WCL201 Windows Vista Application Compatibility and the Microsoft Application Compatibility Toolkit (ACT) 5.0 (WCL201) Suma SaganeGowda Program Manager Application Compatibility Toolkit Microsoft Corporation Peg McNicol Product Manager Application Compatibility Toolkit Microsoft Corporation

Agenda Windows Vista – Innovation and Compatibility Top Compatibility Issues in Windows Vista Application Compatibility Toolkit (ACT) 5.0 Call To Action Resources Question and Answer

Innovation and Compatibility 4/20/2017 9:09 AM Innovation and Compatibility Windows Vista Pillars Security Reliability Application Compatibility (most applications just work) Performance Feedback and Supportability Improvements in Windows Vista occasionally break compatibility. Microsoft has created these tools and services to help with Application Compatibility Application Compatibility Toolkit 5.0 (ACT) Windows Vista Upgrade Advisor 1.0 Vista Readiness Assessment Tool Application Compatibility Factory Windows Logo programs SWAT team and on campus labs

Agenda Windows Vista – Innovation and Compatibility Top Compatibility Issues in Windows Vista Application Compatibility Toolkit (ACT) 5.0 Call To Action Resources Question and Answer

Top Compatibility Issues With Windows Vista User Account Control (UAC) Windows Resource Protection (WRP) Internet Explorer 7 Protected Mode Windows Vista 64-bit Windows Filtering Platform Deprecations/GINA/Session 0 (High Impact/Low Frequency) Operating System Version Change Overall, high compatibility in Windows Vista

User Account Control (UAC) 4/20/2017 9:09 AM User Account Control (UAC) Description Enabling users to run with a standard user account Security feature to reduce introduction of vulnerabilities (Malware, Trojan, Viruses) Issues Custom installers and updaters need administrator privileges Unnecessary administrator checks Writing to file or registry locations that are not virtualized Mitigation Some common shims - Virtualization shims, Force Admin Access Relax ACL's on files and folders

Windows Resource Protection (WRP) 4/20/2017 9:09 AM Windows Resource Protection (WRP) Description Increase system stability by protecting Windows resources (files, folders, registry). Issues Application installers that attempt to replace, modify, or delete OS files and/or registry keys that are protected will fail with an access denied error message because the resource could not be updated. Remedies Never repackage Microsoft redistributables (use the Microsoft provided redistributable package instead). Do not write to system files and registry keys.

Internet Explorer 7 Protected Mode 4/20/2017 9:09 AM Internet Explorer 7 Protected Mode Description Internet Explorer 7 runs in Protected Mode, with greatly restricted privileges Issues IE cannot modify user files, registry keys Applications may not know how to handle new prompts requesting user permissions Mitigation Add the site in question to the trusted sites list.

Windows Vista 64-bit Description Issues Remedies Windows Vista fully supports the 64-bit architecture processors from AMD and Intel. The 64-bit version of Windows Vista can run all 32-bit applications with the help of the WOW64 emulator. Issues Applications or components that use 16-bit executables, 16-bit installers or 32-bit kernel drivers will either fail to start or will function improperly on a 64-bit edition of Windows Vista. Remedies Remove all 16-bit components. Convert 16-bit installers to 32-bit or 64-bit installers Ensure that all 64-bit drivers are digitally signed

Windows Filtering Platform Description The Windows Filtering Platform (WFP) API allows developers to create code that interacts with the filtering that takes place at several layers in the networking stack and throughout the operating system . Publicly supported APIs. Issues Network scanning anti-virus and firewall applications will fail Remedies Update applications to use the new WFP APIs Microsoft is engaged with networking, firewall and anti-virus vendors to adopt the new platform

Deprecations Description Issues Remedies Deprecations – removal of APIs or DLLs from Windows Vista that existed in Windows XP Issues Applications lose functionality or don’t start up correctly Remedies Search MSDN to look for replacement of API

Graphical Identification and Authentication (GINA) Description Windows Vista introduces a new authentication model (new Credential Provider API) Issues Users will not be able to logon using Custom logon applications. These may include: Biometric devices (fingerprint reader) Custom UI for logon Virtual private network (VPN) solutions for remote users with custom logon UI Remedies The applications or components that use the GINA technology will need to be re-authored to use the new logon authentication model for Windows Vista For all credential provider information and questions, send e-mail to the Shell Credential Provider alias: credprov@microsoft.com

