Adding Bluetooth Devices in Windows 7

Bluetooth devices 101

Today, everyone is familiar with Bluetooth thanks to Bluetooth headsets that are very popular on cellular phones. Bluetooth is wireless networking but it is short distance. Technically, when you use Bluetooth networking you are creating a Personal Area Network, or PAN. Other than those Bluetooth headsets that make peoples' ears look like they are on Star Trek, there are a wide variety of Bluetooth devices. All you have to do is to look in the Bluetooth product directory and you will find that there are thousands of Bluetooth devices out there.

Besides the cellular phone headset, I would think that the second most common device is the Bluetooth mouse that many people use on a laptop. Adding one should be easy, right? Well, there may be more to it than you might think.

Flashback to Windows Vista Bluetooth

Back in the "old" Windows Vista (Vista must be old now as Windows 7 is out, right?), to add a Bluetooth device you would simply go to Control Panel and click on Bluetooth Devices, as you see in Figure 1.

Figure 1: Windows Vista Bluetooth Devices

From there you could click on either Add Wireless Device or Bluetooth Settings. What could be easier, right?

In Windows 7 that simple process has been changed in the name of progress. Let me show you how...

Adding a Bluetooth Mouse to Windows 7, step by step

To add a Bluetooth device in Windows 7, you do go to Control Panel but, from there, the water gets a little murky. The first time I went there to add my Bluetooth device, I was not sure what to do so I had to use the Search function and search for the word Bluetooth in order to find the option to add a Bluetooth device. Still, you should not have to do that.

Instead, what you need to do is to click on View Devices and Printers under Hardware and Sound, as you see in Figure 1.

Figure 2: Control Panel in Windows 7

From there, you will be taken to Devices and Printers, which (with the word printers in there), seems like a strange place to go to add a Bluetooth mouse.

Figure 3: Adding a new Bluetooth device in Windows 7

Next, before you click Add a device (shown in Figure 2) you should first do a few things:

1. Make sure that, if you have a laptop, wireless is enabled on the laptop (my Sony has a switch on the side). Bluetooth is wireless and, typically, when you disable all wireless that includes not only 802.11a/b/g/n but also Bluetooth.
2. Make sure that any proprietary software you have that controls power or wireless has Bluetooth enabled (I will cover this more in the "gotchas").
3. Turn on the power on the mouse and press the Connect button.

Now, you can click Add a Device and you should see something like the graphic in Figure 3.

Figure 4: Locating the device to add

Select the device you want to add and click Next.

The device drivers will be loaded and you should see the window in Figure 5.

Figure 5: Bluetooth mouse has been added

At this point, your mouse should be working. You can use it to click Close and you will be taken back to the Devices and Printers window where you can see your device.

Ideally, adding Bluetooth devices should be that easy but there are some "gotchas" to look out for.

"Gotchas" to Watch Out For When Adding Bluetooth Devices

To make sure that it goes as easily as I demonstrated above, look out for these potential pitfalls:

1. Make sure that your laptop or PC actually has Bluetooth. You can not assume that it has it.
2. Make sure that your Bluetooth is ON. Your laptop might have a switch that enables or disables wireless.
3. Make sure that any proprietary software you have that controls power or wireless has Bluetooth enabled. On my Sony Vaio, I have a proprietary software application installed (from Sony) called Smart Wi Connection Utility that enables and disables various types of wireless connections, including Bluetooth. I ran into an issue where Bluetooth was disabled here and I had to track down this utility to enable it.

Figure 6: SmartWi Connection Utility

4. Make sure that your Bluetooth device is powered on and make sure that it has some kind of LED indicating that it has power. While it may be obvious, that also means that your device has batteries that have a charge (fresh batteries are preferred).
5. You may have to press the Connect button on the Bluetooth device to get it talking to the Bluetooth adaptor on the PC or laptop.
6. Make sure that the drive for your Bluetooth device is successfully installed, as you see in Figure 7 and Figure 8.

Figure 7: Bluetooth Device Driver being Installed

Figure 8: Bluetooth Device Driver Installed

Using GUI to script PowerShell with PowerGUI

Why do I need PowerShell?

If you are new to PowerShell you may still be asking what it is and why you need it. These are easy questions to answer and I am confident that you will see the obvious usefulness of PowerShell once it's explained.

According to WikiPedia, PowerShell is an "extensible automation engine from Microsoft, made up of a command-line shell and associated scripting language". It's built on top of .NET and it is used to perform administrative tasks on local and remote Windows systems. Those administrative tasks could be related to Windows network management, Active Directory, Hyper-V, or even 3rd party programs like VMware (if those programs support it). These administrative tasks can be automated to run at specific times or be initiated from other applications to perform some task.

To me, the cool thing about PowerShell is that it can be used across so many different Windows OS features and supported 3rd party applications - allowing you to control and manage your entire Windows server (both OS and apps).

If you are running Windows 7, PowerShell 2.0 is already included and installed. Prior to that OS, you will need to install it from the Microsoft Script Center homepage.

