Customizing the Default User Profile in Windows 7 (Part 2)

In the previous article of this series we began the process of customizing the default user profile in Windows 7. So far we've completed the following steps:

1. Create a Task Sequence for Deploying your Reference Build
2. Create a Task Sequence for Sysprepping and Capturing your Reference Build
3. Customize the Reference Build using Unattend.xml

Let's now continue the process of customizing the default user profile by performing the following additional steps:

4. Deploy and Verify the Partially Customized Reference Build
5. Further Customize the Reference Build Manually
6. Sysprep and Capture the Fully Customized Reference Build
7. Verify All Customizations Made to the Default User Profile

Deploy and Verify the Partially Customized Reference Build

Begin by booting your bare-metal reference computer using the LiteTouchPE_x64.iso boot image found in the Boot folder of your deployment share on your MDT computer. When the Windows Deployment Wizard appears, select the task sequence for deploying your partially customized reference build:

Figure 1: Select the task sequence for deploying your pre-customized reference build

Tip:
If desired you can configure the CustomSettings.ini file in your deployment share to completely automate the process of deploying your reference build. For information on how to do this, see Part 7 and Part 8 of my Deploying Windows 7 series here on WindowsNetworking.com.

Respond to the various prompts of the wizard as needed. On the Specify Whether To Capture An Image page shown below, be sure to select Do No Capture An Image Of This Compute as you haven't finished customizing your reference build yet:

Figure 2: Be sure to select Do No Capture An Image Of This Compute

Once you've finished the wizard, MDT will deploy your partially customized reference build to your reference computer. Upon completion of deployment, you'll be automatically logged on to the reference computer as Administrator.

Now let's see whether the five customizations we performed using our answer file (Unattend.xml) actually worked or not. First, we launch Internet Explorer and notice that the First Run Wizard doesn't appear and the IE home page is the website we specified in our answer file:

Figure 3: Step 1 of verifying pre-customizations made using Unattend.xml

Next, if we click the Start button we see that the Games feature has been turned on:

Figure 4: The Games feature has been enabled

Next, we open Programs and Features in Control Panel and click Turn Windows Features On Or Off. This lets us verify that the XPS Viewer feature has not been installed:

Figure 5: The XPS Viewer feature has not been installed

Finally, opening Problem Reporting Settings in Control Panel let us verify that Windows Error Reporting information will be automatically uploaded to Microsoft:

Figure 6: Windows Error Reporting information will be automatically uploaded to Microsoft

So it looks like the five customizations we automated using Unattend.xml have all been applied to our reference build as expected.

Further Customize the Reference Build Manually

Now let's manually perform some additional customizations of our reference build. We'll make the following five manual customizations:

1. Pin a shortcut for Windows Remote Assistance to the Start menu.
2. Pin a shortcut for Remote Desktop Connection to the Taskbar.
3. Change the default view of the Documents library from Details to Content.
4. Change the Control Panel default view from Category to Small Icons.
5. Change the Desktop Background from the default picture to solid light green.

First, click Start, Programs, Maintenance, and right-click on Windows Remote Assistance to pin a shortcut for this item to the Start menu:

Figure 7: Pin a shortcut for Windows Remote Assistance to the Start menu

Next, click Start, Programs, Accessories, and right-click on Remote Desktop Connection to pin a shortcut for this item to the taskbar:

Figure 8: Pin a shortcut for Remote Desktop Connection to the Taskbar

Next, open the Documents library and change the default view from Details to Content:

Figure 9: Change the view of the Documents library from Details to Content

Next, open Control Panel and change the default view from Category to Small Icons:

Figure 10: Change the Control Panel default view from Category to Small Icons

Finally, open Desktop Background from Personalization in Control Panel and change the Desktop Background from the default picture to solid light green:

Figure 11: Choose the Desktop Background

We're now finished with our additional customizations of our reference build.

Sysprep and Capture the Fully Customized Reference Build

Now let's sysprep our reference build and capture an image of it. We'll use MDT to perform these two actions. While logged on to the reference computer as Administrator, click Start, right-click on Computer, and select Map Network Drive. Then map a network drive to the deployment share on your MDT computer:

Figure 12: Map a network drive to the deployment share on the MDT computer

Once the mapped drive opens in Windows Explorer, double-click on the Scripts folder to display its contents. You'll see two files named LiteTouch, the first a VBScript (.vbs) file and the second a Windows Script (.wsh) file:

Figure 13: Contents of the Scripts folder in the deployment share

Double-click on the second LiteTouch file (the Windows Script or .wsh file) to launch the Windows Deployment Wizard from your reference computer. When the wizard appears, select the Sysprep and Capture task sequence:

Figure 14: Select the Sysprep and Capture task sequence

Walk through the steps of the wizard until you reach the Specify Whether To Capture An Image page, and on that page be sure to select the Capture An Image Of This Reference Computer option. Verify that the Location field is the Captures folder in the deployment share on your MDT computer, and specify a file name for the image you'll be capturing of your reference computer (we choose STEP-2.wim for this filename):

Figure 15: Select the Capture An Image Of This Reference Computer option

Once you've completed the wizard, Sysprep will run on your customized reference build to remove any machine-specific information:

Figure 16: Sysprep running on the reference build.

