Vista Tips

By
The Technocrats
Windows XP Recovery Console Equivalents in Windows Vista
The Recovery Console has been deprecated in Windows Vista, so what happened to all those wonderful commands that were
available in recovery console? Well, we were kind of hoping that you wouldn’t need them anymore. But if you do, you’ll be glad to
know that most of them are available via the command line in the Windows Recovery Environment (WinRE). The recovery console
commands listed in the following table are different or unavailable in WinRE.
Recovery Console Command: BootCfg
WinRE Equivalent: BootRec /ScanOS; BootRec /RebuildBcd; bcdedit
Recovery Console Command: FixBoot
WinRE Equivalent: BootRec /FixBoot
Recovery Console Command: FixMBR
WinRE Equivalent: BootRec /FixMbr
Recovery Console Command: Map
WinRE Equivalent: DiskPart
Recovery Console Command: Logon
WinRE Equivalent: Not needed
Recovery Console Command: LISTSVC; ENABLE; DISABLE; SYSTEMROOT
WinRE Equivalent: Not available
All the remaining commands have the same name in WinRE. You can work around the unavailable services-related commands
(listsvc, enable, and disable) by using regedit to manually load the registry hive.

Enhance Windows Search with the Free Microsoft Filter Pack

The Windows Search service can be enhanced by installing the Microsoft Filter Pack, which provides additional IFilters to support
critical search scenarios across multiple Microsoft Search products. The Filter Pack includes the following IFilters:

Metro (.docx, .docm, .pptx, .pptm, .xlsx, .xlsm, .xlsb)

Visio (.vdx, .vsd, .vss, .vst, .vdx, .vsx, .vtx)
OneNote (.one)
Zip (.zip)

These IFilters are designed to provide enhanced search functionality for the following products: SPS2003, MOSS2007, Search
Server 2008, Search Server 2008 Express, WSSv3, Exchange 2007, SQL 2005, SQL 2008, and Windows Desktop Search 3.01.
When you install the Filter Pack (which you can download for free), the IFilters in the preceding list are installed and registered with
the Windows Search service. The Filter Pack is available for x86 and x64 versions of Windows Vista, Windows Server 2008,
Windows XP, and Windows Server 2003.

Use MoveFile and PendMoves to Move or Delete a File That

is Always in Use
Files can’t be moved when they’re in use by the operating system or an application. If a file is constantly in use, you can schedule
Windows Vista to move the file during startup using the MoveFile tool, which you can download for free.
Use MoveFile exactly like you would use the Move command. For example:
movefile file.txt test\file.txt

Movefile v1.0 - copies over an in-use file at boot time

Move successfully scheduled.
The file will not be moved immediately. However, the next time the computer is restarted, Windows will move the file. If you want
to delete a file that is constantly in use (a common requirement for removing malicious software), provide "" as the destination. For
example:
movefile file2.txt ""

Movefile v1.0 - copies over an in-use file at boot time

Move successfully scheduled.
The same download that includes MoveFile includes the PendMoves command, which displays moves and deletions that have been
scheduled. You can simply run the command without parameters, as the following example demonstrates:
pendmoves

PendMove v1.1
Copyright (C) 2004 Mark Russinovich
Sysinternals - wwww.sysinternals.com
Source: C:\Users\User1\Documents\file.txt
Target: C:\Users\User1\Documents\dest\file.txt
Source: C:\Users\User1\Documents\file2.txt
Target: DELETE
Time of last update to pending moves key: 2/27/2008 10:08 AM

