Following an earlier report on the 14 September by Scott Dunn on the Windows Secrets Web site that the Windows Update service made changes to files on both Windows XP and Vista, without prompting the user for permission, Nate Clinton, Microsoft Update program manager responded on the October 12 in a posting on the Microsoft update product team blog denying that Automatic Updates had made any changes to a users’ automatic update settings, several possible explanations for automatic updates were later added.

Now a recent report on the Windows Secrets web site states that Windows Live OneCare, an Operating System security service featuring an integrated protection suite could be among the root causes of ongoing unwanted automatic updates to Windows programs and applications by silently changing the automatic update settings causing the automatic installation of patches followed by an overnight reboot.

To read the windows secrets article Click Here

.

This is the second in a series of short exercises on Windows Server 2003, XP and Vista

User Account Control (UAC) is a feature in Windows Vista that can help you prevent unauthorized changes to your computer. It works by prompting you for permission and the screen goes dark, when a task requires administrative rights, such as installing software or changing settings that affect other users as shown below:

Although UAC improves the security on Windows Vista it can become annoying and although not recommended this feature can be disabled

There are a number of ways available to disable this feature if required, the simplest is using the Control Panel as outlined in the following steps:

Note: Before proceeding with these steps it is important to realise that disabling UAC will make your system less secure, therefore ensure that you have up to date anti-spyware as well as anti-virus software

• From the Start menu select the Control Panel.
• Under User Account and Family settings click on the “Add or remove user account”.

• Click on one of the user accounts, for example you can use the Guest account.
• Under the Choose the account you would like to change page, shown below

• Click on the “Go to the main User Account page” link shown below.

• Select “Turn User Account Control on or off”

• The check box “Use User Account Control (UAC) to help protect your computer”. Remove (to disable) or add (enable) the check as required, when prompted reboot your computer.

.

This is the first in a series of short exercises on Windows Server 2003, XP and Vista

With Windows Server 2003 uses a feature called the Event Tracker has been enabled which requires the Administrator to provide a reason each time the Server is shut down or restarted.

For a test environment this feature can be disabled the following exercise reviews how to achieve this. To undertake the following you must have administrative rights

To Disable the Event Tracker

From the Start > RUN menu type: GPEDIT.MSC this will open the Group Policy Object Editor

Locate the ‘Display Shutdown Event Tracker’ properties in the right hand pane under the Computer Configuration > Administrative Templates > System object

The screen shot below shows the Group Policy Object Editor

.

Microsoft last week released the Microsoft Security Advisory 943521 detailing a recently discovered URL Handling Vulnerability in Windows XP and Windows Server 2003 with Windows Internet Explorer 7, other applications affected include Firefox, Skype, Acrobat Reader, Miranda and Netscape.. According to Microsoft, Vista and earlier versions of IE are safe.

The United States Computer Emergency Readiness Team (US-CERT), on its Website, gave an example of how the flaw could be exploited: “For example, a “safe” protocol such as mailto: may be incorrectly handled with an “unsafe” application, such as the Windows command interpreter. This can allow the unexpected execution of arbitrary commands.”

After being notified by Heise Security, Firefox fixed this problem with security update 2.0.0.6. Skype also fixed the problem with security update 3.5.0.239.

The Microsoft security advisory did not state when an update would be ready, but the next monthly “Patch Tuesday” release is scheduled for 13 Nov 2007.

On the Microsoft Security Response Center website, Jonathon Ness wrote “Our plan is to revise our URI handling code” he then continued “While our update will help protect all applications from malformed URI’s, application vendors who handle URI’s can also do stricter validation themselves to prevent malicious URI’s from being passed.”

.

As most of you will be aware Microsoft are offering an upgrade route for an MCSA or MCSE qualified on Windows Server 2003 to MCTS on Windows Server 2008

The transition exams are:

• 70-648 – TS: Transitioning your MCSA on Windows Server 2003 to Windows Server 2008 Technology Specialist

• 70-649 – TS: Transitioning your MCSE on Windows Server 2003 to Windows Server 2008 Technology Specialist

These will be available on the 29 October 2007

Microsoft are offering two live meetings to help with these upgrade exams which are scheduled for December. For information click here

.

The Get Genuine Windows Agreement (GGWA) is aimed at increasing Windows XP licensing compliance among businesses.

Two versions of the GGWA are available:

• The Small and Medium Organization contract requires at least five licenses, and is available through Microsoft channel partners.

• The Large Organization agreement is available directly from Microsoft or through Large Account Resellers (LARs).

Microsoft apparently believes that some customers have “misunderstood” their agreements, and have installed full instead of upgrade copies of Windows XP on corporate computers as permitted with the license.

Cori Hartje, director of Microsoft’s Genuine Software Initiative explained that “These purchases are intended to be a onetime catch-up for the unlicensed situation,”

.

Microsoft last Thursday announced through its Website their decision to keep Windows XP, the forerunner of Windows Vista, in sales and in OEM channels until 30 June 2008. Windows XP had previously been scheduled to be taken off shelves and out of OEMs’ hands late in January 2008.

Mike Nash, vice president of Windows Product Management is quoted in a press release as stating:

“Although our research with customers before and since launch has reaffirmed our belief that the previous plan to offer Windows XP through January 2008 would address the needs of most customers, we did get clear feedback that there was a set of customers who needed a bit more time. Feedback from our OEM partners and from customers is that the 30 June 2008 date will address those needs,”

This statement follows an earlier announcement by Microsoft that it was running out of XP product keys after continuing strong sales of the operating system, mainly due to its stability and broad compatibility.

Meanwhile, Vista continues with sluggish sales, failing to win over many businesses after suffering with a number of problems which include endless pop-up boxes asking for permission to do basic tasks from user account control (UAC), increased hardware requirements to make use of the new Aero graphical interface and application compatibility issues

.