Vista in the Enterprise

In our other articles on Windows Vista so far, we have

looked at it in bits and pieces and examined its user interface and some of the

cosmetic changes that have been made. Those were meant to give you an idea of

the general look and feel of the system. In this series, we'll drill deeper

and tell you about new features and services in the OS that could affect you as

a user or a network administrator. We've used the build 5270 for this article,

which we may update to future builds as they become available.

Security features



We found that the Vista build we tested had very tight security, so

much so that almost any system management application like Task Manager,

Registry Editor, anything that uses MMC, which a user launched was subject to a

Permit/Deny prompt. This would not have been an annoyance had these actions been

recorded, so that you would only face them once. Possibly the final release will

take care of this. However, the funny thing was that programs (especially

installers) could start and stop processes at will and make changes to the

registry. We managed to install lots of third party applications on Vista, and

we didn't get any security warnings. So even a program with a hidden malware

plug-in could easily slip through. Does this go to say that users are the

malware and not the applications?

Vista is also supposed to have the new User Authentication

Protocol (UAP), which is supposed to enhance its security. In this, the less

privileged user accounts won't be allowed to install anything on the system,

without first providing the administrator's username and password. However, if

users login as administrators into the local machine, then UAP is useless.

It's therefore up to the network administrator to control the setup.

Currently, there's a lot of debate happening on its true capabilities. Let's

see what finally comes out.

In Win XP, you could prevent certain programs from running

by turning off the related service or preventing the executable from

auto-starting. Vista didn't seem to allow us to do that in this build. No

matter what we tried to turn off, warnings kept appearing out of nowhere.

P2P services



While network administrators scramble to block P2P clients and ports

on their systems, Vista introduces at least four new services that integrate P2P

into the OS itself! These include a new protocol called PNRP (Peer Name

Resolution Protocol) and three services viz. Peer Networking Grouping, Peer

Networking Identity Manager and the PNRP Auto Registration. While the

description for the last service reads 'This is a temporary Beta 1 service',

there are no such promises for the other three. These of course, also affect the

'People Near Me' program in Vista where it lets you establish P2P sessions

with other Vista users 'near' you. Disabling these four services in build

5270 did not impair the system's normal abilities in anyway.

The Health Monitor in Vista displays the vital system instability information at a glance		The Event Viewer provides more detailed information, along with an XML detail view

Lots of services



Vista has 26 services in all and more than 50 percent of them can be

safely turned off. However, some of these are interesting and we examine some of

them briefly below. Rest will be discussed in subsequent issues.

Base Filtering Engine: This manages both the firewall and

IPSec policies on the system. Unless you plan to turn off the firewall and IPSec,

leave this one working. It runs under the Local Service account, hosted by the

'svchost' environment.

Group Policy Client: As the name suggests, this is the

service to blame if changes to the Group Policy are not applied. Strangely this

service seems to be needed on standalone Vista PCs too and if you try to stop

it, you get an 'Access Denied' message.

Multimedia Class Scheduler: Needed for all multimedia on

the PC, even for basic sound to work. The service is meant to change thread

priorities of multimedia tasks based on performance demands.

Network Store Interface: This is a user-mode service and

basic services like IP and Network Location Awareness depend on it. It maintains

a list of network interfaces and helps manage them.

Software Licensing: A separate 'SL UI Notification

Service' is now in charge of licensing and activation related notifications.

This service is responsible for actually enforcing licensing on the system.

There is an attached warning that programs aware of this service may run with

reduced functionality if the service is disabled.

Thread Ordering Server: At the root of all multi-threaded

applications on your system, this service manages threads and schedules their

prioritized execution. Other services like the Windows Audio in-turn depend on

this service.

User Experience Session Management: Manages the desktop and

user session. Unless you want the Vista theme running, you could turn this off.

User Profile: Manages user profiles, loads and saves them

and so forth. Windows now strongly uses the profile system, even if you're

using an isolated desktop with just one user. So, you need to leave this on.