Use the Netsh Command to Manage the Windows Vista

Firewall
If you need to make firewall settings repeatedly—on a single computer as conditions change or, perhaps, on a fleet of computers—
you’ll find working with Windows Firewall (the Control Panel application) or Windows Firewall With Advanced Security to be a bit
cumbersome. The Netsh command, using its Firewall or Advfirewall context, provides an alternative way to view or modify all
manner of Windows Firewall settings. For example, you can enable Windows Firewall with this command:
netsh firewall set opmode enable
The Netsh Firewall context can be considered the basic context, where you can find current firewall settings at a high level. It’s
roughly comparable to the Windows Firewall application in Control Panel. From the command prompt, you can see the basic
configuration by typing:
netsh firewall show config
To see more details about the configuration, use the Advfirewall context—the command-line counterpart to Windows Firewall With
Advanced Security. The Advfirewall context contains three subcontexts: Firewall, Consec, and Monitor. The Firewall subcontext can
be used to show the rule details for specific (or all) rules or set new values for existing rules. You can also add rules on the fly using
this subcontext. The Consec subcontext is used to work with connection security rules on the computer. The Monitor subcontext is
used to view and set security associations.
To view all of the rules within Windows Firewall from the command line (be prepared for a lot of output), type:
netsh advfirewall firewall show rule name=all
With dozens of keywords and options, the Netsh Firewall and Netsh Advfirewall commands are quite complex. The best way to learn
about the various possibilities is through the help available from the command line. You’ll need to do it in several steps, appending
another keyword each time. For example, start by entering netsh firewall ? at a command prompt. This returns a list of each of the
keywords that you can put after firewall—Add, Delete, Dump, Help, Reset, Set, and Show—along with a brief description of each.
Next you might typenetsh firewall set ? to learn about each of the Set options. Then you’d type netsh firewall set opmode ? and so
on, until you reach a screen that shows the command syntax and explains all the parameters for the command you’ve entered.

Enable Auditing for Security Events on Windows Vista

Systems
Windows Vista provides the ability to audit security events by recording attempts to access system resources. No events are written
to the Security log until you enable auditing, which you do via Local Security Policy. Even if you set up auditing for files, folders, or
printers, those events aren’t recorded unless you also enable auditing in Local Security Policy.
To enable auditing, follow these steps:
1. In the Control Panel, open Administrative Tools, Local Security Policy. Alternatively, you can type secpol.msc at a command
prompt, or simply begin typing local security in the Start menu Search box. Give your consent to the User Account Control (UAC)
prompt that appears.
2. Expand Local Policies and then click Audit Policy to display the list of activities you can audit.
3. Double-click each policy for which you want to enable auditing, and then select Success, Failure, or both.
Some activities, such as account management and policy change, can provide an audit trail for administrative changes. Others,
such as logon events and object access, can help you discover how to better secure your system. Still others, including system
events and process tracking, can assist you in locating problems with your system.

Use the Snipping Tool to Capture Screen Shots

You can use Snipping Tool (%SystemRoot%\system32\SnippingTool.exe) to capture a screen shot, or snip, of any object on your
screen, and then annotate, save, or share the image. Simply use your mouse (or tablet pen) to capture any of the following types
of snips:

Free-form Snip. Draw an irregular line, such as a circle or a triangle, around an object.
Rectangular Snip. Draw a precise line by dragging the cursor around an object to form a rectangle.
Window Snip. Select a window, such as a browser window or dialog box, that you want to capture.
Full-screen Snip. Capture the entire screen when you select this type of snip.

After you capture a snip, it's automatically copied to the mark-up window, where you can annotate, save, or share the snip.
When Snipping Tool is open, a white overlay appears on your screen until you capture a snip. To turn off the overlay, open Snipping
Tool, and then click Options. In the Snipping Tool Options dialog box, clear the Show screen overlay when Snipping Tool is active
check box, and then click OK.

Query and Manage Event Logs with the Windows Events

Command Line Utility
The Windows Events Command Line Utility (Wevtutil.exe) lets you retrieve information about event logs and publishers; install and
uninstall event manifests; run queries; and export, archive, and clear logs from an elevated command prompt. (The usage for this
command is described later in this sidebar.) Note that you can use either the short (ep /uni) or long (enum-publishers /unicode)
version of the command and option names, and all commands, options, and option values are case insensitive.

The general syntax for Wevtutil.exe is as follows:

wevtutil command [argument [argument] ...] [/option:value [/option:value] ...]

