SetACL Commands

SetACL

SetACL is a tool for manipulating permissions, or, to be more exact, security descriptors (SDs). SDs are used on operating systems based on Windows NT to control access to securable objects.

SetACL is a tool for manipulating permissions.


SetACL is relatively feature complete and bug free. SetACL has been fast and stable from the very beginning!
SetACL can set permissions on:

• Local or remote directories
• Local or remote files
• Local or remote printers
• Local or remote registry keys
• Local or remote Win32 services
• Local or remote network shares

The following special features distinguish SetACL from similar programs:

• Use all special permissions of Windows 2000 in the file system and in the registry.
• Block the inheritance from the parent object while copying the ACL from the parent object or clearing it.
• Specify how permissions are inherited to child objects: container, object or container + object.
• Set permissions for any type of user or local / domain local / global / universal group.
• Set permissions on any machine; it does not matter whether the target machine is in a trusted domain, an independent domain or a workgroup.
• Use wildcards in object names (only works in the file system).
• Recursively set permissions on any sub-object in the file system and in the registry.
• Set, grant, deny or revoke permissions.

OPTIONS

-on           ObjectName
-ot             ObjectType
-actn        Action
-ace          “n:Trustee;p:Permission;s:IsSID;i:Inheritance;m:Mode;w:Where”
-trst         “n1:Trustee;n2:Trustee;s1:IsSID;s2:IsSID;ta:TrusteeAction;w:Where”
-silent –on          “c:\windows\inf\USBSTOR.INF” -ot FILE -actn trustee -trst 
                            “n1:everyone;ta:remtrst;w:dacl”
-dom        “n1:Domain;n2:Domain;da:DomainAction;w:Where”
-ownr       “n:Trustee;s:IsSID”
-grp          “n:Trustee;s:IsSID”
-rec          Recursion
-op            “dacl:Protection;sacl:Protection”
-rst               Where
-lst             “f:Format;w:What;i:ListInherited;s:DisplaySID”
-bckp          Filename
-log            Filename
-fltr          Keyword
-clr               Where
-silent
-ignoreerr

Parameters:

Object Name: Name of the object to process (e.g. ‘c:\mydir’)

ObjectType:     

Type of object:
file:       Directory/file
reg:        Registry key
srv:        Service
prn:        Printer
shr:        Network share

Action:            
Action(s) to perform:
ace:          Process ACEs specified by parameter(s) ‘-ace’
trustee:    Process trustee(s) specified by parameter(s) ‘-trst’.
domain:   Process domain(s) specified by parameter(s) ‘-dom’.
list:           List permissions. A backup file can be specified by parameter ‘-bckp’.Controlled by parameter ‘-lst’.
restore:    Restore entire security descriptors backed up using the list function. A file containing the backup has to be specified using the parameter ‘-bckp’. The listing has to be in SDDL format.

setowner: Set the owner to trustee specified by parameter ‘-ownr’.
setgroup: Set the primary group to trustee specified by parameter ‘-grp’.
clear:        Clear the ACL of any non-inherited ACEs. The parameter ‘-clr’ controls whether to do this for the DACL, the SACL, or both.
setprot:    Set the flag ‘allow inheritable permissions from the parent object to propagate to this object’ to the value specified by parameter ‘-op’.
rstchldrn:  Reset permissions on all sub-objects and enable propagation of inherited permissions. The parameter ‘-rst’ controls whether to do this forthe DACL, the  SACL, or both.

TrusteeAction:  Action to perform on trustee specified:

remtrst:          Remove all ACEs belonging to trustee specified.
repltrst:           Replace trustee ‘n1′ by ‘n2′ in all ACEs.
cpytrst:           Copy the permissions for trustee ‘n1′ to ‘n2′.

DomainAction:  Action to perform on domain specified:
remdom:      Remove all ACEs belonging to trustees of domain specified.
repldom:        Replace trustees from domain ‘n1′ by trustees with same name from domain ‘n2′ in all ACEs.
cpydom:        Copy permissions from trustees from domain ‘n1′ to trustees with same name from domain ‘n2′ in all ACEs.


Trustee:   Name or SID of trustee (user or group). Format:               

a) [(computer | domain)\]name                                  Where:
                        computer:   DNS or NetBIOS name of a computer -> ‘name’ must be a local account on that computer.
                        domain:      DNS or NetBIOS name of a domain -> ‘name’ must be a domain user or group.
                        name:       user or group name

If no computer or domain name is given, SetACL tries to find a SID for ‘name’ in the following order:

1. built-in accounts and well-known SIDs
2. local accounts
3. primary domain
4. trusted domains

b) SID string

Domain:           Name of a domain (NetBIOS or DNS name).

