Nxl67170 - Windows: Difference between revisions
Jump to navigation
Jump to search
(→Issues) |
|||
| Line 385: | Line 385: | ||
</source> |
</source> |
||
* {{blue|7th}} Install ProNet certificates (see {{file|ASPEX_CA.pfx}} or mail Chris Erven, dd. 2014/2/24). |
* {{blue|7th}} Install ProNet certificates (see {{file|ASPEX_CA.pfx}} or mail Chris Erven, dd. 2014/2/24). |
||
* {{red|new}} Prevent creation of <tt>Zone.Identifier:$DATA</tt> files. Start ''gpedit.msc'', User configuration → Administrative templates → Windows component → Attachment manager → Do not preserve zone information in file attachment = Enabled [http://askubuntu.com/questions/65101/what-are-these-files-like-zone-identifierdata-and-how-to-prevent-them] |
|||
|- |
|- |
||
|Update|| |
|Update|| |
||
Revision as of 07:34, 5 September 2014
Introduction
This is the configuration page for the Windows 7 partition on NXL67170.
Available Images
- (1st image as-of 2012-02-19 deleted)
- Image 1 (ntfsclone) — 2013-03-20 — Native, as received from IT with some additional software (Visio, Euroglot...), but without any virtualization .
- Image 2 (ntfsclone) — Last backup image. Contains additional software, custom settings and virtualization.
- Image 3 (vbox snapshot) — 1st virtualbox snapshot, state as on harddrive image. Content of the next backup image. Last known good version, VM is reverted to that image if Candidate image is broken
- Next images are named Image 4, Image 5...
- Candidate (vbox snapshot) — Last permanent image, VM is reverted to that image regularly to get SW updates, and apply last changes from new. All services enabled. Merged into Image 3 if proven stable.
- Lightweight (vbox snapshot) — Lightweight version of candidate (many serviced and AV disabled). Contains last bleeding-edge changes. VM already started. VM is reverted to that image on a daily basis.
Before Deleting Snapshots
- Backup Personal certificates (save them to ~/Documents/archive.noidx/backup_and_log/nxl67170-latitude_e5430/certificates, see README.TXT for instructions)
- Backup Office templates (from C:\Users\beq06659\AppData\Roaming\Microsoft\Templates to ~/Documents/archive.noidx/backup_and_log/nxl67170-latitude_e5430)
Daily process
- Boot lightweight snapshot.
- Apply last changes during last session (marked new), and update lightweight snapshot (replace previous one).
- Enjoy
Weekly process
- Merge candidate snapshot into image 3.
- Boot the new image 3
- Apply last changes applied in image lightweight, and download last SW update, etc.
- Create new candidate snapshot
- Apply non-permanent changes (lightweight, see below), and create new lightweight snapshot.
Lightweight settings
- Boot image using Windows recovery DVD and start regedit.exe
- Mount SYSTEM hive as
remote_SYSTEM - Mount SOFTWARE hive as
remote_SOFTWARE - Import registry files c:\temp\custom_config\*_On_Remote.reg.
- Restart, and run asap the file c:\temp\custom_config\Customize_config.bat as administrator.
Monthly process
- Backup image 3
Configuration Files
All configuration files can be found here.
Installed Applications
List of applications installed in each image, by order of first appearance, and their configuration settings.
Note: 1st, 2nd, new, etc. indicate that the settings was applied in the given image, and not in the image under which the application is listed (to track settings changed after image was taken).