Here command can be any of the following:

al (archive-log) Archives an exported log.

cl (clear-log) Clears a log.
el (enum-logs) Lists log names.
ep (enum-publishers) Lists event publishers.
epl (export-log) Exports a log.
gl (get-log) Gets log configuration information.
gli (get-log-info) Gets log status information.
gp (get-publisher) Gets publisher configuration information.
im (install-manifest) Installs event publishers and logs from manifest.
qe (query-events) Queries events from a log or log file.
sl (set-log) Modifies configuration of a log.
um (uninstall-manifest) Uninstalls event publishers and logs from manifest.
Common options are as follows:

/r:value (remote) If specified, runs the command on a remote computer named value. Note that im (install-manifest)
and um (uninstall-manifest) do not support remote operation.
/u:value (username) Specifies a different user to log on to remote computer. Here value is a user name in the form
domain\user or user. This option is only applicable when option /r (remote) is specified.
/p:value (password) Specifies a password for the specified user. If not specified or value is "*", the user will be
prompted to enter a password. This option is only applicable when /u (username) option is specified.
/a:value (authentication) Specifies an authentication type for connecting to a remote computer. Value can be Default,
Negotiate, Kerberos, or NTLM. The default is Negotiate.
/uni:value (unicode) Displays output in Unicode. Value can be true or false (if true, output is in Unicode).

To learn more about a specific command, type wevtutil command /? at an elevated command prompt.

Know the Network Troubleshooting Tools in Windows Vista

Windows Vista contains an assortment of utilities you can use to diagnose, monitor, and repair network connections. Here’s an
overview of the key tools you’ll find in Windows Vista and what they’re used for.

Get MAC Address (Getmac.exe)

Discovers the Media Access Control (MAC) address, and lists associated network protocols for all network cards in a computer,
either locally or across a network.

Hostname (Hostname.exe)
Displays the host name of the current computer.

IP Configuration Utility (Ipconfig.exe)

Displays all current TCP/IP network configuration values, and refreshes DHCP and DNS settings.

Name Server Lookup (Nslookup.exe)

Displays information about Domain Name System records for specific IP addresses and/or host names so that you can troubleshoot
DNS problems.

Net services commands (Net.exe)

Performs a broad range of network tasks; type net with no parameters to see a full list of available command-line options.

Netstat (Netstat.exe)
Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, and IPv4/IPv6
statistics.

Network Command Shell (Netsh.exe)

Displays or modifies the network configuration of a local or remote computer that is currently running; this command-line scripting
utility has a huge number of options, which are fully detailed in Help.

PathPing (Pathping.exe)
Combines functions of Traceroute and Ping to identify problems at a router or network link.

TCP/IP NetBIOS Information (Nbtstat.exe)

Displays statistics for NetBIOS over TCP/IP (NetBT) protocol, NetBIOS name tables for both the local computer and remote
computers, and the NetBIOS name cache.

TCP/IP Ping (Ping.exe)

Verifies IP-level connectivity to another internet address by sending ICMP packets and measuring response time in milliseconds.

TCP/IP Route (Route.exe)

Displays and modifies entries in the local IP routing table.
TCP/IP Traceroute (Tracert.exe)
Determines the path to an internet address and lists the time required to reach each hop; useful for troubleshooting connectivity
problems on specific network segments.

Manage Scheduled Tasks with the SchTasks.exe Command

An administrator can use the SchTasks.exe command-line utility to create, delete, query, change, run, and end scheduled tasks on
a local or remote system through the command shell. The SchTasks.exe command interface uses the following syntax:
schtasks /{parameter} [arguments]

The Command Parameters Are:

/Create Creates a new scheduled task

/DeleteDeletes the scheduled task(s)
/Query Displays all scheduled tasks
/Change Changes the properties of scheduled task
/Run Runs the scheduled task immediately
/End Stops the currently running scheduled task
/? Displays this help message

Prevent Users from Deleting Browsing History and Clearing

Cookies
Browsers store many traces of the sites users visit, including cached copies of pages and images, passwords, and cookies. To
simplify removing these traces, Internet Explorer 7 provides a Delete Browsing History option that allows users to initiate cleanup
with one button, easily and instantly erasing personal data.
To delete browsing history, follow these steps:

In your browser, click Tools and then click Internet Options.