Permission:      Permission to set. Validity of permissions depends on the object type (see below). Comma separated list.
                        Example:    ‘read,write_ea,write_dacl’

IsSID:              
Is the trustee name a SID?
y:          Yes
n:          No

DisplaySID:    
Display trustee names as SIDs?
y:          Yes
n:          No
b:          Both (names and SIDs)

Inheritance:     
Inheritance flags for the ACE. This may be a comma separated list containing the following:

so:         sub-objects
sc:         sub-containers
np:         no propagation
io:         inherit only
Example:    ‘io,so’

Mode:          

Access mode of this ACE:

a)   DACL:
               set:         Replace all permissions for given trustee by those specified.
               grant:      Add permissions specified to existing permissions for given trustee.                  
               deny:      Deny permissions specified.
               revoke:   Remove permissions specified from existing permissions for given trustee.

b)   SACL:
              aud_succ:   Add an audit success ACE.                 
              aud_fail:   Add an audit failure ACE.
               revoke:     Remove permissions specified from existing permissions for given trustee.

Where:        

Apply settings to DACL, SACL, or both (comma separated list):
Dacl
sacl
dacl,sacl

Recursion:     

Recursion settings, depends on object type:
a) file:               
                 no:         No recursion.
                 cont:       Recurse, and process directories only.
                 obj:        Recurse, and process files only.
                 cont_obj:   Recurse, and process directories and files.
b) reg:
                 no:         Do not recurse.
                 yes:        Do Recurse.

Protection:    
Controls the flag ‘allow inheritable permissions from the parent object to propagate to this object’:
nc:         Do not change the current setting.
np:         Object is not protected, i.e. inherits from parent.
p_c:       Object is protected, ACEs from parent are copied.
p_nc:       Object is protected, ACEs from parent are not copied.

Format:        
Which list format to use:
           sddl:       Standardized SDDL format. Only listings in this format can be restored.
           csv:        SetACL’s csv format.
           tab:        SetACL’s tabular format

What:           
Which components of security descriptors to include in the listing. (Comma separated list):
           d:          DACL
           s:          SACL
           o:          Owner
           g:          Primary group

Example:    ‘d,s’

ListInherited:

List inherited permissions?
           y:          Yes
           n:          No

Filename:      
Name of a (unicode) file used for list/backup/restore operations or logging.

Keyword:      
Keyword to filter object names by. Names containing this keyword are not processed.

REMARKS

Required parameters (all others are optional):
-on         (Object name)
-ot         (Object type)

Parameters that may be specified more than once:
                 -actn       (Action)
                 -ace        (Access control entry)
                 -trst       (Trustee)
                 -dom        (Domain)
                 -fltr       (Filter keyword)

Only actions specified by parameter(s) ‘-actn’ are actually performed, regardless of the other options set.

Order in which multiple actions are processed:
                 1.          restore
                 2.          Clear
                 3.          Trustee
                 4.          Domain
                 5.          ace, setowner, setgroup, setprot
                 6.          Rstchldrn
                 7.          list

VALID PERMISSIONS

a) Standard permission sets (combinations of specific permissions)

Files / Directories:
              read:          Read
              write:         Write
              list_folder:   List folder
              read_ex:       Read, execute
              change:        Change
              profile:       = change + write_dacl
              full:          Full access
Printers:
              print:         Print
              man_printer:   Manage printer
              man_docs:      Manage documents
              full:          Full access
Registry:
              read:          Read
              full:          Full access
Service:
              read:          Read
              start_stop:    Start / Stop
              full:          Full access
Share:
              read:          Read
              change:        Change
              full:          Full access

b) Specific permissions

Files / Directories:
              traverse:      Traverse folder / execute file
              list_dir:      List folder / read data
              read_attr:     Read attributes
              read_ea:       Read extended attributes
              add_file:      Create files / write data
              add_subdir:    Create folders / append data
              write_attr:    Write attributes
              write_ea:      Write extended attributes
              del_child:     Delete subfolders and files
              delete:        Delete
              read_dacl:     Read permissions
              write_dacl:    Write permissions
              write_owner:   Take ownership

Registry:              query_val:     Query value
              set_val:       Set value
              create_subkey: Create subkeys
              enum_subkeys:  Enumerate subkeys
              notify:        Notify
              create_link:   Create link
              delete:        Delete
              write_dacl:    Write permissions
              write_owner:   Take ownership
              read_access:   Read control

