This article is part of my small series about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. AppLocker Security There is no perfect security, every product has its vulnerabilities and AppLocker is no exception. These are the problems I am aware of.

Due to a lack of visibility permission cleanup is performed far less frequently than it could, and probably should. As a result, ghost ACEs (permissions from deleted accounts) linger in the dark corners of the file system, threatening the unsuspecting admin with the horrors of unresolvable SIDs.

This is the first in a small series of articles about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. Requirements AppLocker works on:

When you are planning a migration of user accounts between domains one task always pops up pretty quickly: reassigning the permissions of the users in the source domain to the corresponding users in the target domain, in other words reACLing the file server.

Windows 7 comes with several features that promise to greatly improve file access over a WAN. One of them is version 2 of the SMB protocol, another transparent caching. This article describes how I measured their effectiveness.

FantecA drive enclosure for 4 SATA drives, connected to the host via USB 3.0 and presented as JOBDs is a great and inexpensive method of adding a lot of hard drive capacity to your computer, e.g. for backup purposes. The enclosure model I have bought is the Fantec QB-35US3. It is compact, the fan not too loud and vibrations from the four drives are kept amazingly low. It can be connected via USB 3.0 and eSATA, but USB is simpler because eSATA requires a port with a multiplier-capable chipset, which is rare. At a retail price of around € 150 the Fantec is relatively inexpensive.

[Update on 29/06/2012: added tests 5 and 6 with RAID controller cache and Atlantis Ilio] When a 400 GB SSD comes nearly at the price of a small car, you expect a lot, performance-wise. At least I did when I got my hands on two drives from HP’s enterprise performance series. Read on to find out if that hefty price tag is justified.

I had a very interesting case recently where copied EXE files could not be deleted. They would simply remain in the folder like zombies, only to disappear a few minutes later.

Configuring an HP Elitebook with integrated HS2340 mobile broadband module to use the 3G connection can be a little tricky. Here is how it works - without third-party dialer software!

As you may know helgeklein.com also hosts a forum where I help people who have questions related to my software. The forum is configured to send out e-mails when new posts are added or when newly registered users need to confirm their e-mail addresses. Since I use Google Apps for helgeklein.com I configured Google’s SMTP server for outgoing e-mails. All worked well until recently when I started to wonder why I had not received new forum post e-mails for several days.

The HotPlug functionality of VMware ESX(i) 4 and 5 has the negative side effect that it is easily possible to “eject” hardware devices from inside the virtual machine, completely removing the respective device from the VM configuration. This is especially bad if it happens to the network card, and others have already described how to prevent that from happening (e.g. here and here).

If you want to disable the BitLocker service via Group Policy Preferences, you will find that you cannot. The service’s startup mode stays at “manual” and the following event is logged to the application event log:

In this article I explain how to create a template for Microsoft User Experience Virtualization. For details on how UE-V works please see my earlier article Microsoft User Experience Virtualization (UE-V): Facts and Review. As a sample application I used my permission management tool SetACL Studio.

16 years after roaming profiles made their debut in Windows NT 4.0 Microsoft takes another stab at synchronizing user settings across devices - a very different one. As we will see, UE-V is radically different from roaming profiles, but so similar to some other user environment management products that it seems like a best-practices implementation.

Windows Offline Files have a bad reputation. Many an administrator can tell a story where Offline Files caused issues that sometimes even required a reinstallation of the affected PC. But Microsoft has gradually improved the functionality and ironed out many of the bugs. Today - in Windows 7 SP1 with all post-SP1 fixes - Offline Files is a technology that still has its problems, but can be used in production - if you are adventurous. This article lists the gotchas I am aware of.

When I first read about Storage Spaces in the Windows 8 blog, I was enthusiastic. Finally a replacement for the drive extender technology Microsoft let die so cruelly. Having used Storage Spaces for several weeks now, I am not so sure any more.

Having a server at home is a great luxury, but having a computer running 24x7 is an extreme waste of energy. Turning it on and off manually is not very appealing, either. Luckily we have to do neither. Windows can easily be configured to put the computer into sleep mode (where modern PCs consume approx. 1 Watt) and have it wake up upon access.

Shadow keys have been around forever, since way before Terminal Services were renamed to Remote Desktop Services (does anybody use that name?). It seemed they would stay in the OS forever, too. Yet, when installing applications on Server 2008 R2 many people notice that the shadow key area does not get populated. Let us find out why that is the case and if shadow keys still work in Server 2008 R2.

Did I mention I love the new Task Manager in Windows 8? It is brilliantly designed, conveying tons of meaningful information while looking very good. This article is not about Task Manager, though, but about Windows 8 - its Storage Spaces functionality, to be exact. But I will be using Task Manager to analyze the performance of Storage Spaces. And with that, we are back where we started.

I have wanted an energy-efficient multi-terabyte home file server for a long time, but until recently such a system was too expensive for my taste, in terms of both energy consumption and purchase price. But now with affordable 3 TB drives and low power Sandy Bridge CPUs the time has come to build the system I have yearned for so long.

The good news first: You can get a Verisign Authenticode code signing certificate for $99. Just check out https://sysdev.microsoft.com/ for details. This price even applies to the renewal when the original certificate expires after a year.

As in previous years I will be speaking at several conferences this year. February WINone May Citrix Synergy

Are you still using Active Setup to distribute per-user files or registry values? If so, stop! There are better ways to manage initial user settings. This article assumes basic knowledge of Active Setup. You might want to refresh your memory by reading my article Active Setup Explained.

In preparation for next week’s MVP summit I wanted to fill my iPad with movies for in-flight entertainment when I noticed that a large part of my iPad’s storage capacity was taken up by stuff from some unexplained “other” category. Here is my account of what I did to get rid of it and reclaim the lost gigabytes.