In the Internet Options dialog box on the General tab, click Delete in the Browsing History group.
In the Delete Browsing History dialog box, shown in Figure 21-15, delete only the objects you need to remove.
Alternatively, you can click Delete All.

You probably knew that already. But did you know you can disable these options?
If you don’t want users to be able to delete their browsing history, form data, or passwords, you can enable the following group
policy settings located in both Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\ and User
Configuration\Administrative Templates\Windows Components\Internet Explorer\:

Turn off ―Delete Browsing History‖ Functionality

Turn off ―Delete Forms‖ Functionality
Turn off ―Delete Passwords‖ Functionality

Remove Unwanted Toolbars and Fix Settings in Internet

Explorer
Remove Unwanted Toolbars
Internet Explorer and Windows Vista include several layers of defense to prevent unwanted software from modifying the Internet
Explorer configuration. If an unwanted toolbar does appear in Internet Explorer, you can disable it using the Add-on Manager.
Sometimes, however, the problem may be more persistent. If the problem persists, start Internet Explorer in No Add-ons mode and
then use the Add-on Manager to disable all add-ons that you have not intentionally installed.
In Internet Explorer 7, No Add-ons mode allows Internet Explorer to temporarily run without any toolbars, ActiveX controls, or
other add-ons. It is very useful when troubleshooting a problem that might be related to an add-on. To enable Add-ons Disabled
mode, follow these steps:

Open the Start menu and point to All Programs.

Point to Accessories, click System Tools, and then click Internet Explorer (No Add-ons).
Note the Information bar display in your browser that indicates add-ons are disabled.

Running Internet Explorer from the standard Start menu shortcut will return the functionality to its prior state.

Fix Unwanted Changes to Settings

If the home page or other settings have changed, you can reset all browser settings except for Favorites, Feed, Internet Connection
Settings, Group Policy Settings, and Content Advisor Settings by following these steps:

Close all windows except for one Internet Explorer window.

Click Tools and then click Internet Options.
In the Internet Options dialog box, click the Advanced tab.
Click Reset.
In the warning box that appears, click Reset.
Click Close and then click OK twice. Restart Internet Explorer.

To prevent unwanted changes in the future, ensure that you have all Microsoft Security Updates installed and are using anti-
malware software, such as Microsoft Forefront or Windows Defender.

Manage Volume Shadow Copy Service from the Vssadmin

Command-Line
You can manage the Volume Shadow Copy service using the Vssadmin command-line tool from an elevated command prompt. You
can use this tool to run the following commands:
Vssadmin List Providers Lists registered Volume Shadow Copy providers. Windows Vista includes Software Shadow Copy Provider
1.0.
Vssadmin List Shadows Lists existing volume shadow copies, the time the shadow copy was created, and its location.
Vssadmin List ShadowStorage Lists the volume shadow storage space currently in use, the space that is reserved for future use
(labeled as allocated), and the maximum space that might be dedicated. This space is used to store changes while a shadow copy is
active. The following sample output was generated using a computer that currently had about 3GB of files stored in a shadow copy,
but that might allocate as much as 6.4GB.
Vssadmin List Volumes Lists volumes that are eligible for shadow copies.
Vssadmin List Writers Lists shadow copy writers, which support communicating with the Volume Shadow Copy service to ensure
that files are captured in a consistent state. By default, subscribed writers include an operating system writer, a registry writer, a
WMI writer, and a search service writer, among others. SQL Server also provides a Volume Shadow Copy writer.
Vssadmin Resize ShadowStorage Resizes Volume Shadow Copy storage. You can use this command to increase the maximum
space that might be used by Volume Shadow Copy. Typically, this is unnecessary. However, if you discover that backups are failing
on a computer because of an extremely high volume of changes during a backup, and Vssadmin List ShadowStorage reveals that
the used Shadow Copy Storage space is at the maximum, you might be able to resolve the problem by manually increasing the
maximum size.

