Discussion on:

10 cool tools in Windows 7

These all look good, but ultimately, I don't spend my day tuning my monitor settings or managing my passwords.

What new tools exist that affect normal usage? Things that make it faster or take less keystrokes/clicks to locate and launch an app for example.

Or, a way to stop applications stealing focus. I like to launch several apps and while they're starting up, do other things. Every time IE steals the focus I curse Steve! I used to curse Bill, but now it's Steves turn.

There doesn't really seem to have been the same effort and intelligence applied to the basic interface as has been spent on the system level stuff in the last few versions of Windows.

The change to Office has been immense in comparison. Or look at how IDE's have changed in the last 5-10 years. Why hasn't the OS and the whole interface metaphor and richness changed at least as much?

It may seem superficial or unimportant to other's but I can't tell you the number of times I've had a slow opening program or it's usless splash logo decide that I didn't want to continue with my previous task while I wait.

Just the other day I looked back at the screen to find half my comment in a new program's input field and an error about not liking the enter key. After win3 through Vista, why on earth is there yet no way to tell programs opening in the background to stay in the background until I, the user of the system, chooses to actually use them?

it happens with me all of the time. I also hate while something is opening, it needs to make sure every network connection is perfect, or it hangs longer.
Yeah -- open a Word doc on your desktop -- a mapped drive is down -- now Word waits almost a minute while trying to make the drive available. I just want my f**king document from my desktop!!!

Word is using IE as it's base to include the actual Word objects into. Since IE is the system explorer, it sees the drives including network mount points. Because it's IE and it's seeing the drives, it has to scan them. This means hanging for the time out limit on network mounted letters with poor connectivity.

That's a random guess though so it would have to be confirmed or corrected by one of the developers.

My office gripe to add is regarding Office for osX. It seems Office for mac constantly broadcasts looking for other Office on osX installations. This may be to provide some Office to Office benefits but was listed as "to confirm that other Office for osX installs are not using the same serial number" according to the searches I've had time to run.

Whatever the reason, I'm getting about a thousand (literally, four digits ####) alerts daily out of my Snort and it's all 255.255.255.255 from the osX box in the office. I could have Snort ignore it but the fact that a machine is broadcasting twice every second indicates a problem for me not something to be ignored.

I'd offer more details but it's also not the top of my work list so I keep reading the IDS notices and running searches when I have time on the side.

Redmond, but the Final Cut suite of edit software, by Apple, uses the mDNS packets - Bonjour - to broadcast and check serial number details. Hence conflicting (i.e. identical) serials can be run concurrently if one of the machines has the mDNS daemon disabled.

The line to enter in terminal is:

launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

Naturally, to reverse this simply change 'unload' above to 'load'. And they need to be run as sudo.

Of course, this breaks Bonjour, and anything else that relies on it such as Bonjour messaging in iChat. But if it's the only Mac machine around and you have a fairly solidly mapped network topology then it should cause no unresolvable problems.

I have the two commands scripted as apps - the only problem is that running them prompts a Terminal window asking for the user p/w to authenticate against the sudoers list. I don't know any way around that, sadly...

I was trying to remember that app name yesterday on another site. Good old Quicktime install suggests (opt-out method) iTunes and Bonjour when all you want is the quicktime core app for Windows. And now, it'll also suggest (opt-out method) the iPhone manager ragardless of if you have an iPhone to pair with your Windows machine.

I'd say that the sudoer's prompt is much better than a more broken approach to security. I have a su.cmd command on my Windows box and welcome the prompt for admin password.

I'll have to try disabling bonjour and see if it stops the constant network noise broadcast out. The few Apple machines don't need iChat within the office.

- I'm the only user on a Windows box I 'inherited' (it was being thrown out). The previous users hadn't bothered with passwords. Why indeed? They trust each other.

They also clearly trusted the entire world, which feasibly had access to their Windows box over the internet, not to execute code when remotely attacking their machine. Again, why not. I'm quite sure Internet Explorer is quite capable of handling any threats

Thus I have a short but mildly secure password on my 'new' box.