When Sysprep is finished, the LiteTouch wizard will capture a .wim image of the sysprepped reference build and upload it to the Captures folder in the deployment share of your MDT computer. This may take awhile to complete:

Figure 17: Capturing an image of the sysprepped reference build

Once the process is finished, the reference computer will reboot. If you now go to your MDT computer and look in the Captures folder in your deployment share using Windows Explorer, you'll see the captured reference build:

Figure 18: The captured reference build has been uploaded to the Captures folder in the deployment share on the MDT computer.

Now all we need to do is to verify that all ten of the customizations we've made—five automated using Unattend.xml and five performed manually after deploying the reference build—have actually been applied to the captured image. To do this, we're going to import our captured image into the Deployment Workbench, create a new task sequence based on the Standard Client Task Sequence template, modify the Unattend.xml file for this task sequence so that the CopyProfile setting has the value True, deploy the captured image to a target system using this task sequence, create a new local user on the target system, and see whether the ten customizations we've made have been successfully applied to the default profile from which new local users are generated. We'll do all this in the next article in this series.

Customizing the Default User Profile in Windows 7 (Part 1)

If you are an admin of a Windows-based network, there are a number of reasons why you might want to customize the default user profile. For example:

• You might want to customize users' desktops prior to deploying Windows 7 onto new computers so that users have a pre-configured desktop experience to start from.

• You might want to use roaming profiles to enable users to roam between different computers on your network while accessing their own personalized desktops and you might want to customize the initial desktop experience of your users.

• You might want to use mandatory roaming profiles to provide a locked-down, customized desktop experience to users in a Remote Desktop Services (RDS) or Virtual Desktop Infrastructure (VDI) environment based on Windows Server 2008 R2 SP1 Hyper-V.

Unfortunately, the method used for customizing the default user profile in previous versions of Windows—customizing the Administrator account and then copying the Administrator user profile over the Default User profile—doesn't work anymore in Windows 7. In fact, that method, which has been used since Windows NT and was documented in several Knowledge Base articles on TechNet (articles that have since been pulled) never really worked properly in the first place! It worked pretty well with Windows NT, but as the Windows shell (desktop) became increasingly complex through Windows 2000, Windows XP and Windows Vista, following the old method for customizing the default user profile caused some strange things to happen on users' computers, such as certain user profile folders having incorrect names, files for certain applications being saved in the wrong folders, and various other unpredictable and hard to reproduce problems.

So if you want your desktop computers to be in a supported configuration, you now need to follow the new, improved—and fully supported by Microsoft—method for customizing the default user profile. This series of articles walks you through the steps involved in customizing the default user profile for Windows 7 and Windows Server 2008 R2, explains how to use your customized profile as a default network profile for roaming scenarios, and discusses various issues including the limitations of profile customization on these platforms. The method used for customizing the default user profile involves using Microsoft Deployment Toolkit (MDT 2010) Update 1 and if you aren't familiar with how to use MDT you should first work through my 29-part series of articles titled Deploying Windows 7 here on WindowsNetworking.com.

1.  Create a Task Sequence for Deploying your Reference Build

To customize our default user profile, we're going to deploy Windows 7 on a computer called our master or reference computer. The installation will be called our master installation or reference build. Then we're going to customize our reference build as desired, sysprep it, capture an image of the build, and finally deploy the customized, captured image onto our target computers (users' computers).

Start by opening the Deployment Workbench on the computer that has MDT 2010 Update 1 installed. Expand your deployment share, right click on the Task Sequences folder, and select New Task Sequence to create a new task sequence for deploying your reference build. We'll call this task sequence STEP-1 as shown below:

Figure 1: Step 1 of creating a task sequence for deploying the reference build.

Select the Standard Client Task Sequence from the drop down list of task sequence templates:

Figure 2: Step 2 of creating a task sequence for deploying the reference build.

Select the operating system you want to deploy, which in this walkthrough is Windows 7 x64 Enterprise Edition:

Figure 3: Step 3 of creating a task sequence for deploying the reference build.