In Windows 7, just go to the Start menu, Administrative Tools, then to Windows Powershell Modules. You will see your PowerShell command line that looks like this:

Figure 1: PowerShell CLI

While that is "nice" and the way that most admins use PowerShell this command-line interface can be daunting for those new to PowerShell or even new to any kind of command line interface.

The answer is PowerGUI.

What is PowerGUI and how can it help me?

Before you think that I am trying to sell you some kind of commercial tool here, let me first tell you that PowerGUI is completely free, as are their PowerGUI libraries and community forums.

PowerGUI can help you by:

1. Allowing you to run PowerShell scripts with NO scripting knowledge
2. Allowing you to see the scripts that PowerGUI creates for you so that you can understand PowerShell and by allowing you to export those scripts (which you could modify and turn into your own scripts)
3. Provides a way to add "PowerPack Libraries" so that you can extend this functionality to 100's of other applications and/or Windows features (see Figure 2)
4. Offering an intelligent PowerShell script editor to make script editing easier (see Figure 3)

Figure 2: Extend PowerGUI with PowerPacks from the Library

Figure 3: PowerShell Script Editor

So where do you get it and how do you install it?

Downloading and Installing PowerGUI

The 8MB PowerGUI can be found at the PowerGUI download page. As you can imagine with an application that size, the download and installation are very fast.

Other than all the standard installation questions, there is just one point in the GUI that you need to take note of - the Features Install. During this point in the install (before in Figure 4), you have the chance to specify what PowerGUI features you want installed.

Figure 4: PowerGUI Features Selection

This includes PowerPacks like Exchange 2007, Active Directory, and Network. While Local System and Network are checked by default, the other two I mentioned are not.

Just before the installation completes, you can say that you want PowerGUI to start automatically when the install finishes. Here is what PowerGUI looks like when it is first started:

Figure 5: PowerGUI Initial Startup

That's much less intimidating that the command prompt I showed you above, isn't it?

Honestly, thus far in my PowerShell education, I am just getting started but with just a little clicking-around, I was able to browse to the user list on my local computer and see what users are currently added. By going up to View, then down to PowerShell script, a new tab was opened that showed me the PS that is executed for anything that I did. It is in this window that I could take the PS for the common tasks that I perform and easily create automated scripts, even without really knowing much of anything about how to use PS. Here is what it looks like in Figure 6:

Figure 6: Viewing PowerShell scripts that are being run

Creating, Attaching, and Mounting VHD Files in Windows 7 and Windows 2008 R2

New features in Windows 7 and Windows Server 2008 R2 allow Windows Admins to create, mount, and attach virtual hard disks (VHD). This feature will get a lot of use from Windows admins and it saves us from having to use 3rd party tools to do this. In fact, Microsoft is even offering test drives of their popular enterprise applications (such as Window 7 and Exchange 2010).

Microsoft Virtual Hard Disk (VHD) files have been increasing in popularity along with the popularity of the Microsoft Virtual PC and Server virtualization software solutions. However, with the release of Microsoft Hyper-V and (which uses VHD) files, the use of VHD files really skyrocketed. Windows Admins need to mount VHD files to access files in these virtual disk images. Admins also have the option to create their own VHD images.

Why do you need to mount VHD files?

Like me, most Windows Admins have mounted an ISO file and a ZIP file this month (or even today). You did it because perhaps you needed a driver file from an archive or to install an application.

Unlike ZIP files or ISO files, most Windows Admins use VHD files for their intended purpose - serving as the virtual hard drive for a virtual machine (VM). However, you could use a VHD file for whatever you like when it comes to file storage.

Where do you download VHD files from the Internet?

While the VMware VMDK format is still more popular than the Microsoft VHD format for distributing virtual appliances (see the VMware virtual appliance marketplace to download VMDK files), the VHD format is starting to get a foothold. This is due to Microsoft distributing evaluation / demo virtual machines from their website using the VHD format. Here are some links to site from Microsoft and others where you can download VHD files:

• Run IT on a Virtual Hard Disk – Test Drive Program - offers Windows Server 2008 R2, Windows 7 Enterprise, Exchange Server 2010 and a ton more VHDs available for free download (note that these are all evaluation versions that expire after 180 days)
• Windows 7 90-day eval - while you will likely find this inside the test drive program, I think that this is likely the most useful of all the VHD downloads
• SharePoint Add-ons in VHD Format

How do you create, attach, and mount VHD files in Windows 7?

The great new feature in Windows 7 and Windows Server 2008 R2 is that you can now mount (attach, as they call it) and create Microsoft VHD files. Thus, you do not need any third-party software to do this, as you did in the past.

Attaching and Creating VHD files is done inside the Windows Disk Management console. Most people access this by going into the Computer Management. You access this by right-clicking on My Computer, then click Manage. This brings up the Computer Management MMC console where you can do many different things (task scheduler, event viewer, shared folders, users and groups, performance, device manager, manage services, and, finally, disk management).

To attach or create a VHD, you click on the Action menu.

In Figure 1 you can see how Computer Management was used to access the VHD attaching and creating options.

