Archive

Posts Tagged ‘AppCompat’

Less Than 1 Week Until the End of Support for Legacy versions of Internet Explorer (except Windows Vista and Server 2008)


Here we are! It is almost time. Over 16 months ago, Microsoft announced that support for legacy versions of Internet Explorer would be ending on January 12th, 2016 (http://blogs.msdn.com/b/ie/archive/2014/08/07/stay-up-to-date-with-internet-explorer.aspx.) The hour is almost upon us. In addition to the announcement, technologies including Enterprise Mode, Compatibility View, and persistent emulation modes were addedenhanced to assist customers in bringing older sites and web applications over to remove deployment blockers to IE11 and ultimately, Windows 10. Most of our customers in the enterprise have already leveraged (or are currently in the process of leveraging) these technologies.

If you are still running on older versions, you will soon notice that there is a warning message that will start appearing. In December, Microsoft published an article (https://support.microsoft.com/en-us/kb/3123303) that lays out the details of a new "End of Life" upgrade notification for Internet Explorer, which will be shipped as an update next week on January 12th.

The update will apply to Windows 7 SP1 and Windows Server 2008 R2 for users who have not upgraded to Internet Explorer 11 (i.e. IE8, IE9, and IE10 users). The update includes a new “end of support” notification feature when the browser is launched. This will automatically open a new tab with the appropriate download page (http://windows.microsoft.com/en-us/internet-explorer/download-ie) for your particular operating system.

For those enterprise customers that are still in the process of deploying and migration to Internet Explorer 11 (or have arranged for a custom support agreement) the KB article mentioned above also lays out instructions for disabling the notifications.

For those customers that are still on Windows Vista and Windows 2008 (which are in extended support and do not support IE11) – those operating systems will not be affected by the update. IE9 is still the latest version of Internet Explorer supported by these operating systems. Windows 8 and Windows 8.1 are also unaffected (support for Windows 8 will end on January 12th and Windows 8.1 comes with IE11).

The notification tab will not appear on every launch of the browser. After the tab is closed it will be 72 hours before it is shown again and only when launching IE (i.e. not during a browsing session).

For more information about the end of support for old versions of Internet Explorer see the following links: https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support and https://support.microsoft.com/en-us/lifecycle#gp/Microsoft-Internet-Explorer page. For technical information about how to upgrade to Internet Explorer 11 and Microsoft Edge see the Browser TechCenter pages on TechNet (https://technet.microsoft.com/en-us/browser.)

Here’s a Short Blog with a very Important Message (T-MINUS LESS THAN 6 MONTHS)

November 14, 2013 Leave a comment

Early last year I wrote a blog specifying how MED-V does NOT affect the Windows XP EOL Support issue: http://blogs.technet.com/b/gladiatormsft/archive/2012/07/30/how-med-v-affects-windows-xp-end-of-life-support-policy-it-doesn-t.aspx 

Little did I know how widely pulicized this would be (re: quoted in The Register and others – http://www.theregister.co.uk/2012/08/01/windows_xp_medv_no_go/)

Today’s a good reminder for all that we are now within six months. If you are looking to start a Windows XP migration please be advised that if the purpose of migration is to avoid unsupported or expensive custom extended support agreements, then MED-V will not resolve these concerns. Everything in that article is still valid. If you are still on XP, please feel free to comment on what your migration blockers are below. Are you being held back by a legacy LOB app or is it an Internet Explorer 6 issue?

Categories: Uncategorized Tags: , , , ,

App-V: On Application Compatibility and Shims with Regards to Applications Virtualized with App-V 4.x and 5.x

October 9, 2013 10 comments

While the origins of Softgrid may have revolved around addressing some application compatibility issues, the primary tenets of using Softgrid then (and App-V now) still are to provide on-demand application delivery, “installation-footprint-free” assets, as well as application-to-application isolation. This does not include being a solution for application compatibility. The old notion of “If you can’t fix it with shims, you can just use App-V and sequence it on XP! – Then run it on Windows 7 or 8” is not true. If this solved one of your application issues when migrating to Windows 7 or 8 – it was only a case of luck. App-V has not, does not, and will not fix App-to-OS bugs.