Step through the remaining pages of the wizard until you're finished. For example, we specified the password for the local Administrator account in the task sequence:

Figure 4: Step 4 of creating a task sequence for deploying the reference build.

2. Create a Task Sequence for 'Sysprepping' and Capturing your Reference Build

Next, we need to create a second task sequence. This second task sequence will be used to do two things:

• Sysprep the reference build (after you've customized it) in order to generalize the installation by removing machine-specific information such as security identifiers (SIDs), the contents of event logs, any system restore points, installed Plug and Play drivers, and so on.

• Capture an image (.wim file) of the 'sysprepped' reference build and upload the captured image to your MDT computer.

Once your customized reference build has been 'sysprepped' and captured, you can then use MDT to deploy the captured image to your target computers. From the Deployment Workbench, launch the New Task Sequence Wizard again and give your new task sequence a name like STEP-2 as shown below:

Figure 5: Step 1 of creating a task sequence for 'sysprepping' and capturing the reference build.

From the list of task sequence templates select Sysprep and Capture as shown below:

Figure 6: Step 2 of creating a task sequence for 'sysprepping' and capturing the reference build.

Complete the remaining steps of the wizard. You should now see two task sequences in your Deployment Workbench:

Figure 7: Two task sequences have been created.

3. Customize the Reference Build using Unattend.xml

You're now ready to begin customizing your reference build. Wait a minute! We haven't deployed our reference build yet, so how can we possibly customize it? Simple — we can pre-define various customizations for our reference build by making modifications to the answer file (unattend.xml) that MDT will use to perform an unattended setup of our reference build. Wherever possible, you should use this approach to customizing your reference build since it automates the customization process which in the long run can save you a lot of time (provided you've documented your answer file modifications).

Begin by right-clicking on the task sequence that will be used to deploy the reference build (we called this STEP-1) and select Properties to open the properties of the task sequence. Then select the OS Info tab as shown below:

Figure 8: The OS Info tab of the properties of the task sequence that will be used to deploy the reference build.

On the above tab, click the Edit Unattend.xml button. This opens Windows System Image Manager (Windows SIM) which can be used to modify settings in our answer file:

Figure 9: Using Windows SIM to modify the settings in the answer file for the task sequence that will be used to deploy the reference build.

Tip:
If you're not familiar with how to use Windows SIM, see article 6 in my earlier Deploying Vista series here on WindowsNetworking.com.

For this walkthrough, we're going to modify our Unattend.xml file so that five customizations are automatically performed during deployment of our reference build. These five modifications will be as follows:

1. Disable the Internet Explorer First Run Wizard.
2. Specify a home page for Internet Explorer.
3. Configure Windows Error Reporting (WER) so that collected data is automatically uploaded to Microsoft with no user interaction required.
4. Enable the Games built-in feature.
5. Prevent the XPS Viewer application from being installed.

We'll begin by disabling the Internet Explorer First Run Wizard, which when a user logs on for the first time asks them if they want to enable certain IE 8 features. Using Windows SIM, expand the Specialize section of the Unattend file and select the Microsoft-Windows-IE-InternetExplorer component as shown below:

Figure 10: Step 1 of disabling the Internet Explorer First Run Wizard.

In the Properties pane for this component, click the field besides the DisableFirstRunWizard setting and change the value from False to True:

Figure 11: Step 2 of disabling the Internet Explorer First Run Wizard.

Next we'll specify a home page for Internet Explorer. In the same Properties pane, click the field besides the Home_Page setting and change it from about:blank to some website (I chose www.mtit.com which is my own business website):

Figure 12: Specifying a home page for Internet Explorer.

Next, we want to configure WER so that collected data is automatically uploaded to Microsoft without any user interaction needed. To make this customization we'll need to first add a component to our answer file. The component we need to add is called Microsoft-Windows-ErrorReportingCore, and to add it to our answer file we need to expand the Components node under the catalog in the Windows Image pane of Windows SIM, find the component we want to add, right-click on it and add it to the Specialize pass as shown here:

Figure 13: Step 1 of configuring Windows Error Reporting behavior.

How do we know which component we need to add to our answer file to do this? By searching the Unattended Windows Setup Reference Help (.chm) file that is included with the Windows Automated Installation Kit for Windows 7. You can get the updated .chm file here.

How do we know which configuration pass (i.e. Specialize) we need to add this component to? In this case, the other configuration passes are grayed out so you don't have any option of selecting them. But for some components you try to add to your answer file you may have several passes you can choose from. In general, you want to use only the Specialize or OobeSystem configuration passes to automate customization of a reference build. For more information on configuration passes, see article 3 of my earlier Deploying Vista series.