Figure 1:  Creating and Attaching a VHD file in Windows 7 Computer Management

However, the absolute fastest way to get to the VHD attaching and mounting menu is to run the Disk Management MMC directly by just going to the start menu, typing is diskmgmt.msc, and pressing enter (as you see in Figure 2, below).

Figure 2: Running diskmgmt.msc

Of course, you can always attach a VHD that you created in Microsoft Virtual PC or Virtual Server but you can also create your own VHDs inside Windows 7 or Win 2008 R2.

To do this, click in the Create option on the Action menu. You will need to choose as to whether you want to create a fixed or a dynamic VHD file, specify a path, and specify the size of the new virtual disk (as you see in Figure 3).

Figure 3: Creating a new Virtual Disk

When you create the new VHD for the first time, you will see that the Microsoft VHD HBA device driver is being loaded (in Figure 4).

Figure 4: Microsoft VHD HBA driver loaded

This will enable Disk Management to see the new drive but you still need to initialize it, create a new volume, and format it like any other drive. Right-click on the new disk and click to Initialize Disk.

Figure 5: Initializing the VHD Disk

You will be asked if you want to initialize the disk (click OK).

Figure 6: Initializing the Disk

Now, Right-click on the disk again and click New Simple Volume. This will bring up the New Simple Volume Wizard.

Figure 7: Running the new simple volume wizard

In this wizard, you will select the volume size, drive letter, format, and disk block size before you click Finish to complete the wizard.

Figure 8: New Simple Volume Wizard

When done, you will have a new disk volume that looks just like any other physical disk partition.

Figure 9: New VHD Volume created

In fact, I do not see any way to tell that the new volume is a VHD file except for when I right-click on the Disk and see the option to Detach VHD.

Figure 10: Detach VHD File

Attaching a VHD is much easier. Let us say that I detached the VHD file above. To attach it, just go to Action then Attach VHD.

You will be prompted to browse for the VHD file, specify if you want it mounted as read-only, and then you can mount it.

Figure 11: Attach a Virtual Hard Disk (VHD)

New Netsh Commands in Windows 7 and Server 2008 R2

The Network Shell (Netsh) tool was first introduced with Windows 2000. It allows you to configure, troubleshoot, and administer many different network components of Windows via the command line both locally and remotely. More contexts and commands have been added with Windows releases to support new and existing network functions.

Wireless LAN (WLAN) Commands

One new feature of Windows 7 and Windows Server 2008 R2 is Wireless Hosted Networks. It lets you create a virtual wireless access point (AP) with your wireless adapter, even when connected to a wireless network. Once you enable Internet Connection Sharing (ICS), others can connect to your virtual AP with the encryption key and access the Internet.

You can create and manage Wireless Hosted Networks with Netsh:

• netsh wlan set hostednetwork:  Define the settings for the Wireless Hosted Network, using the following optional parameters:
  - mode = { allow | disallow }
  - ssid = WirelessNetworkName
  - key = YourDesiredPassword
  - keyUsage = { persistent | temporary }
• netsh wlan refresh hostednetwork: Set a new WPA2-PSK encryption key. Enter the command followed by the new key.
• netsh wlan start hostednetwork: Enable and start broadcasting the Wireless Hosted Network.
• netsh wlan stop hostednetwork: Disable and stop broadcasting the Wireless Hosted Network.
• netsh wlan show hostednetwork: Print the settings of the Wireless Hosted Network, including a list of connected users.
• netsh wlan export hostednetworkprofile: Save the Wireless Hosted Network profile as an XML file, using the following parameters:
  - Folder = PathandFileName
  - Name = WirelessProfileName (as shown when using the netsh wlan show profiles command)

Figure 1: Setting up and starting a Wireless Hosted Network.

Here are some new WLAN commands to show or print the value of other settings:

• netsh wlan show allowexplicitcreds: Shows if the computer is allowed to use stored user credentials for 802.1X authentication when a user isn't logged on to the computer.
• netsh wlan show createalluserprofile: Shows if users can create wireless profiles for all users, rather than just for their own Windows account.
• netsh wlan show onlyusegpprofilesforallowednetworks: Displays if only the wireless profiles of Group Policy are allowed when Group Policy is implemented.

Here are a couple more new miscellaneous Netsh WLAN commands:

• netsh wlan set allowexplicitcreds: Specify if the computer is allowed to use any stored user credentials for wireless 802.1X authentication when a user isn't logged in, using the following parameter:
  - allow = { yes | no }
• netsh wlan set profiletype: Specify whether only the current user or all users can use the given wireless network profile, using the following parameter:
  - name = ProfileName
  - profiletype = { all | current }
• netsh wlan set blockperiod: Specify the number of minutes (0 – 60) a user must wait to retry after unsuccessfully connecting to a wireless network.
• netsh wlan reportissues: Create a report in the C:\Windows\Tracing directory for troubleshooting wireless networking issues.

Local Area Network (LAN) Commands

There are only two new Netsh LAN commands, which are the wired version of the two new Netsh WLAN commands:

• netsh lan set allowexplicitcreds: Specify if the computer is allowed to use any stored user credentials for wired 802.1X authentication when a user isn't logged in, using the following parameter:
  - allow = { yes | no }
• netsh lan set blockperiod: Specify the number of minutes (0 – 60) a user must wait to retry after unsuccessfully connecting to a wired network.