Out of interest, being relatively new to Windows (I've not used it much in the 4 years or so that it's taken me to learn Mac admin), is there a Windows equivalent to Bonjour? Is that what 'NetBIOS' is? I know mDNS can be annoying, especially when a machine doesn't respect its network and starts spamming indiscriminately, but zero-config is a very useful networking tool in networks where machines are popping on and off the network.

Various freelancers are in now and then and they often bring their own machine with them. I'm also running NetAppleTalk on my iPhone so it pops up on the network too. The Finder SideBar constantly refreshes to show local machines with any services running, whether it's filesharing, screensharing or remote login. It brings networking to a level where normal users can perform what is quite a sophisticated operation, without needing help...

Thus I have a short but mildly secure password on my 'new' box.

I'd suggest using a strong password. At minimum, it maintains a good habit, at maximum, it can provide a security mechanism should your machine get jacked. Make it longer than 15 characters or disable LM Hash passwords in your local policy. LM hash is very easy to break as is separates the password into seven character chunks which are quickly found with easily downloaded rainbow tables.

http://support.microsoft.com/kb/299656

I'm not completely clear on what Bonjour does but NetBIOS is a win95/win98 era thing that allows your computers to connect by host name. You can probably disable it and retain the same connectivity with TCP/IP since your home router's dhcp will manage it if the local system doesn't. It's also not noisy like Bonjour so it won't generate constant packets.

CIFS is your new risk. It's very convenient for connecting shared directories or printers but is a cleartext protocol or at least clear enough that your password hash can be sucked out of the network traffic. This probably only applies within your network though unless you decide to play with any of the public WINS name servers; it's not worth it just to extend Network Neighborhood outside your own LAN.

I've not looked at zero-conf since dhcp seems to do all I need. I thought that was more of an instant "setup my wifi" type function but I should probably give it a closer look.

Screensharing equivalent is remote desktop. You can configure it to accept incoming connections from specific user accounts and/or accept requested "help" connections from the local user. There is a Remote Desktop client for osX which will bridge your platforms though I don't know about the Windows -> osX desktop direction.

Also, take some time to visit blackviper.com (black background, lots of white text) which will give you a good idea of what services do what and which can be disabled.

Each machine broadcasts (well, technically multicasts, obviously) its own hostname/IP - having got the IP from DHCP - and what services are active on it. These are set in the Sharing pane of System Preferences, the OS X equivalent of the MS Control Panel. So looking at my machine, I have Screen Sharing (vnc), File Sharing (afp/smb/nfs), web sharing (http) and remote login (ssh) set 'on'. They're just checkboxes in a list with basic options configurable in a sidepanel to the right, when applicable.

The services I've set 'off' are DVD or CD sharing which allows for remote access to the contents of your optical drive/s, printer sharing since we don't use any USB printers in this office any more (except mine which is specialised), remote management which enables ARD, another Apple product (essentially merging vnc and ssh afaik), remote Apple events which can be generated using AppleScript among other things, Xgrid sharing which enables cluster-based processing for Compressor, and Internet sharing.

For more info on Bonjour and Mac networking in general, check out this PDF - it's more detailed than Apple literature tends to be and is actually rather useful. Page 168 onwards spells out Bonjour, what it can do for you, and how you can manage it.

I think there is still space for zeroconf in a modern networking setting. DHCP for example, runs on our server - it broadcasts what IP is the gateway, what subnet mask to use, who to query for DNS or LDAP lookups, and so on. Basically it tells you what it does and where to find the basic services.

With machines running, for example, Bonjour, however - it's like *every* machine is broadcasting their service list. In fact that's the literal paradigm. It's only really advisable on a LAN but that makes it perfect for single-office or home use. I can pick any machine from the /Network directory in Finder and see the Public folders of every account in /Users on that machine (if file sharing is on). By default that's drop boxes only but for file propagation that's fine. I can also share their screen if activated, either by authenticating as a known administrator or requesting it from the currently logged in user. And it takes no setting up whatsoever other than each user deciding what they want to make available to others.