Once we've added the Microsoft-Windows-ErrorReportingCore component to the Specialize pass of our answer file, it is displayed in the Answer File pane of Windows SIM. We then change the DefaultConsent4 which specifies that all data is sent automatically: setting for this component to the value

Figure 14: Step 2 of configuring Windows Error Reporting behavior.

How do we know that the value 4 specifies that all data is sent automatically? By searching the Unattended Windows Setup Reference Help (.chm) file for "DefaultConsent".

Next, we want to enable the Games feature, which is a built-in feature of Windows 7 that is not installed by default on Enterprise Edition (for obvious reasons). To do this, we must first include a package in our answer file. This package is Microsoft-Windows-Foundation-Package, which is found in the Windows Image pane under Catalog\Packages\Foundation as shown below. Right-click on the package and select Add to Answer File:

Figure 15: Step 1 of enabling the Games feature.

How do we know which package we need to add to our answer file to do this? By searching the Unattended Windows Setup Reference Help (.chm) file for "Games".

Once the package has been added, it is displayed in the Answer File pane of Windows SIM. We can then change the value of the InboxGames setting from Disabled to Enabled:

Figure 16: Step 2 of enabling the Games feature.

Finally, we want to prevent the XPS Viewer application from being installed (it's installed by default). Since this is installed as part of the same package as Games, we simply scroll down in the Properties pane to find the Xps-Foundation-Xps-Viewer setting and change its value from Enabled to Disabled:

Figure 17: Preventing the XPS Viewer application from being installed.

Windows 7 Default Services and Suggested Startup Mode

Windows 7 comes with a slew of services, which might not be that important to your computer. If you are running Windows 7 on a personal laptop, home computer, or computer where you can control the services yourself, you might want to look at stopping some of the services to improve performance. If you are a corporate network administrator, you should also look closely at the overall list of services, as some of them are not needed for your corporate network desktops.

Like always, never take settings and suggestions like these verbatim, be sure to test them in your specific environment. Although I have been able to run my personal laptop, production desktop, and even corporate desktops where I have contracted.