Windows Filtering Platform (WFP) Commands

The Windows Filtering Platform (WFP) is a new architecture that debuted in Windows Vista and Windows Server 2008. It gives software developers much more access and control over the TCP/IP stack.

Microsoft added a diagnostic tool for the WFP in Windows 7 and Windows Server 2008 R2. It can help you troubleshoot issues with Windows Firewall and IPsec. It runs diagnostic tests and creates a report in XML format. Here are the diagnostic capture commands:

• netsh wfp capture start: Begins the capturing, and continues until you enter the stop command, with the following optional parameters:
  - cab = { on | off }: Specify if the two output files should be  compressed into a .cab file. When not specified, it is set to on.
  - traceonly = { on | off }: State if only event tracing data should be captured, reducing the output file size. When not specified, it is set to off.
  - keywords = { none | bcast | mcast | bcast+mcast }: Set the type of network traffic to capture. Unicast network traffic is always included, even when set to none. bcast means broadcast traffic and mcast is multicast traffic.
  - file = PathAndFilename: Specify the path and filename (without extension) to write the output files.
• netsh wfp capture status: Shows if a capture session is currently active.
• netsh wfp capture stop: Stops the capturing session.

Figure 2: Starting and stopping the capturing.

Two persistent options for the diagnostic capturing can be set with the netsh wfp set options command, using the following parameters:

• netevents = { on | off }: Specify if network events should be included in the diagnostics output. The default value is on.
• keywords = { none | bcast | mcast | bcast+mcast }: Set the type of network traffic to capture. Unicast network traffic is always included, even when set to none. bcast means broadcast traffic and mcast is multicast traffic.
• Information about the current WFP and firewall configuration, filters, and network events that's set when Windows first starts can be displayed with netsh wfp show, using the following commands:
• netsh wfp show appid: Show the device-based application path for a file, using the following parameter:
  - file = PathAndFilename: Define the file path using the standard, i.e. C:\folder\subfolder.
• ·         netsh wfp show boottimepolicy: Displays the WFP policy and filters that's set when Windows first starts, before the Windows Firewall with Advanced Security service is loaded, using the following optionally parameter:
  - file = PathAndFilename: Specify where to write the output. If not specified, the filename is btpol.xml. If you enter a dash (-) for the file value, it is written only to the console.
• netsh wfp show filters: Shows the currently active WFP filters. You can specify the output file (or print to the console) and limit results with the following parameters:
  - file = PathAndFilename
  - protocol = IPProtocolNumber
  - localaddr = IPv4orIPv6Address
  - remoteaddr = IPv4orIPv6Address
  - localport = PortNumber
  - remoteport = PortNumber
  - appid = PathAndFileName
  - userid = { SID | UserName }
  - dir = { in | out }
  - verbose = { on | off }
• netsh wfp show netevents: Displays the list of network traffic events. You can specify the output file (or print to the console) and limit results with the following parameters:
  - file = PathAndFilename
  - protocol = IPProtocolNumber
  - localaddr = IPv4orIPv6Address
  - remoteaddr = IPv4orIPv6Address
  - localport = PortNumber
  - remoteport = PortNumber
  - appid = PathAndFileName
  - userid = { SID | UserName }
  - timewindow = secondsprevious
• netsh wfp show options: Shows the value of the netevents or keywords settings, with the following parameter:
  - optionsfor = { netevents | keywords }
• netsh wfp show security: Displays the security descriptor of a selected item, using the following parameters:
  - type = { callout | engine | filter | kesadb | ipsecsadb | layer | netevents | provider | providercontext | sublayer }
  - guid = GUID
• netsh wfp show state: Shows the current functioning state of the WFP and IPsec, using the following optionally parameter:
  - file = PathAndFilename: Specify where to write the output. If not specified, the filename is wfpstate.xml. If you enter a dash (-) for the file value, it is written only to the console.
• netsh wfp show sysports:  Displays the TCP and UDP ports currently used by the TCP/IP protocol stack, and the remote procedure call (RPC) subsystem, using the following optionally parameter:
  - file = PathAndFilename: Specify where to write the output. If not specified, the filename is sysports.xml. If you enter a dash (-) for the file value, it is written only to the console.

Network Trace Commands

Netsh in Windows 7 and Windows Server 2008 R2 features trace commands to help you diagnose and trace network-related issues. Here are three commands you need to know to use the diagnosis tool:

• netsh trace show scenarios: Lists the network components you can perform traces and diagnosis on.
• netsh trace show scenario: Shows the information for the specified scenario, including the attribute(s) for the you can use to perform the diagnosis, using the required parameter:
  - name = ScenarioName: Specify the name of the desired scenario.
• netsh trace diagnose: Starts a diagnostic session that tries to detect the root cause and repair the issue, using the following parameters:
  - scenario = ScenarioName (Required)
  - namedAttribute = AttributeValue (Required)
  - saveSessionTrace = { yes | no }
  - report = { yes | no }
  - capture = { yes | no }

Figure 3: Running a FileSharing diagnosis to see why the LAPTOP computer isn't accessible.