Thanks for both those links btw - when I'm back on my XP box I'll be sure to lock it down tighter and have a browse of the BV site. I'm pretty keen to get my head around XP as I have OS X pretty well understood so far and it's great to diversify. So if I understand you correctly, NetBIOS is old school and CIFS is the new kid in town, right? CIFS is what Samba is emulating iirc, last time I networked a Vista machine to our Leopard server I had to tweak its SecPol utility to allow Samba connections as they're off by default...

They are related but separate.

CIFS, formerly SMB is the actual software that shares your folder to the network and connects to folders shared on other machines. Windows uses it to connect to your network shared printer for example. In older Windows networks, it would use NetBIOS to locate the address of the network machine name you gave it. Modern Windows systems simply use DNS.

Samba is the FOSS project focused on providing CIFS(SMB) connectivity for non-Windows systems.

http://en.wikipedia.org/wiki/Netbios
http://en.wikipedia.org/wiki/CIFS
http://en.wikipedia.org/wiki/Samba_software

thanks for that. So I guess that NetBIOS is an analogue for Bonjour, and CIFS/SMB are 2 versions of the analogue for AFP.

DNS is fine for resolving hostnames, but what I like about Bonjour is that it can broadcast much more than that - if you want to you can advertise what machines are sharing what, be it file sharepoints, print services, screen sharing. What's great is that it's zero config - you don't need to wait for your sysadmin to update DNS when you change hostname or add a machine. Just set your Sharing prefs, plug in the patchcable/connect to wi-fi and you're in. Everyone sees your hostname and what you're offering.

Even more importantly, Bonjour allows you to bypass DNS on networks that use DHCP to allocate dynamic IPs - you really need to statically map them for machines running services such as fileshares that need to be accessed or printservers. It's not a big suck if you're prepared to stay on top of it or never change these, but if you want to provide outside access it can reduce your security to keep a static network topology...

I'd really like to know if anyone has any experience with Bonjour in a Windows environment. If Windows really has rejected zero-config in favour of the DNS route then it sounds like Bonjour offers something for which there is no common equivalent in a Windows network. When I get my XP box repaired (lost some DLLs when preboot scanning the filesystem with Avast!) I'll have a play with it and see if I can get it to talk to my GF's MacBook...

If Bonjour is broadcasting that much information about my systems all one has to do is suck up the traffic and they get a pretty comprehensive picture of my network and systems during the reconnaissance stage. It seems like walking up to a border guard and announcing everything you have on you versus just asking the questions asked of you. My preference would be the machines validating and answering requests for service listings. I can also see an nmap scan where I can't see who is capturing my Bonjour announcements.

I'll have to think on Zeroconf more and see what's been written about it by the security researchers. At home my router does dhcp with static IP and hostnames placing unknowns into a guest range of IPs so I can see them by address or name very easily. It doesn't provide the flexability of name changes for the static ones but it does pull the hostname from guests.

"security to keep a static network topology..."

I've been considering this recently and I'm still a little devided.

Static topoligy
+ machines are easy to find by IP or hostname
+ ip remains static for firewall rules and similar
- someone running a long scan has more time to complete it stealthily since machines leaving and joining do so with the same host/ip
- someone finished a long scan can use that same topology list when the return a second or third time

Dynamic topology
- hostname does not always map to same IP
- IP based rules have to be updated with the new IP
+ someone running a long slow scan gets jumbled results as machines join and leave the network
+ someone finished a scan has to rerun the scan again as the current topology list becomes outdated

Does the obfuscation provide any real defensive advantage or is it the very definition of obscurity in that it feels safer without providing any real security increase. This like obscuring http by moving it to port 81 which is only effective briefly until people discover it versus applying a true security mechanism infront of it.

"I'd really like to know if anyone has any experience with Bonjour in a Windows environment. If Windows really has rejected zero-config in favour of the DNS route then it sounds like Bonjour offers something for which there is no common equivalent in a Windows network."

