MDM & GP Tips Blog

Today’s the day where you’re going to start to be bombarded with bajillions of messages about  how Windows 7 is the best operating system ever produced.

Look, that’s not for me to say — history will shake out and tell us all over time. It  might end up being the best selling operating system ever produced; and it might have  already even hit that mark for all I know, but that’s another topic.

Here’s my 2¢ of Jeremy wisdom (if there is such a thing)..

In the coming days, weeks, and possibly months, you’re going to hear about every  possible Windows 7 feature under the sun to “make your life better” and “more  wonderful” and “Oh, look! Shiny shiny shiny.”

I don’t have any beef with features like Multi-Touch, or Aeropeek or Aeroshake.

(Okay, well, maybe Aeroshake…  I’ve turned it off.)

But as IT Pros and managers, we need to be focused and ready to understand what’s  important to US and our businesses, versus all the gook from TV advertisements, Twitter tweets, and fancy-pants demos.

Indeed, Microsoft’s pseudo-tagline for Windows 7 is “A billion options.”

Ow. That kind of hurts my brain.

I guess what I’m trying to say is: It’s ALL good stuff. But, in the words of the late Clara Peller, “Where’s the beef?

And here’s the good news: there IS beef there. It’s just that we, as IT geeks, need to be conscientious and thoughtful about discerning and filtering out the incoming “shiny, shiny, shiny” messages from the “what really matters” of Windows 7.

So, in the days and weeks to come, with all the hubbub about Windows 7, we should try to focus in on key points where Windows 7’s new technologies can help our business grow,and be prosperous.

If I had to pick three areas to focus on initially (to get the most bang for the buck)  I would focus on…

Management: Group Policy improvements, GP Prefs improvements

Efficiency: GP + Powershell, Powershell for other non-GP tasks, DirectAccess

Security: AppLocker for system protection, Bitlocker for whole drive encryption

That’s not to say there aren’t OTHER areas to possibly focus on; these are just my opinions.

So, welcome Windows 7. It’s shiny. It’s beefy.

Let’s eat !

PS: This blog entry is on the home page of GPanswers.com. Re-Tweet if you like!

PS: Tip… Online Group Policy Training at www.GPanswers.com/training gets you a jump on Windows 7 today.

PPS: Note… I have one seat left for the live Orlando class next week. If you think you can make a miracle happen and join us, you HAVE TO CALL us at 302-351-4903. No more seats available thru the website

Team:

Check this out.

Let’s say you had a Windows 7 management machine and also a Windows Server 2008 (or 2008 R2) as your management machine.(In “Jeremy-parlance” a “management machine” is where you run the GPMC from.)

Turns out that on Windows Server 2008 and 2008 / R2, there’s a gaggle of “extra” policy settings !

Seriously, this is weird, so stick with me.

Click here:
…and you’ll see the Windows 7 management machine view of the Computer Configuration | Policies | Administrative Templates | System | Group Policy node.

Click here:
…and you’ll see shows the same thing, except seen from a Windows Server 2008 management machine.

So, what are these “missing” definitions?

These are the settings used to control, manage and monitor the Group Policy Preferences settings. The very “way” GP Prefs “operates.” You’ll see specific Group Policy Preferences items like “Printers Policy Processing”, “Shortcuts Policy Processing”, “Start Menu Policy Processing” and all sorts of other Group Policy Preferences-specific settings.

And my favorite strangeness in this area is “Registry Policy Processing” (with an upper case P in Policy) right next to its cousin “Registy policy processing” (with a lower case P in policy.) The lower case P policy (Registry policy Processing) is about how we handle the stuff inside the “Administrative Templates” node; ya know – “normal” Group Policy settings like “Prevent Access to the Control Panel.” The upper case P policy setting (Registry Policy Processing) is about the “Registry node” in the Group Policy Preferences (Chapter 10 in the Green book)

Bizzaro, but now at least it’s understandable.

Look closely, and you’ll also see another whole node within the Group Policy node called “Logging and tracing.”

Okay, so what gives?

I’ll go more into this at another time, but since you can’t wait that long, here’s the abbreviated version. In short the “definitions” of what’s possible in Group Policy-land are stored in ADMX files Turns out, though that Windows 7’s RSAT and Windows Server 2008 don’t ship with the exact same definitions.