So where does App-V fit into the Application Compatibility Process?

Application Virtualization is a packaging technology that contains both state separation and isolation. But it alone, does not remediate compatibility issues. Laying out the industry accepted AppCompat process, virtualization/sequencing is considered a form of packaging.

 

The sequencing of applications for a target operating system should occur only after that application has been verified for operating system compatibility directly or through remediation. Yes, that remediation may include a shim containing compatibility fixes.

But I heard you can’t shim App-V applications!

You heard wrong. If you must shim that internal custom LOB application for which you can no longer locate the source code, you can certainly apply the same shim to an application running natively or virtualized so long as you have deployed the shim locally. This is so the Application Experience service can work with the fixes properly. I, personally believe in Shims as a last resort, especially with App-V. Remember, some global compatibility flags (__COMPAT_LAYER) can also be applied to App-V applications as environment variables. Zarbie mentioned this a while back in one of his blogs: (http://blogs.technet.com/b/virtualworld/archive/2010/04/13/the-requested-operation-requires-elevation-2c-000002e4.aspx.) You should always look for the simplest of solutions first.

But for that application that may require several fixes, there have been many questions and requests regarding guidance on how shims developed to address compatibility issues (also known as AppCompat Shims) can be implemented with App-V.

Using the Stock Viewer application that comes with the ACT, I will demonstrate both the relationship of how most compatibility issues affect App-V packages as well as how we apply compatibility shims to App-V packages. The well-known Stock Viewer Demo App (from the ACT) is a great teaching tool to demonstrate applying some of the issues that will rear their ugly head exactly the same way in a virtual App-V application the same way they would in a native application. So if we wanted to implement the ElevateCreateProcess, ForceAdminAccess, LocalMappeObject, and VirtualizeHKCRLite fixes into an application virtualized with App-V, we would go about it the same way we would using a normal local installation of the Stock Viewer application along with the rest of the ACT. I create my shim as follows:

1. Start the Compatibility Administrator application (COMPATADMIN.)

2. Click yes to the UAC prompt.

3. In the left pane click Custom Databases and then select “New Database(1) [Untitled_1].”

4. On the toolbar, click Fix.

5. In the Create new Application Fix wizard, on the Program information page, in name, type StockViewer, in Location, type c:Program FilesMicrosoft Application Compatibility ToolkitCompatibility Administrator (32-bit)Demo ApplicationStockViewerStockViewer.exe, and then click Next.

6. On Compatibility Modes page select None for Operating Systems Modes, and then click Next .

7. On the Compatibility Modes page, click Next.

8. On the Compatibility Fixes page, check ElevateCreateProcess, ForceAdminAccess, LocalMappedObject, VirtualizeHKCRLite, and then click Next.

9. On the Matching Information page, click Finish .

10. On the toolbar, click Save.

11. In the Database Name dialog box, type StockViewerFixes, and then click OK.

12. On the Save Database browse window, in filename, type C:SDBShareStockViewerFixes, and then click Save.

So now we have a shim StockViewerFixes.sdb that can later be applied with a simple command:

sdbinst.exe -q

The –q installs it in quiet mode.

 

Shims and App-V 4.6

When Stock Viewer is virtualized and executed as a standard user, you will find that the user encounters the same initial launch error virtualized as it would when it is installed natively.

Permission Denied

You must be an administrator to run this application.