Here are the commands to perform network traces:

• netsh trace start: Begins a trace session, using the following optional parameters:
  - scenario = Scenario1,Scenario2
  - globalKeywords = keywords
  - globalLevel = level
  - capture = { yes | no }
  - report = { yes | no }
  - persistent = { yes | no }
  - traceFile = Path\Filename
  - maxSize = MaxFileSizeInMB
  - fileMode = { single | circular | append }
  - overwrite = { yes | no }
  - correlation = { yes | no | disabled }
  - provider = ProviderIdOrName
  - keywords = KeywordMaskOrSet
  - level = level
  - provider = Provider2IdOrName
  - keywords = Keyword2MaskOrSet
• netsh trace Stop: Stops the trace session.

Figure 4: Starting and stopping a trace on the WLAN.

The trace convert and trace correlate commands can help you manipulate the trace files. Plus you might look into the following that can display more information related to tracing and diagnosis:

• netsh trace show CaptureFilterHelp
• netsh trace show globalKeywordsAndLevels
• netsh trace show helperclass
• netsh trace show interfaces
• netsh trace show provider
• netsh trace show providers
• netsh trace show status

New Wi-Fi Features in Windows 7

Among enhancements to the Network and Sharing Center, there have been a couple new Wi-Fi features added in Windows 7 and Windows Server 2008 R2. Native support of Wi-Fi Protected Setup (WPS) lets admin and users more easily set up wireless routers or access points and wireless clients. Wireless Hosted Networks let you create virtual Wi-Fi networks. Advanced 802.1X settings give you more control over authentication settings when using the Enterprise mode of WPA or WPA2 security. In this article, we'll discuss each of these features.

Native Support for Wi-Fi Protected Setup (WPS) and Wireless Router Configuration

Wi-Fi Protected Setup (WPS), developed by the Wi-Fi Alliance, helps users quickly and easily configure WPA/WPA2-Personal (PSK)security on wireless routers and clients. Vendors use one or both of two different WPS configuration methods: Personal Information Number (PIN) and Push Button Configuration (PBC).

The PIN method usually consists of entering a wireless adapter's PIN into the web-based control panel of the router. This PIN can be preset and printed on the adapter or displayed and/or customized via the client software.

The Push Button Configuration (PBC) method consists of pressing a button on the wireless router and then pressing a button on the wireless adapter or computer (that supports WPS) within a minute or so. Most wireless adapters don't have physical buttons, but they may have a button on the client software if you've installed it. Similarly, wireless routers will have WPS settings available on the web-based control panel.

The exact workings of WPS can vary among hardware and software vendors. However, generally WPS works like this: It creates a WPA/WPA2 passphrase on the first WPS attempt when the wireless router is still set with the factory default settings. Any clients that participate in the first or future WPS attempts will automatically be configured with the same WPA/WPA2 passphrase. However, if some settings on the wireless router (such as the SSID) are changed from defaults before the first WPS attempt, security may not be enabled by WPS. If WPA/WPA2 security is already set via other methods, WPS will still help configure client devices with the existing WPA/WPA2 passphrase.

Microsoft started introducing its implementation of WPS in Windows Vista under the Windows Connect Now feature. The use of WPS PINs were supported but required you to initially connect via Ethernet. Windows Vista SP2 then added support for Push Button Configuration (PBC). Here we'll discuss the WPS functionality in Windows 7.

Windows 7 supports the PBC method. The first time you try to connect to a wireless router with WPS, Windows 7 prompts you to enter the security key or press the button, such as Figure 1 shows.

Figure 1: Prompt to enter PSK key or remaindering to push WPS button on the router.

If you press the WPS button on the router, the security setting will automatically be transferred to Windows 7, it will connect, and a profile will be created and stored for future connections to the router.

Windows 7 also supports the PIN method, but not in the normal sense, only when setting up the router for the first time. If Windows 7 detects that the router is using factory default settings when you try to connect, it will prompt you to setup the router, such as Figure 2 shows.

Figure 2: Prompt to setup a new wireless router.

You can proceed connecting to the unsecure signal or you can setup the router right in Windows 7. If you choose to setup the router, you'll be prompted for the router's PIN (see Figure 3).

Figure 3: Entering the WPS PIN to setup a new wireless router.

Then you'll be prompted to enter a Network Name (SSID) and optionally customize the security settings, as Figure 4 shows.

Figure 4: Entering wireless settings.

Once configured, it will display the encryption key to use on older Wi-Fi devices that don't support WPS. If you have Windows XP machines, you can even insert a USB flash drive to copy the configuration onto it.

New Wireless Hosted Networks Feature

Part of an old Microsoft project called Virtual Wi-Fi, the Wireless Hosted Network feature lets you create a virtual wireless router with a supported wireless adapter in Windows 7 or Windows Server 2008 R2.You can even host the virtual wireless network while being connected to a regular wireless network using the same wireless adapter.

You can use a Wireless Hosted Network to setup a temporary Wi-Fi network to securely share files when away from your home or office network. You could also use it to extend or share a wireless or wired network connection. It's basically an enhanced version of ad-hoc networking.