Kooky. The “missing” Group Policy settings are only available in Windows Server 2008’s “set” of definitions. And, yes, that set is downloadable if you don’t want to rip it out of an existing Windows Server 2008 machine.

To catch-up your “Windows 7 management machine” download and utilize the files here http://tinyurl.com/mb6x5v (though there are sure to be updates for Windows Server 2008 R2, so, I would try to track those down when available.)

Don’t be caught off guard if a GP Prefs problem occurs… now you’re in the know!

Some discount seats left for the Group Policy Master Class training in Orlando.

Sign up at https://www.gpanswers.com/training/live-courses.html

Use Coupon code NEXTSIXORLANDO to get $200 off the whole week !

Great News!  The Windows 7 and Windows Server 2008 R2 Group Policy spreadsheets have been released! 

Microsoft has also placed all of the spreadsheets into one download page for easier access.

Click here to access the download page.

Let's go right to the punchline: Overall; positive.

Okay, now let's get to what's great, what's not and what's just weird.

Actually, before we do that, let's start off with my new hardware. If you know me, you know I love to do demos. I do demos left and right in my training courses, at WinConnections and TechEd, and other sundry events.

And, of course, I need to use a laptop lug around and do that. My laptop of choice has always been Dell. I've been a Dell man, since, well, Dell Laptops had TRACKBALLS in them, and not touchpads.

Yes, _that_ long.

Now, for the first time ever I went Lenovo. Honestly, the new Dell E series just seemed too "humongo" for me. The whole package, including the power supply just looked too.. Bulky.

Yep, that was my "very technical reason" for not getting another Dell. I'm sure they're great inside, but their aesthetics (at least compared to my Dell D620) was not an improvement (to me, anyway.) So, I got a Lenovo T500. The name alone makes me feel like I'm perpetually the star in my own personal Terminator film. I bought it cheap from the "Lenovo outlet store." It has a T9600 Core2Duo processor on board, and I fitted it myself with (oh drool!) 8GB RAM and 500GB hard drive @ 7200RPM (killer!)

Then I waited to get my hot little hands on Windows 7. I was in the beta program, so I got a "free key" to use when the beta ended.

Last Thursday night, I installed Windows 7, 64-Bit edition on my new monster laptop.

Before that, I had previously went to Lenovo's website and downloaded ANYTHING associated with the T500 + Vista. That is to say, since all Vista drivers are "upward" compatbile to Windows 7, having them "at the ready" seemed to be a good idea. I put them on an external USB disk.

My first 24 hours wasn't great. I installed Windows 7. I took all the updates. Then I installed all the T500 / Vista drivers. I rebooted when necessary. Finally, when I installed the video driver software, Windows 7 just hung and hung and hung and hung at the "Please wait" page.

Arrrgh. And this was AFTER I had already activated Windows 7 (Stupid, Stupid, Moskowitz.)

Well, I knew I could boot to Safe Mode and hack and slash my way out of this. But the more I thought about it.. why was I installing drivers for something that was, well, working already?

So I didn't.

I re-formatted and re-installed Windows 7. In my experience, more manufacturer software equals slower and more unstable machine. Said another way, if I can "get away with" the drivers that are included as part of Windows 7, I should have a faster and more stable system overall ... instead of having to know exactly WHICH drivers and in WHAT ORDER I should be installing them.

So that's what I did. I loaded Windows 7, I took all of Windows' updates (it had several driver updates for my system.) There were two devices Windows didn't have "built in drivers" for, and I did, indeed, install those from the Lenovo website. And that was it. I was done.

That being said, it wasn't totally a bed of roses.

This T500 system has this newfangled idea of having TWO video chips instead of just one. Let's call these two chips the "Good one" and the "Awesome one." Honestly, I don't ever, ever need the "Awesome one." I don't play games, so I don't need "awesomeness." "Awesome graphics" don't make my demos any faster, and honestly, that's all I care about for this machine.

This newfangled idea of two chips sounds great, but for me it just wasn't working perfectly with my total re-install. Every time I closed the lid and re-opened it, it thought my laptop display was "Display 2." All the stuff I was working on just disappeared.

You could say: "Well, Moskowitz, if you installed the drivers from Lenovo, you wouldn't be having this problem." Except, remember .. when I did install the drivers, that's exactly when the machine went into "mega hang" mode.

So, I needed a Plan B.

To fix this, I adjusted the T500's bios to say "Kill the Awesome chip. Only let me use the Good chip." And magically, all my troubles went away.