I know Windows does have a zero-conf service so I wouldn't say it's rejecting it in favor or DNS. I'd have to do a bit of reading and confirm exactly what the difference between NetBIOS and the new aproach is. I think Windows will work by hostname even if on a local network without dns/dhcp dedicated machine so the hostname/address relationships must get discovered somehow.

I know my Windows environment at work is getting noisy because of the Bonjour packet broadcasts. I've not set my IDS rules to ignore yet. At home, my wife's Apple doesn't generate the same constant network noise so there is something different in the two system setups.

Bonjour may offer something more than the similar services in Windows to still. I'd be interested to hear what you find when you do compare them.

but I'll let you know my findings, Neon. Thanks, it's great to have someone to butt heads with over network topology as I'm literally the only computer tech in my company. We're a small production company so all the other people with any technical experience have it in video editing and camera standards. With the sysadmin stuff I'm an island

I take your point on the security through obscurity, I think there are definitely pros and cons to both approaches. I will say though, on the dynamic side the obscurity is perpetual. It's not quite the same as moving http to port 81 - it's more like moving it to port 81 for this session, then port 87 for the next session, and another port after that*. A scan might reveal the port used (or in this case the network toplogy) but that information would expire with the session.

I like to think of it like a school classroom. Every day the kids come in and sit in the same seats. If you wanted to run in and steal the lunch money of the rich kid you could just check where he sits and wait for him to come in. Alternatively if the seating was random, you might still catch him - but you'd have to do the same prep work every day. It's not much but it's a layer of protection, however thin.

On the subject of Bonjour, it's a LAN protocol. It doesn't traverse networks. We have VPNs to our two satellite offices for connectivity but Bonjour doesn't cross that either. I think it's a wider limitation of mDNS specifically, actually. I've little experience with packet sniffing or attacking a network though, so I'm not sure whether an outside snooper would be able to intercept them. It is something I would like to develop a wider knowledge actually, I have a book on network security assessment but as with all things, it's finding the time...

My conclusion of Bonjour is that it provides little (though still a tangible something ) that a properly configured network can't already have - but the same could be said of DNS. A truly committed sysadmin could certainly provide up-to-date hosts file to map the local network, and simply rely on DNS to communicate with the outer world. They're both simply tools to reduce that workload so other things can be accomplished in the same time... such as security precautions!

*Obviously, if a protocol was really moving it would have to avoid the well-known ports.

"
Port 445 provides SMB over TCP. From Microsoft "Windows supports file and printer sharing traffic by using the Server Message Block (SMB) protocol directly hosted on TCP. This differs from earlier operating systems, in which SMB traffic requires the NetBIOS over TCP (NBT) protocol to work on a TCP/IP transport."
"

http://isc.sans.org/diary.html?storyid=7210

I thought it a nice clear description of SMB/CIFS and NetBIOS related to TCP/IP.

The SMB/CIFS/Samba service does manage it's own name/address relationships based on a Master SMB and client SMBs. Basically, the first SMB service to make noise will find no master to it assumes the role. At home this could be whatever machine boots faster based on the Workgroup it was set to join. If the network is instead setup with a domain server (LDAP; normally MS Active Domain branded) then the workstations join the domain which provided the CIFS/SMB Master role.

That's my understanding now that some of the other cobwebs clear away.

You morons! This is a basic article about Windoze 7. Why go rambling on about something not related? Can you read? Do you have a brain. STFU!!!

Maybe if you'd been more active you would have realized that off-topic discussions are not just tolerated but often welcome here.

.. a true credit to all those who call themselves IT consultants.

you'll love his other vitriolic posts.

what amuses me more - that someone would attempt to 'shut up' posts on a forum they aren't being forced to read, or that after describing the original topic as 'a basic article about Windoze 7', they express disbelief that the conversation would wander OT.

If STFU is the language you're happy using then you should have no problem grasping epic FAIL.

Just fix it yourself. There are loads of ways to stop this.