Troubleshoot Group Policy with GPLogView

GPLogView.exe is a command-line troubleshooting tool that you can use to dump Group Policy–related events logged in the System
Event Log channel and the Group Policy Operational Event Log channel. GPLogView.exe works only on Windows Vista; it is not
included with Windows Vista but GPLogView.exe is available as a free download. The command-line options for this tool are:
-? Shows this usage message.
-o [output file name] Output filename required for text, xml, or html; not valid if -m is specified.
-n Do not output the activity ID.
-p Dump the process ID and thread ID associated with each event.
-a [activity id guid] Shows only events matching the given activity ID.
-m Runs the tool in monitor mode displaying events in real time.
-x Dumps the event in XML; the only other options allowed with this option are –m and -a but not both together.
-h Dumps the events in HTML format; -m or -x option not allowed, and -a and -n are allowed, but not both together. Also must
specify -o option.
-q [Query file name] Uses the query specified by query file.
-l [Publisher name] If -q is specified, the publisher name must be specified.

The following examples illustrate the use of this tool:

GPLogView.exe -o GPEvents.txt
GPLogView.exe -n -o GPEvents.txt
GPLogView.exe -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.txt
GPLogView.exe -p -o GPEvents.txt
GPLogView.exe -x -o GPEvents.xml
GPLogView.exe -x -m
GPLogView.exe -x -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.xml
GPLogView.exe -h -o GPEvents.html
GPLogView.exe -h -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.html
GPLogView.exe -h -q somequeryFile.txt -l Microsoft-Windows-GroupPolicy -oGPEvents.html

Track and Analyze System Stability and Reliability with

RACAgent
Reliability Monitor gathers and processes data with the Reliability Analysis Component (RAC). The RACAgent is a hidden scheduled
task that is automatically configured during system installation. This task is responsible for gathering the reliability data and
displaying it in the chart view. The RACAgent task typically runs once every hour and will not wake the computer if it is sleeping. If
the computer is a laptop on battery power, RACAgent.exe will immediately exit if the battery capacity is at less than 33 perc ent.
To view the RACAgent task in Task Scheduler, select RAC within the Task Scheduler library and then right-click and select View –
Show Hidden Tasks in the MMC action pane.
If you do not want to track system stability, you can disable the RACAgent task by selecting the Disable option, which is accessible
in any of the following ways when the RACAgent task is highlighted in the main MMC pane:

Via the action menu

Via the action pane
Via the shortcut menu for the task

Best Practices for File Sharing in a Domain Environment

In an Active Directory environment, best practices for sharing files on Windows Vista computers include the following:

Turn off Network Discovery in a domain environment, as it can generate excessive network traffic that can interfere with
normal network activities.
Publish shared folders in Active Directory so that users can search for them in the directory and access them instead of
having to browse the network to find them.
Use Group Policy to prevent users on Windows Vista computers from sharing files on their computers from their user
profiles unless they are local administrators on their computers. For more information, see the section titled ―Managing
File Sharing Using Group Policy‖ earlier in this chapter.
Allow only advanced users the ability to share folders on their computers by giving them administrative rights on their
computers.

Note: Do not make users local administrators on their computers unless you understand the consequences of doing so. One
consequence is that they will be able to share folders and open firewall exceptions on their computers. Sharing folders from desktop
computers in a domain environment may mean that important documents are being stored on computers instead of on network file
servers, and since desktop computers are not normally backed up, this can mean lost work. Educate users to store files instead
within shared folders on network file servers where their work can be centrally backed up regularly.
High Availability Printing with the Print Management
Console
With Windows Vista client computers and the Windows Vista Print Management console, printer administrators can easily provide
users with high printer availability. This can be achieved by moving users from the print queues on one server to identical print
queues (for the same physical printers) on another server when the first server is unavailable.
First, use the Print Management console to deploy printers to a number of users using a Group Policy object (let’s say
\\ServerA\ColorPrinter, with GPO1) and link GPO1 to an OU with a number of users or computers.
Then, using the Print Server import/export tool, do a backup of a print server. In the Print Management console, right-click a print
server and select Export Printers To A File. All the print queues and printer drivers will be exported to a .printerExport file.
Alternatively, you can use the command-line tool Printbrm.exe (in %WinDir%\System32\spool\tools), either from the command line
or from Task Scheduler, to do periodic backups of the print server.
When a print server goes down because of a hardware failure, the administrator can easily move users to a new server. On the new
server (Server2), use the Print Management console to import the .printerExport file. New print queues will now be created (s uch as
\\Server2\ColorPrinter, if the old server had \\Server1\ColorPrinter).
Using the deployed printers functionality in the Print Management console, deploy the printers using GPO2. With the Group Pol icy
Management tool, disable the link to GPO1. The print queues from Server1 will be undeployed and the print queues from GPO2
(Server2) will be installed.
When the old print server is online again, the link to GPO2 can be disabled, and the link to GPO1 can be enabled.

