Alex Scoble's IT Notes - An Information Technology Blog

A few months ago Microsoft released security patch MS12-034 Because of this patch and the way that it installs, I ran into problems installing it on Win XP and 2003 systems.

Specifically, the patch does a check of a system's keyboard layout registry keys and makes sure that each layout key has a resulting dll file. If no file is found, it adds the missing dll to a file named C:\Windows\faultykeyboard.log and stops the install until either the registry keys are removed, or the missing dll is readded to the file system.

In my case, I found that all of the systems having problems installing the patch were failing because kbdsf.dll and kbdcr.dll were missing from C:\Windows\System32. The offending registry objects are:

Value: HKLM\System\CurrentControlSet\Control\Keyboard Layout\DoskeybCodes, value 0000100c
Key: HKLM\System\CurrentControlSet\Control\Keyboard Layouts\0000046e
Key: HKLM\System\CurrentControlSet\Control\Keyboard Layouts\0000141a

The two files, incidentally are for the "Luxembourgish" and Slovakian keyboard layouts.

Since we use neither layout here, the simple fix was to remove the registry keys before running the patch.

Because we use a patch management system and because that system is able to run VB scripts in order to do things like remove registry keys, it was a fairly simple matter of researching the VBScript code required to delete the keys.

I made a custom patch in the system that first checks to make sure that the offending registry objects are not in the registry, and if they are then proceeds to run the following VBScript to remove the keys:

Const HKEY_LOCAL_MACHINE = &H80000002

strComputer = "."

Set objRegistry=GetObject("winmgmts:\\" & _
 strComputer & "\root\default:StdRegProv")

strKeyPath1 = "System\CurrentControlSet\Control\Keyboard Layout\DoskeybCodes"
strKeyPath2 = "System\CurrentControlSet\Control\Keyboard Layouts\0000046e"
strKeyPath3 = "System\CurrentControlSet\Control\Keyboard Layouts\0000141a"
strValueName = "0000100c"

objRegistry.DeleteValue HKEY_LOCAL_MACHINE, strKeyPath1, strValueName
objRegistry.DeleteKey HKEY_LOCAL_MACHINE, strKeyPath2
objRegistry.DeleteKey HKEY_LOCAL_MACHINE, strKeyPath3
ReportRepairResult True,"nice job!"

Here's a quick rundown of what the script does... It sets up a constant &H80000002 as HKEY_LOCAL_MACHINE (go here to find out what constants apply to which registry hive)
It then sets up a number of variables to be used later, including the registry keys and value to be deleted. It then deletes the registry objects one at a time using the previously defined variables to complete the function. Lastly we echo True and nice job! out so that the system running the script knows that the script completed successfully. Without that last bit, our patch management system would keep reporting that the custom patch failed.

We then set up a custom patch cloned from the patch management system's own definition for MS12-034 and add our registry fix as a dependency so that it runs before MS12-034 is installed.

And there you have it. The things we go through to fix Microsoft's messes, eh?

Patching is killing Windows (AKA the problem that Microsoft MUST solve in order to remain competitive)

I wrote a blog post back in 2005 on my Computerworld blog detailing 4 things that I thought that Microsoft needed to fix in Windows in order to remain competitive. Unfortunately, the biggest thing on that list, the land of a thousand reboots, hasn't gotten much better.

Right now, one of my main functions at my job is to manage patches for nearly a thousand Windows systems. "Pain in the ass" doesn't even begin to describe the difficulties of patching that many Windows servers and workstations.

First off, you can't do it without an enterprise tool like LANDesk, Secunia, GFI LANGuard, Microsoft SCCM, etc. These tools are big, complex, hard to manage and typically require agents which often have their own issues.

Second, the number of third party apps that you have to track and patch is significant and growing. Because of compliance requirements, some organizations have to assess every single "security patch" for applicability. To do this, you have to know every piece of software that you have installed in areas requiring compliance and you have to regularly search for security updates to all of those applications. Yes, it is as laborious and mind numbing as it sounds. I have a lot of fun at my job, but this area is totally not intellectually stimulating at all.

Third, because of the fact that Windows patches require a reboot, scheduling downtime of critical production systems can be a total nightmare.

I should mention right now that Linux does all of this far better. If you pick your tools right (limit the tools that can't be installed from a repository), you manage all of your patching from one place. Yum for RedHat/CentOS or Aptitude for Debian. If your server is headless (who needs a GUI that takes up all of those resources and adds another 200 packages that need to be updated), patching a brand new server up to current takes minutes and requires ZERO reboots. It's as easy as typing "yum update". Since it can be used to track what security patches are applicable for each system, there's no research that needs to be done on just about anything other than the stuff that you installed from source.

Linux is quite simply light years ahead of Windows in this area. It is probably the main reason that I'm getting into Linux so much of late.

It sometimes takes over an hour to install a service pack on a Windows server. I can build up a new Linux server and fully patch it in less time. In fact, I can build up a new server with the LAMP stack, install an app on top of that (for log management, for instance) AND fully patch it in less time.

It's no wonder that Microsoft's share of datacenter systems has remained weak and will continue to slide. This situation is unacceptable. Even with clustering, which is expensive, hard to maintain and requires a lot more hardware, Microsoft can't maintain the kind of uptime that Linux is able to. Because guess what, patching invariably BREAKS your cluster.