Actually, I would like to fix that myself on a few systems if you've utilities or links to recommend. I'd be even more interested if it managed splash screens for third party apps also but just having programs not take focus by default would be worth a look.

I thought of something after posting. If your a gamer then software compatibility may fit into your question. I've heard rumour that Vista can run Longbow2 which is pretty much a lost love for some of us flightsim junkies since early win98. If Win7 will run LB2, I'll have to put some effort into getting hands on a legal license.

If it can run LB2 which has graphics support and ram>128 issues then it's worth looking at what else it may run better for you.

Sounds like I might be able to get Flight Unlimited 1 working. It's still the best sim for the pure fun of flying that I've ever seen.

I can spend hours soaring along the hills and catching thermals. The hoops courses are also huge fun and a real challenge.

Regards

Is that one of the early ones that focused on the environment more than the plane? If I remember, it has a glider and a few power planes. If it's the same one, I've also spent a lot of time in it soaring. Sadly, I can count the number of times I managed to stay in a thermal.

It focuses on aerobatics and has no radio, control tower, other traffic, or anything that distracts from the flying.

It was a great sim that I spent hours in with that tear-drop. Thermalling was a little harder than the real thing and I always did fly the toe up rather than jumping to an altitude.

After getting licensed, it filled my need for soaring as affording the real thing on weekends wasn't easy for a highschool kid.

These days I have a lovely feedback Logitech stick without a good glider sim. I'm trying to curb my Windows addiction but I may have to buy MS Flight before it goes DX10 only.

I'd prefer to stick with Flightgear if it could get reasonable FPS counts as it even has the glider I learned on among the extensive library (AH64 also which is a different sim addiction). That's between Nvidia and the Flightgear devs to figure out though.

My top wishlist item is for Windows and IE to interact with MS Office and other apps so that customizations to toolbars and other personalization features (but especially toolbars) would be portable. Log in using your Windows Live (or whatever it's going to be called) password, and your customizations would get downloaded on the spot. Why this isn't an obvious need, I don't get. The other thing is to establish a standard UI for all Windows apps (at least MS Office apps!) so that things like centering use the same keyboard shortcuts, etc., are the same between Word, Outlook, Excel, PowerPoint, etc.

JVP,

I recently saw some screen shots of Office 2010 that standardize some of the UI. I think it's a gallery post on Tech Republic somewhere.

I've installed Windows 7 on my desktop PC that is a new loaded computer and also on a 2 yr. old Compag Laptop 1.6 Mhz 1 MB RAM and both went without a glitch. I did install the latest ATI drivers for the desktop even though it installed an ATI driver thatworked. On the notebook, which is a wide-screen, it didn't have the wide-screen resolution and all I could find for the notebook was the old XP video drivers which installed and seems to work perfectly. It will not run Aero though but who needs it on a notebook.

I'm impressed, very impressed with Windows 7 and plan on buying the final release whenever it comes out. In the meantime I'll transfer all my files and programs and start using it as my main OS on both machines. It's such a relief from Vista's constant nagging screens and slowness it's like having a brand new computer with the latest hardware, especially on the old notebook.

Another backup program?

All I want to do is select what I want to backup, where I want to back it up to and how to back it up - compressed, encrypted, complete disc image or just data etc.

DOS was the last OS that alowed me to do at least the first two needs WITHOUT a third party backup program. Nothing in Microsoft Windows backup has ever worked. The backup didn't do what I needed or the retore failed to put my system back to EXACTLY where it was when backed up.

I have ziltch confidence Windows 7 will be any better. When Microsoft puts all it's money on crap like Areo, what makes you think they will spend any on such important things like a good backup program?

I had a machine where the owner got locked out of her own files. Backup from ntfs then restore to fat32; problem solved.

(yeah, I know.. two days later I realized I should have just enabled the explorer advanced view and flipped the file ownership. It's always the expert that checks everything but the power cord first though.)

I tried backing up a specific folder and there is no option.
Instead I had to create a batch file to open a network drive, copy the folder and contents, and disconnect the network drive. Then I had to setup the schedule for when to do it.
Apparently MS thinks that they know more about what I want than I do -- huh! Nice to know that they added this functionality back.