I'm sure, really, really sure, this is because I didn't choose to install Lenovo's "mega video driver" or something for the secondary video driver chips.

But I'm okay with that. I honestly need my laptop to do EXACTLY two things: display on the panel when I want to, and display outward on the VGA port for projecting when I want to.

Nothing fancy. So, no "awesome chip settings with crazy drivers" for me, thank you very much.

So, how is my overall experience with Windows 7 compared to Windows Vista? Well, my biggest problem with Windows Vista was that it was slow. Yes, lots of people complained about it being slow, but I tried to take an empirical approach and learn WHY my experience with Vista was slow.

For me, personally, I learned the "slow culprit" was the "Windows Search" service. On my previous laptop, the D620, where I tried to run Vista, every time I ran Filemon / Procmon, I could see it. Spinning it's wheels, doing it's thing -- ALL THE TIME and slowing me down.

As for Windows 7, I'm sad to say, that my initial experience is the same in this particular regard. Windows 7 still appears to (at least with my files) churn and churn and churn.

Maybe I haven't given it a fair shake. It's true, I didn't let it "settle in for three days" before getting frustrated and turning it off. I do have 60GB of "data" for it to pour over. So, in fairness, I'm going away next weekend, and I'm planning on turning ON the search service BEFORE I LEAVE, and see what happens when I return.

But for now, I have uninstalled the Windows 7 search feature, and you also (oddly) seem to need
to DISABLE the search service to really kill it (according to my Procmon traces.)

Here's the payoff though: Man, is this lappy fast! Right now, I'm really happy with the speed. Applications pop. Demos snap. Everything is like a crisp clean spring morning. Between a new processor, new OS, the 64-bits, 8GB of RAM and a 7200 RPM HD, darn tootin' this thing better fly.

Here are some miscellaneous notes about my first 7 days, in no particular order:

• I have a wacky wacky "Cannon" all-in-one printer, fax, scanner thing. And that driver was included in Windows 7. And, it even shows me the "ink levels" while printing; just like the driver I previously needed to download from Cannon then hand-install on XP. Neat.
• I'm pretty "keyboard centric." So about 1000 times a day, I type the following key sequence when working on XP: Ctl-Esc, R, cmd, enter. In XP, this would open the Start menu, R would hit the Run command, and CMD would get me to a command prompt. Now on Win 7, the same sequence makes NOTHING happen, because (even though I've put RUN back on the Start menu) there's no keyboard shortcut for 'R'un. gRRRR.  PS: My lappy has a WIN key, so Win+R work, but my external keyboard doesn't, so I'm stuck.
• I have ONE piece of hardware that, darn it, I cannot use, and man, I'm disappointed. It's a USB-connected phone system that's voice activated and hooks into Outlook. It just crashes every time it runs. Just flat out crashes. Can't really get to the bottom of this. If anyone else has this device, it's called ArialPhone, and I'd love to hear if it's working for anyone out there on Win 7 or even Vista. (PS: Even "XP compatibility mode" likely won't get me out of this one; unless I want to run a copy of Outlook *INSIDE* that fake XP machine, which I don't.)
• I have two other Outlook plug-ins which worked great on XP, but won't do their magic on Windows 7. Oddly, two *OTHER* Outlook plug-ins are working swimmingly. So, I don't know where the problem is. Still hacking on this one.
• The Beta for the App-V client 4.6 is out, and includes 64-bit support. Honestly, the thing seems ROCK SOLID to me, but my understanding is that it's planned to be Beta for a while before it goes gold. AppV Applications in cache seem to run WAY WAY faster than they did in AppV 4.5. It took me about an hour to convert all my existing 4.5 sequenced apps to 4.6.
• My wife walked behind me to see what I was working on. And it was my Windows 7 desktop. She saw the huge, huge icons that Windows 7 defaults with and asked "Are you in safe mode?" I can totally see her confusion, as Windows 7, in my opinion, looks totally bizzare with those big honkin' icons. The fix? While on the desktop, hold down Control and use the scroll wheel of your mouse to adjust. Kooky.
• Lots of people seem to be all "gaga" about the new taskbar. Honestly, I don't love the "mixed metaphor" of applications running and applications' icons all jumbled together. I've reset it act a little more like XP did, and I'm a little saner now.

