Preventing items from being added to the MFU list

The old addage of "Prevention is better than cure" I have found to be true with relation to removing items from the Most Frequently Used (MFU) start menu list.

The following powershell script prevents the Windows Tour icon and Migration settings wizard from being added to the MFU list. Of course, this could be used to prevent any other number of items from being added to the MFU list.

<<<>>>

$TaskDesc = "Clear MFU List"
$AddRemoveApps_New = ";TourStart.exe;MigWiz.exe"
$AddRemoveApps = Get-ItemProperty HKLM:\Software\Microsoft\Windows\Currentversion\Explorer\FileAssociation
-name AddRemoveApps
Set-ItemProperty HKLM:\Software\Microsoft\Windows\Currentversion\Explorer\FileAssociation
-name AddRemoveApps -value $AddRemoveApps$AddRemoveApps_New

# Test to see if the Registry action succeeded
If ($?) {
Write-Host "Enabled $($TaskDesc)"
} Else {
Write-Host "Error:$($TaskDesc) $($Error[0])"
}

Frequently used programs not automatically added to the Start menu
http://support.microsoft.com/kb/q282066/

NVIDIA Screen resolution resets

Issue

Each time a user without administrative privileges logs on to a workstation the screen resolution is set to the maximum capable resolution.

Cause

The NVIDIA Display Driver Service (NVSvc) inserts the "NvCplDaemon" run key in the machine startup Run key.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

The key executes the command "RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup",
which is responsible for setting the screen resolution to the highest capable resolution.

Workaround

Disable the NVIDIA Display Driver service and remove the run key.
This may be achieved from the command line with the following commands;

Sc \\[ComputerName] config NVSvc startup= disabled
Reg delete \\[ComputerName]\HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v NvCplDaemon

Mandatory ZTI advertisement does not run

When a workstation is built using OSD, the SMS Package and Program are flagged as being executed on the SMS client. This prevents any future mandatory ZTI advertisements from executing. Thus when an automated Computer refresh is undertaken, the refresh may not run.

This workaround specifically relates to ZTI deployments, however, the principals would apply to an SMS Advertisement that requires re-running without modification of the client Execution History.

Cause:
The SMS Client flags the Package and Program has having been previously executed and checks the following registry location when a request to run the Package is received.

HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Mobile Client\Software Distribution\Execution History\System\[PackageID]\[ExecutionGUID]

If an entry exists for the Package and Program, a message is logged in the ExecMgr.log file, stating that the program cannot be run as it is prevented by policy.

Microsoft reports this as behaviour by design.

Workaround:

Add a second Mandatory Assignment for the actual desired deployment time. This triggers the client to execute the SMS recurring advertisement code and re-runs the advertisement.

To automate a ZTI deployment, I created a new advertisement, added a dummy mandatory assignment time, then a second mandatory assignment for the desired deployment time.

Notes:

With regards to what I have referred to as the ExecutionGUID, I have been unable to find a definitive description of what this part of the registry key entails. So I put forth my description of the entry.

It appears to be a dynamically generated GUID for a unique representation of this execution of the Package/Program on an individual client. This is contrary to Microsoft's description in KB829853 which suggests it is related to the program.

My investigations and testing this showed that the GUID was indeed different for the same Package / Program on different clients.

Checks of the program GUID using the SMS Console "Node Information" tab, with the /sms:nodeinfo=1 switch enabled, showed the Program to have a different GUID to the one listed in the aforementioned registry location.


SMS: Client Does Not Run New Advertisement of the Same Package and Program
http://support.microsoft.com/kb/257271

Advertisements are run again if you upgrade a Systems Management Server 2.0 client to a Systems Management Server 2003 advanced client
http://support.microsoft.com/kb/829853

Understanding the Most Frequently Used (MFU) registry key

Have you ever wondered what the gibberish in the MFU key is? These are the items that get populated dynamically in the start menu when you click on an item.

Analysing the key shows some not so obvious items. They are in fact filepath / filename pairs to the files initiated from the start menu.

For some reason Microsoft felt the need to encrypt the entries, presumably from prying eyes. The question I am unable to answer is why?

Anyway the encryption MS chose is a rather simple key substition named ROT-13. Simply, if the alphabet is number 1-26 with A =1, take a character and add 13 to it. For letters toward the end of the alphabet add up to 26, then start at 1.