Do a search for this, it's out there. I've done it a couple of times. Works as a fairly simple alternative to a purchased backup.

Thanks for the tip.

But like I said in the original post, even XP's backup program didn't back up everything or didn't restore everything. After several restore attempts with XP, my system wouldn't work, or was altered enough to have to do a clean install. Third party disc images where the only backup/restore I could count on. NTFS' basic design is OK but fails miserably when it comes to backups and restores. Hopefully, the next File System Microsoft comes out with will finally end their long career of backup failure in Windows OSs.

I have the RC installed in a VMWare. Prior to this I had all the beta's installed in a VM. The auto resize no longer works when I resize W7's VM. Makes me wonder if there is a deliberate effort to eliminate the competition for Hypervisor. The smooth fast operation is now gone into cyberspace. I have lost ASIO compatibly, which the beta's had. The install utility corrupts files. I could name a few more issue's in less than a few minutes testing, why bother.

I would have recommended W7 to others when released; based on the breaking of functionality that I have seen, I no longer can do so in good conscious.

The problem step recorder looks like a great tool.... for identity theives. Let's hope it is something that can be removed from the system.

Excellent list! The Problem Steps Recorder in particular sounds like an outstanding solution for enterprise support staffs.

Does it have XP defragment format?

cool

its cool

I was thinking about this and it occurred to me that there is nothing here that lets you create content.

A PC, to me at least, is primarily a tool for creating things or collecting things others have made. Why don't we see new tools in our new OS's that are used to create things rather than simply look at what others do?

We've have a bitmap editor for quite a few versions of Windows now. Why hasn't it grown to rival Photoshop? Why don't we now have 3D modelling tools and renderers?

Obviously there are a lot of freeware, shareware and open source alternatives, but why not as part of the system?

Why are there no programming tools in the OS? We used to get GW Basic at least. Why haven't we got a language that is as far in advance of GWB as Win7 is to Windows 2?

Who decided we don't want more functionality in our OS? Why??

I understand the anti-trust and monopoly issues, but having a basic application as part of the OS doesn't stop others providing more capable apps. Which is what they should be doing if they want to make money. If you're not innovating, you don't deserve to survive! If you don't offer something others don't, you have no place in the market.

Any thoughts?

Operating System. Primary use is to let you run other applications for which you create content with.

to the release of W7 since a friend showed me some of the cool things in the RC, such as the homegroups functionality.

But, I have to say, only Microsoft could incorporate a keylogger into their OS, and cite it as a 'feature'. It's a positive thing! Yeah, great. What user does it run as? Now malware doesn't even have to snoop on a user. Just activate Windows' inbuilt functionality and get the OS to do it for you. Now that's progress.

MS really are the cracker's best friend...

These things are really not going to persuade me to shell out more money on yet another Microsoft attempt at an operating system.

It'd be better if they made stuff that works properly rather than spending effort writing better tools to submit problem reports.

They've had enough chances already.

If they wrote something halfway decent they could extend it, develop it, make enhancements as time goes on, rather than re-inventing fantastic new ideas that nobody wants and building in loads of stuff to force users along specific paths.

Almost everything I want can be found in really decent open-source.

Web browser - I'll make my own choice thanks.
Email - I'll make my own choice thanks.
Office - MS office is fine, but others might prefer Open Office, or something else.
Burning images - plenty of choice for free.
Security software - I'll choose.

What I really want from an o/s is solid basic functionality. Networking, device support, a decent filing system with file-sharing, and a good user interface.

I'll add anything else I want. At least then I know how it works, where it is, what it depends on, and how to change it/get rid of it if I don't like it.

I'm sure Windows 7 will be ok, but it takes years to learn the intricacies of a new system to the extent that you can make it how you want and maintain it.

I want to spend my time using my computer, not re-learning it every two years.

Enough! No more messing about.

XP until it dies and then re-learn something designed with a vision for the future.