Session 0 Description Issues Remedies Services are isolated to run in their own private Session (Session 0) to enhance security. Users no longer share this session Issues Services with user interaction may hang as UI is not visible to the user Remedies Update Apps, to ensure services do not display UI In-box mitigation where notification is sent to current user when there is UI in Session 0

Operating System Version Change Description The internal version number for Windows Vista is changed to 6. The GetVersion function will now return this version number to applications when queried. Issues Any application that specifically checks for the OS version will get a higher version number which it may not be designed to handle Application installers may prevent themselves from installing and applications may prevent themselves from starting. Mitigation Use compatibility administrator and apply XP SP2 layer or version lie shim

Agenda Windows Vista – Innovation and Compatibility Top Compatibility Issues in Windows Vista Application Compatibility Toolkit (ACT) 5.0 Call To Action Resources Question and Answer

Application Compatibility Toolkit Customer Target Medium/Large Businesses and Large Enterprises Mission A lifecycle management tool that assists in identifying and managing your overall application/device/computer portfolio, reducing the cost and time involved in resolving application compatibility issues, and helping you quickly deploy Windows Vista and Windows Updates. Strategy Help detect, diagnose, and mitigate compatibility issues found in Windows Vista Microsoft Compatibility Exchange to facilitate exchange of compatibility data between ISV/IHV, Microsoft, and customers Deliver tools that are timely and relevant to Windows releases

ACT 5.0 - High Level Architecture 4 Compatibility Exchange Desktop Topology Europe North America HR Finance 2 Log Processing Service Internet 1 Agent Framework/Compatibility Evaluators 3 Inventory IE UAC UCE Etc… Local ACT DB Application Compatibility Manager Betty Wilma

ACT Methodology Collect Data Analyze Test 4/20/2017 9:09 AM ACT Methodology Collect Data Analyze Test Inventory Applications and Devices Gather high-level compatibility evaluator data Prioritize and Categorize Synchronize data with Microsoft Compatibility Exchange Identify high-level issues In-depth testing with dev/test tools Log test data Build and test mitigations

COLLECT Inventory and Compatibility Data 19

ACT Data Collection Architecture Data Collection Packages Inventory Collector IE Evaluator UAC Evaluator Vista Evaluator Application Compatibility Manager ACT Database Log Processing Service Desktop Topology 20

Compatibility Evaluators for Vista Inventory Collector Gathers data on a computer regarding applications, devices (device manager), and system information. User Account Control Detects which applications may have issues with running as Standard User on Vista Windows Vista Deprecations - identifies applications that are loading binaries or using APIs that will be removed in Vista GINA - identifies applications that installed a Graphical Identification and Authentication (GINA) DLL Session 0 - identifies applications with interactive services Internet Explorer Detects compatibility issues with web applications due to IE security features

Compatibility Evaluator for Updates Detects applications impacted by Windows Updates Windows Updates Enterprise Desktop Topology Update Compatibility Evaluator Update Manifest Update Compatibility Evaluator Data Application Compatibility Manager

4/20/2017 9:09 AM ACT - Collect

ANALYZE Prioritize, Categorize, Rationalize, Synchronize and Manage compatibility data 24

Prioritize, Categorize, Rationalize Application A 1.0 Application A 1.1 Application B 1.0 Application Test List with Redundancy Removed Business Critical Important Nice to Have Unimportant Software Vendor Third Party Custom Microsoft Corporation Test Complexity High Medium Low Division Research and Development Finance Sales Region North America Europe Asia 25

Consolidated view from all data providers Application Compatibility Manager My Assessment Vendor Assessment Certified for Windows Vista Works with Windows Vista Community Assessment Microsoft Assessment

