What could be geekier than a t-shirt imprinted with actual source code from a tool that helps administrators around the world tame one of the most dreaded beasts in IT: permissions?

On my quest for a decent PowerShell development tool I first tried out PowerGUI, but was not very happy with it. When the RTM version of PowerShell 3.0 along with a revamped ISE was released a few days ago, I decided to give it a try. Here is what I found.

This is a complete listing of all Windows 7 HKEY_CURRENT_USER registry permissions. The list was generated on a 32-bit installation with SetACL. More default permission listings can be found here.

This article is part of my small series about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. AppLocker and UAC One of the default rules allows unrestricted application execution for administrators. That is only sensible. After all, someone needs to be able to troubleshoot and perform maintenance. However, if UAC is enabled, that rule is not very useful. Remember: UAC filters the SID for the group Administrators from the access token during normal operation. With the Administrators’ SID gone, AppLocker is active for administrators in the same way it is for all other users. Administrators wishing to bypass AppLocker need to start executables from an elevated command prompt (or right-click and select run as administrator), which is often impractical.

This is a complete listing of all Windows 7 file system permissions. The list was generated on a 32-bit installation with SetACL. More default permission listings can be found here.

This article is part of my small series about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. AppLocker Security There is no perfect security, every product has its vulnerabilities and AppLocker is no exception. These are the problems I am aware of.

Due to a lack of visibility permission cleanup is performed far less frequently than it could, and probably should. As a result, ghost ACEs (permissions from deleted accounts) linger in the dark corners of the file system, threatening the unsuspecting admin with the horrors of unresolvable SIDs.

This is the first in a small series of articles about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. Requirements AppLocker works on:

When you are planning a migration of user accounts between domains one task always pops up pretty quickly: reassigning the permissions of the users in the source domain to the corresponding users in the target domain, in other words reACLing the file server.

Windows 7 comes with several features that promise to greatly improve file access over a WAN. One of them is version 2 of the SMB protocol, another transparent caching. This article describes how I measured their effectiveness.

FantecA drive enclosure for 4 SATA drives, connected to the host via USB 3.0 and presented as JOBDs is a great and inexpensive method of adding a lot of hard drive capacity to your computer, e.g. for backup purposes. The enclosure model I have bought is the Fantec QB-35US3. It is compact, the fan not too loud and vibrations from the four drives are kept amazingly low. It can be connected via USB 3.0 and eSATA, but USB is simpler because eSATA requires a port with a multiplier-capable chipset, which is rare. At a retail price of around € 150 the Fantec is relatively inexpensive.

[Update on 29/06/2012: added tests 5 and 6 with RAID controller cache and Atlantis Ilio] When a 400 GB SSD comes nearly at the price of a small car, you expect a lot, performance-wise. At least I did when I got my hands on two drives from HP’s enterprise performance series. Read on to find out if that hefty price tag is justified.

I had a very interesting case recently where copied EXE files could not be deleted. They would simply remain in the folder like zombies, only to disappear a few minutes later.

Configuring an HP Elitebook with integrated HS2340 mobile broadband module to use the 3G connection can be a little tricky. Here is how it works - without third-party dialer software!

As you may know helgeklein.com also hosts a forum where I help people who have questions related to my software. The forum is configured to send out e-mails when new posts are added or when newly registered users need to confirm their e-mail addresses. Since I use Google Apps for helgeklein.com I configured Google’s SMTP server for outgoing e-mails. All worked well until recently when I started to wonder why I had not received new forum post e-mails for several days.

The HotPlug functionality of VMware ESX(i) 4 and 5 has the negative side effect that it is easily possible to “eject” hardware devices from inside the virtual machine, completely removing the respective device from the VM configuration. This is especially bad if it happens to the network card, and others have already described how to prevent that from happening (e.g. here and here).

If you want to disable the BitLocker service via Group Policy Preferences, you will find that you cannot. The service’s startup mode stays at “manual” and the following event is logged to the application event log:

In this article I explain how to create a template for Microsoft User Experience Virtualization. For details on how UE-V works please see my earlier article Microsoft User Experience Virtualization (UE-V): Facts and Review. As a sample application I used my permission management tool SetACL Studio.

16 years after roaming profiles made their debut in Windows NT 4.0 Microsoft takes another stab at synchronizing user settings across devices - a very different one. As we will see, UE-V is radically different from roaming profiles, but so similar to some other user environment management products that it seems like a best-practices implementation.

Windows Offline Files have a bad reputation. Many an administrator can tell a story where Offline Files caused issues that sometimes even required a reinstallation of the affected PC. But Microsoft has gradually improved the functionality and ironed out many of the bugs. Today - in Windows 7 SP1 with all post-SP1 fixes - Offline Files is a technology that still has its problems, but can be used in production - if you are adventurous. This article lists the gotchas I am aware of.

When I first read about Storage Spaces in the Windows 8 blog, I was enthusiastic. Finally a replacement for the drive extender technology Microsoft let die so cruelly. Having used Storage Spaces for several weeks now, I am not so sure any more.

Having a server at home is a great luxury, but having a computer running 24x7 is an extreme waste of energy. Turning it on and off manually is not very appealing, either. Luckily we have to do neither. Windows can easily be configured to put the computer into sleep mode (where modern PCs consume approx. 1 Watt) and have it wake up upon access.

Shadow keys have been around forever, since way before Terminal Services were renamed to Remote Desktop Services (does anybody use that name?). It seemed they would stay in the OS forever, too. Yet, when installing applications on Server 2008 R2 many people notice that the shadow key area does not get populated. Let us find out why that is the case and if shadow keys still work in Server 2008 R2.

Did I mention I love the new Task Manager in Windows 8? It is brilliantly designed, conveying tons of meaningful information while looking very good. This article is not about Task Manager, though, but about Windows 8 - its Storage Spaces functionality, to be exact. But I will be using Task Manager to analyze the performance of Storage Spaces. And with that, we are back where we started.