Chapter 5 Managing Applications

Transcription

1 Chapter 5 Managing Applications Lesson 1: Application Compatibility The Program Compatibility Troubleshooter : A tool that automatically attempts to configure application compatibility settings. Works only with executable files. Built-in Compatibility Modes and Options. Replicates the environment of previous operating systems. Right click application, choose properties, compatibility. Modes available : p The Application Compatibility Toolkit (ACT) (downloadable from microsoft.com) is a collection of tools that allows you to resolve application issues. You can use ACT to determine whether existing applications are compatible with Win 7 before deploying. The ACT contains the following components : - Application Compatibility Manager - Compatibility Administrator - IE Compatibility Test Tool - Setup analysis Tool - Standard User Analyzer Application Compatibility Manager : MS SQL Server which contains collected compatibility telemetry. You can use the Application Compatibility Manager to create and deploy data-collection packages. Data collection packages gather data about hardware, software and device information for a group of specified client computers. System-log.com MCTS Training 1

2 Compatibility Administrator Allows you to resolve a large number of application compatibility issues that might occur when you attempt to deploy an existing application on Windows 7. Provides a collection of compatibility fixes and compatibility modes that can resolve problems with existing software. If no solution exist, you can create your own. A compatibility fix, also known as a shim is a piece of software that intercepts application programming interface (API) calls from applications, modifying them so that Win 7 provides a similar response as a previous version of Windows did. A compatibility mode is a group of compatibility fixes. Internet Explorer Compatibility Test Tool allows you to test existing web sites to determine if they have compatibility problems that adversely influence how they will display on IE 8. To use IE Compatibility Test Tool, open the tool from the developer and tester tools menu from the MS Application Compatibility Toolkit folder in the Start Menu, click Enable and then open IE. Visit the sites you want to test and a log is written with potential compatibility issues. System-log.com MCTS Training 2

3 Setup Analysis Tool monitors the actions taken by application installers and can detect the following compatibility issues : - Installation of kernel mode drivers - Installation of 16-bit components - Installation of graphical Identification and Authentication dynamic-link libraries (DLLs) - Modifications of files or registry keys that are guarded by Windows Resource Protection (WRP). To use open the Setup Analysis Tool and type in the location of the setup file. Standard User Analyzer tests applications to determine if they have compatibility issues caused by User Account Control. To use start the tool, specify the target application, and then click launch. The application attempts to start, and the Standard User Analyzer profiles how it interacts with the Windows 7 environment. Application Compatibility Diagnostics Policies There are six application compatibility related group policies that influence how Windows 7 responds when it encounters an application compatibility problem. System-log.com MCTS Training 3

4 Windows XP Mode for Windows 7 Windows XP Mode works in two ways both as a virtual operating system and as a way to open programs within Windows 7. Windows XP Mode runs in a separate window on the Windows 7 desktop, much like a program, except it's a fully functional version of Windows XP. In Windows XP Mode, you can access your physical computer's CD/DVD drive, install programs, save files, and perform other tasks as if you were using a computer running Windows XP. When you install a program in Windows XP Mode, the program appears in both the Windows XP Mode list of programs and in the Windows 7 list of programs, so you can open the program directly from Windows 7. Windows XP Mode provides an x86 version of Windows XP Professional SP3. Windows Virtual PC does NOT support x64 virtual clients, which means that you cannot use Windows XP Mode or Virtual PC as a compatibility solution for x64 applications. Installing and using Windows XP Mode To use Windows XP Mode, you need to download and install Windows XP Mode, which is a fully licensed version of Windows XP with Service Pack 3. You also need to download and install Windows Virtual PC, which is the program that runs virtual operating systems on your computer. When you install a program in Windows XP Mode, the program becomes available for use in both Windows XP Mode and Windows 7. Exercises p [LESSON Page ] System-log.com MCTS Training 4

5 Lesson 2: Managing AppLocker and Software Restriction Policies. Software Restriction Policies managed trough Group Policy (Computer Configuration\Windows Settings\Security Settings\Software Restriction Policies node of a group policy). When using Software Restriction Policies you use the unrestricted setting to allow an application to execute, and the restricted disallow setting to block an application from executing. AppLocker vs. Software Restriction Policies The advantage of Software Restriction Policies over AppLocker policies is that SRP can apply to computers running WinXP, Vista as well as to computers running Win 7 editions that do not support AppLocker. The disadvantage is of SRP is that all rulkes must be created manually because there are no builtin wizards to simplify the process of rule creation. SRP is applied in a particular order (1 is applied first and is most specific) : 1. Hash rules 2. Certificate rules 3. Path rules 4. Zone rules 5. Default rules System-log.com MCTS Training 5

6 Security Levels and Default Rules : - Disallowed When this rule is set, users are unable to execute an application if the application is not allowed by an existing Software Restriction Policy - Basic User Users are able to execute applications as long as those applications do not require administrative access rights. - Unrestricted When this rule is set, users is able to execute an application unless Software Restriction Policy blocks that application. Enforcement You can use the Enforcement Properties Policy to specify whether SRP to all software files except libraries, such as DLLs or all software files including DLL s. Microsoft recommends that you do not include DLL s because of an increase of work for an administrator. System-log.com MCTS Training 6

7 Designated File Types Policy allows you to determine which file extensions should be recognized as executable files and hence fall under the influence of SRP. Path Rules allow you to specify a file, folder or registry key as the target of a Software Restriction Policy. The more specific a path rule is, the higher its precedence. The drawback of path rules is that they rely on files and folders remaining in place (hacker-tool.exe can be moved from one place to another, and therefore not be blocked. System-log.com MCTS Training 7

8 Hash Rules works through the generation of a digital fingerprint that identifies a file based on its binary characteristics. The drawback of hash rules is that you need to create them on a per-file basis. Is the file updated or changed, a new rule has to be made. Certificate Rules use a code-signed software publisher s certificate to identify applications signed by that publisher. Will affect all applications from one publisher. Will impose a performance burden on the computer, since it will check the certificate each time the application is executed. Network Zone Rule apply to.msi files obtained using internet explorer only. Zone rules function by differentiating installer packages based on the site from which they were downloaded. Possible locations include internet, intranet, restricted sites, trusted sites and my computer. AppLocker Application Control Policies : Exercises p [LESSON Page ] System-log.com MCTS Training 8