If a supported wireless adapter is detected by Windows 7 or Windows Server 2008 R2, you'll see the Microsoft Virtual Wi-Fi Miniport Adapter on the Network Connections window, such as Figure 5 shows.

Figure 5: Virtual adapter for Wireless Hosted Networks.

To get started, you'll probably first want to enable Internet Connection Sharing (ICS) to provide an Internet connection on the host network. On the Network Connections window, right-click the network adapter that's connected to the Internet via a regular network and select Properties. Select the Sharing tab, check the Allow other network users to connect through this computer's Internet connection, choose the Hosted Network Connection from the drop-down listbox, and click OK.

Next, configure the hosted network via the Command Prompt:

Netsh wlan set hostednetwork mode=allow ssid=YourVirtualNetworkName  key=YourNetworkPassword

Now start the hosted network:

Netsh wlan start hostednetwork

To stop the hosted network:

netshwlan stop hostednetwork

See Figure 6 for an example of these commands.

Figure 6: Configuring, starting, and stopping a Wireless Hosted Network.

Wireless Hosted Networks can be useful and interesting for techies, but they also can serve as another security hole on corporate networks that admins should plug. Employees may knowingly or unknowingly create a Wireless Hosted Network, opening uncontrolled wireless access to the corporate network. Though it's secured with WPA2/AES encryption, it's not controlled by the admins. If you're using a Windows Server, you might be able to prevent users from creating Wireless Hosted Networks via the Wireless Network (IEEE 802.11) Policies.

Addition of Advanced 802.1X Settings

Microsoft introduced advanced settings for 802.1X authentication in the Group Policy settings of Windows Vista. Now most of those settings are available on the GUI of Windows 7. They're accessible by clicking the Advanced Settings button on the Security tab on the Wireless Network Properties dialog (see Figure 7) and Authentication tab on the Local Area Connection Properties dialog (see Figure 8)

Figure 7: Security tab on the Wireless Network Properties dialog.

Figure 8: Authentication tab on the Local Area Connection Properties dialog.

Figure 9 shows the Advanced Settings dialog.

Figure 9: Advanced 802.1X Settings dialog.

The first section is where you can specify the authentication mode: User, Computer, or Guest. If you aren't sure, there's also the User or Computer option. When using User authentication, you can click the Save Credentials button to input the username and password. Additionally, you can remove saved credentials by marking the checkbox below.

The second section of the dialog lets you enable and configure single sign-on functionality. If supported by the system and network, configuring these settings eliminates the need to provide separate login credentials. Windows would use the Windows account credentials during the 802.1X authentication.

For wireless connections, you'll also find an 802.11 Settings tab, as Figure 10 shows.

Figure 10: Advanced Wireless802.1X Settings dialog.

Here you can enable and configure Pairwise Master Key (PMK) caching. This facilitates fast roaming between multiple wireless access points (APs). When enabled and supported by the APs, the APs will share the PMKs among themselves so clients don't have to perform pre or full 802.1X authentication when roaming to another AP—speeding up the roaming process up.

When PMK caching is enabled, you can also enable and configure pre-authentication, in case PMK caching isn't supported by an AP. Pre-authentication eliminates the need for clients to perform full 802.1X authentication when roaming to another AP—also speeding up the roaming process

On this tab you can also enable the Federal Information Processing Standards (FIPS) mode, used by non-military US government agencies and contractors.

Command-Line Tools in Windows Vista & Windows 7

Many new command-line tools were introduced with Windows Vista and Windows Server 2008, and some in Windows 7 and Windows Server 2008 R2. Some are replacements for previous tools providing enhancements and some are completely new.

auditpol

You can configure, create, backup and restore audit policies on local and remote computers. This replaces auditusr.exe.

Audit categories include account logon events, account management, directory service access, logon events, object access, policy changes, privilege use, process tracking, and system events. Enabling auditing, records the events for the specified categories in the Security log which you can access via the Event Viewer.

To retrieve the policy for the System category:

auditpol /get /category:"System"

To backup all auditing settings to a CSV-formatted text file:

auditpol /backup /file:auditpolicy.csv

To restore all auditing settings from a previously created CSV-formatted text file using /backup:

auditpol /restore /file:c:\auditpolicy.csv

bcdedit

The Boot Configuration Data (BCD) replaces boot.ini, holding the boot configuration settings. Thus the BCDEdit tool replaces the boot.ini editor bootcfg.exe. BCDEdit lets you manage the BCD stores. You can create, delete, and reorder the boot loader.

View the Boot Manager and Boot Loader details:

bcdedit

Set the default operating system:

bcdedit /default ID

Change the description of a boot entry:

Bcdedit /set ID description "THE NEW DESCRIPTION"

bitsadmin

Lets you manage file transfers made via the Background Intelligent Transfer Service (BITS). BITS uses idle network bandwidth for the file transfers, reducing impact on network performance. It's used by several Microsoft components, including Windows Update, Microsoft Update, Windows Server Update Services, and Systems Management Server.