Name of Service	Default Startup Mode	Possible Startup Mode
ActiveX Installer (AxInstSV)	Manual	Manual
Adaptive Brightness	Manual	Disabled
Application Experience	Manual	Manual
Application Identity	Manual	Manual
Application Information	Manual	Manual
Application Layer Gateway Service	Manual	Disabled
Application Management	Manual	Disabled
Background Intelligent Transfer Service	Manual	Manual
Base Filtering Engine	Automatic	Automatic
Bitlocker Drive Encryption Service	Manual	Disabled
Block Level Backup Engine Service	Manual	Disabled
Bluetooth Support Services	Manual	Disabled
BranchCache	Manual	Disabled
Certificate Propagation	Manual	Disabled
CNG Key Isolation	Manual	Manual
COM+ Event System	Automatic	Automatic
COM+ System Application	Manual	Manual
Computer Browser	Manual	Disabled
Credential Manager	Manual	Manual
Cryptographic Services	Automatic	Automatic
DCOM Server Process Launcher	Automatic	Automatic
Desktop Window Manager Session Manager	Automatic	Automatic
DHCP Client	Automatic	Automatic
Diagnostic Policy Service	Automatic	Automatic
Diagnostic Service host	Automatic	Automatic
Diagnostic System Host	Manual	Manual
Disk Defragmenter	Manual	Disabled
Distributed Link Tracking Client	Automatic	Automatic
Distributed Transaction Coordinator	Manual	Manual
DNS Client	Automatic	Automatic
Encrypting File System (EFS)	Manual	Disabled
Extensible Authentication Protocol	Manual	Manual
Fax	Manual	Disabled
Function Discovery Provider Host	Manual	Manual
Function Discovery Resource Publication	Manual	Disabled
Group Policy Client	Automatic	Automatic
Health Key and Certificate Management	Manual	Disabled
HomeGroup Listener	Manual	Disabled
HomeGroup Provider	Manual	Disabled
Human Interface Device Access	Manual	Manual
IKE and AuthIP IPsec Keying Modules	Manual	Manual
Interactive Services Detection	Manual	Manual
Internet Connection Sharing (ICS)	Disabled	Disabled
IP Helper	Automatic	Automatic
IPsec Policy Agent	Manual	Manual
KtmRm for Distributed Transaction Coordinator	Manual	Manual
Link-Layer Topology Discovery Mapper	Manual	Disabled
Media Center Extender Service	Disabled	Disabled
Microsoft .NET Framework NGEN v2.0.50727_X86	Manual	Manual
Microsoft iSCSI Initiator Service	Manual	Manual
Microsoft Software Shadow Copy	Manual	Manual
Multimedia Class Scheduler	Automatic	Automatic
Net.Tcp Port Sharing Service	Disabled	Disabled
Netlogon	Manual	Manual
Network Access Protection Agent	Manual	Manual
Network Connections	Manual	Manual
Network List Service	Manual	Manual
Network Location Awareness	Automatic	Automatic
Network Store Interface Service	Automatic	Automatic
Offline Files	Automatic	Disabled
Parental Controls	Manual	Disabled
Peer Name Resolution Protocol	Manual	Manual
Peer Networking Grouping	Manual	Manual
Peer Networking Identity Manager	Manual	Manual
Performance Counter DLL Host	Manual	Disabled
Performance Logs & Alerts	Manual	Disabled
Plug and Play	Automatic	Automatic
PnP-X IP Bus Enumerator	Manual	Manual
PNRP Machine Name Publication Service	Manual	Manual
Portable Device Enumerator Service	Manual	Manual
Power	Automatic	Automatic
Print Spooler	Automatic	Automatic
Problem Reports and Solutions Control Panel Support	Manual	Disabled
Program Compatibility Assistant Service	Manual	Disabled
Protected Storage	Manual	Disabled
Quality Windows Audio Video Experience	Manual	Disabled
Remote Access Auto Connection Manager	Manual	Disabled
Remote Access Connection Manager	Manual	Disabled
Remote Procedure Call (RPC)	Automatic	Automatic
Remote Procedure Call (RPC) Locator	Manual	Manual
Remote Registry	Manual	Manual
Routing and Remote Access	Disabled	Disabled
RPC Endpoint Mapper	Automatic	Automatic
Secondary Logon	Manual	Manual
Secure Socket Tunneling Protocol Service	Manual	Disabled for desktops, enabled for laptops
Security Accounts Manager	Automatic	Automatic
Security Center	Automatic (Delayed Start)	Automatic
Server	Automatic	Automatic
Shell Hardware Detection	Automatic	Automatic
Smart Card	Manual	Disabled
Smart Card Removal Policy	Manual	Manual
SNMP Trap	Manual	Disabled
Software Protection	Automatic	Automatic
SPP Notification Service	Manual	Manual
SSDP Discovery	Manual	Manual
Superfetch	Automatic	Automatic
System Event Notification Service	Automatic	Automatic
Tablet PC Input Service	Automatic	Disabled
Task Scheduler	Automatic	Automatic
TCP/IP NetBIOS Helper	Automatic	Automatic
Telephony	Manual	Disabled
Themes	Automatic	Automatic
Thread Ordering Server	Manual	Manual
TP AutoConnect Service	Manual	Manual
TPM Base Services	Manual	Manual
UPnP Device Host	Manual	Manual
User Profile Service	Automatic	Automatic
Virtual Disk	Manual	Manual
Volume Shadow Copy	Manual	Manual
WebClient	Manual	Disabled
Windows Audio	Automatic	Automatic
Windows Audio Endpoint Builder	Automatic	Automatic
Windows Backup	Manual	Manual
Windows CardSpace	Manual	Disabled
Windows Color System	Manual	Disabled
Windows Connect Now - Config Registrar	Manual	Disabled
Windows Defender	Automatic	Automatic
Windows Driver Foundation - User-mode Driver Framework	Automatic	Automatic
Windows Error Reporting Service	Manual	Disabled
Windows Event Collector	Manual	Disabled
Windows Event Log	Automatic	Automatic
Windows Firewall	Automatic	Automatic
Windows Font Cache Service	Manual	Manual
Windows Image Acquisition (WIA)	Manual	Disabled
Windows Installer	Manual	Manual
Windows Management Instrumentation	Automatic	Automatic
Windows Media Center Receiver Service	Manual	Disabled
Windows Media Center Scheduler Service	Manual	Disabled
Windows Media Player Network Sharing Service	Manual	Disabled
Windows Modules Installer	Manual	Manual
Windows Presentation Foundation Font Cache 3.0.0.0	Manual	Manual
Windows Remote Management (WS-Management)	Manual	Manual
Windows Search	Automatic	Automatic
Windows Time	Automatic	Automatic
Windows Update	Automatic (Delayed Start)	Automatic (Delay Start)
WinHTTP Web Proxy Auto-Discovery Service	Manual	Manual
Wired AutoConfig	Manual	Disabled
WLAN AutoConfig	Manual	Disabled for LAN, Enabled for Wireless
WMI Performance Adapter	Manual	Manual
Workstation	Automatic	Automatic

How to Proceed

For your laptops and desktops for both your personal and corporate environments, be sure to setup a test computer or pilot group and make sure that all other functions on the computer work before you proceed with rolling this out to all computers on your network. In my experience, disabling the services above has given me significant performance enhancements by removing the services from running. In most cases the services were not running (set to manual and not started), but in many cases the services were running and were just taking up memory and processing time.