 

So if we wanted to apply this shim to the computers local database, we could do so by quietly deploying the shim (using sdbinst as an administrator.) Then you would want to add in a Service Inclusion for the Application Experience service (AeLookupSvc) in the App-V Client Configuration so the Application Experience service can work inside the App-V virtual environment and ensure all shims are applied properly. I discussed Service Inclusions last year in the following blog: http://blogs.technet.com/b/gladiatormsft/archive/2012/08/01/app-v-4-6-using-service-and-process-inclusions.aspx

Service Inclusions can be useful not only for Anti-Virus applications, but other key services as well. For example, this is how we allow for AppLocker to work with virtualized applications. For the Application Experience service, you would need to create the service inclusion for the service – AeLookupSvc by simply creating a string value (REG_SZ) under the following key:

X86

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSoftGrid<version>ClientAppFSServiceInclusions

X64

HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftSoftGrid<version>ClientAppFSServiceInclusions

Value: AeLookupSvc1

Data: AeLookupSvc

The main challenge will be if you want to deploy the shim “on-the-fly” when you deploy the application. My good friend and idol Chris Jackson mentioned this a while back in his Technet Magazine article:

http://technet.microsoft.com/en-us/magazine/ff458340.aspx

He mentions the use of a pre-launch script in the OSD file to apply a shim using sdbinst. This works well except that it requires administrator access and the command will be running in the security context of the user. Also note that he also addressed the problem with using a centralized shim database due to problems with elevation and the AppV Bubble. The use of creating a Service Inclusion for the AE Lookup service addresses this issue now.

 

Shims and App-V 5

With App-V 5, the process is more straight-forward. You can use individual shims or a centrally managed shim database without the need to have a service inclusion included due to the new App-V file system and hook model. You even have better options of applying the shim for each virtualized application individually by taking advantage of the more advanced App-V script model. Since the desired workflow is to be able to apply the shim without unnecessarily elevating the security context of the user or application itself, you can apply the shim using the AddPackage event within the deploymentconfig.XML file. This will run under the context of the SYSTEM account.

    <MachineScripts>

      <AddPackage>

        <Path>sdbinst</Path>

        <Arguments>-q stockviewerfixes.sdb </Arguments>

        <Wait RollbackOnError=”true” Timeout=”15″/>

      </AddPackage>

 

Likewise, you can reverse this when the package is removed by assigning a script on the RemovePackage event.

    <MachineScripts>

      <RemovePackage>

        <Path>sdbinst</Path>

        <Arguments>-u stockviewerfixes.sdb </Arguments>

        <Wait RollbackOnError=”true” Timeout=”15″/>

      </RemovePackage>

Bear in mind, these events will only occur when deploying using PowerShell. If you want to deploy this shim using the publishing server, you will want to target the machine and not the user and assign the shim installation to the PublishPackage event.

With Windows XP hitting end of life, there is a rapid increase in the movement to Windows 7, Windows 8, and Windows 8.1. While modernization of your legacy applications still should be your ultimate goal, remediating your application into a working solution that is both compatible and portable is, in many cases, the next best thing from a transitional perspective.

 

Windows ADK is now Available!

August 19, 2012 1 comment

The Windows® Assessment and Deployment Kit (Windows ADK) is now Available for Download. This complete set of Windows 8 performance, migration, and deployment tools is live at the Download Center. You can download use the following link:

http://www.microsoft.com/en-us/download/details.aspx?id=30652

This is a huge bundle of may well-known tools so basically:

The Next Version of the Application Compatibility Toolkit is now Live!

The Next Version of the User State Migration Tool is now Live!

The Next Version of WinPE is now Live!

etc.

Well, you get the idea. The Windows ADK includes the following tools:

• Application Compatibility Toolkit (ACT)

• Deployment Tools (DISM, Windows SIM, etc.)

• User State Migration Tool (USMT)

• Volume Activation Management Tool (VAMT)

• Windows Performance Toolkit (WPT, PAL, XPERF)

• Windows Assessment Toolkit

• Windows Assessment Services

• Windows Preinstallation Environment (Windows PE) 

Categories: Uncategorized Tags: , , , , , ,