Download a file from a URL to your hard drive:

bitsadmin /transfer DOWNLOADJOBNAME /download /priority normal http://downloadsrv/file.zip c:\file.zip

Monitor all jobs in the queue, refreshing the status every 5 seconds:

bitsadmin /monitor

Cancel all jobs in the transfer queue:

bitsadmin /reset

BITSAdmin is deprecated starting with Windows 7/Server 2008 R2 and tools for the BITS service are now provided by BITS PowerShell cmdlets.

cmdkey

Lets you manage stored user names and passwords from the Windows Credentials Manager. Though you can also access the Credentials Manager via a GUI from the Control Panel, commands can make it easier to remove and/or add login credentials for multiple PCs.

Display the list of user names and credentials:

cmdkey /list

Add a user name and password for a user to access a server/computer:

cmdkey /add:SERVER /user:USERNAME /pass:PASSWORD

(Omitting the password would prompt the user for it when logging on.)

Delete the credential stored for a server/computer:

cmdkey /delete:SERVER

icacls

This updated version of cacls lets you display, modify, backup, and restore access control lists (ACLs) and DACLs of files and directories. You can also set mandatory labels of an object for interaction with Mandatory Integrity Control.

Save the DACLs for all files and subdirectories in the C:\Windows directory:

icacls c:\windows\* /save BACKFILENAME /t

Restore the DACLs for all files and subdirectories in the C:\Windows directory:

icacls c:\windows\ /restore BACKFILENAME

Give a user Delete and Write permissions to a file:

Icacls FILENAME /grant USERNAME:(d,wdac)

mklink

This helps you create, modify and delete symbolic links, hard links, and directory junctions. Symbolic links are soft links, essentially just a shortcut folder or file that when double-clicked on, redirects the user to the specified directory or file. Hard links are direct links that stay synchronized with the original file. It essentially creates a duplicate file that appears to be separate from the original file. Directory Junctions are hard links for directories, creating what looks like a separate duplicate directory but is linked directly to and stays in sync with the original directory.

Create a symbolic link or shortcut folder (C:\MyDocs) that redirects the user to the C:\Users\UserName\My Documents folder:

mklink /d C:\MyDocs "C:\Users\UserName\My Documents"

Create a hard link (C:\MyDocs\LinkToMyFile.txt) to the C:\Users\UserName\My Documents\MyFile.txtfile.

mklink /h C:\MyDocs\LinkToMyFile.txt "C:\Users\UserName\My Documents\MyFile.txt"

Create a directory junction (C:\MyPics) that links directly to the C:\Users\UserName\MyPictures folder:

mklink /j C:\MyPics "C:\Users\UserName\MyPictures"

query

You can display current information about application servers, objects, processes, sessions, and users on the network.

Show available application servers on the network:

Query appservers

List all processes belonging to the current user

query process

Display all active sessions:

query session

Show all users logged on the system:

query user

Show all users logged on another system:

query user /server:SYSTEMNAME

robocopy

Robocopy is an enhanced version of copy and xcopy with additional features to perform advanced file and directory copying. It can resume copying after network interruptions and preserve original timestamps, NTFS ACLs, and audit information. It also has the ability to skip files that already appear in the destination folder with identical size and timestamp and to delete files from the destination that are no longer present in the source.

Copy files from one server to another, but skipping files already in the destination:

robocopy \\SERVER1\DIRECTORY \\SERVER2\DIRECTORY*.* /S

List files over 32 MBs in size:

robocopy C:\DIRECTORY /MAX:33554432 /L

Move files over 14 days old:

robocopy C:\SOURCEDIRECTORY C:\DESTINATIONDIRECTORY /move /minage:14

rpcping

It enables you to ping a server using a remote procedure call (RPC) and to confirm the RPC connectivity. It's most useful for troubleshooting the connection between a Microsoft Exchange Server and client. You can do simple pings or send simulated traffic of common Outlook RPC/HTTP requests. You can also verify that the client can contact the backend ports. If you receive errors, you can reference causes of common verbose responses.

Test the RPC proxy server:

rpcping -t ncacn_http -s ExchServer -o RpcProxy=RPCProxyServer -P "user,domain,*" -I "user,domain,*" -H 2 -u 10 -a connect -F 3 -v 3 -E -R none

takeown

This allows administrators to take ownership of a file or directory even if access has been denied. This can help if you're locked out of a folder or file after someone messed with the ACL. After using takeown, you may still need to adjust the ACL with icacls commands.

Change ownership of file to current admin user:

takeown /f FILENAME

Change ownership of file to the Administrators group instead of the current admin user:

takeown/a /f FILENAME

Change ownership of directory and all its files and subdirectories to current admin user:

takeown /f C:\DIRECTORY/r

wbadmin

Enables you to back up and restore your operating system, volumes, files, folders, and applications via an elevated command prompt. Wbadmin replaces the previous Microsoft Windows Backup command-line utility, NTBackup.

Create a backup of drive E and D and save the backup to drive F:

wbadmin start backup -backupTarget:f: -include:e:,d:\mountpoint

Check the status of backup operations:

wbadmin get status

whoami

This displays user, group, and privileges information for the current user.

