Remote Assistance, VNC, and UAC Prompts

Intro
Many of us as tech professionals are quite busy and reducing time doing unnecessary tasks is necessary so we can still complete the ever growing tasks being asked of us. One of the ways to do this is remove travel whenever it is possible. When someone has a problem and you need to resolve it then often we run down to do it ourselves.

Luckily Microsoft has us covered by including remote assistance and for some the preference or need means VNC. Both of these programs allow us to complete tasks remotely without leaving our desk. Many of us also follow LUA, aka Least-Privileged  User Account, meaning most of our users run as limited users. Because of this when you connect to a computer using the two previous methods you would have to use various "Run As" methods to remotely change some settings or install software.

With Windows XP this wasn't a problem, as long as you knew the various ways run as methods to get into various control panels, software installs, and other tasks that you might be called upon to complete.

Problem
With the advance of Windows Vista and 7 came UAC and "secure desktop." These things were great but when you wanted to use Remote Assitance or VNC then anytime something deemed that administrative rights were required you would get a blank screen with a Pause symbol on Remote Assistance and with VNC I believe it turned everything a pink color and in both cases you lost control. The user than would be displayed a prompt to put in credentials.(In Group Policy it may not be set to display credentials so your behavior may be slightly different.

This effectively reduced the functionality these tools brought us quite heavily to the point that trips were sometimes made instead. The reason this was happening is that UAC was set to display only on "Secure Desktop." For a good article on this behavior you can read a Microsoft Article here.

Solution
Security settings can be changed on the computer to fix this issue. Remember though you are loosening some the settings so read up on the changes and determine if you are fine taking the associated risk. If you are using Group Policy this makes life a lot easier. If not you can change these locally on the computer by going into "Local Security Settings" and deploy this using various methods.

Under Group Policy\Domain then you will take the following path:
Computer Configuration>Policies>Windows Settings>Security Settings> Local Policies>Security Options

Under Local Security Policy:
Local Policies>Security Options

Remote Assistance
If you are using Remote assistance then you will need to change the following settings to Enabled:
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop

This will allow Remote Assistance to disable "secure desktop" for UAC so you can also see the prompts allowing for you to do what is needed. For information on this setting click here.

VNC (Other Viewers such as TeamViewer should fall under this settings)
Now if you installed VNC as a service than the later version may work by just changed the above settings. If they are installed as an application, or if just changing the above setting didn't work then you need to Disable the following setting:
User Account Control: Switch to the secure desktop when prompting for elevation

This will disable "Secure Desktop" for all prompts. I recommend again reading the first link mentioned in this article so you can determine for yourself if you are OK with the potential security risks. For more information about this setting you can also read this article here.

Taking the above step might also require a reboot. After the appropriate setting is changed though you should now be able to use your favorite tool to complete and RunAs remotely.

Windows Update Failing with Error 80243004

The Problem

I have 8 computers that due to the software they have on them I must some and update them manually once a month. Upon doing this I had three that failed with the error to the right. The Screen sat with the status "Preparing to Install" for quite a long time then all of them failed with the error 80243004.

I had one of the computers "Try again" with no avail it just failed again. After doing that I ran around the Internet searching for a solution. I found the following thread on Technet and in it my solution here.

The Solution

The solution is strange. It has to do with the notification area of the taskbar. See by default the notification area in Windows 7 and Server 2008 hide most of the notification icons in an area found by clicking on the skyward pointing white arrow shown to the right. Well if you look at this area after this error you will see the notification area is huge with tons of blank spaces. If you are seeing this then the solution to your update problem follows below.

Right-click on some blank space on the taskbar and select "Properties" about half-way down the screen you will see a button that says "Customize...", click it. On the next screen you will see the option displayed in the picture below: "Always show all icons and notifications on the taskbar", place a check by it and click "OK" to close out that window and do it again for the notification properties window as well.

 It will then display all of the notifications now in the taskbar as you see in the picture below. Go ahead and have Windows Update "Try Again" now. It should complete successfully. After that you can revert your notification area back by going back and unchecking the setting you see in the picture above.

