many solutions with App-V, so many issues, so many solutions... And the cycle continues...

References:

How to dynamically suite two packages using App-V 4.5 and DSC

http://blogs.technet.com/softgrid/archive/2008/09/24/how-to-dynamically-suite-two-application-packages-using-app-v-4-5-and-dsc.aspx

Circular dependencies with Dynamic Suite Composition and App-V 4.5

http://blogs.technet.com/softgrid/archive/2009/06/22/circular-dependencies-with-dynamic-suite-composition-and-app-v-4-5.aspx

A Look Under the Covers - The LOCAL_INTERACTION_ALLOWED Tag

http://blogs.technet.com/softgrid/archive/2007/09/20/a-look-under-the-covers-the-local-interaction-allowed-tag.aspx

SSMSE 2008 - Messy!

greg.lambert@gmail.com (Greg Lambert) — Mon, 19 Oct 2009 07:59:00 +0000

I just may not be smart enough to install SQL Server Management Studio 2008.

Our company (ChangeBase) uses SQL Server 2008 to drive our application compatibility software (AOK). So, when something goes wrong (dare I say it), or we simply need to debug something, I have to install SQL Server Management Studio - which is fine.

Except the fact, that I can't. Really.

I downloaded the installation for SQL Management studio, which can be found here: http://www.microsoft.com/DOWNLOADS/details.aspx?displaylang=en&FamilyID=08e52ac2-1d62-45f6-9a4a-4b76a8564a2b

It's a simple, single executable. How hard can it be? Well, one of the surprises with the SSMSE is that to install it, you actually instantiate the SQL Server main installation routine which looks like this;

Is this the SQL Server Installation start-up dialog? Oh no it isn't. It the Microsoft Program Compatibility Assistant. Quite wisely, my Operating System has detected a potential issue and is trying to direct me to either a later version (which hopefully solves the problem) or a support page for some commiseration. The problem with this dialog box, is that I am (and I have checked) running the latest version of SQL Server 2008 (SP1) and the latest release of SQL Server Management studio. What am I missing?

This problem can be overcome as I choose to simply run the program (for the fifth time) and try install Management Studio Express. So, I now I get a chance to install software, with an installation dialog that looks like this;

I have always struggled with these kind of installations "front-pages" as there is a distinct lack of a "Install" button. Where do you start? OK, I got past this hurdle , and chose the Installation tab, and then was presented with the following "quiet point in my day";

It looks like I should be waiting for something, as the message indicates "Gathering user Settings"... So, I waited a while, nothing happened and my instinctive tendencies overwhelmed my better judgement and I pressed the Install button.

And, I installed the SQL Support files for the fifth (or sixth if you included the initial SQL Express installation) time.

And, here is where everything goes a bit wrong. The next dialog helpfully asks the user if he/she wants to perform a new installation or add to an existing feature. I have installed SQL Express 2008 already - really I have. I mean it - I use the database several times a day - it's there.

Note: There is NO option for installing SQL Server Management Studio

I struggled here: And after several rounds of failure. I tried to un-install SQL Server Express. Tried to find a later version (self-doubt ruins your concentration), I searched the web.

In desperation, I tried the following ;

Yes, I tried to install a new instance of SQL Express 2008 using the installation media for SQL Server Management Studio. After progressing through the SQL Server EULA, I was finally rewarded with the following;

Now, I had the option to install the Management Tools (Basic, of course). The installation then went smoothly .... Or, so it appeared initially. As a result of my aberrant behaviour, I had to re-attach all of my databases back to my initial instance of SQL Server Express.

That said, I can now run SQL Server Management Studio 2008.

Remember, SQL Server Management studio 2005? A single EXE, it installed. It worked. Yes??

Microsoft Azure: Not quite ready for prime time

greg.lambert@gmail.com (Greg Lambert) — Fri, 16 Oct 2009 12:39:00 +0000

I am fortunate enough to be working with the Microsoft Azure team and have had an opportunity to play with Microsoft's "Cloud" database offering; Azure.

Setting up, or more accurately getting access to my Azure database was simple.

I was able to access my account via my Microsoft Live ID, and create a new database with a very simple (but as we will soon see, a very limited interface) web based interface.

I have included a snap-shot of the default Azure databases;

One thing that is vitally, SUPER important. You need to select the Firewall Settings Tab and allow your IP address. Or, you will not be able to connect. Helpfully, the error dialog advises your of your IP address (that Azure sees) so you can add the correct IP address range.

I am not quite ready to publish some of our performance ratings. To be fair to Microsoft Azure is still in CTP mode (Community Technology Preview) and we could not get our diagnostic tools loaded. Which leads me onto my next point. Azure is at this stage, kind of interesting, but we are a long way from getting a USEFUL Azure-based product working.