The other benefit to disabling services that are not needed is that it reduces your attack surface. The fewer services running means the fewer ports open, which means the fewer viruses and worms, will function on your computer.

If a feature or function fails to work after disabling services, just re-enable the service to manual or automatic. If you are uncertain which service is required, you can look at the service descriptions on your computer services list or check online for a description of your feature and which service is required.

How do I recover my missing files from USB drive?

USB drives become the famous between all computer user, since easy to use and carry. However, like other storage devices the USB drives also prone to loss files. The cause of file missing is unintentional deletion, formatting and virus.

Since the recovery of missing files is possible whatever be the cause of missing files but in some cases such as virus attack then extent of recover lost data is depends upon the destruction cause by the virus.

How do you recover files from a formatted USB drive?

The recovery of the files is possible only with the help of the USB partition recovery software. There are a lot of kinds of file recovery software available. Our USB uses FAT files system so requires USB files recovery software.

To get missing data, insert the USB drive to a computer. Download the USB files recovery software to recover important missing files.

Steps to be followed to recover missing files from USB drive

• You require removing of USB from PC as soon your files are missing as to ensure retrieval of files in good state and to prevent the USB drive from further loss by overwritten of files.

• Make sure that you are using USB files recovery product which recover files in read-only mode.

• Save the recovered files to a healthy storage device such as hard drive.

• If you have any mess in recovering the missing data, resolve it with the support team of software publisher.

Forgot Windows 7 Password, What to Do?

Forgot Windows 7 password? Locked out of your computer? Don't want to reinstall your computer as there are some vital data on it, like precious images and your school essay? Then what should you do?

Windows 7 allows PC users to enable fingerprint logon, but most PC users are used to set a password in Windows 7. It is much easier for you to create a Windows 7 password consisting of symbols and numbers than to create fingerprint logon. But the only disadvantage is that you have to remember the password. Otherwise, it will be troublesome if you are locked out of computer when you forgot Windows 7 password.

Although Windows enables you to create a password reset disk in Windows 7, it seems to have little effect. Many PC users don't know how to create a Windows 7 password reset disk. And some don't remember to create the password reset disk until they forgot Windows 7 password. Everyday there are many questions about forgot Windows 7 password online. Here I recommend you to try Windows Password Breaker when you forgot password on Windows 7.

Windows Password Breaker is a helpful windows password recovery tool to reset windows passwords, including Windows administrator password or user passwords. It supports to reset passwords of all Windows versions, like Windows 7, Vista, XP, 2008, 2003 and 2000, etc. With this password recovery, you easily remove lost Windows password by burning a bootable CD/DVD or USB flash drive.

Steps to remove password with a bootable CD/DVD when you forgot Windows 7 password as follow:

1. Download Windows Password Breaker Standard in any computer.
2. Run the program and burn a bootable CD/DVD or USB flash drive.
3. Set your computer boot from CD/DVD or USB.
4. Reset lost Windows password.

Now you successfully remove windows password with Windows Password Breaker Standard. You can log on your computer without password. No need to worry about anything if you forgot Windows 7 password. You can also use a USB flash drive like iPod to remove forgotten Windows 7 password based on the above steps.

Network Access Protection (Part 7)

How to configure a Vista client and how to test your NAP server.

At the conclusion of Part 6, I showed you how to set up a non functional VPN connection on a Windows Vista client. In this article, I will conclude this article series by showing you how to complete the client configuration process.

Begin the configuration process by opening the Control Panel and clicking the Network and Internet link, followed by the Network and Sharing Center link. When the Network and Sharing Center window opens, click to the Manage Network Connections link. You should now see a screen which displays all of your network connections, and the VPN connection that you created in the last part of this article series.

Right-click on the VPN connection, and select the Properties command from the resulting shortcut menu. Once Windows displays the connection's properties sheet go to the Security tab and select the Advanced (Custom Settings) radio button, shown in Figure A.

Figure A: You must configure your connection to use the Advanced (Custom Settings) security settings

Now click the Settings button to reveal the Advanced Security Settings dialog box. Since we have set up the VPN connection to use the Extensible Authentication Protocol, you must select the Use Extensible Authentication Protocol (EAP) radio button. Upon doing so, the drop-down list below this radio button will be activated. Choose the Protected EAP (PEAP) (Encryption Enabled) option, as shown in Figure B.