With scripting this I used an alternate method that was easier to code, see my reference at the bottom of this post for the decrypt rot-13 script.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{7504
8700-EF1F-11D0-9888-006097DEACF9}\count

HRZR_PGYFRFFVBA REG_BINARY C124430E01000000
HRZR_PGYPHNPbhag:pgbe REG_BINARY
01000000020000000000000000000000
HRZR_EHAPCY REG_BINARY 0100000006000000A04C12589864C801
HRZR_EHAPCY:qrfx.pcy REG_BINARY
0100000006000000A04C12589864C801
HRZR_EHACNGU REG_BINARY 010000001300000020E6A157DE66C801
HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\zzp.rkr REG_BINARY
0100000006000000405D7EF5CC66C801
HRZR_EHACNGU:Q:\frghc.rkr REG_BINARY
010000000600000080794A9ACD66C801
HRZR_EHACVQY REG_BINARY 010000000D00000080DE7657DE66C801
HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\zfugn.rkr REG_BINARY
01000000060000001076BCA0D266C801
HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\gbhefgneg.rkr REG_BINARY
01000000000000000000000000000000
HRZR_EHACNGU:P:\Cebtenz Svyrf\Jvaqbjf Zrqvn Cynlre\jzcynlre.rkr
REG_BINARY 01000000000000000000000000000000
HRZR_EHACNGU:P:\JVAQBJF\rkcybere.rkr REG_BINARY
0100000006000000C0E3DCDDD466C801
HRZR_EHACNGU:P:\Cebtenz Svyrf\Vagrearg Rkcybere\vrkcyber.rkr
REG_BINARY 010000000A00000000B43246DE66C801
HRZR_EHACVQY:::{2559N1S4-21Q7-11Q4-OQNS-00P04S60O9S0} REG_BINARY
010000000800000080EF4239DE66C801
HRZR_EHACVQY:%pfvqy2%\Vagrearg Rkcybere.yax REG_BINARY
010000000600000030A11F46DE66C801
HRZR_EHACVQY:%pfvqy2%\Nqbor Ernqre 8.yax REG_BINARY
010000000600000080DE7657DE66C801
HRZR_EHACNGU:P:\Cebtenz Svyrf\Nqbor\Ernqre 8.0\Ernqre\NpebEq32.rkr
REG_BINARY 010000000600000020E6A157DE66C801
HRZR_EHACNGU:{NP76ON86-7NQ7-1033-7O44-N81000000003} REG_BINARY
010000000600000020E6A157DE66C801


Decrypted

ueme_ctlsession
ueme_ctlcuacount:ctor
ueme_runcpl ert_ovanel
ueme_runcpl:desk.cpl
ueme_runpath
ueme_runpath:c:\windows\system32\mmc.exe
ueme_runpath:d:\setup.exe
ueme_runpidl
ueme_runpath:c:\windows\system32\mshta.exe
ueme_runpath:c:\windows\system32\tourstart.exe
ueme_runpath:c:\program files\windows media player\wmplayer.exe ueme_runpath:c:\windows\explorer.exe
ueme_runpath:c:\program files\internet explorer\iexplore.exe
ueme_runpidl:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
ueme_runpidl:%csidl2%\internet explorer.lnk ueme_runpidl:%csidl2%\adobe reader 8.lnk ueme_runpath:c:\program files\adobe\reader 8.0\reader\acrord32.exe
ueme_runpath:{ac76ba86-7ad7-1033-7b44-a81000000003}

Decrypt / Encrypt string using ROT-13 Encryption
http://cmb-it.blogspot.com/2008/05/decrypt-encrypt-string-in-rot-13.html

ZTITattoo.wsf - OSD clears TaskSequence registry entries

During OSD of a custom image the ZTITatoo.wsf script clears the TaskSequenceVersion, TaskSequenceName and TaskSequenceID fields.

Line 131 of ZTITatoo.wsf refers to a registry write action for when an LTI deployment is running.
Line 140 performs the corresponding update for OSD only if a OSD deployment is running.

The contents of TaskSequence* registry fields are pertinent to an OSD deployment as they provide information as to which WIM and Deployment task sequence are utilised.

I would contend that the ZTITatoo.wsf script would be better served having a conditional execution around the update of the LTI TaskSequence* fields.