Installed in 1st Image
| Outlook 2010 |
10.0.2.2 mail.gandi.net
10.0.2.2 mail.gandi.net
To is (exactly) Michael Peeters
To is (exactly) Michaël Peeters
To is (exactly) michael.peeters@nxp.com
To is (exactly) michael.peeters@noekeon.org
To is (exactly) michael.peeters@immie.org
To is (exactly) peeters-ml1@noekeon.org
To contains Michael Peeters
To contains Michaël Peeters
To contains michael.peeters@nxp.com
To contains michael.peeters@noekeon.org
To contains michael.peeters@immie.org
To contains peeters-ml1@noekeon.org
|
| Windows Explorer |
|
| Office Lync 2010 |
|
| Windows Command Processor (cmd.exe) |
|
| 7-zip |
|
| Launchy |
|
| Sysinternals Process Explorer |
|
| Sysinternals Autoruns |
|
| MS Office Visio Professional 2010 SP1 EN |
|
| MS Office Word 2010 SP1 EN |
|
| Euroglot Professional 7.6.3 EN |
|
| Opera |
leu-phil1.be-leu01.nxp.com leu-phil2.be-leu01.nxp.com |
| PDF X-Change Vewer |
|
| Vim |
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{51EEE242-AD87-11d3-9C1E-0090278BBD99}]
@="Vim Shell Extension"
[HKEY_CLASSES_ROOT\CLSID\{51EEE242-AD87-11d3-9C1E-0090278BBD99}\InProcServer32]
@="C:\\Program Files\\vim\\vim73\\gvimext.dll"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{51EEE242-AD87-11d3-9C1E-0090278BBD99}"="Vim Shell Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Vim\Gvim]
"path"="C:\\Program Files (x86)\\vim\\vim73\\gvim.exe"
Note that we tell gvimext.dll to use 32-bit version of gvim.exe. More solutions at [2], [3], but the shellex DLL offers more flexibility.
|
| Internet Explorer |
|
| Windows Update |
|
Installed in 2nd Image
| Nokia PC Suite |
|
| Virtualbox Additions |
|
| PrimoPDF |
|
Installed in 3rd and upcoming Images
| WinDirStat |
|
| Flash player plugin |
|
| Cygwin | |
| QPST | (NXP Telematics ATOP dev)
|
| QXDM | (NXP Telematics ATOP dev)
|
| QC USB Drivers | (NXP Telematics ATOP dev)
|
Installed in New / Candidate Image
| tbc |
|
Not Yet Installed
| Picasa 3 |
|
System Settings
| Physical-2-Virtual (P2V) |
bcdedit /export C:\BCD_Backup
ren c:\boot/BCD bcd2.old
bootrec /rebuildbcd
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0000]
"InfPath"="mshdc.inf"
"InfSection"="msahci_Inst"
"ProviderName"="Microsoft"
"DriverDateData"=hex:00,80,8c,a3,c5,94,c6,01
"DriverDate"="6-21-2006"
"DriverVersion"="6.1.7600.16385"
"MatchingDeviceId"="pci\\cc_010601"
"DriverDesc"="Standard AHCI 1.0 Serial ATA Controller"
"Migrated"=dword:00000001
[HKEY_LOCAL_MACHINE\nxl_SYSTEM\ControlSet001\Control\PnP]
"DisableCDDB"=-
[HKEY_LOCAL_MACHINE\nxl_SYSTEM\ControlSet001\services\atapi]
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\nxl_SYSTEM\ControlSet001\services\msahci]
"Start"=dword:00000000
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\nxl_SYSTEM\ControlSet001\Control\PnP]
"DisableCDDB"=-
|
| Tuning |
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Control Panel\Desktop]
"ScreenSaverIsSecure"="0"
"ScreenSaveTimeOut"="1200"
"ScreenSaveActive"="1"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop]
"ScreenSaveActive"=-
"ScreenSaverIsSecure"=-
"ScreenSaveTimeOut"=-
|
| Misc |
|
| Fonts |
|
| Network |
10.0.2.2 localproxy
10.0.2.2 localserver
10.0.2.2 nxl67170ux
10.0.2.2 mail.gandi.net # To avoid 'The target principal name is incorrect' error msg in Outlook
92.120.126.14 caprica # Telematics QNAP Server
92.120.126.15 marmaduke # Telematics QNAP Server
127.0.0.1 wbi.nxp.com
92.120.126.24 leu-phil1.be-leu01.nxp.com
92.120.126.25 leu-phil2.be-leu01.nxp.com
|
| Update |
|
| Region and Language |
|
Cygwin
See Nxl67063 for reference configuration.