Figure B: You must configure your VPN security to use Protection EAP (PEAP) (Encryption Enabled) security

Now, click the Properties button to reveal the Protected EAP Properties dialog box. Select the Validate Server Certificate check box and deselect the Connect to these Servers check box. You must also select the Secured Password (EAP-MSCHAP V2) option from the Select Authentication Method drop down list. Finally, deselect the Enable Fast Reconnect check box and select the Enable Quarantine Checks check box, as shown in Figure C.

Figure C: The Protected EAP Properties sheet allows you to set the parameters for Extensible Authentication Protocol based authentication

At this point, go ahead and click OK on each open dialog box to close it. You have now configured the VPN connection so that it meets the necessary requirements. We're not quite done though. In order for Network Access Protection to work, the Network Access Protection service needs to be set to start automatically. By default, Windows Vista sets the service to start manually, so you will have to make a change to the way that the service starts.

To do so, open the Control Panel and click on the System and Maintenance link, followed by the Administrative Tools link. Windows should now display a list of the various administrative tools. Double-click on the Services icon to open the Service Control Manager.

Scroll through the list of services until you locate the Network Access Protection Agent service. Double-click on the service and then set the startup type to Automatic and click OK. Keep in mind that setting the service's startup type to Automatic does not start the service. It only ensures that the service will be automatically started after the next reboot. You can however start the service without rebooting by right clicking on the service and choosing the Start command from the resulting shortcut menu. If you have trouble starting the service, then make sure that the Remote Procedure Call (RPC) service and the DCOM Server Process Launcher service are both started. The Network Access Protection Agent service can not function without these underlying dependency services.

Testing Network Access Protection

Believe it or not, we are finally finished configuring Network Access Protection. Now it is time to perform some simple tests to make sure that everything is functioning as intended.

As you may recall, we reconfigured our network policy server so that noncompliant machines are automatically remediated. We also configured our network policy server so that the only criteria that it checks for is whether or not the Windows firewall is enabled. That being the case, you should be able to disable the firewall on the client machine, and then connect to the network policy server that is using the VPN connection that you have created. Upon doing so, the client machine's firewall should be automatically re-enabled.

Let's begin by disabling the firewall on the client machine. To do so, open the Control Panel and click the Security link. Now, click the Windows Firewall link to open the Windows Firewall dialog box. Assuming that the Windows Firewall is already running, click the Turn Windows Firewall On or Off link. You should now see a dialog box that allows you to turn the firewall on or off. Select the Off (not recommended) radio button, as shown in Figure D, and click OK. The Windows firewall should now be disabled.

Figure D: Select the Off (Not Recommended) radio button and click OK to disable the Windows firewall

Now that you have turned off the Windows Firewall, it's time to establish a VPN connection to your RRAS / NAP server. To do so, open the Control Panel and click on the Network and Internet link, followed by the Network and Sharing Center link. When the Network and Sharing Center window opens, click on the Manage Network Connections link. You should now see a list of the workstation's Local Area Network connections and any existing VPN connections.

Double click on the VPN connection that you have created, and then click the Connect button. You will now be prompted to enter a user name, password, and a domain name. Click OK after entering this information, and a connection will be established to your VPN / NAP server.

Shortly after the connection is established, you should see a message bubble appear at the bottom of the screen displaying the following message:

This Computer Does Not Meet Corporate Network Requirements. Network Access is Limited.

You can see the exact message, shown in Figure E.

Figure E: When the firewall is disabled, you should receive this message upon establishing a VPN connection

Shortly thereafter, you should see the Windows Firewall icon change to indicate that the firewall has been enabled. When this happens, you will see another pop up bubble displaying the following message:

This Computer Meets Corporate Network Requirements. You Have Full Network Access.

You can see the actual message in Figure F.

Figure F: When the NAP Server enables the Windows Firewall, this is the message that is displayed

The message shown in Figure F will also be displayed when a computer that fully meets the corporate network requirements connects to the NAP server through the VPN connection.

Network Access Protection (Part 6)

Creating a default authentication policy.

In the previous article in this series, I showed you how to create authorization policies for both compliant and for non compliant computers. In this article, we will complete the server configuration procedure. The first step in doing so is to create a default authentication policy that can be applied to any machine that authenticates through the RRAS server.

Begin the process by opening the Network Policy Server console and navigating through the console tree to NPS (Local) | Authentication Processing | Authentication Policies. At this point, the details pane should display any previously existing authentication policies. Delete the existing policies by right clicking on them and selecting the Delete command from the resulting shortcut menu.

Now it's time to create a default authentication policy. To do so, click the New link found in the Actions pane and then choose the Custom option. Windows will now display the New Authentication Policy properties sheet, shown in Figure A.