Microsoft Compatibility Exchange 4/20/2017 9:09 AM Microsoft Compatibility Exchange Works for me! 1. Community See risk rating and/or issues summary IT Pro (Enterprise A) IT Pro (Enterprise B) Compatibility Exchange Internet Features: IT Pros helping each other out by sharing of application compatibility rating with community Secure and privacy compliant transactions Simple and easy to share Submission can be anonymous or by user name Partner with MCS and deployment specialist in building and seeding community data Scalable solution Analysis and Reporting App Compat Testing Certify app works or Publish issues ISV Microsoft Logo and Certification 2. Authoritative Sources Features: Feedback mechanism to vendors on most requested applications Authoritative data compliments community rating Leverage existing Microsoft data repositories (test, certification, logo, vendor portal) Limited data due to dependencies on Vendor Portal and test team

4/20/2017 9:09 AM ACT - Analyze

TEST AND MITIGATE Test, Debug, Resolve, Deploy Solutions 29

Developer and Tester Tools Standard User Analyzer Provides a way for testers to further test the LOB applications to determine what will fail as Standard User on Vista Internet Explorer Test Tool Provides a way for testers to further test the intranet web applications to understand the exact issue and determine which of their web applications will not work with IE 7 Setup Analysis Tool Detects issues such as WRP, installing of 32 bit kernel mode drivers, 16 bit components to flag any of your packages which could run into this issue Compatibility Administrator Helps IT Admins, Developers, Testers create and test compatibility shim/fixes (no code changes required)

4/20/2017 9:09 AM ACT – Test and Mitigate

Standard User Analyzer The Standard User Analyzer is a tool to help diagnose potential issues with an application when it is run as a standard user Based on LUA Predictor technology in Application Verifier (AppVerifier) Intercepts common API calls which usually require elevated privileges Predicts whether these API calls would have succeeded as a standard user 32 3232

SUA - API Coverage File system access (e.g. Program Files) Registry access (e.g. HKLM) INI WriteProfile (privileged locations) Token checking (explicit checks) Privilege (e.g. enabling SeDebugPrivilege) Namespace (creating global objects) Other securable objects (events, mutexes, waitable timers, semaphores, etc.) Process creation (attempting to launch another process which requires elevation) 33

Internet Explorer Compatibility Test Tool Installs the IE Compatibility Evaluator Enables Internet Explorer logging Compatibility issues are recorded in the event log IECE processes the event log to list events You can see the events real time, helps for easy debugging 34

ACT Feature Comparison ACT 5.0 Beta ACT 5.0 RTW Client tool for Reporting and Analysis  Configuration Wizard Inventory Collector Internet Explorer Compatibility Evaluator (websites) UAC Compatibility Evaluator Update Compatibility Evaluator Microsoft Compatibility Exchange Website Reports (integrated in ACM) Prioritize, Categorize, and Deployment Tracking Devices Support Vista Compatibility Evaluators (GINA, Session 0, Deprecated Components) Compatibility Administrator (fix applications) Filter and Custom Report Developer Tester Tools (IE, SUA, Setup Analysis) Integration with SMS

Call To Action Download ACT 5.0 RC Now!! http://connect.microsoft.com/site/sitehome.aspx?SiteID=81 Windows Vista Application Compatibility Training 2.5 days of intense learning to detect, troubleshoot and mitigate Windows Vista application compatibility issues Day 1: Windows Vista Application Compatibility Fundamentals - Lectures and demos to recognize and resolve the most common Windows Vista app compatibility issues: User Account Control (UAC), Windows Resource Protection (WRP), Session 0 Isolation, IE7 protected mode and more Day 2: Application Compatibility tools and techniques - Lectures and hands-on-labs about ACT 5.0, Standard User Analyzer, LUA Buglight, Shims and other troubleshooting techniques Day 3: Debugging Demystified - Hands-on-labs for setting up a debugging environment, debugging failed apps with WinDbg, and handling crash dumps Provided free of charge by the AE SWAT team Contact: aecoe@microsoft.com Leverage services provided by Microsoft and Partners Application Compatibility Factory, On campus labs, Windows Logo Program