| Base system (vim) |
mkgroup -l > /etc/group
mkgroup -d -g "Domain Users" >> /etc/group
mkpasswd -l > /etc/passwd
mkpasswd -d -u beq06659 >> /etc/passwd
for i in c d h; do ln -sf /cygdrive/$i /$i; done
|
| Git (git git-svn git-completion) |
|
| SSH (openssh) |
|
| Midnight commander (mc) |
|
VirtualBox settings
- Shared folders
- 1st /home/beq06659, auto-mount, read-only
- 1st /data/d, NO auto-mount (auto by windows), full
- USB Device Filters
- 5th (NXP Telematics ATOP dev) Add filter for NXP Semiconductors NXP ATOP USB
- Firewall
- Input filter — Netword card attached to NAT
- Output filter — Done on Linux host. Add at the end of /etc/ufw/before.rules (before
COMMITline)
# VIRTUALBOX - Block output connection for user vbox
# Don't create chains with -N, but use this syntax:
:vbox-output - [0:0]
:vbox-output-logging-deny - [0:0]
:vbox-output-logging-allow - [0:0]
-A ufw-before-output -m owner --uid-owner 7000 -j vbox-output
# We accept everything going to ports DNS/Kerberos/Netbios/LDAP
# We reject all connections to intranet (with logging), but allow 92.120.124.210 (online) and 92.120.124.197, port 1025 (for Lync?)
# And by default, we allow
# 92.120.124.197 = beqleunxp1dc100.wbi.nxp.com.
# 92.120.124.210 = online.be-leu01.nxp.com
-A vbox-output -p tcp -m multiport --dports 88,135,139,445 -j ACCEPT
-A vbox-output -p udp -m multiport --dports 53,137,138 -j ACCEPT
-A vbox-output -p tcp -d 92.120.124.210 -j vbox-output-logging-allow
-A vbox-output -p tcp -d 92.120.124.197 --dport 1025 -j vbox-output-logging-allow
-A vbox-output -d 92.120.0.0/16 -j vbox-output-logging-deny
-A vbox-output -j ACCEPT
-A vbox-output-logging-deny -j LOG --log-prefix "[UFW BLOCK] [VBOX] "
-A vbox-output-logging-deny -j REJECT
-A vbox-output-logging-allow -j LOG --log-prefix "[UFW ALLOW] [VBOX] "
-A vbox-output-logging-allow -j ACCEPT
- Summary on how these rules where generated:
- Boot virtual image while watching ufw log (
tail -f /var/log/ufw.log|grep "\[VBOX\]") - Many connections to DNS / LDAP (port 53,389) and NetBIOS (135,137,138,139 and 445)
- Many Kerberos authentication requests - blocking these considerably slow down login sequence
- For now, we are just blocking intranet (92.120.*.*), except some sites.
- Boot virtual image while watching ufw log (
Remarks
- Install advertised program
This works even if policy deleted (winlogon was running though), network interface set to NAT, and with most service disabled (but smshost and ccmexec services must be running).
To Do
Issues
- Issue — virtualbox shared folder \\vboxsrv\d is not visible from Administrator account. Very annoying when copying files to system32 for instance (because source won't be visible anymore).
Temp. workaround, launch cmd as administrator:
net use D: \\vboxsrv\d
- Issue — Opera does not work with custom proxy.pac file.
- Issue — Nokia PC Suite, only detect & connect if I detach then reattach USB BCM20702A0
- Issue — HOMEDRIVE and HOMEPATH always pointing at network share, causing lags when disconnected.
- See [5] for potential workarounds
- Issue — Tuning settings reverted every 10 min or so (like CcmExec or wuauserv re-enabled)
- Add firewall rules to filter vbox output connection - to no avail so far
- Check process taskeng.exe and wscript.exe
- This task executes a file at \\wbi\sysvol\wbi.nxp.com\Policies\{916532D9-BDF8-46FE-A77B-F84124C54878}\Machine\Scripts\Startup. How come it is accessible despites the firewall? offline storage / access outside intranet / using one of the allowed port?
- Found reference to this script in registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy and HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Group Policy.
- Fixed? In lightweight image, add a command to disable the scheduled task, and purge registry from policy settings (see Customize_config.bat)
To Do
Questions
- Outlook — macro always enabled. Any better solution?
- Outlook — move .ost to d: drive (or find a solution that outlook always complaining .ost is old)
- Outlook — find a rss reader that can save into IMAP (check rss2email or feed2imap)
- System — Enable page file?
- Merge history from file win7_P2V_links.txt, and written notes.
- Recover application settings from old profile
Done & Fixed
- Fixed — Issue description
Fix description - Done — Description