On Windows 7, it can take over an hour to fully patch a new laptop or workstation and thats with SP1 already installed.

Even a shark with a congested nose can smell the blood in the water.

Linux administrators are able to perform patch management on their systems without buying expensive tools, without wasting a lot of time performing CVE and NVD searches for their apps, with a minimal amount of downtime and with significantly lower risk to their systems. Not to mention that it's much easier to deal with patching of systems isolated from the internet because you can build your own repositories.

Microsoft will continue to bleed marketshare and loyal customers like me until they solve this problem.

It will likely take a complete rewrite of Windows to do it, but given that the survival of the company depends on it, at least in my opinion, it would be stupid of them not to do it and soon.

I won't hold my breath though.

Dear Bill Gates, features and fixes I'd like to see in next Windows

This was originally posted to my ComputerWorld blog back in 2005, but as some of it is still pertinent today, I'm recreating it here. 

I'm sure that anyone who's used Windows has at least one pet peeve that they'd like to see fixed. As much as I like Windows (at least in its latest incarnation), I'm no exception.

What's more annoying is that some issues have been around for several versions of Windows (Office too).

OK, so let's get to it! Here's my list of things I'd like to see changed in Windows Mountain View (sorry, still can't call it what Microsoft wants to call it -psst...Windows Vista-...hurts my fingers just thinking about typing it).

1. Focus, focus focus! 

The way Windows changes focus, or how it designates what is the current active window, has been an annoyance of mine for a while now. 

For example, you are working on something, a Word document for instance, you need to reference a web page, so you click on the Firefox icon (or IE) in the Quick Launch bar and get back to typing your current thought stream on the Word document, when all of a sudden mid-sentence, you realize that you are now on your homepage in Firefox. Exasperated, you sigh, click back on your Word document and retype the thought stream from the point where Windows, thoughtfully, changed the active window.

Hey Microsoft, here's a hint for you in as plain english as I can make it: Never, ever, never, ever, ever, ever, never, ever, ever, ever, ever change focus from the window that I'm WORKING on until I EXPLICITY COMMAND Windows to do so!!!!

I don't CARE what your usability testing shows you, I work in specific ways and it would be MOST APPRECIATIVE if I was given the choice on how Windows handles change of focus.

2. I'm the boss!! 

I'm trying to delete files, a lot of them, from the Temp directory for instance. Windows pops up an error window telling me that the file is in use and can't be deleted. It doesn't tell me the specific app that is holding the file open. It doesn't ask me if I want to delete it anyways and it doesn't give me the choice to continue the file delete with the next file. LAME! 

Give me the choice, I don't care how hidden it is, as long as it's there and documented. Unless the file is a required system file, ask me if I want to disconnect the app's connection to the file and delete the file. 

Let me continue the delete from the next file chosen. 

Give me choice! Give me control! Give me more information! Gimme, gimme, gimme!

3. Major Tom to Ground Conrol.

An error comes up when I'm running an application. An error is in the event viewer. I'm having problems performing a specific task (such as trying to connect to console session of a Windows 2003 Server using RDP).

Where's the info in the event logs? Why are you making me click on a link to find out what the error means? Why is there nothing in the event logs at all? Why is the error not listed anywhere in the knowledge base with the same context as my error?

Windows should do a much better of job of telling the user (and an even better job of telling the admin) what's going on under the hood. What does the error mean, why is that application not starting, what's causing my inability to connect to another system's event logs.

I shouldn't have to download support tools in order to drill down to the lower levels of what's going on in Windows. It should tell me.

All error codes should translate into real english messages in the event viewer. All problems should be logged somewhere, or Windows should ask the user if they'd like the problem to be thoroughly added to the event log and Microsoft should at least let customers know that their problem is known even if there's not currently a fix.

Microsoft could even go the extra mile and ask the user if they'd like to be notified if a fix is created for their particular issue.

4. Welcome to the land of a thousand reboots.

So you install a new app, Windows asks you to reboot. You install a new driver for your printer, Windows asks you to reboot. You install a new security update, Windows asks you to reboot. You sneeze, Windows asks you to reboot. You run into a problem, so you reboot. Reboot, reboot, reboot after reboot.

I think you get the idea even if I have exaggerated the issue, but not by much. Sometimes it feels like I spend half my life waiting for systems to reboot. Perhaps it's not quite that much, but it's still too much. 

Even with all the improvements that Microsoft has made in this area it's still not enough. Linux only needs to be rebooted for kernel updates (as far as I know, perhaps Martin MC Brown could shed more light on this), in other words, very very rarely.

With the amount of updates, patches and security fixes that Microsoft puts out for Windows, the reboot requirements are way too high. The only way to get ultra high reliability with Windows currently is to run it in clusters. This is simply not acceptable for small businesses that can't afford double the servers and licenses.

Because we can't afford double the hardware and software is no excuse for us not to have high levels of uptime.

These are just 4 of the issues that I have with Microsoft. To some they might seem minor, but in my line of work, I am bumping up against these problems almost every day.

Microsoft is starting to bump up against competitors in the consumer sector and business sector. In light of this, I would suggest to Microsoft and all of its employees, that good enough isn't. New features aren't enough. You have to be better than your competitors, some of whom offer their products for free, far better. You just about have to be perfect.

You have a long way to go. And Windows Vista better be the next big leap instead of the next small step.