 
           USAGE ::
<object name>   = Any valid path to local or remote object
<object type>   = {/file | /dir | /printer | /registry | /service | /share}
<action>        = {/deny | /grant | /set | /revoke}
<trustee>       = User/group to grant/deny permissions for, ie. ‘machine\user’
<permissions>
      /file       = {/read | /write | /read_ex | /change | /full | /traverse |
                     /list_dir | /read_attributes | /read_ea | /add_file |
                     /add_subdir | /write_attributes | /write_ea |
                     /delete_child | /delete | /read_dacl | /write_dacl |
                     /write_owner}

      /dir        = {/read | /write | /list_folder | /read_ex | /change |
                     /profile | /full | /traverse | /list_dir |
                     /read_attributes | /read_ea | /add_file | /add_subdir |
                     /write_attributes | /write_ea | /delete_child |/delete |
                     /read_dacl | /write_dacl | /write_owner}
            /printer    = {/print | /man_printer | /man_docs | /full}

      /registry   = {/read | /full | /query_val | /set_val | /create_subkey |
                     /enum_subkeys | /notify | /create_link | /delete |
                     /write_dacl | /write_owner | /read_access}
      /service    = {/read | /start_stop | /full}
      /share      = {/read | /change | /full}


<inheritance>  = {cont_obj_inh | cont_inh | obj_inh | no_prop_inh |
                  inh_only_obj | inh_only_cont | inh_only_cont_obj}

<inh. from parent>
               = {yes | no_copy | no_dont_copy}
<recursion>    = {cont_obj | cont | obj}
/sid           : <trustee> parameter is a SID, not an account/group name.
                 Well-known SIDs can be used.
/silent        : No output whatsoever is displayed if the number of
                 parameters passed is correct.


Remarks
The “object name” parameter:

• Files/directories: Can be a relative path (“filename”), absolute path (“c:\dirname”) or a UNC name (“\\machine\share\dirname“).

• Printers: Can be a local (“printername”) or a remote printer (“\\machine\printername“)

• Registry key: Can be a local (“MACHINE\MyKey”) or a remote registry key (“\\machine\MACHINE\MyKey”).The hive keys must be specified like this: “CLASSES_ROOT”, “CURRENT_USER”, “MACHINE”, “USERS”.

• Service: Can be a local (“servicename”) or a remote service (“\\machine\servicename“).

• Share: Can be a local or remote network share. Always specify: “\\machine\share“.  The “action” parameter:

• ”/grant”: Creates a new access-allowed ACE that combines the specified rights with any existing rights of the trustee. The new ACE replaces any existing access-allowed ACE for the trustee. The program also modifies or deletes any existing access-denied ACE for the trustee that denies the specified rights.

• ”/set”: Similar to /grant except that the new access-allowed ACE allows only the specified rights, discarding any existing rights. This flag also removes any existing access-denied ACE for the trustee.

• ”/deny”: Creates a new access-denied ACE that replaces any existing access-denied ACE for the trustee. The new ACE denies the specified rights in addition to any currently denied rights of the trustee. The program also modifies or deletes any existing access-allowed ACE for the trustee that allows the specified rights.

• ”/revoke”: Removes any existing ACEs for the specified trustee. The program ignores the rights specified.

• The action parameters can be abbreviated by using only the first letter, ie. “/g” instead of “/grant”. The “trustee” parameter:

• This is the user or group you want to set the permission for.

• It can be a any type of local or domain user or group (local/domain user, local group, domain local group, global group or universal group).

• Always use the format ‘machine\user’ or ‘domain\user’. If you want to set permissions for a local group on your local machine, please omit the ‘machine\’ part.

• You can use predefined groups, like “EVERYONE” or “GUEST”. If you do this, a machine name should not be specified.

• The following special names can be used:

o ”CREATOR GROUP”: This is used in conjunction with inheritance. When a new object is created, the system replaces this SID with the primary group SID of the user who created the object.
o ”CREATOR OWNER”: This is used in conjunction with inheritance. When a new object is created, the system replaces this SID with the SID of the user who created the object.
o ”CURRENT_USER”: Indicates the owner of the calling thread or process.

• If the optional parameter “/sid” is used the trustee is expected to be a SID (security ID). This can be very useful if you want to set permissions for generic (built-in) users or groups in a language independent way. Example: on an english machine the administrators group is called “Administrators”; on a german machine it is called “Administratoren”. Hint: the SIDs of generic users/groups are always the same, regardless of OS type or language. A list of generic SIDs can be found here.
The “permissions” parameter:

• The permissions you can set on files, directories and registry keys correspond to the standard and special permissions of Windows 2000.

• I added a set of permissions of my own, “/profile”, which sets the permissions needed for a user profile folder on Windows 2000, which are “change” + “set permissions”.

• The permissions you can set on printers, network shares, services and correspond to the standard permissions of Windows 2000.
The “inheritance” parameter:

• Use this with extreme caution, especially on production machines!

• The correct (standard) inheritance flags are always set for you. If you need to, you can use this parameter to specify special, non-standard inheritance flags.

• If you set permissions on a container (for example, a directory) that contains sub-containers and/or objects, permissions are propagated down the tree.

• The following flags can be used:
o ”/cont_obj_inh”: Both container and noncontainer objects that are contained by the specified container inherit the ACE in addition to the container specified.
o ”/cont_inh”: Other containers that are contained by the specified container inherit the ACE in addition to the container specified.
o ”/obj_inh”: Noncontainer objects contained by the specified container inherit the ACE in addition to the container specified.
o ”/inh_only_obj”: The ACE does not apply to the specified container to which the ACL is applied, but objects contained by the specified container inherit the ACE.
o ”/inh_only_cont”: The ACE does not apply to the specified container to which the ACL is applied, but containers contained by the specified container inherit the ACE.
o ”/inh_only_cont_obj”: The ACE does not apply to the specified container to which the ACL is applied, but containers and objects contained by the specified container inherit the ACE.
o ”/no_prop_inh”: The ACE is not propagated down to lower level objects/containers.
The “inherit from parent” parameter:

• ”yes”: This object inherits permissions from its parent objects. This is the normal setting for any type of object. If you do not specify this optional argument, “yes” is always assumed.

• ”no_copy”: This object blocks permissions from its parent objects. The permissions from the parent object are copied to the object specified and then the permissions are set.

• ”no_dont_copy”: This object blocks permissions from its parent objects. The permissions from the parent object are NOT copied to the object specified which results in an ACL that contains only the permissions set with SetACL.
The “recursion” parameter:

• (Only for registry keys and directories) Walk down the tree and set permissions on every key/directory/file. This is only needed on NT4 and in special cases since Windows 2000 progagates permissions down the tree all by itself.

• ”cont_obj”: Recursively set permissions on every container (registry keys and directories) and object (files).

• ”cont”: Recursively set permissions ONLY on containers (registry keys and directories).

• ”obj”: Recursively set permissions ONLY on objects (files).
The “/sid” parameter:

• If the optional parameter “/sid” is used the trustee is expected to be a SID (security ID). This can be very useful if you want to set permissions for generic (built-in) users or groups in a language independent way. Example: on an english machine the administrators group is called “Administrators”; on a german machine it is called “Administratoren”. Hint: the SIDs of generic users/groups are always the same, regardless of OS type or language. A list of generic SIDs can be found here.
The “/silent” parameter:

• If the optional parameter “/silent” is used no output will be generated if the number of parameters passed to the program is correct. This can be useful if SetACL is used in batch files or from scripts. Successful execution can be checked using the return value which is always set.

Difference between Run Runonce and ActiveSetup

Active Setup:

It is used when your application requires installation of components such as files or registry keys on a per-user basis, but application has no advertised entry points or other triggers to initiate the installation process.

Run:

The Run key is processed after every logon, either by the Explorer shell, if it is present, or by First Boot Agent (FBA), if a custom shell, Command shell, or Task Manager Shell is used. If FBA processes this key, it does so after every logon, not during first boot as it normally would. Typically, this flag is used to load Systray applications, launch services in executables, hide autostart applications, or hide background processes

Run Once:

The RunOnce key is processed only once, by FBA, after Plug and Play device enumeration and DLL registration processing have completed. The values of this registry key are deleted from the registry after it is processed, so that it will not run again. Typically, this flag is used when a reboot is required, such as for a DLL or OCX registration, or for cleaning up a setup or an uninstall.

What is ALLUSERS=1

ALLUSERS =1   -> Per machine installation
ALLUSERS=0    -> Per User Installation, application will be installed only to user who is installing application
ALLUSERS=2    -> Depending upon user rights application will be installed.

                                If the user is Administrator then app will be installed as ALLUSERS=1
                                If the user is non-admin then app will be installed as ALLUSERS=2

Different GUIDs present in MSI

ProductCode
PackageCode
ComponentCode
UpgradeCode

Why multiple MSIExec.exe processes run during an installation?

A number of MSIExec processes can be running during an installation. The reason for this is that Windows Installer uses a client-server model for performing installations. Additionally for security reasons, Windows Installer hosts DLL and script custom actions in a “sandbox” process. Depending on how the install was initiated, one of the MSIExec processes can be the client process. Another MSIExec process is Windows Installer service. Any remaining MSIExec processes are usually sandbox processes for hosting custom actions. The determination as to which MSIExec process will serve as the sandbox process for a script or DLL custom action depends in part on whether the custom action will run elevated or impersonated and whether the custom action is 32-bit or 64-bit.