New in diagnostics



When things go wrong, Vista has a lot to offer in terms of the

built-in diagnostic tools. It does remain to be seen how much of them would

remain accessible or usable when there's a real problem. There are mainly two

tools for this, both accessible from the Computer Management console. The first

is the Reliability Monitor and the second is the Diagnostic Console. Then there

are specific tools for disk and memory. We look at each below.

Reliability Monitor



This monitor is sparsely functional now, but looks promising as the

product heads to release. Right now, all you can do with it is view the data it

collects. There's a calendar to the right of the pane with the report, but it

does not seem to let you change a date. You can however click on the vertically

arranged dates just under the reliability graph, or the points marked on the

graph itself. Also, it does not seem to need any active service. Once a

particular date or range of dates has been selected, the pane below the graph

updates to show specific failures or incidents viz software changes, application

crashes, driver failures, hardware failures and failures in Windows subsystems

itself. This is useful if you'd like to know more or less at a glance what's

been happening on the system. But for more details and specifics, you need to

look to other tools.

The event tracer agents can be configured to a high degree. It allows the setup of what providers to poll for trace information		This is the main diagnostics console screen that provides vital performance information at a glance

Diagnostic Console



This is a single point console for diagnostic and monitoring activity. You have
four items under this — System Monitor, Data Collector Sets, Reports and Event

Trace Sessions. The System Monitor is nothing but the old Performance Monitor,

looks and behaves the same familiar way too. Although a wizard opens up when you

click on 'New' under Data Collector Sets, you can only cancel it so that's

not of much use now. And there are no predefined sets to play with. Reports is

also blank and Event Trace Sessions is a list of active agents that are

collecting diagnostic data. You can double-click (or select Properties from its

context menu) to set up each agent. Settings include everything from security to

trigger conditions and alarms. You can have each agent save its logs to a

different directory and configure its polling intervals.

The console's main screen (when you click its main node

in the tree) is a very informative on a number of points. It tells you at a

glance, graphically, what's happening in the CPU, disk, network and memory.

You can double-click on one of the graphs or on the dropdown arrows to get

further details of that particular subsystem. This lists all processes using

that resource with individual usage counts.

Disk and Memory Diagnostic Tools



You can launch the memory from Accessories>System Tools. But it

will run only on boot up and cannot be run from within the Windows environment.

So, you should use one of the two options on the dialog to schedule for next

boot or reboot and run immediately. This tool will scan your system's RAM

thoroughly for any problems and tell you if you need to replace memory. We have

seen similar tools before in other third party troubleshooting software, but

this is the first time that it comes with Windows. The disk diagnostic is

nothing but good old CHKDSK that we know from the NT days. It is a little more

verbose and lets the user know what's happening instead of just the dumb

progress bar we're used to. It is also a little faster than before.

Event Viewer



The old event viewer was an interface where you saw reports from a

fixed set of event sinks. You couldn't make your own or customize it to

something more comfortable. Now all that is changed. If you'd like to see

events from any software subsystem, you can now do that with just two clicks.

What you need to do is open the Event Viewer node and click on the 'Add

Application View' menu item from the right-side pane. From the small dialog

that appears, select the item you want to see events of and that's it. Do note

though that this can make your system take a performance hit on some PCs. This

new event viewer also has a new section called 'Critical and error events in

global logs' (under the 'Views' node) where all the critical items from

all the logs under the 'Global logs' set come in automatically.

And, haven't you ever wished that you could automatically

run the Disk Cleanup agent or a batch task when your disk is full? Now that can

be done. From the event viewer, you can attach a scheduled task to be triggered

whenever a particular item is logged. This is as simple as selecting 'Attach

Task to this Event' from the right-side pane after selecting some event entry

first. Do note that the Task Scheduler Service should be started before you can

attach tasks. The new 'details' pane for each event log entry displays

content in XML format. You can change to 'Friendly view' by clicking the

almost invisible radio field just above the XML field to see what exactly it is.

We shall see some more interesting aspects of Vista that

will impact its use in your enterprise in the forthcoming parts of this series.

Sujay V Sarma