Troubleshoot Slow Start Ups with Windows Boot

Performance Diagnostics
Sometimes, Windows might start correctly but might take an unusually long time to do so. Such a problems can be difficult to
troubleshoot, because there’s no straightforward way to monitor processes while Windows is starting. To help administrators
identify the source of startup performance problems, and to automatically fix some problems, Windows Vista includes Windows Boot
Performance Diagnostics.
You can use the Group Policy settings to manage Windows Boot Performance Diagnostics in an Active Directory environment. In the
Computer Configuration\Administrative Templates\System\Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics
node, edit the Configure Scenario Execution Level policy. When this policy is enabled, you can choose from the following two
settings:
Detection And Troubleshooting Only Windows Boot Performance Diagnostics will identify startup performance problems and will
add an event to the Event Log, allowing administrators to detect the problem and manually troubleshoot it. Windows Boot
Performance Diagnostics will not attempt to fix the problem, however.
Detection, Troubleshooting, And Resolution Windows Boot Performance Diagnostics will identify startup performance problems
and automatically take steps to attempt to alleviate the problems.
If you disable the setting, Windows Boot Performance Diagnostics will neither identify nor attempt to resolve startup performance
problems. For Windows Boot Performance Diagnostics to function, the Diagnostic Policy Service must be running.
Settings for Windows Shutdown Performance Diagnostics, which function similarly to the Windows Boot Performance Diagnostics,
are located in the Computer Configuration\Administrative Templates\System\Troubleshooting And Diagnostics\Windows Shutdown
Performance Diagnostics node.

New Command-Line Switches for Sc.exe

You can use the sc.exe command to start, stop, configure, and manage various aspects of services in the same way that you can on
earlier versions of Windows. On Windows Vista, however, the sc.exe command has been enhanced with new command-line
switches.

New switches for specifying required privileges for a service include:

-privs Sets the required privileges for a service.
-qprivs Queries for the required privileges of a service.

New switches that support per-service SIDs include:

-sidtype Changes a service’s SID.
-qsidtype Retrieves the setting for service’s SID.

New switches to enable configuration of the FailureActionsOnNonCrashFailures setting include:

-failureflag Changes the setting of the FailureActionsOnNonCrashFailures flag.
-qfailureflag Retrieves the setting for the FailureActionsOnNonCrashFailures flag.
-showsid Displays the service SID string corresponding to an arbitrary name.
-stop This is an old setting that has been enhanced in Windows Vista to specify the stop reason. This enables postmortem reliability
analysis to find out reasons (by examining the event logged by the SCM with the stop reason) an administrator would stop a
service.

For more information about these new command-line switches for sc.exe, type sc /? at a command prompt.

Create an Ad Hoc Wireless Network

If you want to share information stored on your computer with other people nearby and everyone’s computer has a wireless
network adapter, a simple method of sharing is to set up an ad hoc wireless network. In spite of the fact that members must be
within 30 feet of each other, this type of network presents a lot of possibilities. For example, you might consider establishing an ad
hoc network at a meeting of mobile computer users so that you can share information with other attendees on their own screens
rather than an overhead projector. (After establishing the network, you can do this by using Windows Meeting, for instance.)
Ad hoc networks are by definition temporary; they cease to exist when members disconnect from them, or when the computer from
which the network was established moves beyond the 30-foot effective range of the others. You can share an Internet connection
through an ad hoc network, but keep in mind that the Internet connection is then available to anyone logging on to a computer that
is connected to the network, and thus is likely not very secure.