For example, there are some pretty hefty limitations to Azure. For example, even in the humble database creation command (our natural starting point), we found the following limitations documented in the online Azure documentation;

SQL Azure does not support the following arguments and options when using the CREATE DATABASE statement:

Parameters related to the physical placement of file, such as and

COLLATE on a user database
External access options, such as DB_CHAINING and TRUSTWORTHY
Attaching a database
Service broker options, such as ENABLE_BROKER, NEW_BROKER, and ERROR_BROKER_CONVERSATIONS
Database snapshot

So, we could not set the collation on our newly minted Azure database, and so NOTHING from our development team will work. This kinda sucks. Hopefully, soon we will be able have more control over the database creation process (ALTER and UPDATE too please) and then we can give Azure a proper test.

App-V Versus Altiris SVS

greg.lambert@gmail.com (Greg Lambert) — Thu, 15 Oct 2009 17:55:00 +0000

I was asked today to comment on the differences between Microsoft's App-V and Altiris' SVS virtualization solutions. I thought, aha! A blog posting for Thursday! Here are my initial thoughts. Note, I have heavily referenced a report published by PQR and so have included a reference to their more complete evaluations of currently available virtualization products on the market.

Altiris SVS leverages two technologies to deliver virtualized application environments to the user:

Virtual distribution—streaming allows the user to acquire applications from any endpoint, while minimizing bandwidth requirements and optimizing license consumption.
Virtual execution—layering applications on disk ensures that each application includes all of its appropriate resources, eliminates conflicts with other applications and the base operating system, and enables instant repair.
Rule based application and licensing management

Microsoft’s App-V environment provides a virtualization platform that delivers;

Application virtualization: Enable applications to be deployed an run without the need to visit a desktop, laptop, or terminal server.
Applications are no longer installed on the client—and there is minimal impact on the host operating system or other applications.
Dynamic streaming delivery: Applications are delivered, on demand, to laptops, desktops, and terminal servers. In some cases a small portion of the application is downloaded to the client in order to launch the application.
Centralized, policy-based management (AD): Virtual Application deployments, patches, updates, and terminations are more easily managed via policies, and administered through the App-V console or via your ESD system.

A comparison between the two Virtualization Technologies (for my boss) would include;

App-V is the most complete, best managed virtualization system on the market today
SVS offers a local execution, layered virtualization technology that App-V does not
App-V is fully integrated into Microsoft Active Directory management platform
SVS experiences technical challenges when dealing when dealing with middleware (i.e. JAVA)
App-V experiences difficulty with IE6 and some .NET packages.
App-V sequencing and SVS capture technologies are both relatively immature

For the full report, look here: http://www.virtuall.nl/download-document/application-virtualization-solutions-overview-and-feature-compare-matrix

Microsoft Security Updates for October: The Results...

greg.lambert@gmail.com (Greg Lambert) — Wed, 14 Oct 2009 13:10:00 +0000

The big story with the October 2009 Patch Tuesday Security Update from Microsoft is the sheer size (both breadth and depth) of the update. This is the largest update in the history of patch Tuesday.

Thirteen updates this month, with eight updates rated critical and the other five updates rated as Important.

The good news is that despite what one might think the impact on application compatibility is not huge across all the patches.

Based on the results of our application compatibility lab (c. 1000 sample packages), twelve of the 13 patches have very limited impact on applications. The one patch with issues is MS09-061 (Vulnerabilities in GDI+ Could Allow Remote Code Execution Which affects c. 13% of a sample application portfolio. We would recommend technical teams focus their testing on this patch.

MS09-050 : : Marginal impact and negligible testing profile.
MS09-051 : : Marginal impact and negligible testing profile.
MS09-052 : : Marginal impact and negligible testing profile.
MS09-053 : : Marginal impact and negligible testing profile.
MS09-054 : : Marginal impact and negligible testing profile.
MS09-055 : : Marginal impact and negligible testing profile.
MS09-056 : : Marginal impact and negligible testing profile.
MS09-057 : : Marginal impact and negligible testing profile.
MS09-058 : : Marginal impact and negligible testing profile.
MS09-059 : : Marginal impact and negligible testing profile.
MS09-060 : : Marginal impact and negligible testing profile.
MS09-061 : : Marginal impact and negligible testing profile.
MS09-062 : : Strong potential impact and large testing profile.