Display the current domain and user name:

whoami

Display all the user, group, and privileges information:

whoami /all

winsat

This gives you command-line access to the assessment tools used to generate the Windows Experience Index (WEI) score introduced by Microsoft in Windows Vista. It measures various hardware performance characteristics and capabilities, and then gives a number from 1.0 and 5.9 for Windows Vista and from 1.0 and 7.9 for Windows 7.

Assess the ability of a system to display the Aero desktop effects.

winsat dwm

Assess the ability of a system to run Direct 3D applications, such as games.

winsat d3d

Assesses the performance of disk drives.

winsat disk

Assess the performance of the CPU(s).

winsat cpu

Run all assessments (data saved at %systemroot%\performance\winsat\datastore) and display results on the System dialog in Windows:

winsat formal

Display relevant system information:

winsat features

VPN Single Sign On with Windows 7

Configuring Windows 7 for VPN Single Sign On

Let's begin with a computer that has Windows 7 installed and is not yet domain-joined. Begin by logging on using the credentials of a local administrator on the computer:

Figure 1: Step 1 of configuring Windows 7 for VPN Single Sign On

Once you are interactively logged on to the Windows desktop, open the Network and Sharing Center. The next step is to create your VPN connection, and you begin doing this by clicking the Set Up A New Connection Or Network link circled in red below:

Figure 2: Step 2 of configuring Windows 7 for VPN Single Sign On

In the Set Up A Connection Or Network wizard, click the Connect To A Workplace option as shown below. If the user of the computer is going to be using a dial-up modem connection instead of a VPN tunnel over the public Internet, select the fourth option in this wizard page instead and proceed similarly to the steps that follow.

Figure 3: Step 3 of configuring Windows 7 for VPN Single Sign On

In the Connect To A Workplace wizard, click the Use My Internet Connection (VPN) option as shown next:

Figure 4: Step 4 of configuring Windows 7 for VPN Single Sign On

On the next wizard page, specify a FQDN or IP address for the VPN server the user will use to connect to the corporate network, and type a friendly name for this connection as shown below. Also be sure to select the Allow Other People To Use This Connection checkbox as shown below. Selecting that checkbox is important since it makes the System built-in identity the owner of the VPN connection and not the user (Karen) who is configuring the connection on the computer, and that will allow other users of the computer to perform VPN SSO logon. And if the user of the computer will be using his smart card for logging in, be sure to select the Use A Smart Card checkbox as well. Finally, if the computer you are configuring is not currently connected to the Internet, you can select the Don't Connect Now option which will set up the new VPN connection but not initiate it until you manually choose to do so later.

Figure 5: Step 5 of configuring Windows 7 for VPN Single Sign On

On the next wizard page, type the credentials that will be used for logging on to the domain. In this case, Karen Berg is configuring the computer for her own personal use, so she enters her own credentials here.

Figure 6: Step 6 of configuring Windows 7 for VPN Single Sign On

Finish the wizard to set up the new VPN connection. Once this is done, the user can click the Network icon in the notification area of the taskbar, and a popup window will appear showing the newly created VPN connection:

Figure 7: Verifying the VPN connection.  

To complete setting up her computer, Karen now joins her computer to the domain. If she is in the office, she can do this by connecting the computer to a LAN drop, clicking Start, and right-clicking Computer to open the System Control Panel item. Then she clicks Change Settings and join her computer to the domain the usual way. If she is on the road sitting in a hotel somewhere, she would first use a LAN drop in a hotel room or a secure wireless hotspot to gain Internet access and then click the Network icon in the notification area, click My VPN Connection in the popup window, click the Connect button, provide her domain credentials when prompted to do so, establish a VPN connection to the corporate network, finish logging on to her desktop, and then join her computer to the domain in the usual way.

Logging On using VPN SSO

Now Karen is on the road and she needs to access shared resources on her company's internal network over a VPN connection. To do this, she turns on her computer and waits until the logon screen appears:

Figure 8: Step 1 of logging on using VPN SSO

Karen then presses Ctrl+Alt+Del and sees the usual logon screen as shown next:

Figure 9: Step 2 of logging on using VPN SSO

Instead of typing her password, Karen clicks the Switch User button, and an additional blue button now appears near the bottom right of her screen. This button is circled in red in the next figure, and if Karen hovers her mouse over this button a tooltip saying "Network Logon" appears:

Figure 10: Step 3 of logging on using VPN SSO

Karen clicks the blue Network Logon button, and this opens a new logon screen called My VPN Connection (this was the friendly name that Karen gave to the VPN connection she created earlier). Karen now types her username and password (if she uses a smartcard then she selects the checkbox instead):

Figure 11: Step 4 of logging on using VPN SSO

After entering her credentials, Karen presses Enter and a dialog box appears indicating that the VPN connection is being established with the remote network:

Figure 12: The VPN connection is being established

Once the VPN connection has been established, the credentials Karen specified will automatically be used to log her on to the desktop of her computer. Once her desktop has appeared, she can browse shared resources on the corporate network over the VPN connection, upload and download files, and perform her work.