Something like the following (Line 127);

'//----------------------------------------------------------------------------
'// If this is Lite Touch, populate the task sequence details
'//----------------------------------------------------------------------------
If oEnvironment.Item("OSDPACKAGEID") = "" then
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\BDD 2007\Task Sequence ID", oEnvironment.Item("TaskSequenceID"), "REG_SZ"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\BDD 2007\Task Sequence Name", oEnvironment.Item("TaskSequenceName"), "REG_SZ"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\BDD 2007\Task Sequence Version", oEnvironment.Item("TaskSequenceVersion"), "REG_SZ"
End If

Need to move the Microsoft Deployment Distribution (BDD) file location?

Recently, I needed to move the contents of the LAB deployment point in Microsoft Deployment Toolkit (MDT) to a different location on the filesystem.

As it turns out, this was quite simple.

Edit the Deploy.xml located in the MDT installation directory, by default this is located in %PROGRAMFILES%\Microsoft Deployment Toolkit\Control.

Just find the node in the Deploy.xml file and replace the old path with the new one. Once complete, modify the "Distribution_Dir" registry value to reflect the new path;

HKLM\Software\Microsoft\Deployment 4\
Value: Distribution_Dir
Type: REG_SZ
Data: [NewDistributionDirectoryPath]

Set Location in "Regional and Language Options" control panel applet

Having done my share of unattended XP builds for various, invariably one of the items that I am asked is how to change the Country under the Location Tab found in the "Regional and Language options" Control Panel applet.

Originally, this took some finding as it is doesn't appear to be a supported entry for sysprep.inf or unattend.txt.

HKU\.Default\Control Panel\International\Geo
OR
HKCU\Control Panel\International\Geo
Value: Nation
Type: REG_SZ
Data: "12"

(0xC) 12 is the code for Australia.

Tip: To set this in an unattended build, set the HKU\.Default\Control Panel\International\GEO value, as SysPrep does not apply this setting to all users when the HKCU setting is configured.

A complete list of nation codes can be found at
http://msdn2.microsoft.com/en-us/library/ms776390(VS.85).aspx
GetGeoInfo
http://msdn2.microsoft.com/en-us/library/ms776300(VS.85).aspx

Dial up connections do not use LAN proxy settings

The default behaviour changed with Internet Explorer 5 and later, in that each connection has unique proxy settings.

Resolution:
A hotfix is available from Microsoft, see the KB reference. After installing the hotfix, the following registry key can be added per user or per machine.

HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings
OR
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
DialupUseLanSettings REG_DWORD [01]

http://support.microsoft.com/?kbid=818060

Hiding or Displaying Default Desktop icons

The default desktop icons can be hidden or displayed using the registry or Group policy. However, before they can be managed using Group Policy the icons must have the following registry keys present.

{20D04FE0-3AEA-1069-A2D8-08002B30309D} - My Computer
{450D8FBA-AD25-11D0-98A8-0800361B1103} - My Documents
{208D2C60-3AEA-1069-A2D7-08002B30309D} - My Network Places
{871C5380-42A0-1069-A2EA-08002B30309D} - Internet Explorer
{645FF040-5081-101B-9F08-00AA002F954E} - Recycle Bin

A DWORD value of 0 displays the icon, 1 hides the icon.
Setting this value in HKCU takes precedence over HKLM.

To hide the icons from the Start Menu add the Key and value to - \Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu To hide the icons from the Desktop add the Key and value to - \Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

Cached logons are available by default on a domain member system (workstation or server).

The password for a cached logon doesn't expire, it is only when the offline computer is connected back to the domain that domain synchronisation occurs and expires the user object password. I have seen some newsgroup posts supporting this statement but no "official" microsoft documentation.

To disable cached logons set the

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: CachedLogonsCount
Type: REG_SZ
Data: 0

Note: Before disabling cached logons on Servers ensure you checkout this article, given that this would be an unlikely scenario given the size of site requiring a cluster...

The main scenario where this might occur in is the availability of the Private Cluster LAN, yet the Public LAN is broken in some manner.Still a good insight to other potential issues with disabling cached logons.

Cluster nodes may fail when the CachedLogonsCount value in the registry is set to zero
http://support.microsoft.com/kb/827885

Default values for Domain Controllers Pre-2008 is 10 cached logons, with this figure being bumped to 25 for "Longhorn" server.

Cached domain logon information
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q172931
The default value of the cachedlogonscount registry entry has changed from 10 to 25 in Windows Longhorn Server
http://support.microsoft.com/kb/911605