But, all around, 95% of my applications are working. Everything that's "broken" seems to be revolved around Outlook in some way. Everything else is working great. So, I'm not sure if I can blame Windows or what here. Regardless, I'll get to the bottom of these and shake out my final bugs.

But in short, my first week -- pretty solid after getting thru the bumps. I do have that "last mile" to push through, and I'll keep you posted as things progress.

Let's go right to the punchline: Overall; positive.

Okay, now let's get to what's great, what's not and what's just weird.

Actually, before we do that, let's start off with my new hardware. If you know me, you know I love to do demos. I do demos left and right in my training courses, at WinConnections and TechEd, and other sundry events.

And, of course, I need to use a laptop lug around and do that. My laptop of choice has always been Dell. I've been a Dell man, since, well, Dell Laptops had TRACKBALLS in them, and not touchpads.

Yes, _that_ long.

Now, for the first time ever I went Lenovo. Honestly, the new Dell E series just seemed too "humongo" for me. The whole package, including the power supply just looked too.. Bulky.

Yep, that was my "very technical reason" for not getting another Dell. I'm sure they're great inside, but their asthetics (at least compared to my Dell D620) was not an improvement (to me, anyway.) So, I got a Lenovo T500. The name alone makes me feel like I'm perpetually the star in my own personal Terminator film.  I bought it cheap from the "Lenovo outlet store." It has a T9600 Core2Duo processor on board, and I fitted it myself with (oh drool!) 8GB RAM and 500GB hard  drive @ 7200RPM (killer!)

Then I waited to get my hot little hands on Windows 7. I was in the beta program, so I got a "free key" to use when the beta ended.

Last Thursday night, I installed Windows 7, 64-Bit edition on my new monster laptop.

Before that, I had previously went to Lenovo's website and downloaded ANYTHING associated with the T500 + Vista. That is to say, since all Vista drivers are "upward" compatbile to Windows 7, having them "at the ready" seemed to be a good idea. I put them on an external USB disk.

My first 24 hours wasn't great. I installed Windows 7. I took all the updates. Then I installed all the T500 / Vista drivers. I rebooted when necessary. Finally, when I installed the video driver software, Windows 7 just hung and hung and hung and hung at the "Please wait" page.

Arrrgh. And this was AFTER I had already activated Windows 7 (Stupid, Stupid, Moskowitz.)

Well, I knew I could boot to Safe Mode and hack and slash my way out of this. But the more I thought about it.. why was I installing drivers for something that was, well, working already?

So I didn't.

I re-formatted and re-installed Windows 7. In my experience, more manufacturer software equals slower and more unstable machine. Said another way, if I can "get away with" the drivers that are included as part of Windows 7, I should have a faster and more stable system overall ... instead of having to know exactly WHICH drivers and in WHAT ORDER I should be installing them.

So that's what I did. I loaded Windows 7, I took all of Windows' updates (it had several driver updates for my system.) There were two devices Windows didn't have "built in drivers" for, and I did, indeed, install those from the Lenovo website.  And that was it. I was done.

That being said, it wasn't totally a bed of roses.

This T500 system has this newfangled idea of having TWO video chips instead of just one. Let's call these two chips the "Good one" and the  "Awesome one." Honestly, I don't ever, ever need the "Awesome one." I don't play games, so I don't need "awesomeness." "Awesome graphics" don't make my demos any faster, and honestly, that's all I care about for this machine.

This newfangled idea of two chips sounds great, but for me it just wasn't working perfectly with my total re-install. Every time I closed the lid and re-opened it, it thought my laptop display was "Display 2." All the stuff I was working on just disappeared.

You could say: "Well, Moskowitz, if you installed the drivers from Lenovo, you wouldn't be having this problem." Except, remember .. when I did install the drivers, that's exactly when the machine went into "mega hang" mode.

So, I needed a Plan B.

To fix this, I adjusted the T500's bios to say "Kill the Awesome chip. Only let me use the Good  chip." And magically, all my troubles went away.

I'm sure, really, really sure, this is because I didn't choose to install Lenovo's "mega driver" or something for the secondary video driver chips.

But I'm okay with that. I honestly need my laptop to do EXACTLY two things: display on the panel when I want to, and display outward on the VGA port for projecting when I want to.

Nothing fancy. So, no "awesome chip settings with crazy drivers" for me, thank you very much.

So, how is my overall experience with Windows 7 compared to Windows Vista? Well, my biggest problem with Windows Vista was that it was slow. Yes, lots of people complained about it being slow, but I tried to take an empirical approach and learn WHY my experience with Vista was slow.

For me, personally, I learned the "slow culprit" was the "Windows Search" service. On my previous laptop, the D620, where I tried to run Vista, every time I ran Filemon / Procmon, I could see it. Spinning it's wheels, doing it's thing -- ALL THE TIME and slowing me down.

As for Windows 7, I'm sad to say, that my initial experience is the same in this particular regard. Windows 7 still appears to (at least with my files) churn and churn and churn.

Maybe I haven't given it a fair shake. It's true, I didn't let it "settle in for three days" before getting frustrated and turning it off. I do have 60GB of "data" for it to pour over. So, in fairness, I'm going away for the next weekend, and I'm planning on turning ON the search service BEFORE I LEAVE, and see what happens when I return.

But for now, I have uninstalled the Windows 7 search feature, and you also (oddly) seem to need
to DISABLE the search service to really kill it (according to my Procmon traces.)

Here's the payoff though: Man, is this lappy fast! Right now, I'm really happy with the speed. Applications pop. Demos snap. Everything is like a crisp clean spring morning. Between a new processor, new OS, the 64-bits, 8GB of RAM and a 7200 RPM HD, darn tootin' this thing better fly.

Here are some miscellaneous notes about my first 7 days, in no particular order:

- I have a wacky wacky "Cannon" all-in-one printer, fax, scanner thing. And that driver was included in Windows 7. And, it even shows me the "ink levels" while printing; just like the driver I previously needed to download from Cannon then hand-install on XP. Neat.

- I'm pretty "keyboard centric." So about 1000 times a day, I type the following key sequence when working on XP: Ctl-Esc, R, cmd, enter. In XP, this would open the Start menu, R would hit the Run command, and CMD would get me to a command prompt. Now on Win 7, the same sequence makes NOTHING happen, because (even though I've put RUN back on the Start menu) there's no keyboard shortcut for 'R'un. gRRRR.

- I have ONE piece of hardware that, darn it, I cannot use, and man, I'm disappointed. It's a phone system that's voice activated and hooks into Outlook. It just crashes every time it runs. Can't really get to the bottom of this. If anyone else has this device, it's called ArialPhone, and I'd love to hear if it's working for anyone out there on Win 7 or even Vista.

- I have two other Outlook plug-ins which worked great on XP, but won't do their magic on Windows 7. Oddly, two *OTHER* Outlook plug-ins are working swimmingly. So, I don't know where the problem is. Still hacking on this one.

- The Beta for the App-V client 4.6 is out, and includes 64-bit support. Honestly, the thing seems ROCK SOLID to me, but my understanding is that it's planned to be Beta for a while before it goes gold. AppV Applications in cache seem to run WAY WAY faster than they did in AppV 4.5. It took me about an hour to convert all my existing 4.5 sequenced apps to 4.6.

- My wife walked behind me to see what I was working on. And it was my Windows 7 desktop. She saw the huge, huge icons that Windows 7 defaults with and asked "Are you in safe mode?" I can totally see her confusion, as Windows 7, in my opinion, looks totally bizzare with those big honkin' icons. The fix? While on the desktop, hold down Control and use the scroll wheel of your mouse to adjust. Kooky.

- Lots of people seem to be all "gaga" about the new taskbar. Honestly, I don't love the "mixed metaphor" of applications running and applications' icons all jumbled together. I've reset it act a little more like XP did, and I'm a little saner now.

But, all around, 95% of my applications are working. Everything that's "broken" seems to be revolved around Outlook in some way. Everything else is working great. So, I'm not sure if I can blame Windows or what here. Regardless, I'll get to the bottom of these and shake out my final bugs.

But in short, my first week -- pretty solid after getting thru the bumps.

Part 1: My First 7 days with Windows 7
------------------------------------------------------

Let's go right to the punchline: Overall; positive.

Okay, now let's get to what's great, what's not and what's just weird.

Actually, before we do that, let's start off with my new hardware. If you know me, you know I love to do demos. I do demos left and right in my training courses, at WinConnections and TechEd, and other sundry events.

And, of course, I need to use a laptop lug around and do that. My laptop of choice has always been Dell. I've been a Dell man, since, well, Dell Laptops had TRACKBALLS in them, and not touchpads.

Yes, _that_ long.

Now, for the first time ever I went Lenovo. Honestly, the new Dell E series just seemed too "humongo" for me. The whole package, including the power supply just looked too.. Bulky.

Yep, that was my "very technical reason" for not getting another Dell. I'm sure they're great inside, but their aesthetics (at least compared to my Dell D620) was not an improvement (to me, anyway.) So, I got a Lenovo T500. The name alone makes me feel like I'm perpetually the star in my own personal Terminator film. I bought it cheap from the "Lenovo outlet store." It has a T9600 Core2Duo processor on board, and I fitted it myself with (oh drool!) 8GB RAM and 500GB hard drive @ 7200RPM (killer!)

Then I waited to get my hot little hands on Windows 7. I was in the beta program, so I got a "free key" to use when the beta ended.

Last Thursday night, I installed Windows 7, 64-Bit edition on my new monster laptop.

Before that, I had previously went to Lenovo's website and downloaded ANYTHING associated with the T500 + Vista. That is to say, since all Vista drivers are "upward" compatbile to Windows 7, having them "at the ready" seemed to be a good idea. I put them on an external USB disk.

My first 24 hours wasn't great. I installed Windows 7. I took all the updates. Then I installed all the T500 / Vista drivers. I rebooted when necessary. Finally, when I installed the video driver software, Windows 7 just hung and hung and hung and hung at the "Please wait" page.

Arrrgh. And this was AFTER I had already activated Windows 7 (Stupid, Stupid, Moskowitz.)

Well, I knew I could boot to Safe Mode and hack and slash my way out of this. But the more I thought about it.. why was I installing drivers for something that was, well, working already?

So I didn't.

I re-formatted and re-installed Windows 7. In my experience, more manufacturer software equals slower and more unstable machine. Said another way, if I can "get away with" the drivers that are included as part of Windows 7, I should have a faster and more stable system overall ... instead of having to know exactly WHICH drivers and in WHAT ORDER I should be installing them.

So that's what I did. I loaded Windows 7, I took all of Windows' updates (it had several driver updates for my system.) There were two devices Windows didn't have "built in drivers" for, and I did, indeed, install those from the Lenovo website. And that was it. I was done.

That being said, it wasn't totally a bed of roses.

This T500 system has this newfangled idea of having TWO video chips instead of just one. Let's call these two chips the "Good one" and the "Awesome one." Honestly, I don't ever, ever need the "Awesome one." I don't play games, so I don't need "awesomeness." "Awesome graphics" don't make my demos any faster, and honestly, that's all I care about for this machine.

This newfangled idea of two chips sounds great, but for me it just wasn't working perfectly with my total re-install. Every time I closed the lid and re-opened it, it thought my laptop display was "Display 2." All the stuff I was working on just disappeared.

You could say: "Well, Moskowitz, if you installed the drivers from Lenovo, you wouldn't be having this problem." Except, remember .. when I did install the drivers, that's exactly when the machine went into "mega hang" mode.

So, I needed a Plan B.

To fix this, I adjusted the T500's bios to say "Kill the Awesome chip. Only let me use the Good chip." And magically, all my troubles went away.

I'm sure, really, really sure, this is because I didn't choose to install Lenovo's "mega video driver" or something for the secondary video driver chips.

But I'm okay with that. I honestly need my laptop to do EXACTLY two things: display on the panel when I want to, and display outward on the VGA port for projecting when I want to.

Nothing fancy. So, no "awesome chip settings with crazy drivers" for me, thank you very much.

So, how is my overall experience with Windows 7 compared to Windows Vista? Well, my biggest problem with Windows Vista was that it was slow. Yes, lots of people complained about it being slow, but I tried to take an empirical approach and learn WHY my experience with Vista was slow.

For me, personally, I learned the "slow culprit" was the "Windows Search" service. On my previous laptop, the D620, where I tried to run Vista, every time I ran Filemon / Procmon, I could see it. Spinning it's wheels, doing it's thing -- ALL THE TIME and slowing me down.

As for Windows 7, I'm sad to say, that my initial experience is the same in this particular regard. Windows 7 still appears to (at least with my files) churn and churn and churn.

Maybe I haven't given it a fair shake. It's true, I didn't let it "settle in for three days" before getting frustrated and turning it off. I do have 60GB of "data" for it to pour over. So, in fairness, I'm going away next weekend, and I'm planning on turning ON the search service BEFORE I LEAVE, and see what happens when I return.

But for now, I have uninstalled the Windows 7 search feature, and you also (oddly) seem to need
to DISABLE the search service to really kill it (according to my Procmon traces.)

Here's the payoff though: Man, is this lappy fast! Right now, I'm really happy with the speed. Applications pop. Demos snap. Everything is like a crisp clean spring morning. Between a new processor, new OS, the 64-bits, 8GB of RAM and a 7200 RPM HD, darn tootin' this thing better fly.

Here are some miscellaneous notes about my first 7 days, in no particular order:

- I have a wacky wacky "Cannon" all-in-one printer, fax, scanner thing. And that driver was included in Windows 7. And, it even shows me the "ink levels" while printing; just like the driver I previously needed to download from Cannon then hand-install on XP. Neat.

- I'm pretty "keyboard centric." So about 1000 times a day, I type the following key sequence when working on XP: Ctl-Esc, R, cmd, enter. In XP, this would open the Start menu, R would hit the Run command, and CMD would get me to a command prompt. Now on Win 7, the same sequence makes NOTHING happen, because (even though I've put RUN back on the Start menu) there's no keyboard shortcut for 'R'un. gRRRR.

- I have ONE piece of hardware that, darn it, I cannot use, and man, I'm disappointed. It's a USB-connected phone system that's voice activated and hooks into Outlook. It just crashes every time it runs. Just flat out crashes. Can't really get to the bottom of this. If anyone else has this device, it's called ArialPhone, and I'd love to hear if it's working for anyone out there on Win 7 or even Vista. (PS: Even "XP compatibility mode" likely won't get me out of this one; unless I want to run a copy of Outlook *INSIDE* that fake XP machine, which I don't.)

- I have two other Outlook plug-ins which worked great on XP, but won't do their magic on Windows 7. Oddly, two *OTHER* Outlook plug-ins are working swimmingly. So, I don't know where the problem is. Still hacking on this one.

- The Beta for the App-V client 4.6 is out, and includes 64-bit support. Honestly, the thing seems ROCK SOLID to me, but my understanding is that it's planned to be Beta for a while before it goes gold. AppV Applications in cache seem to run WAY WAY faster than they did in AppV 4.5. It took me about an hour to convert all my existing 4.5 sequenced apps to 4.6.

- My wife walked behind me to see what I was working on. And it was my Windows 7 desktop. She saw the huge, huge icons that Windows 7 defaults with and asked "Are you in safe mode?" I can totally see her confusion, as Windows 7, in my opinion, looks totally bizzare with those big honkin' icons. The fix? While on the desktop, hold down Control and use the scroll wheel of your mouse to adjust. Kooky.

- Lots of people seem to be all "gaga" about the new taskbar. Honestly, I don't love the "mixed metaphor" of applications running and applications' icons all jumbled together. I've reset it act a little more like XP did, and I'm a little saner now.

But, all around, 95% of my applications are working. Everything that's "broken" seems to be revolved around Outlook in some way. Everything else is working great. So, I'm not sure if I can blame Windows or what here. Regardless, I'll get to the bottom of these and shake out my final bugs.

But in short, my first week -- pretty solid after getting thru the bumps. I do have that "last mile" to push through, and I'll keep you posted as things progress.

Team: I had this email exchange with a friend of mine the other day.

The email title was: "Policy vs. Preference (I don't get it.)"

I thought you'd like it. Read all the way thru to the end for how to get more information TOMORROW, Friday at 12.00 PM EST.

[Note, we're having some login issues to the GPanswers.com web accounts. Sorry if you're affected right now; we're working to fix it... Thanks.]

--

Jeremy...

OK I'm having serious brain 'problem.' What, really, is the difference between an unmanaged policy setting and a preference (GPPreferences-style)?

I CAN remember, at this late hour, that managed policy settings are in the Policies key of the registry. Seems to me that unmanaged policy settings (which equate to settings that can tattoo, right?) are elsewhere, yeah? So what makes them different than changes made by Preferences?

I am just trying to hone my use of terminology and make my boss understand "Policy" vs "Preference" vs "PolicyPak". THANKS!!!!

Okay Frank.. So.. I'm sure there's some "complete and proper definition" somewhere at Microsoft about what a Policy is vs. a Preference.

But when I talk with people about "Policy" Vs. "Preference" here's the litmus-test I use to determine "which is which."

I define policy as "three things"... that is, these three things need to be TRUE for you to be able to call it a "True Policy." A policy means that the setting:

1. Properly goes to the "Policies" keys in the registry (one of only FOUR sanctioned locations)

and

2. UI lockout occurs such that users cannot scoot around it

and

3. UI lockout / setting reverts when GPO falls "out of scope" (ie: You whack the GPO.)

So, "Prohibit Access to the Control Panel" is a true POLICY. It meets these three criteria.

If you crack open the ADM/X, you'll see that the registry punch goes to the Policies keys... and once set, users cannot scoot around it.

A Preference is EVERYTHING ELSE.

So.. some criteria to check if it's a Preference would be:

1. Does it store its keys anywhere in the registry? (ie: OUTSIDE the 4 proper Policies keys?)

and

2. Does it still permit a user to manipulate the UI? (ie: No UI lockout?)

So, 99% of hand-created ADM or ADMX templates and a large percentage of GP Prefs items are just that.. Preferences. (Note that many GP Preferences items have a scope which are NOT the registry. For instance, "Local users and groups" deals with the local SAM and NOT the registry. Others, deal with services. But for the purposes of this discussions, I think you're asking about REGISTRY items, and many of the GP Preferences items are, indeed, registry focused.)

So, let's examine the GP Preferences "Internet Explorer Settings." They're Preferences.

Why? Because... once a user gets the settings...

Test #1: The keys aren't contained in the "Policies" keys
Test #2: Users can scoot around and change the values to whatever they want
Test #3: If you whack the GPO with a preference, what happens? It "tattoos" or "leaves behind" the settings you set.

Do note, if you whack the GPO with a GP Preference, on some items there is an extra flag which is called "Remove when no longer applies" which will DELETE THE VALUE (not REVERT the value). Which, could be harmful to your application. Ouch.

So, where does PolicyPak fit in?

In contrast.. POLICYPAK will "bridge the gap" when it comes to Registry punches and settings Applications' settings.

The free PolicyPak Community edition is able to:

1. Write keys anywhere in the registry

while

2. Performing UI lockout

and magically

3. Reverting to the value you want when no longer applies (not totally deleting the value!)

PS: There's a guide which I wrote to help clear up a lot of these questions. Let me know what you think:
https://www.policypak.com/solutions/why-group-policy-admins-need-policypak.html

Quick update #1: About the "backing up GPOs" stuff we talked about this week...
-------------------------------------------------------------------------------------------------------------------

I forgot all about Darren Mar-Elia's PowerShell cmd-lets (free!)

If you don't want to wait for Win 7 but want to use Powershell to manage GPOs now, head on over to http://www.sdmsoftware.com/freeware and get their free Powershell GPMC cmdlets.

To backup up all GPOs in a domain using the SDM Powershell cmdlets, just use:

Get-sdmgpo * | export-sdmgpo -location c:gpbackups

Neat !

Team:

Last week, we talked about backing up your GPOs, and how you should be, ya know, "just doing it."

Then I got some emails asking me about "automating that backup."

Turns out.. that's easy too! Here's two ways (I'm sure there are more.)

Way #1: VB-scripts via the GPMC scripts
The older GPMC had built-in scripts. The newer GPMCs require that you download the sample scripts. These are great and super helpful and can be found here: http://tinyurl.com/gpscripts

You can see examples of using the scripts if you head over here:
http://msdn.microsoft.com/en-us/library/aa814151(VS.85).aspx

The script you want to play with is called "BackupAllGPOs.vbs."

It's easy as pie. Or punch. Or something that's easy.

Way #2: If you're a Powershell geek / geekette
The newest GPMC with Win7 and WS08/R2 supports lots of SIMILAR constructs (create GPOs, backup, restore, etc), but now you can ALSO use PowerShell. So, to "get" the GP-related commands into Powershell, I typed

"Import-Module grouppolicy -verbose"

then I was able to run this quick command

"backup-gpo -all -path c:SavedGPOs"

And, blammo. Instant backup of my GP-world.

There's more to the command, of course; but that's its simplest use.

Again, easy as falling off a log... if you know the secrets.

I helped give some advice recently to SearchWinIT about what to do if someone is downsized. In other words, YOU'RE in IT, and you need to act to help keep the company going. Read about it here.