Conclusion

You should now be good to go. After checking the Windows Update Log located at C:\Windows\WindowsUpdate.lob I found the following error lines:

Can not perform non-interactive scan if AU is interactive-only
AU setting pending client directive to 'Install Complete Ux'
WARNING: Pending directive, 'Install Complete Ux', is not applicable
Successfully wrote event for AU health state:0

Now I was installing these updates under a standard user account and I know from UAC group policy a standard user is also referred to as "interactive-only" in some policies. I don't know if it was trying to display something to me and choked, hopefully Microsoft finds out. Either way thanks to all in that thread who discovered this wierd fix.

UPDATE:

I found that changing this setting while Windows Update is displaying "Preparing to Install" seems to actually kick start it so if the above solution doesn't work for you try checking or unchecking that setting and mousing over the notification area while windows update is displaying "Preparing to Install." 

Word could not create the work file. Check the temp environment variable.

A friend of me contacted me and let me know that he was constantly getting an error while opening word, which said "Word could not create the work file. Check the temp environment variable." But clicking through it allowed you to get into word. This happened every time no matter if he was opening a saved document or just starting word with the normal blank new document. Also he lost his favorites, and his history.

The Word error is right. One of the variables is wrong. You need to browse too the registry to the following key: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" Look for any keys that may be pointing to a set location IE: "K:\Todd\Favorites" All entries should use the %USERPROFILE% Variable.

When you find the offending registry keys than you can look around at surrounding ones and most likely correct it. If not then ask in the comments or your friendly tech guy. After fixing these variables you may need to log out and back in. The picture below is for Windows 7 yours may appear differently if working under a different version. Keep that in mind.
Interestingly enough though the locations pointed to a backup external Hard drive. It was pointing to a folder created by the manufacturer backup software. I wonder why this was caused. Anyways it's been a couple of days and no further problems so it didn't revert back.

Windows Update Error 80073712 and fixing the problem

So I have a library that I support. Public Kiosk computers are way too much fun to support. While I was down fixing a problem I decided to update all the computers. After running through updates, half of my computers wouldn’t install the updates. I tried a reboot and still it wouldn’t work. I was getting an Error 80073712 and the updates would fail to install.

So I started searching around. I won’t bore you will all the fixes I tried that didn’t work. Below are the steps I took to resolve the issue.

I downloaded the latest Windows system Update Readiness Tool. You can download it from here: http://windows.microsoft.com/en-gb/windows7/What-is-the-System-Update-Readiness-Tool

After you download it run it. It will take a while but when it’s done it creates two log file. They are located here: “%SYSTEMDRIVE%\Windows\Logs\CBS\” and called checksur.log (This is only results for this run of the tool) and checksur.persist.log(results from the last couple of runs maybe all of them).

In the log it mentioned missing manifests and said where they should be. I checked there location and sure enough they weren’t there. It said it was missing 296. I ran the tool on the other computers having a problem and one had four missing manifests. Four is a lot easier to work with than 296 so I started with this computer. I then went to one of the computers that was working fine. Found the missing manifests and copied them to a thumb drive. They were located in the folder “C:\Windows\winsxs\Manifests.“

I then went to the other computer and tried to copy them in that same folder. Access denied. I was administrator so tried it again and still a problem. I didn’t want to bork anything so I searched the net and ran across this document which will help you fix other windows update servicing problems as well: http://technet.microsoft.com/en-us/library/ee619779(WS.10).aspx

It notates that for missing manifests that you want to copy onto a non-working machine you place them in “C:\windows\Temp\CheckSUR\winsxs\Mainfests” and re-run the System Update Readiness tool. It then will run through the same process and in my case fixed the problem. Make sure that the found errors and the fixed  errors match. If so it fixed all the problems.

You need to reboot the computer then rerun windows update install the updates that it finds. It should then work. Now on one of the 4 computers I had one other problem to resolve but the majority of them worked without a problem. (also one of mine sat at configuring Windows Update 100% for a while, just be patient, or try press Ctrl + Alt + Del)

When you are only missing like 4 files it is ok to search manually and grab the right files, but in my case I had 2 computers missing 296 files. I was not going to do that manually. So I created a script to take the list of missing files and grab them from a working computer. You can download it here. To get the list of files, just copy out the list of files needed from the CheckSur.log and paste them into
notepad. The list starts after “Unavailable repair files:”

You need to get rid of the space before all the files and instead of doing it tediously one by one here is what I did. Copy the text from notepad into excel. It will remove the blank space(a tab) for us by splitting the blank space from the actual filenames into two columns. Copy the Second
column and paste it back into the text file and save it.

Use the script I have uploaded and change the parts to the
folder locations. The Blue change to where you and what you list of missing
manifests is called. The red section change to the folder you want it to copy
the missing manifests. Run it and it should copy all the manifests that are
listed in your file. This prevents you from doing some time consuming
searching as well as most likely making mistakes.

After its done open the folder and Select all check the count. Make sure it matches your count from the error log. If not the computer you are using doesn’t have all the files. Also the link above from Microsoft warns that they Ensure that the computer being used to copy files from is using the same version of Windows and system architecture. To check this then go the link and it shows you how.

You will then follow the steps you I did above. Browse to C:\windows\Temp(It will give you an prompt asking for permission click “Continue.” Continue to CheckSUR\winsxs\Mainfests and copy all the
manifests from your removable media into the folder. Re-run the System Update
Redines tool. After it completes, reboot and you then rerun windows update. Tell ith
to install the updates it finds.

This was a very unfun problem and I am unsure of what caused it. All the computers are the same and have the same software so why some and not others had the problem is odd. Also remember if you computer is missing files other than manifests than you will need to read the microsoft article and copy the files you find into a different location. Good Luc

Using Sysinternals Desktops to assist in removing a virus

Sysinternals Desktops

I was asked to look at a computer that was acting funny by a friend; they thought that it had a virus. After working on the computer for a little while I didn’t notice anything that really popped out. But I went to install Microsoft Security Essentials and it would never complete. It wouldn’t lock up the computer and the scroll bar kept rotating. I also noticed that shutting down and starting up was taking longer than it should.

After realizing something was up I opened task manger and didn’t notice anything odd. Winlogon was being more active than it should be though; something I only noticed because I was trying to see what would maybe be conflicting with the MSE install.

So I decided to start diagnosing and pulled over the Sysinternals suite to look around. Weirdly though anytime I started to try and open Process Monitor, Process Explorer or Rootkit Revelear they would open for about a second than close again.

I was confident at this time that their existed a virus on the computer. For testing I named a text document “Process Explorer” and opened it. It also was force closed shortly after that. I knew this was a pretty sure sign that I had something to wrestle with. Also I noticed a weird rar.exe file sitting hidden on my jump drive I used to move files over. I would delete it and it would return while being plugged into the computer. So I had a pretty good guess that the program would propagate itself using jump drives. I was after a reboot able to get MSE to install but left it alone so I could figure out the virus.

So I set out to find out a way to start process monitor or Process Explorer, since I knew if the virus didn’t want me opening these tools, then I would be able to use them to find my solution. So in trying to figure out how to trick the program I tried renaming the programs which still didn’t work. After a little bit I saw the Sysinternals desktops application in their suite and wondered how it went about creating multiple desktops on the background. I thought maybe (or had a small hope) that maybe the virus wasn’t smart enough to notice apps running inside a different desktops. After running desktops and opening a second desktop I was able to open, in that second desktop, process monitor and process explorer.

I restarted the computer wanting to ensure that it was desktops and not something I had done earlier allowing me this. After windows loaded I had the same problem of not being able to run Process Monitor and Process Explorer. I Fired up Desktops again and in the second desktop again I was able to get them running fine. Desktops will forever be in my antivirus removal box because of this.

I didn’t notice anything funny in process explorer and everything listed as Microsoft signed. The machine was actually very clean for a home user. So I ran Process Monitor for a minute and stopped it looking for any peculiar behavior. After looking through I noticed what I noticed earlier, winlogon was showing up way more than normal. After filtering to include only winlogon I noticed that about a little under every second it would check a key here:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acdcacaeaacbafbeaa



Process Monitor of Winlogon Activty - Part 1





Process Monitor of Winlogon Activty - Part 2

And then all the subkeys. The funny random name of the key was a bad sign. I popped up regedit and saw the it also had a dll with the same random key name, as it’s, file name located in the system32 folder of windows. I was pretty confident this was my problem. I exported the key just for sure and then deleted it. Right away the key was back.

I also noticed it would look at Pending File Rename Operations and then also a value called Blud under the Winlogon key. With all this info I then, went back to installing MSE and after it installed and manually installed the latest defenitions which I had downloaded earlier. I right-clicked the DLL acdcacaeaacbafbeaa.dll in the System32 folder and told MSE to scan it. It then said that it had found WORM:Win32/Swimnag.gen!A.dll I did a search and came up with this link from google. http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Worm%3aWin32%2fSwimnag.gen%21A

I checked the dll was gone, good job MSE on keeping it gone. I was then able to go into the registry and delete the blub key located at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\

I also noticed the associated key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acdcacaeaacbafbeaa" was no longer there. After reviewing the scan history on the computer I pulled up the log and noticed MSE had removed it too.

After watching taskmgr.exe and running a Process Monitor session I could see that winlogon was back to normal. I restarted the computer one more time to see if this time it would boot normally. It did. Also the computer stopped placing the hidden Autorun.inf and rar.exe on the jump drive. The computer was overall a lot more responsive. At this point I did a full scan with MSE and discovered no further problems.

CONCLUSION – I have tried to see if anyone else has used desktops to prevent a virus from closing applications and posted the story online but haven’t seen it. I don’t think this was an intended use of desktops but very interesting none the less. I would love to hear if this works for other viruses.

NOTE - Microsoft's stance is normally that after your system has been compromised you should reinstall the computer. I didn't do it here because I was feeling challenged at the time, and didn't have the disks for this persons computer. Normally I do reinstall since.

UPDATE - Shared this with Mark Russinovich and based on what I said the program was checking the Window titles, using window enumeration and that it only works for the current desktop. That is why I was able to use Sysinterlas Desktops to create another desktop to open Process Monitor and Process Explorer.

Legally Re-Imaging/Cloning computers with Windows

So I was at a Technet UserGroup meeting and heard something that was important for people. After chatting with a Microsoft License Specialist it became clearer.

So legally you cannot re-image computers with an OEM license. To do this the lowest requirement you must meet is this:

• One Volume License for the Desktop Windows Product that matches what you have. So if you purchased computers with Windows 7 Professional, than you will need a Volume License for Windows 7 Professional.
• Volume License Media for that product

You will then base your image off of this software and after imaging using the OEM key that is on the computer. The cool part is you may have 4000 computers with OEM licenses of Windows 7 pro, but you only need to add the 1 VL and the VL Media and your legal. Why Microsoft does this I am not going to go into but you have the basic info and below a little more nifty VL information

When you purchase a Volume license of a Windows Desktop Os you are actually purchasing a upgrade license. This is different than all of their other products, where usually you are buying a full license. So since they are an upgrade licenses you must have an existing Windows OS on the computer or for the computer (Full Retail Product) to apply this VL to. So you can't buy a computer without an OS and think you can buy a Volume License.

I mention this blog posting because this was news to me. Apparently in the EUA it states you can't re-image using just the OEM Media and I know we all read the EUA :) and know this, errr not. Anyways I hope this helps you feel legal.

You can grab the file Microsoft refers to re-imaging here: Microsoft Reimaging download . As you look at this I recommend giving their license people a call.

.5 Credit's = Windows 7 for $30.00

So Microsoft has a deal for students that are enrolled in at least .5 Credit's of College. It's great they are making this affordable for students to purchase and now days most people are at some point in college.

Go to http://www.win741.com/. Click on the Buy link which is the first picture in the second row. It will take you to a page filled with more details regarding purchasing Windows 7. This deal ends January 3, 2010 at 12:00 am CST. So you have a little bit of time to scrape together the money to purchase it.

Now this is for Windows 7 Home Premium or Windows 7 Professional. You can only purchase one copy per student. You can Also get the 32bit version or 64bit version. I recommend going 64bit.

You will need an .edu email address or you can upload a digitial scan of one of the following items:

• Student ID card
• Class list
• Proof of course payment.

Also make sure you are currently enrolled in at least .5 credit's woth of classes. They can ask for proof. Anyways run and take advantage of this awesome price. Shoot me an email or comment and I will answer any questions you have. I have been running Win 7 since last August. Worth the money to me.