Patch Name	Total Issues	Matches Affected	Reboot	Rating
Microsoft Security Bulletin MS09-050	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-051	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-052	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-053	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-054	1%	1%	YES	Critical
Microsoft Security Bulletin MS09-055	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-056	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-057	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-058	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-059	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-060	1%	1%	YES	Critical
Microsoft Security Bulletin MS09-061	1%	1%	YES	Critical
Microsoft Security Bulletin MS09-062	11%	<1%	YES	Critical

Legend:

	No Issues Detected
	Potentially fixable application Impact
	Serious Compatibility Issue

Security Update Detailed Summary

MS09-050	Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517)
Description	This security update resolves one publicly disclosed and two privately reported vulnerabilities in Server Message Block Version 2 (SMBv2). The most severe of the vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB packet to a computer running the Server service. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate from outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed.
Payload	Srv2.sys
Impact	Critical – Remote Code Execution

MS09-051	Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution (975682)
Description	This security update resolves two privately reported vulnerabilities in Windows Media Runtime. The vulnerabilities could allow remote code execution if a user opened a specially crafted media file or received specially crafted streaming content from a Web site or any application that delivers Web content. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	wmavds32.ax, wmspdmod.dll, msaud32.acm
Impact	Critical – Remote Code Execution

MS09-052	Vulnerability in Windows Media Player Could Allow Remote Code Execution (974112)
Description	This security update resolves a privately reported vulnerability in Windows Media Player. The vulnerability could allow remote code execution if a specially crafted ASF file is played using Windows Media Player 6.4. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	strmdll.dll
Impact	Critical – Remote Code Execution

MS09-053	Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254)
Description	This security update resolves two publicly disclosed vulnerabilities in the FTP Service in Microsoft Internet Information Services (IIS) 5.0, Microsoft Internet Information Services (IIS) 5.1, Microsoft Internet Information Services (IIS) 6.0, and Microsoft Internet Information Services (IIS) 7.0. On IIS 7.0, only FTP Service 6.0 is affected. The vulnerabilities could allow remote code execution (RCE) on systems running FTP Service on IIS 5.0, or denial of service (DoS) on systems running FTP Service on IIS 5.0, IIS 5.1, IIS 6.0 or IIS 7.0.
Payload	ftpsvc2.dll
Impact	Important

MS09-054	Cumulative Security Update for Internet Explorer (974455)
Description	This security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Iecustom.dll, Browseui.dll, Cdfview.dll, Danim.dll, Dxtmsft.dll, Dxtrans.dll, Iepeers.dll, Inseng.dll, Jsproxy.dll, Mshtml.dll, Msrating.dll, Mstime.dll, Pngfilt.dll, Shdocvw.dll, Shlwapi.dll, Urlmon.dll, Wininet.dll, Browseui.dll, Cdfview.dll, Danim.dll, Dxtmsft.dll, Dxtrans.dll, Iepeers.dll, Inseng.dll, Jsproxy.dll, Mshtml.dll, Msrating.dll, Mstime.dll, Pngfilt.dll, Shdocvw.dll, Shlwapi.dll, Urlmon.dll, Wininet.dll, Iecustom.dll
Impact	Critical – Remote Code Execution

MS09-055	Cumulative Security Update of ActiveX Kill Bits (973525)
Description	This security update addresses a privately reported vulnerability that is common to multiple ActiveX controls and is currently being exploited. The vulnerability that affects ActiveX controls that were compiled using the vulnerable version of the Microsoft Active Template Library (ATL) could allow remote code execution if a user views a specially crafted Web page with Internet Explorer, instantiating the ActiveX control. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	No Files – Registry Settings Only
Impact	Critical – Remote Code Execution

MS09-056	Vulnerabilities in Windows CryptoAPI Could Allow Spoofing (974571)
Description	This security update resolves two publicly disclosed vulnerabilities in Microsoft Windows. The vulnerabilities could allow spoofing if an attacker gains access to the certificate used by the end user for authentication.
Payload	msasn1.dll
Impact	Important

MS09-057	Vulnerability in Indexing Service Could Allow Remote Code Execution (969059)
Description	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker set up a malicious Web page that invokes the Indexing Service through a call to its ActiveX component. This call could include a malicious URL and exploit the vulnerability, granting the attacker access to the client system with the privileges of the user browsing the Web page. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	query.dll
Impact	Important

MS09-058	Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (971486)
Description	This security update resolves several privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow elevation of privilege if an attacker logged on to the system and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit any of these vulnerabilities. The vulnerabilities could not be exploited remotely or by anonymous users.
Payload	ntkrnlmp.exe, ntkrnlpa.exe, ntkrpamp.exe, ntoskrnl.exe, ntkrnlmp.exe, ntkrnlpa.exe, ntkrpamp.exe, ntoskrnl.exe, ntkrnlmp.exe, ntkrnlpa.exe, ntkrpamp.exe, ntoskrnl.exe, ntkrnlmp.exe, ntkrnlpa.exe, ntkrpamp.exe, ntoskrnl.exe
Impact	Important

MS09-059	Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (975467)
Description	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker sent a maliciously crafted packet during the NTLM authentication process.
Payload	Msv10.dll, Netlogon.dll
Impact	Important

MS09-060	Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)
Description	This security update resolves several privately reported vulnerabilities in ActiveX Controls for Microsoft that were compiled with a vulnerable version of Microsoft Active Template Library (ATL). The vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Cnfnot32.exe, Contab32.dll, Dlgsetp.dll, Dumpster.dll, Emablt32.dll, Emsmdb32.dll, Envelope.dll, Exsec32.dll, Impmail.dll, Mimedir.dll, Mlcfg32.cpl, Mlshext.dll, Mspst32.dll, Oladd.fae, Olappt.fae, Oljrnl.fae, Olkfstub.dll, Olmail.fae, Olmapi32.dll, Olnote.fae, Oltask.fae, Omsmain.dll, Omsxp32.dll, Outlctl.dll, Outlmime.dll, Outlook.exe, Outlph.dll, Outlrpc.dll, Outlvba.dll, Outlvbs.dll, Pstprx32.dll, Recall.dll, Rm.dll, Rtfhtml.dll, Scanost.exe, Scanpst.exe, Scnpst32.dll, Scnpst64.dll
Impact	Critical – Remote Code Execution

MS09-061	Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)
Description	This security update resolves three privately reported vulnerabilities in Microsoft .NET Framework and Microsoft Silverlight. The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications, or if an attacker succeeds in persuading a user to run a specially crafted Microsoft .NET application. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing it, as could be the case in a Web hosting scenario. Microsoft .NET applications, Silverlight applications, XBAPs and ASP.NET pages that are not malicious are not at risk of being compromised because of this vulnerability.
Payload	mscordacwks.dll, mscorlib.dll, SOS.dll, mscorwks.dll
Impact	Critical – Remote Code Execution

MS09-062	Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488)
Description	This security update resolves several privately reported vulnerabilities in Microsoft Windows GDI+. These vulnerabilities could allow remote code execution if a user viewed a specially crafted image file using affected software or browsed a Web site that contains specially crafted content. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	gdiplus.dll
Impact	Critical – Remote Code Execution

Microsoft Security Updates for October: Monster!

greg.lambert@gmail.com (Greg Lambert) — Tue, 13 Oct 2009 15:52:00 +0000

Well, it looks like quite a few release and testing engineers are going to busy over the next few weeks. Microsoft has just released information for this month (October 2009) for 13 updates. An absolute MONSTER of a Security update.

This is a record release, with the next worst (or biggest, depending on your viewpoint) with a release of 12 updates.

With the October Security update, there are eight Critical updates, and 5 bulletins rated as Important. From the summary information, it appears that six update will definitely require a machine reboot (Restart in MS parlance). Generally, what we see is that most updates to the Windows Operating System require a restart. It remains to confirmed by our analysis this evening, but my bet is either all of the updates will require a restart or all but one (the MS Office update may not require a reboot ) may require a machine restart.

The advance security briefing documentation can be found here: http://www.microsoft.com/technet/security/Bulletin/MS09-oct.mspx

ChangeBase will conduct a review of 2000 application packages and will publish a report on the potential impact of these security updates tomorrow. Our approach includes a Red, Amber, Green appraisal of how the security "payload" (the changes and files affected by the security update) affects each package and their Operating System level dependencies.

Watch this space!

Windows 7: Early Migrations

greg.lambert@gmail.com (Greg Lambert) — Fri, 09 Oct 2009 08:22:00 +0000

Gavriella Shuster posted an entry on her Windows Team Blog a little while ago that discussed some of the success stories of for early Windows 7 and Windows Server 2008 R2 migrations.

Her posting can be found here:

http://windowsteamblog.com/blogs/business/archive/2009/09/14/no-need-to-wait-begin-your-windows-7-deployment-now.aspx

And the main Windows Team blog can be found here: http://windowsteamblog.com/

I really enjoyed reading the post, as 2 out of the 3 success were clients that used our AOK software. One of these "success" stories was a direct client where we were able to load, report and remediate a number of applications in preparation for a Windows 7 deployment in just a few days. The other Windows 7 migration story is one of our more productive partners in Europe.

And, from the way things are going right now, I feel that there is going to quite a few more of these early migration stories. Windows 7 just works...

Also, if you are looking for a good case study on the cost-saving for Microsoft's App-V virtualization technology, look here: http://download.microsoft.com/download/E/5/C/E5C17DCA-1387-4D50-AFFC-2C4DC47126E7/APP-V%20Cost%20Reduction%20White%20Paper%20-%20FINAL%2009-09-09.pdf

Windows 7: The Ballmer Edition

greg.lambert@gmail.com (Greg Lambert) — Wed, 07 Oct 2009 08:51:00 +0000

Making my way across Europe right now, working with our partners in each region to assist with the launch of Windows 7.