Application Compatibility Resources 4/20/2017 9:09 AM Application Compatibility Resources For IT Professionals: Application Compatibility in Windows Vista http://www.microsoft.com/technet/windowsvista/appcompat/default.mspx Business Desktop Deployment Solution Accelerator http://www.microsoft.com/technet/desktopdeployment/bddoverview.mspx Download ACT 5.0 RC http://connect.microsoft.com/site/sitehome.aspx?SiteID=81 For Developers: Application Compatibility Cookbook http://msdn.microsoft.com/windowsvista/default.aspx?pull=/library/en-us/dnlong/html/AppComp.asp  Windows Vista Application Development Requirements for User Account Control http://download.microsoft.com/download/5/6/a/56a0ed11-e073-42f9-932b-38acd478f46d/WindowsVistaUACDevReqs.doc Questions related to SUA suatool@microsoft.com ACT Newsgroup: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.deployment.app_compatibility

Related Sessions Breakout Sessions/Chalk Talks HOL’s WCLCT07 – Windows Application Compatibility and the Microsoft Application Compatibility Toolkit (ACT 5.0), Thu Nov 16 10:45 - 12:00 WCLCT05 - Business Desktop Deployment (BDD) 2007 and Vista Deployment Best practices, Thu Nov 16 13:30 - 14:45 MGTCT07 - Drilldown into SoftGrid Application Virtualization, Fri 17 Nov 13:30 -14:45 MGT324 - Vista and Office 2007 in a Flash: Accelerating your Vista and Office 2007 Deployments with SoftGrid and SMS 2003, Fri 17 Nov 9:00 - 10:15 MGT320 - Using Application Virtualization to Decrease Your Application Management TCO, Fri 17 Nov 15:15 - 16:30 HOL’s WCLHOL09 - Application Compatibility Toolkit for Windows Vista (ACT 5)

Ask The Experts Get Your Questions Answered You can find us at the Microsoft Ask the Experts area, located in the Exhibition Hall: Thursday 16 November 14:45 – 15:45 Friday 17 November 10:15 – 10:45 Friday 17 November Lunch

Compatibility Evaluators – Supported Platforms Agent Windows 2000 Windows XP Windows Server 2003 Windows Vista Collector Yes IECE No Yes (with IE7) UACCE Vista (Deprecations/ GINA/Session 0) IE Test Tool Setup Monitor Yes - Guest only SUA UCE

Inventory Collector Scans computer for devices, application, and system information Locations we search for applications - .Msi (Windows Installer database) Add/Remove Programs (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*) Windows Shell (Start menu) App Path (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\*) Locations pointed to by path environment variables (%PATH%) Registered file extension handlers (HKEY_LOCAL_MACHINE\Software\Classes\*) Registry Run (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\*) Service Control Manager (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\*) (Filters out Windows Components/Features)

User Account Control Compatibility Evaluator Detects what applications will have issues with running as Standard User on Windows Vista Issues Detected - File Operations Lets the user know if the file will be virtualized If not, lets the user know the access is restricted (e.g. locations like Program Files which only admins have access) Registry Operations Lets the user know if the registry key will be virtualized If not, lets the user know the access is restricted (e.g. locations like HKLM which only admins have access) Profile API operations Checks if any applications are writing into any system ini files (including win.ini) Elevation Detection Detects applications that need to run elevated/ as administrator (i.e. setup.exe)

Internet Explorer Compatibility Evaluator Detects Compatibility issues with web applications due to IE security features Issues detected - (IE6) - LMZL, Mime Handling, Windows Restrictions, Zone Elevation, Binary Behaviors, Object Caching, ActiveX Blocking, Popup Blocking, Download Blocking, CURL - Centralized URL Parsing, International Domain Names (IDN) Support, SSL, XDom Barrier, Manage Add-ons, Anti-Phishing, Cross Frame navigation, CSS fixes (IE7) - All of the above plus: Protected Mode More details about the issues http://msdn.microsoft.com/library/default.asp?url=/library/en-us/IETechCol/cols/dnexpie/ie7_compat_log.asp?frame=true

Windows Vista Upgrade Advisor Customer Target Consumer and small businesses Mission Assist customers in upgrading from Windows XP to Windows Vista Features Scans a single computer to create compatibility report for upgrading to Windows Vista Provide reports on system, device, and application compatibility issues Helps you choose the edition of Windows Vista best fits the way you use your computer

©. 2006 Microsoft Corporation. All rights reserved © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.