Microsoft provides ample documentation describing the process for enabling Bitlocker in the enterprise.  There are only a half a dozen or so steps required to prepare then Active Directory environment and then a few minor modifications to the SCCM or MDT task sequence to enable BitLocker during builds.  In the field I have found there is one area where the BitLocker documentation is lacking and thought I would share this tip.

When enabling backup of Bitlocker Recovery key information in Active directory it is required that Group Policy be configured in order to turn on the Active Directory backup feature of BitLocker on the worstation itself.  The Microsoft guide for preparing and configuring Active Directory can be found HERE.

Unfortunately the guide does not provide complete information for Group Policy configuration.  Following the guide will result in two group policy settings being configured, one for TPM recovery keys and one for BitLocker recovery keys.  Six group policy settings are required in order to properly configure Active Directory backup of BitLocker keys.  This requirement is not clearly detailed in the Microsoft documentation.  If these policy settings are missing and you attempt to save BitLocker recovery information to Active Directory via the “manage-bde -protectors -adbackup c: -id {device id}” command line you will receive the following error:

ERROR: Group policy does not permit the storage of recovery information to Active Directory. The operation was not attempted.

Additionally, searches for recovery key information in Active Directory BitLocker Recovery Key Viewer will not return any results.

Resolution:

Verify all of the following group policies are configured and present on the workstation, then retry saving BitLocker recovery information to Active Directory via the “manage-bde -protectors -adbackup c: -id {device id}” command:

• Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)
• Configure how BitLocker-protected operating system drives can be recovered
• Configure how BitLocker-protected removable data drives can be recovered
• Configure how BitLocker-protected fixed data drives can be recovered
• Configure how BitLocker-protected drives can be recovered (Windows Server 2008 and Vista)

And finally, for the TPM:

• Turn on TPM Backup to Active Directory Domain Services

If you do not know the device id then run the “manage-bde -protectors -get c:” command, replacing “c” with the drive letter of the device in question.  If all of these settings have been configured properly and BitLocker is successfully enabled you will see the following event in the system log:

I started out running only the Apple OS X operating system. I had Office 2011 for Mac for my productivity suite and I was able to do many work related tasks. However, I found myself using Citrix or my Windows computer for other work related applications such as our Document Management System iManage, our ticketing system ConnectWise and other web applications that only work fully with Internet Explorer.

I then decided to purchase the external DVD drive so I could install Windows directly on the MacBook Air via the built in Boot camp utility. This lets you dual boot between Windows and OS X as opposed to running a virtualization product such as VMware Fusion or Parallels. I use VMware Fusion on my home iMac and it works great. On a laptop with limited RAM, CPU and battery life, virtualization does not make sense.

Running native Windows via Boot camp works VERY well. The Apple hardware runs Windows as good, if not better, than a computer made to run Windows. Apple includes all the Windows drivers and makes the process very easy. Over time, I found myself using Windows exclusively and never booting into OS X as I use this primarily for work duties. I decided to take the plunge and remove the OS X partition so that Windows is the only operating system. I did this to give more space to Windows as I only have the 64 GB solid state drive.

Some notes to you network admins out there.  Apple laptops are missing some key things that Windows laptops have.  They don’t have Trusted Platform Module (TPM) chips.  TPM chips play an integral role in many laptop encryption products.  While you can use encryption software without them, they often require USB keys or something to store the encryption key for the drive.  Also, as far as I can tell, Apple computers can’t do a standard PXE boot to use network based imaging.  You can however, boot to a Windows PE CD and bring down an image that way.  While a little cumbersome, it would allow you deploy Windows on an Apple computer using a standard image.

Overall, I really enjoy using my MacBook Air running Windows.  The performance and battery life are great and I can run all of my standard work applications.  Unfortunately, I wouldn’t recommend clients to go out and buy Apple laptops for everyone during their next upgrade.  There’s still too many issues with management and Windows computers should still be the norm.  However, if you have a VIP user that really wants a Mac, it is possible for that user to have a mostly standard Windows experience while running on Apple hardware.

This was a welcome addition that provides an easy way to create a Sysprep’d WIM of an existing machine.  The problem, unfortunately, is if you try to PXE boot and run the “Sysprep and Capture” task sequence it fails at the Execute Sysprep action and returns a series of errors, including  “Unhandled error returned by LTIsysprep: The system cannot find the file specified.”

This happens because the “Sysprep and Capture” task sequence wasn’t designed to be run from Windows PE.  To run this task sequence:

1. Boot the machine into Windows and log in with an account that has access to the deployment share.
2. Connect to the deployment share, i.e. \\NYDEPLOY01\Deploy$, and launch LiteTouch.vbs in the Scripts folder.

This initiates the deployment process just as it would from PE, but now grants the “Sysprep and Capture” task sequence access to the files it needs and allows it to complete successfully.

The requirements to participate in the Microsoft Partner Program have recently evolved to help differentiate technical and business capabilities among participants; Kraft Kennedy has risen to the challenge by quickly exceeding the goals set forth by the program.

Each competency requires specific individuals with deep technical skills, Microsoft verified customer references, and challenging certification exams to be completed.  This commitment demonstrates our breadth, deep specialization, and proven expertise across a range of Microsoft technologies.

About Kraft Kennedy

Kraft Kennedy provides business and technology-related consulting services to the legal community. By combining outstanding technical skills with an intimate knowledge of our clients’ business and information needs we tailor solutions that enhance attorney productivity, effectiveness, and client value.

We focus on the business needs of the client and ensure that technology is used to enhance, not inhibit their business. KK’s talented staff of strategic consultants, project managers, and network consultants have years of experience with hundreds of projects for firms from small to large. Our services portfolio includes advanced infrastructure projects, business continuity and data center consolidation, desktop deployment, network design and implementation, storage design and replication, and messaging systems migration among others. Our Microsoft specialties include: Desktop, Server Platform, Unified Communications, Portals and Collaboration, Search, Systems Management, Virtualization, and Small Business Specialist Community.

In Outlook 2003, 2007, and 2010, reminder windows pop up in Outlook, but they do not steal the focus if you are working in another program.  For example, if you currently working in Word or Internet Explorer, you won’t see a reminder window if one pops up, since you’re not in Outlook.

In previous versions of Windows, this wasn’t as big of a deal because you would still see the reminder window in the task bar.  So even though you didn’t see the actual window, you would see the tab for it flashing on the taskbar.

In Windows 7 however, the default grouping of same-application windows, makes is much harder to see when a reminder window pops up. For example, the image below shows a second Outlook window, which is actually a reminder window.

As a result, Windows 7 users may find that they’re more likely to miss reminders and meetings.

The Solution – An Outlook Addin to Bring Reminders to Focus

Kraft Kennedy has created an Outlook addin which responds to the “reminder” event in Outlook, and uses Windows API functions to locate the reminder window and force it into the foreground.

With this addin installed, users would see the reminder window pop up in front of whatever application they are working in, and it will stay in the foreground until the reminder is dismissed or snoozed.

People who may have missed reminders before should now find that it is no longer an issue.

The image below shows a reminder in the foreground, over an Internet Explorer session.

We’re giving this addin away for free to anyone that is interested, but with no support.  If you’re interested in using it, please contact Michael Worth at  (212) 692-5610 or worth@kraftkennedy.com.

Address Space Layout Randomization (ASLR) is a security feature that randomizes the position of data in memory, making it more difficult for attackers to predict where data can be found while in memory. This feature has been enabled in Windows since Windows Vista, and other operating system such as Linux and MacOS implement this in some form as well.

Since ASLR randomizes information in memory it makes sense that it would be more difficult for TPS to find identical memory pages and thus memory sharing would be reduced. But just how much of a difference does it make? I decided to try and find out. Here are the specs from my test environment:

Server: HP DL385 G1 (AMD Opteron 275)
ESX: 4.0.0 build 244038
Guest OS: Windows Server 2008 R2
Guest RAM: 2.5GB

All guests were cloned from the same template and have the same software installed. On guests TESTSRV1 and TESTSRV3, I left the default settings. On TESTSRV2 and TESTSRV4, I disabled ASLR using the following regkey:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
“MoveImages”=dword:00000000

In all of my testing, including leaving VMs idle and also running memory tests, I found no measurable difference in the amount of memory shared with TPS. I also looked at esxtop to see how much memory was actually being shared and I saw virtually no difference whatsoever between VMs that had ASLR enabled and those that had it disabled.

Host Memory Usage:

esxtop statistics:

The SHRD and SHRDSVD columns represent how much memory is being shared with TPS and the total memory savings. Clearly there is quite a bit of memory sharing going with or without ASLR enabled.

Why would this be the case since it makes sense that TPS would be hurt by ASLR? ASLR requires applications to “opt-in” to have their memory randomized, and I suspect that much of Windows 2008 R2 is not opted in. Perhaps applications will come out in the future that are written to take advantage of ASLR, but at the moment that doesn’t appear to be the case.

Of course this is by no means a definitive test as it wasn’t run with production systems and real users running real applications. That said, I think it shows that ASLR does not dramatically reduce the amount of memory shared with TPS. I did also look at production systems left at the default settings (ASLR enabled) and saw similar memory sharing gains. I’m curious if others have seen similar results in their environments, so drop me a line if you’ve done any similar testing.

More info:

What is ASLR (Wikipedia)
Interpreting esxtop statistics

For years the best practice has been to disable screensavers on virtual machines.  Screensavers take memory and CPU cycles to run and that can hurt consolidation ratios, especially when there is no reason to run a screensaver on a server VM.  After all, why run a screensaver on a server that doesn’t actually connect to a monitor?  Seems obvious and almost unnecessary to bring up in 2009.

While working on a recent VDI project, I noticed unexpectedly high CPU utilization on a seemingly idle virtual desktop.  Turns out that the desktop image we were given had the 3D Flying Objects screensaver enabled.  When it kicked in after the desktop went idle it started taking a fair amount of the CPU.  How much CPU it was using might surprise you.  Take a look:

High CPU utilization when screensaver kicks in

That ended up being around 900MHz of a modern Intel X5460 CPU.  If this was lunch time and 15 people left their VDI session idle, this easily could have caused high CPU utilization across the entire ESX host and hurt performance for everyone.

Most organizations require that a screensaver kick in after a set period of idle time to protect access to the desktop.  A much better alternative is to use the Blank screensaver available in Windows XP/Vista/7 to protect the screen and require a password to unlock.  You get the protection without the unnecessary drain on the CPU.

The landscape has changed though with the release of Windows 7.  There are a few reasons why Kraft Kennedy is advising our customers to deploy Windows 7 now:

• Still 6.x:  Since the build of Windows 7 is actually 6.1 (Vista is 6.0), most applications that were designed to be compatible with Vista will be compatible with Windows 7.   When Microsoft made the jump from 5.1 (XP) to 6.0 (Vista), it took software vendors months to re-write their products to be Vista-compatible.  We’ve seen these compatibility issues become more sparse with Windows 7.
• Better than Vista:  Simply speaking, Windows 7 is the OS that Microsoft wanted Vista to be.  It looks slick, performs well, and has a lot of useful features that firms will likely take advantage of.
• From Beta to Omega: Kraft Kennedy started using Windows 7 with our application set as soon as the first Beta was available.  Nearly all our staff was using Windows 7 fully before the RTM was released on October 22.  In addition, we’ve already developed processes for a completely automated and zero-touch deployment of Windows 7 using Microsoft technologies.

For reasons similar to this, Kraft Kennedy is also advising our Worldox DMS customers to upgrade the latest version, GX2, when implementing the new Windows 7 desktop.   GX2 is already supported on Windows 7, and like Windows 7, is using similar (but much improved) code to its previous version, Worldox GX.   Kraft Kennedy has had betas running in it’s research lab, and now has the final released version running as well.   The new features of GX2 were described in a previous blog post.

This week, Kraft Kennedy will be completing its first 64-bit Windows 7 deployment and Worldox GX2 rollout at a client site.  Initial pilot and lab testing has been successful, and the performance of launching Microsoft Word 2007 on 64-bit Windows 7 is a sight to behold!   Look for myself and other Kraft Kennedy bloggers to report on the success of this deployment in the coming weeks.

It’s time to start implementing the future today.