October is definitely going to be busy with loads of Product launch parties and "Business Briefings". Adding to that, November is already getting booked up with Windows 7 and Application Compatibility briefing sessions. The level of activity and interest we are seeing in the Partner community right is far, far higher than what we experienced with Windows Vista. It seems that the Windows eco-system is really behind this release - which is good news for Windows 7.

On that note; I was quite surprised by the release of the Windows 7: Ballmer Edition. This special edition is a signed copy of the release and is being offered at some of the business briefing and partner events.

I am not a big fan of these "Ego Editions". Now that Bill Gates is doing philanthropy full-time now, why can't Microsoft do a little charity on the side? I suggest that Microsoft create a Windows 7 C edition - Windows 7 Charity Edition.

A portion (or all of the retail price) for these limited Charity editions would go to the Charity of your choice. You could choose from a list of pre-approved Charities for your region from a web-based portal. Microsoft could show-case their newer technologies (Azure?) for the back-end technology/infrastructure of the service.

It would be a technology driven, community supporting, audience involving way of delivering Windows 7 to customers and doing something for a good cause.

Windows 7: London Business Launch Event

greg.lambert@gmail.com (Greg Lambert) — Tue, 06 Oct 2009 07:11:00 +0000

I was fortunate enough to be not only invited to the Microsoft Windows 7 Business Launch yesterday, but our company (ChangeBase AOK) was one of the three that were allowed to present a stand and do demonstrations of our software. I thought that being included in this rare, privileged group was quite exciting and a real indication of how seriously Microsoft is now taking application compatibility.

Steve Ballmer did a great presentation (he is actually a pretty compelling speaker) and had the following quote;

"Mr Ballmer said:

"We got some uneven reception when [Vista] first launched in large part because we made some design decisions to improve security at the expense of compatibility. I don't think from a word-of-mouth perspective we ever recovered from that."

Well, to counter this perception, I bet that Steve would be delighted with the results of a straw poll that I conducted at the reception. The questions were,

"Do you run Windows 7 at work?"
"Do you run Windows 7 at home?"
Have you installed Windows 7 on a friend or family members laptop or machine?"

The results were amazing.

More than 30% of the respondents were already running Windows 7 at work and 100% were using Windows 7 at home. Only 10% had installed Windows 7 on someone else's machine.

But, this is a major contrast with the release of Windows Vista.

From what I remember from last year, the results for Vista were exactly the opposite for those running the OS at home and a work. Basically last year almost everyone was using Vista at work, but no one was using Vista at home.

What you see here, is a living testament to the allure of Windows 7. People actually WANT to use Windows 7.

App-V 4.2 to App-V 4.6: Trouble brewing??

greg.lambert@gmail.com (Greg Lambert) — Sat, 03 Oct 2009 15:49:00 +0000

I am currently engaged in researching how .NET and Internet Explorer affect the process of sequencing applications under Microsoft's Virtualization technology App-V.

I recently posted about some of the underlying (even architectural) changes introduced with the Release of App-V 4.6. Especially, how it would affect .NET applications and whether or not including the required .NET dependency would adversely impact an existing 4.2 sequenced package when deployed under App-V 4.6 environments.

As part of this research on App-V application compatibility, I come across another little gem in the release notes found here: http://technet.microsoft.com/en-us/library/cc817171.aspx

It says,

"When upgrading 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System

When upgrading a package from 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation.

The following files are located in CSIDL_SYSTEM\:

cabinet.dll
msi.dll
msiexec.exe
msihnd.dll
msimsg.dlll

And the proposed work-around is:

"Delete all of the preceding files from the package. Delete the mappings on the VFS tab as well as the actual files in the CSIDL_SYSTEM folder in your decode path."

Good advice. You need to get rid of these files from each an every sequenced package, in order to have full support for your App-V 4.6 deployments.

So, I decided to have a quick scan of some of our customers existing App-V sequenced packages (in the SFT file format) to determine how packages contained these files (and thus, would need updating, testing and redeployment.

Here is a quick snap-shot of the results from AOK tool.

I hid the name of the application package (SFT file) to protect the innocent.

Overall, for each application portfolio that I analysed the results were roughly the same: approximately 60% of the scanned application packages (SFT) contained all of these files and would need to be updated, tested and redeployed .

Estimated 3-4 hours work for each application update, that translates to roughly 4000 hours effort for one of our clients. Or, two man years of effort.

And, I thought App-V was supposed to save you time and money....

App-V and .NET: Pick a bubble, any bubble

greg.lambert@gmail.com (Greg Lambert) — Wed, 30 Sep 2009 07:49:00 +0000

Over the past week, I was tasked with investigating some of the "effects" of the .NET framework and related applications with the Microsoft App-V sequencing environment.

For those following the evolution of App-V (from the days of Softricity), the recent update of Microsoft's Application Virtualisation technology (App-V) to 4.5 and version 4.6 saw a big change in the way that the .NET framework was sequenced with applications.

Life is really complex now, as I will demonstrate in the latter part of this blog, but life used to be simple (ahh, the good old days). Prior to the release of App-V 4.5 (and this includes the latest release of "service pack" update 4.6) you could be forgiven for sequencing your applications with a version of Microsoft's .NET framework. Meaning that each individual App-B virtualized "bubble" would include the required application and the required .NET dependency. Forgiven, but not encouraged.

Given this rather lack state of sequencing Best Practices and rigour; a rather large number of people (and organizations) took the App-V 4.2 challenge and virtualized a good number of their applications. And, a good number of these App-V sequenced packages were .NET applications that included their required version of the .NET framework.

The result. App-V 4.2 was a round for a while. And, these 4.2 App-V sequenced .NET application packages (including their dependant .NET frameworks) will be a round for a lot longer.

Let's flash forward to today. Flash!

App-V 4.6 is released and Microsoft releases the following update for .NET applications.

"Microsoft has made several architectural changes in the implementation of Microsoft Application Virtualization (App-V) 4.5 to ensure that the product is aligned with our roadmap for future innovation. One such change entailed moving the API intercepts from kernel mode into user mode. This change had a side-effect of changing the App-V compatibility with the .NET Framework from previous versions of App-V."

"App-V 4.5 continues to be fully compatible with .NET applications. The change in compatibility only manifests itself with the .NET Framework."

You can find the whole article here: http://technet.microsoft.com/en-us/appvirtualization/dd146065.aspx

Now, what this means is that all of the App-V packages that included .NET and were generated in versions of App-V prior to 4.5 must abide by the following scenarios;

Using and deploying applications that include the .NET Framework 3.5 (or earlier versions) is fully supported on Windows XP (SP2 and later) with App-V 4.5 CU1.
For all other platforms, the client OS must have .NET locally installed. The installed version must be greater than or equal to the application’s .NET dependency
Windows Vista RTM includes .NET 3.0 by default, no additional .NET installation is required unless the application requires .NET 3.5 RTM or SP1
Windows Vista SP1 (fully-patched) includes .NET 3.0 by default, no additional .NET installation is required unless the application requires .NET 3.5 RTM or SP1

And to add to this (already complex) matrix , what about Server 2008 (R2)? ?And 64-bit platforms? How are they handled?

I was told by a Microsoft engineer last week, that App-V does not solve Operating system level application compatibility issues. With these kind of deployment scenarios and requirements/dependencies - no wonder they have taken this view.

Whew!

Morning - You've got Middleware!

greg.lambert@gmail.com (Greg Lambert) — Mon, 28 Sep 2009 13:18:00 +0000

After suffering through the usual vagaries of Ocado deliveries, feeding three small children and then getting them to school and nursery I got to sit down at my desk this morning in peace and quiet for the 1st time in a few weeks.

And, now that I am officially a twitter-er (http://twitter.com/changebase), I decided to download, install and use Tweetdeck (a great tool to manage your Facebook and twitter accounts. Tweetdeck can be downloaded from here: http://www.tweetdeck.com/

I was (kinda) surprised to have to download Adobe's AIR, the new browser-ish based application runtime environment. For those who are new to Adobe AIR, it could be described as a "a cross-platform runtime environment. Simply put, a way for applications to be developed/coded and run on any operating system. The programming languages used to build an AIR application are Flash, Flex, HTML and AJAX. These are all inherently web-based programming languages. But, using AIR, those languages can now be used to create a desktop application.

So, AIR is cool because you can now use web application technologies to create and deploy desktop based applications. This is a little like .NET for non-Microsoft web-heads.

To read more about Adobe's AIR, look here at Adobe's FAQ: http://learn.adobe.com/wiki/display/air/developer+faq#DeveloperFAQ-IsAdobeAIRpartoftheOpenScreenProject%3F

Not only will Adobe AIR applications look different. They will install differently, as you can see by the installation engine and related dialog box in the following screen-shot.

I am really keen to determine just how far the promise of "run on any operating system" will go.

I am sure that you could get good, similar results running across XP, Vista and the soon to be released Windows 7. But how will your application look across Linux, Apple's Leopard and Windows 7? Ohhh, and what about my iPhone and the soon to be released Windows 7 mobile.

If Adobe AIR get's this "run anywhere" play right - we could see a big change in how applications are developed, deployed and maintained in the future.

Windows 7: An Application Un-Compatibility Update 26 September 2009

greg.lambert@gmail.com (Greg Lambert) — Sun, 27 Sep 2009 01:23:00 +0000

Microsoft released a compatibility update earlier this week, relating to how applications should "transition" through the upgrade process for Windows 7.

I was in Redmond the past week working with the App-V team and some members of the Windows 7 deployment team and so I missed out on blogging about the Windows 7 compatibility update.

Apologies for this, I should have commented on this earlier.
I thought that update was pretty intriguing, as it demonstrated that Microsoft has already engaged it Support and Maintenance "Engine" (Patches and Updates) for an operating system that has not yet even been formally released.

The Window 7 compatibility patch can be found here: http://support.microsoft.com/?kbid=974332

And, according to the Microsoft support Knowledge Base (KB) article, the following applications were updated in this September 2009 update;

Application	Behavior after you install the update
Alcohol 52%	Update enables Windows 7 compatible Alcohol 52% versions to work
Altiris and Symantec Virtual Software up to version 6.1.499.x	Upgrade Block to avoid errors during Windows upgrade
ZoomText version 9.18	Driver hard Block to prevent an error
Dell Printer Driver (Models-V105, V305 and V505)	Upgrade Block to avoid setup failure
Trend Micro Internet Security 2007	Upgrade Block to avoid error during Windows upgrade
Trend Micro Internet Security 2008	Upgrade Block to avoid error during Windows upgrade
Trend Micro Internet Security 2009	Upgrade Block to avoid error during Windows upgrade
YiDongFeiXin version 2.2.x and version 3.5.x	Enables application to work
PGP Desktop up to version 9.x	Soft Block to warn about possible issue after Windows upgrade
Trend Micro VirusBuster 2008	Upgrade Block to avoid errors
Windows Live Photo Gallery	Update Windows Live Photo Gallery to avoid file association issue with Windows Media Player OCX

In addition, there are a number of core SDB files (or SHIM database files) which are updated as part of this update. Here is a screen-shot of my local machine directory structure;

In this case both SYSMAIN.SDB and the PCAMAIN.SDB files were updated. For those of you who don't deal with application compatibility issues everyday, these files may seem a little new/strange/worrisome to you. These SDB files are delivered as part of Windows (and Windows Vista) and contain information in a proprietary database format that details how the target operating system should handle the application. For example, what application SHIM should be used for the to allow YiDongFeiXin to work.

What is interesting update this "compatibility" update is that this is actually a "non-Compatibility" update.

Read the messages for the following applications;

Altiris and Symantec Virtual Software up to version 6.1.499.x	Upgrade Block to avoid errors during Windows upgrade
ZoomText version 9.18	Driver hard Block to prevent an error

These "Update Blocks" for these applications actually STOP these applications from running - so, they won't cause any application or system level errors. This is part of Microsoft's Program Compatibility Assistant technology. You can read more about this here: http://msdn.microsoft.com/en-us/library/bb756937.aspx

I repeat, as part of this Compatibility update, the solution here is to simply stop the applications from starting or our upgrading. With the good intention that this new behaviour will prevent the user from a bad experience.

As Robert Heinlein once said, "Good intentions are the root of all evil!"

Virtual Round Table - Part 2

greg.lambert@gmail.com (Greg Lambert) — Wed, 23 Sep 2009 14:46:00 +0000

I was lucky enough to be invited to the initial Application Compatibility focused Microsoft Virtual Round Table session that was televised a few months back. I really enjoyed chatting with Mark Russinovich, Jeremy Chapman and especially appreciated Gov Maharaj's thoughts on application compatibility issues with Windows 7.

Here is a screen shot the main panelists on the program.

If you missed the 1st session (filmed and then broadcast live), you can catch a replay of the video here: http://www.computertech4u.com/the-springboard-application-compatibility-vrt-rebroadcast-is-live/

And, a direct link to the video here: http://technet.microsoft.com/en-us/windows/dd981014.aspx?ITPID=sprblog

Well, I am back again. This time, the boys and I will be discussing Microsoft Virtualization issues. The link (for scheduling and viewing details ) can be found here: http://www.computertech4u.com/springboard-series-virtual-roundtable-windows-7-application-compatibility-part-2-virtualization/

For this session, we plan to cover the following topics;

Microsoft App-V
Microsoft Med-V
Windows XP Mode
Windows 7 Compatibility issues

Should be fun...

Once the video is posted online for this session, I will update this Blog posting.

Windows 7: With or without IE

greg.lambert@gmail.com (Greg Lambert) — Mon, 21 Sep 2009 09:47:00 +0000

I was reading the Windows Blog (http://windowsteamblog.com) this morning and came across the following article: Windows 7 E Best Practices for ISV's.

Found here: http://windowsteamblog.com/blogs/developers/archive/2009/07/13/windows-7-e-best-practices-for-isvs.aspx

The blog opens with the following quote from the author Yochay Kiriaty:

" we will ship the same version of Windows 7 in Europe as in rest of the world on the worldwide launch date of 22 October, 2009. This version of Windows 7 includes Windows Internet Explorer 8 to help people get the most from their PCs and the Internet."

There is some real confusion on my part here, as the article continues to discuss about the shipments of Windows 7 "E" but I think the core point here is that there are going to workstations out there running Windows 7 and will not include IE8. Whatever they are called; Windows 7 or Windows 7 -E
As a side note, "E Versions of Windows" or more accurately "European Versions" will not contain Internet Explorer 8 or at least the IE feature will not be enable by default. From what I understand, if someone wants Internet Explorer 8 functionality that can enable the functionality through the Turn Windows On or Off dialog box, they could simply enable it through the following dialog box (I bet a reboot will be required);

There is some real confusion on my part here, as the article continues to discuss about the shipments of Windows 7 "E" but I think the core point here is that there are going to workstations out there running Windows 7 and will not include IE8. Whatever they are called; Windows 7 E, Windows 7 No-E, Windows 7 E-Less or my favourite Windows 7 -E, the real question for us application compatibility drones/workers/slaves/enthusiasts, is how should we test our applications?

It appears that there are already a few documented "No-IE" application compatibility scenarios including;

Hard-Coded application references to Internet Explorer will not load the default browser correctly (i.e. shellexecute is bad!)
Explicit references to IE8 API functions will not work
HTML 'Window Open' calls may fail to open a new browser window correctly

In addition, I have the following issues that may be an application compatibility issue;

Application help files (CHM format) rely on the web-browser control - will these work properly?
How will applications get/set their internet proxy settings? ChangeBase AOK could be a victim here. Ooops!
How about applications with embedded dependencies on a web-browser such as Sage, Reuters and Bloomberg?

I think that most applications should work OK - as always it will be the applications that broken previous rules either due to hard-coding references or bad assumptions about the target platform.
There is one benefit to all this though - most Microsoft Patch Tuesday updates relates to security updates Internet Explorer. If you don't have IE on your machine, well, the theory is you might just have a slightly easier Wednesday morning.

Windows 7 - Some Overal Compatibility Results

greg.lambert@gmail.com (Greg Lambert) — Fri, 18 Sep 2009 16:58:00 +0000

We have been busy!

Over the past few months, we have been working with Microsoft and their partners to get a early view on the compatibility issues that Windows 7 might raise with client application portfolios.

This process was called a Proof of Concept (POC) and covered the following platforms;

     • Windows 7
     • Office 2007
     • Internet Explorer 8
     • Microsoft App-V (Virtualization)

Drawing from clients across Europe and America, the company I work for (ChangeBase) was able to rapidly deliver automated application compatibility assessments for Windows 7, Microsoft’s App-V virtualization technology, Microsoft Office 2007 suitability and Internet Explorer (IE8) compatibility in minutes per client.

Our software was able to generate a comprehensive report on specific application compatibility issues and then automatically fixing a select number of business critical applications. This ensured that these updated application packages were fully compliant with Microsoft and Industry Standards for Windows XP, Windows 7 and Windows 2008 operating system platforms.

And, here is the part you are interested in...

From this large portfolio of applications, the following application compatibility results were generated;

Where Red issues represent non-fixable applications, Amber indicated fixable (manual and automated fixing included) and Green represents applications without reported issues. This means that 92% of applications were ready to deploy to Windows 7. From these results the top application compatibility issues were;

I find these kind of numbers fascinating as it shows that each application portfolio has a large number of applications that need some work to getting working on Windows 7. Most importantly, it looks like these issues can be readily fixed. Making the resultant applications ready for deployment for Windows 7.

For my next posting, I will discuss some of the RED issues; those that can't be easily fixed and may require an application upgrade.

The 1st hit is free.... Ahhh

greg.lambert@gmail.com (Greg Lambert) — Thu, 17 Sep 2009 18:17:00 +0000

One of our ChangeBase partners, Arclite is now offering an online automated Application Compatibility assessment service for your application packages.

This service (http://free.appcompat.net ) allows you load an application through a web-page and received an automated assessment of the potential compatibility issues your application package may encounter.

Here is a sample of one of the reports.

And, if you are looking for more detail, the automated application compatibility report provides detailed remediation information including the following detail;

This report fully automated and analyses each application for the following compatibility issues;

Windows 7
Microsoft App-V
Office 2007
Microsoft Internet Explorer 8

In addition, there is a really useful guide to interpreting the results, which can be found on the Arclite driven Application Compatibility online ship website.

Found here: http://shop.appcompat.net/v/vspfiles/assets/images/report%20interpretation%20guide%20v4.pdf

And, as a bonus, it looks like the 1st try is for Free. Give it a go at: http://free.appcompat.net/