Figure A: Enter RRAS as the policy name and then verify that the policy is enabled

Enter RRAS as the policy name, and then verify that the Policy Enabled check box is selected. Next, make sure that the Available Sources radio button is selected, and then select the Remote Access Server (VPN-Dialup) option from the Available Sources drop down list.

Now, switch to the Settings tab and select the Authentication container from the console tree. Now, select the Override Authentication Settings from Authorization Policy check box. When you do, the details pane will display a variety of authentication methods, as shown in Figure B. Select the EAP check box, and then click the EAP Methods button.

Figure B: Select the EAP check box and then click the EAP Methods button

Windows will now display the Select EAP Providers dialog box. Click the Add button to reveal a list of EAP authentication methods. Choose EAP-MSCHAPv2 and Protected EAP (PEAP) from the list and click OK. The selected EAP authentication methods should now be displayed in the Select EAP Providers dialog box, as shown in Figure C. Click OK to continue.

Figure C: You must enable MSCHAPv2 and PEAP authentication

Now go to the Conditions tab. You must select at least one condition that must be met in order for the policy to be enforced. You can set any condition that you want, I recommend navigating through the console tree to Connection Properties | Tunnel Type and then selecting the Point to Point Tunneling Protocol and the Layer Two Tunneling Protocol check boxes and clicking the Add button. That way the new authentication policy will apply to VPN connections. Click OK to save the new authentication policy that you have created.

RADIUS Client Configuration Policy

In this type of deployment, the Network Policy Server acts as a RADIUS server. Rather than clients performing a direct RADIUS authentication against the Network Policy Server, the RRAS server that is acting as a VPN server is going to be acting as the RADIUS client.

The last step in the server configuration process involves providing the Network Policy Server with a list of authorized RADIUS clients. Since the only RADIUS client is going to be the VPN server, you will simply enter the VPN server's IP address. Since the RRAS services are running on the same physical server as the Network Policy Services, you will simply use the server's IP address.

To create a RADIUS Client Configuration Policy, navigate through the Network Policy Server console tree to NPS (Local) | RADIUS Clients. Now, click the New RADIUS Client link found in the Actions pane. Windows will now launch the New RADIUS Client Wizard.

On the wizard's initial screen, you will be prompted to enter a friendly name and an IP address for the new RADIUS client. In a real world deployment, you would enter RRAS as the friendly name and you would enter the RRAS server's IP address into the space provided. As you will recall, this is a lab deployment, and RRAS is running on the same server as the Network Policy Services. Therefore, enter the server's own IP address into the space provided and click Next.

At this point, the wizard will display the Additional Information screen. This screen asks you for a client vendor and for a shared secret. Select RADIUS Standard as the Client Vendor. For the purposes of this article, enter RRASS as the shared secret. Select the Client is NAP Capable check box, as shown in Figure D, and click Finish. You are finally done configuring the Network Policy Server!

Figure D: Enter a shared secret and select the Client is NAP Capable check box

Client Configuration

Now that we have finished configuring the Network Policy Server, it's time to configure a client to connect to the server. Keep in mind that the technique that I am about to show you will only work on clients that are running Windows Vista.

For the purposes of this article, I am assuming that the client machine is running Windows Vista, and that it is configured with a static IP address. As you may know, Windows Vista is designed to run IPv6 by default. Network Access Protection should eventually support IPv6, but being that Windows Longhorn Server is still in beta testing, it seems that IPv6 is currently unsupported when it comes to Network access protection. That being the case, you should disable IPv6 on the machine's network configuration. When Longhorn Server is eventually released, I intend to write an update to this article series that addresses the use of IPv6, as well is anything that has changed since the beta.

The client computer should also be configured as a member of the domain that contains the Network Policy Server. In addition, the domain should contain a user account that you can use to log in to the Routing and Remote Access Server that you have created.

Now let's create a Virtual Private Network connection that you will eventually be able to use to test the Network Access Protection server. To do so, open the Control Panel and click on the Network and Internet link, followed by the Network Center link. When the Network Center opens, click the Set up a Connection or Network link. You should now see a screen asking you what type of connection you want to create. Click the Connect to a Workplace option and then click Next.

Choose the option to connect through a VPN, and you'll be prompted to enter a Internet address and a destination name. You should enter the IP address of the RRAS server into the Internet Address field. You can enter anything that you want into the Destination Name field. Select the Allow Other People to use this Connection check box, and click Next. You must now enter a user name and password for a user who has permission to logon to the RRAS server, as well as the name of the domain that you will be logging onto.

Click the Connect button and Vista will attempt to connect to your RRAS server. More than likely, the connection will fail. When you receive the message stating that the wizard cannot connect to your workplace, click the Setup a Connection Anyway icon. This will save your settings so that we can finish customizing them in the next part of this series.