Suppress reboot in WiseScript

Set Variable RESTART to NULL (dont give any value and its considered as NULL)

VBScript to Delete User folders or files on Windows 7

Following script deletes folder by searching each user profile on windows7





Dim FSfolder 
Dim subfolder 
Dim i 


set objshell = CreateObject("Wscript.shell") 
Set FSO = CreateObject("Scripting.FileSystemObject")
Profile = strSysDrive & "C:\Users"
Set FSfolder = FSO.GetFolder(Profile) 'getting the user profile folders




'starting of the loop to delete the HKCUs


For Each subfolder In FSfolder.SubFolders


   If (subfolder.Name <> "All Users" And  subfolder.Name <> "Default User"_
   and subfolder.Name <> "LocalService" and subfolder.Name <> "NetworkService") Then


folder1=Profile & "\" & subfolder.Name & "\AppData\Local\TechSmith\Snagit"




DeleteThisFolder(folder1)




   end if


Next 


'*******************************************************************************************************


Function DeleteThisFolder(FolderName)


    If FSO.FolderExists(FolderName) Then
    objshell.Run "CMD.EXE /C RD /S /Q """ & FolderName & """",0,True 
    End If


End Function

How do disable a feature in MSI

In Feature Table, Goto Level of the particular feature which as to be disabled and  set it to 0

Another way to disable feature is set the feature level to above the value of INSTALLEVEL property value.

If INSTALLLEVEL property value is 100, then feature level has to be any value above 100.

File Versioning Rules

At the core of any installer is the actual installation of files. Determining whether to install a file is a complex process. At the highest level, this determination depends on whether the component to which a file belongs is marked for installation. Once determined that a file should be copied, the process is complicated if another file with the same name exists in the target folder. In such situations, making the determination requires a set of rules involving the following properties:

• Version
• Date
• Language

The installer only uses these rules when trying to install a file to a location that already contains a file with the same name. In this case, the Windows Installer uses the following rules, all other things being equal, to determine whether to install.

Highest Version Wins—All other things being equal, the file with the highest version wins, even if the file on the computer has the highest version.

Versioned Files Win—A versioned file gets installed over a nonversioned file.

Favor Product Language—If the file being installed has a different language than the file on the computer, favor the file with the language that matches the product being installed. Language-neutral files are treated as just another language so the product being installed is favored again.

Mismatched Multiple Languages—After factoring out any common languages between the file being installed and the file on the computer, any remaining languages are favored according to what is needed by the product being installed.

Preserve Superset Languages—Preserve the file that supports multiple languages regardless of whether it is already on the computer or is being installed.

Nonversioned Files are User Data—If the Modified date is later than the Create date for the file on the computer, do not install the file because user customizations would be deleted. If the Modified and Create dates are the same, install the file. If the Create date is later than the Modified date, the file is considered unmodified, install the file.

The installation of a Companion File depends not on its own file versioning information, but on the versioning of its companion parent. In the case of Companion Files, the installation is skipped only if the parent file has a higher version. Note that a file that is the key path for its component must not be a companion file because this results in the versioning logic of the key path file being determined by the companion parent file.

Nonversioned Files Using Companion Files-A nonversioned file that is associated with a versioned file using the companion mechanism abides by the rules for the versioned file. The only exception is if the versioned file on the computer and the versioned file being installed have the same version and language but the companion file is missing on the computer. In this case the companion file being installed is used even though the versioned file on the computer is used. Additionally, a nonversioned file using a companion file is installed if the REINSTALLMODE property includes the overwrite older versions options ("o" or "e") and the companion file's version is equal to a file already on the machine.

Source Resiliency

Applications that rely on network resources for installation-on-demand are susceptible to source failures if the source location should change for any reason or become damaged. The Windows Installer provides source resiliency for features that are installed on-demand by using a source list. The source list contains the locations searched by the installer for installation packages. The entries in this list can be network locations, Uniform Resource Locators (URLs), or compact discs. If one of these sources fails, the installer can quickly and seamlessly try the next.

The application developer does not need to incorporate any special information into the installer package to ensure source resiliency. Once the application is installed, the installer has the behavior of adding the last successfully used source as an entry in the source list. By default, this source is the location from which the installer package is initially installed, and is the same as the SourceDir property.

A system administrator can change the source list by applying a transform or by changing the SOURCELIST property from the command line or in the Property table.

REINSTALLMODE=amus

• a - Force all files to be reinstalled, regardless of version
• m - all required computer-specific registry entries (default)
• u - all required user-specific registry entries (default)
• s - all existing shortcuts (default)

Difference between Selfheal and Repair of MSI

Self Heal and Repair are two different concepts in Windows Installer which people gets confused with.


Self Heal is triggered by advertised shortcuts, or other advertising information in the package which eventually Repairs respective feature


Repair of an MSI can be triggered by

Repair button in Add/Remove programs
Using command line msiexec /f{optional switches} <Path of MSI>

MSI Uninstallation Command

MSI can be uninstalled in two ways.


1. MSIEXEC /x <ProductCode> /qb
2. MSIEXEC /x <Path of MSI> /qb


If in case MSI and MST are installed together, MST is not required during uninstallation. just the above commands are enough

Rename Folders using VBScript

Following script renames the folder in each user profile on WindowsXP machines


Dim FSfolder
Dim subfolder
Dim i

set objshell = CreateObject("Wscript.shell")
Set FSO = CreateObject("Scripting.FileSystemObject")

SysDrv=objshell.ExpandEnvironmentStrings("%systemdrive%")


Profile = SysDrv & "\Documents and Settings"
Set FSfolder = FSO.GetFolder(Profile) 'getting the user profile folders


'starting of the loop to delete the HKCUs

For Each subfolder In FSfolder.SubFolders

   If (subfolder.Name <> "All Users" And  subfolder.Name <> "Default User"_
   and subfolder.Name <> "LocalService" and subfolder.Name <> "NetworkService") Then

folder1=Profile & "\" & subfolder.Name & "\Application Data\Documentum\Client for Outlook"



RenameFolder(folder1)



   end if

Next

'*******************************************************************************************************

Function  RenameFolder(FolderName)

    If FSO.FolderExists(FolderName) Then
    'msgbox Foldername & ".old"
FSO.MoveFolder FolderName, Foldername & ".old"

    End If

End Function

SCCM 2012 Features

Microsoft System Center 2012 Configuration Manager helps you deliver user experiences across a wide range of devices, while also ensuring that you meet corporate control and compliance requirements. Learn more about the product capabilities in this comprehensive System Center solution.

Key Capabilities

• Application Delivery
  Configuration Manager has a user-centric approach to application delivery that allows…
  Learn More

• Mobile Device Management
  Configuration Manager enables users to be productive on the devices of their choice…
  Learn More

• Virtual Desktop Management
  Configuration Manager reduces the complexity and cost of implementing virtual…
  Learn More

• Endpoint Protection
  Configuration Manager serves as the infrastructure for Microsoft System Center 2012 Endpoint …
  Learn More

• Compliance & Settings Management
  Configuration Manager allows you to create a baseline for “desired configuration state”, …
  Learn More

• Software Update Management
  Configuration Manager continues to simplify the complex task of delivering and managing…
  Learn More

• Power Management
  Configuration Manager helps you get more out of your energy-saving hardware by providing…
  Learn More

• Operating System Deployment
  Configuration Manager simplifies the complex task of distributing operating systems to physical …
  Learn More

• Client Health & Monitoring
  Configuration Manager monitors and evaluates client health across your client environments…
  Learn More

• Asset Intelligence
  Configuration Manager includes asset intelligence technologies that provide administrators with…
  Learn More

• Inventory
  Configuration Manager can inventory hardware and software in your organization to help give you…
  Learn More

App-V 5.0 Beta Released

Microsoft has released App-V 5.0 Beta recently which has lot of new features.

For more information. Please go through following link

http://www.microsoft.com/getappv5

Application Packaging Online Training - May 2012 Batch

New batch of Application Packaging Online Training starting from 10th May 2012


Course Duration: 1 Month


Anyone interested? please contact me on Virtual.App.Packager@gmail.com


visit www.AppRepack.in for more information on training topics.

Microsoft UE-V

Microsoft User Experience Virtualization (UE-V) is an enterprise-scale user state virtualization solution that provides users a consistent, personal Windows experience that matches their unique work style.  UE-V is simple and versatile so IT professionals can enable the personal, user-defined experiences across many devices while maintaining oversight.  It can also integrate into existing management tools and infrastructure, which make it easily scale to the needs of any size organization.


Please use following URL to download UE-V


https://connect.microsoft.com/MDOPTAP/UEV

App-V 5.0 Beta Released

Microsoft has released App-V 5.0 Beta recently which has lot of new features.
For more information. Please go through following link


http://www.microsoft.com/getappv5

Application Packaging Services & Training

Application Packaging Services & Training


AppREPACK Technologies offers solutions on Application Packaging, Virtualization and Deployment technologies.

Application Packaging Training - April 2012 Batch

New batch of Application Packaging Classroom Training at Hyderabad from 1st week of April 2012


Course Duration: 1 Month


Anyone interested? please contact me on Virtual.App.Packager@gmail.com
visit www.AppRepack.in for more information on training topics.


Note: Send me an email, if you are looking for online training details. Thanks

Application Packaging Online Training - Weekend Batch

New batch of Application Packaging Online Training Weekend Batch starting from 25th March 2012.


Course Duration: 5 to 6 weeks
Anyone interested?, please contact me on Virtual.App.Packager@gmail.com


visit www.AppRepack.in for more information on training topics.

What are Merge Modules

Merge modules are a mechanism in Windows Installer that allows software companies to
prepackage and share standard component definitions. For example, take the infamous Crystal
Reports runtimes. The files, DLLs, and registry entries that make up these runtimes can be
defined as Windows Installer components and placed in a merge module.
When any developer in the world wants to distribute these runtimes, they use the vendor merge
module to ensure that a complete set of runtimes files is included with the vendor assigned
versions, component codes, registry keys, and other Windows Installer elements that the owning
software vendor assigned. Obviously one of the biggest publisher’s of merge modules is
Microsoft. When not merged into a package, merge modules are contained in .MSM files
(another variant on the .MSI format).

What is Self Healing

Self-healing is the ability of Windows Installer to detect and repair any critical resources that are
required for the user to successfully launch and use the application. Every resource of a package
is not checked during self-healing. Because self-healing occurs as the application is launched,
exhaustive checking of every resource would lead to excessive wait times.


Earlier we discussed how Windows Installer performs basic actions (install, uninstall, and so on)
on lists of Components. We also discussed how these lists of Components were specified by a
list of Features. Self-healing follows this approach as well.


Self-healing, install-on-demand, and user profile fix-up are all variations on the same
functionality provided by Windows Installer. Windows Installer is asked to find the appropriate
software application when an entry point is activated by a user (usually double-clicking a
shortcut or document type). If Windows Installer finds the software is not yet installed, it will
immediately install it. If the software is installed, it will be verified by self-healing. In both cases,
this happens at the Feature level.

MSI Properties

There are several notable properties that will be used many, many times. Most of them control
how a package is installed:
• TRANSFORMS—Specifies a list of transforms to apply to an MSI during package
installation.
• ADDLOCAL—Lists features to install on the local computer.
• ALLUSERS—Controls whether installations are performed for all users of the computer
or just the user running the installation.
• ROOTDRIVE—Controls which drive Windows Installer installs packages on—by
default packages are installed on the local drive that has the most free space.
• INSTALLDIR—Controls the exact directory to which a package must be installed.
• REBOOT—Controls whether the package requests a reboot after installation.

Entry Points and Advertisements

Ever wonder how Windows Installer knows to get involved with repairing or installing an
application? Entry points allow Windows Installer to proxy the startup of an application and
perform application management tasks before the user is allowed to access the application. In
other words, when you double-click the icon for a Windows Installer packaged software
application, it does not actually attempt to start the application directly. The icon is a special icon
that asks Windows Installer to find the software application and start it. This is when Windows
Installer can use the MSI repository information, the installed application resources (files,
registry keys, and so on), and the original package file to perform the magic of self-healing and
install on demand.




An entry point turns into an advertised interface when any Feature that its Component belongs to
is advertised or installed on a target computer system. When a Windows Installer package is
advertised, advertised interfaces make it appear as though the application is installed and ready
to use. When a Windows Installer package is installed, advertised interfaces trigger Windows
Installer for self-healing and user profile fix-up checking. An entry point/advertised interface can
be:


• A shortcut (special Windows Installer shortcut)
• A document extension (association)
• A MIME type (Internet document types)
• A Class ID (CLSID)—Programmatic identities used for sharing software within and
between various applications

I can change My Document folder,My Favorites,Start Menu?

Use Registry entry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Then change path you want to change and Log off or Restart machine to view changes

How to retrieve Uninstall Information of various applications?

1. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Application_Name

      

2. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Application_Name

     (From here you can get information regarding the installed applications)

Enable Windows Installer Logging

To enable Windows Installer logging, use following registry

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer

Reg_SZ: Logging

Value: voicewarmup 

What is Active Setup

Active setup is a process that runs automatically when a user logs in.

Registry keys at 

HKLM\Software\Microsoft\Active Setup\Installed Components\%APPNAME% 

and 

HKCU\Software\Microsoft\Active Setup\Installed Components\%APPNAME% 

are compared, and if the HKCU registry entries don't exist, or the version number of HKCU is less than HKLM, then the specified application is executed for the current user. 

If your application requires installation of components such as files or registry keys on a per-user basis, but your application has no advertised entry points or other triggers to initiate the installation process, then Active Setup is the solution. To implement Active Setup, 

populate the following registry key with two ( REG_SZ ) values: 

KEY: 

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%APPNAME% - where %APPNAME% is an arbitrary string which can be the application name, or its product code GUID if using an MSI. (As long as it is unique on that workstation!)

VALUE1: StubPath=<full local path>\YourActiveSetup.exe 

VALUE2: Version=1 

When each new user logs on, the operating system compares Active Setup keys between HKLM and HKCU, and runs the nominated executable if the HKCU entry is missing or the version in HKCU is less than HKLM.  So if you ever need to update the ActiveSetup executable, just install

a new version, and increment the Version registry key (VALUE2 above) in HKLM. Next time the user logs on, the active setup will run again for that user. 

To force a repair using the existing MSI where a separate Active Setup EXE is not required, you can do it this way: 

Create the following key structure under HKEY_LOCAL_MACHINE hive:

HKEY_LOCAL_MACHINE\Software\Microsoft\ActiveSetup\InstalledComponents\[ProductCode]

Under this registry key, create a <new string value> such as:

"StubPath"="msiexec /fous {ProductCode} /qb"

Run, Run Once Registry Keys

Run keys cause programs to automatically run each time that a user logs on. The Windows registry includes the following four Run keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Each of these keys has a series of values. The values allow multiple entries to exist without overwriting one another. The data value for a value is a command line.


There are some special considerations for the third and fourth keys in the list, the RunOnce keys:

1.     By default, Run keys are ignored when the computer starts in Safe mode. Under the RunOnce keys, you can prefix a value name with an asterisk (*) to force the associated program to run even in Safe mode.

2.     You can prefix a RunOnce value name with an exclamation point (!) to defer deletion of the value until after the command runs.

3.     Without the exclamation point prefix, a RunOnce value is deleted before the command runs. As a result, if a RunOnce operation does not run properly, the associated program is not asked to run the next time you start the computer.

If more than one program is registered under any particular key, the order in which those programs are run is indeterminate. A program run from any of these keys should not write to the key during its execution. Doing so will interfere with the execution of other programs registered under the key. Furthermore, applications should use the RunOnce keys only for transient conditions (such as to complete application setup); an application must not continually re-create entries under RunOnce. Doing so will interfere with Windows Setup.

Application Packaging Overview

Resolve ICE 57 Error

Error: Component has both per user and per machine data with a per machine keypath

Solution: Create a new component (with a new GUID), move all of the per user data from the component that kicks up the error to the new one. Set one of the files/reg keys as it’s keypath.

Application Packaging Online Training – Weekend Batch

New batch of Application Packaging Online Training Weekend Batch starting from 25th March 2012.

Course Duration: 5 to 6 weeks

Anyone interested?, please contact me on Arjun@Apprepack.in

visit www.AppRepack.in for more information on training topics.

Resolve ICE 57 Error - MSI

Error: Component has both per user and per machine data with a per machine keypath


Solution: Create a new component (with a new GUID), move all of the per user data from the component that kicks up the error to the new one. Set one of the files/reg keys as it’s keypath.

Resolve ICE 43 Error - MSI

Error: Component “…” has non-advertised shortcuts. It Should use a registry key under HKCU as its KeyPath, not a file.


Solution: Put one Current_User registry key under the mentioned component and set that registry key as the keypath

Resolve ICE18 Error - MSI

Error: KeyPath for Component “…” is Directory “…”. The Directory is not listed in the CreateFolders table


Solution: Create a new row in the table “CreateFolder”, select the mentioned Directory and the mentioned Component.

Application Packaging Training - March 2012 Batch

New batch of Application Packaging Classroom Training at Hyderabad from 10th March 2012.


Course Duration: 1 Month
Anyone interested?, please contact me on Virtual.App.Packager@gmail.com
visit www.AppRepack.in for more information on training topics.


Note: Send me an email, if you are looking for online training details. Thanks

Application Packaging Training - January 2012 batch

New batch of Application Packaging Classroom Training at Hyderabad from 17th January 2012.


Course Duration: 1 Month
Anyone interested?, please contact me on Virtual.App.Packager@gmail.com
visit www.AppRepack.in for more information on training topics.


Note: Send me an email, if you are looking for online training details. Thanks