To set up an ad hoc network:

1. On the Start menu, click Connect To.
2. In the Connect to a network window, click the Set up a connection or network task.
3. On the Choose a connection option page, click Set up a wireless ad hoc (computer-to-computer) network, and then click Next.
(This option only appears on computers that have wireless adapters.)
4. Read the ad hoc network information, and then click Next.
5. Provide a network name, select whether the network is open or requires authentication, provide a security phrase if necessary,
and then click Next.

After Windows Vista sets up the ad hoc network, you have the option of sharing your Internet connection.
To disconnect from an ad hoc network, display the Connect To A Network window, click the ad hoc network, and then click
Disconnect.

Use Msconfig to Disable and Enable UAC

Msconfig.exe is a troubleshooting tool that can be useful for temporarily disabling UAC to determine whether UAC is causing an
application compatibility problem. To make the change, msconfig.exe simply modifies the registry value. To disable UAC with
Msconfig.exe, follow these steps:
1. Click Start, type msconfig, and then press Enter. The System Configuration tool opens.
2. Click the Tools tab.
3. Click Disable UAC and then click Launch.
A command window appears, and shortly thereafter, a notification bubble appears informing you that UAC is disabled. Restart your
computer to apply the change.
To re-enable UAC with Msconfig.exe, follow the preceding steps, clicking Enable UAC instead of Disable UAC.

Know the Tools You’ll Need to Deploy Windows Vista

You will use the following tools when you prepare images and deploy Windows Vista throughout your organization:
Sysprep This is the updated version, modified for Windows Vista.
Setup A new installation tool for Windows Vista that replaces WINNT and WINNT32.
ImageX The new command-line tool for creating WIM images.
Windows SIM A tool for creating and modifying Unattend.xml files.
PEimg The tool for customizing Windows PE 2.0 images.
Windows DS The new version of RIS, which adds the ability to deploy Windows Vista images as well as Windows PE 2.0 boot
images.
Pnputil This is the new tool for adding and removing drivers from the Windows Vista driver store.
Pkgmgr Use this new Windows Vista tool for servicing the operating system.
Ocsetup Replaces Sysocmgr and is used for installing Windows components.
Bcdedit A new Windows Vista tool for editing boot configuration data.
Application Compatibility Toolkit 5.0 Use this updated tool to assess whether or not your applications are compatible with
Windows Vista.
User State Migration Tool 3.0 An updated tool for capturing and restoring user state.
BitLocker The full-volume drive-encryption capability included in Windows Vista Enterprise and Ultimate editions.

You can forget about using these tools:

Remote Installation Services (RIS) RIS has been replaced by Windows DS, but Windows DS still offers legacy support on
Windows Server 2003.
Setup Manager and Notepad Use Windows SIM instead for editing unattended setup configuration files.
Winnt.exe and Winnt32.exe Use Setup instead.
Sysocmgr Replaced by Ocsetup and Pkgmgr.
MS-DOS Boot Floppies Forget them. Use Windows PE

Delete Files Permanently with SDelete

When you delete a file, Windows removes the index for the file and prevents the operating system from accessing the file’s
contents. However, an attacker with direct access to the disk can still recover the file’s contents until it has been overwri tten by
another file—which might never happen. Similarly, files that have been EFS-encrypted leave behind the unencrypted contents of the
file on the disk.
With the SDelete tool, which you can download for free, you can overwrite the contents of free space on your disk to prevent
deleted or encrypted files from being recovered.
To use SDelete to overwrite deleted files on the C drive, run the following command:

sdelete -z C:
SDelete - Secure Delete v1.51
Copyright (C) 1999-2005 Mark Russinovich
Sysinternals - www.sysinternals.com
SDelete is set for 1 pass.
Free space cleaned on C: