What an amazing week here in Berlin. We had over 60 sessions presented by over 80 different speakers on Windows 7 this week.

We had hundreds of people stop by our Springboard Series on TechNet booth and the Talking About Windows booth. Since we localize Springboard in 10 languages we had a cool time showing demoing the site in all of the different languages. I also want to give out a huge thanks to our STEP (Springboard Technical Experts Program) members who helped to work our booth. These amazing guys came from Ireland (Aiden), Bolivia (Miklos), New Zealand (Erdal) and the UK (Justin) to help support Springboard and Windows 7.

I even had a chance to be part of the Pre-Keynote. Check out the video of the bus arrival with keynote hosts Hyper-D and Hyper-T.

We met tons of IT pros excited about Windows 7 as well. We worked with a STEP member named Alex de Jong from the Netherlands. Alex asked the delegates at Teched EMEA about their Windows 7 experience. Alex contributes to NGN, the Dutch community of IT Pros. To learn more about Alex and all he does for the community, follow him on Twitter at @alexdejongngn. So ready to see the cool interviews and hear what over 100 IT pros from all over the world had to say about Windows 7 and Springboard? Check out our Talking About Windows events page under the TechEd EMEA event listing here. (Also a huge thanks to his crew, Ed Wens and Michel van den Einden who did all the camera, editing, and production).

 
Also, make sure to check our our newest Engineering and IT pro videos on the main page from Lidiane Souza, Greg Lambert, Stephen Hall and Peter Menadu.

Tuesday night was our Springboard Party at the Water-Gate Club. Over 300 It pros from around the world showed up to party and share their love of Windows 7 and Springboard. It was a great time with great music courtesy of DJ Joey Snow and DJ David Lowe. Thanks again to our co-sponsors on the Windows Server team and TechNet+ team as well as everyone who showed up to celebrate with us.

It was a week of listening to amazing speakers, everyone asking great questions,cool demos, people working in HOLs all day and getting certified that evening, amazing food and people passionate about all of our products. All of this and the 20th anniversary of the fall of the wall. Our motto, “Life Without Walls” really took on a whole new meaning for me as I stood in front of the wall and outside the Brandenburg Gate on Monday.

Thank you Berlin for an amazing time.

Stephen

Coming to TechEd EMEA? Well make sure you stop by the Springboard or Talking About Windows booths! Why? Well, in addition to all the cool information on Windows 7 we have to share with you we have tons of cool opportunities and prizes!

Talking About Windows booth

• Attendees who find the Talking About Windows Video crew and record their thoughts about Windows 7 will have the opportunity to win prizes.  Videos will be shown in the booth on the TAW plasma and on the TAW web site. Plus, we will be giving out some cool prizes.
• Talking About Windows Interviews - Come hear from our community experts and ask questions live during our video podcasts. Stop by for a list of speakers and times.
• Live MVP Call – At 10 am on Wed, join us for a live MVP call with Karen Anne Young of the MVP group and Graham Watson of Culminus.

Springboard Series on TechNet Booth

• Springboard Series Community Influencers Party
  Tuesday, 10 November, 17.00 – Midnight
  Hosted by:  Springboard Series, Server & TechNet+
  Audience:  MVP, TechNet+, MCT, Microsoft
  By invitation only
• Springboard Series Learning Plans - Complete a Springboard Series Learning plan for a chance to win a Flip HD video camera

Plus we have swag and other cool opportunities so stop by, say hi and learn about all the cool information we have to help you Discover, Explore, Pilot, Deploy and Manage Windows 7.

See you at the show!

Stephen

These are some quick notes from a session on AppLocker by Paul A. Cooke, Tech-Ed EMEA 2008:

As you may have seen, I’ve written a few articles on Software Restriction Policy (SRP) under Windows XP and Windows Vista for www.windowsecurity.com (see below). I’m very happy to tell you, that Microsoft now improved this functionality and renamed it into: AppLocker!

Unfortunately I cannot bring you any screenshots (because of NDA), but I can tell you a few things about the basic functionality. With AppLocker you can more easily eliminate unwanted and unknown applications in your Windows (7) environment. You can enforce application standardization – both from a security (malware), and from a management point of view (licensing & user control).

What most organizations try to do these days, it to limit users to be standard users (non-administrators) on their local machines – however this is actually not enough to feel secure as an IT administrator. Running as standard user is not the solution to all of our problems. Many applications can do bad stuff, even within user context – like stealing data, deleting data, manipulating data, encrypting data, creating bot-nets, send spam, social engineering etc. etc. This is true for applications that install in user context (like Google Chrome), or regular executables that don’t actually install – they just run!

If you want to control applications like that, what can run and what cannot – then you need another approach. AppLocker comes to the rescue!

AppLocker has been build around digital signatures – signing of software executables and DLLs. This was also an option in SRP under Windows XP, were we had path, filename, HASH & certificate rule, but it was pretty hard to manage and enforce back then. With Windows 7, a new GUI has been added to the group policy editor to support easy creation of software rules. We have 3 types of rules:
- Allow rules: same as Whitelisting (‘known good’ software)
- Deny rules: same as Blacklisting (‘known bad’ software)
- Exceptions: exclusion from allow or deny rules

Allow rules are of course the recommended approach – the “default deny all applications” rule (Whitelisting), but with specific applications the network administrators wants to allow users to run. As an administrator, you get granular control of specific applications, enforcing who can run and/or install them (if they have the appropriate rights and permissions).

The administration is done by group policy under Computer Configuration > Application Control Policies, but strangely enough you have to put in affected users and groups (still unclear whether or not the SYSTEM account is still excluded from SRP checks). So this is actually Computer policies that are able to hit users, like loopback or group policy preferences.

You can create multiple rule sets and take advantage of specific attributes, like app version (equal/above/below X.0.0.0), filename (executable name), product publisher (the valid root certificate used to sign), product suite (like “Microsoft Office 2007”) – and wildcards seems to be supported still.

You can control executables, installers (MSI), scripts, and DLLs, using certificates (publisher), HASH or path rules. The disadvantage of using HASH rules is, that the HASH will change if the application is updated, certificate/publisher rules are much more flexible because the signature is still going to be there (unless the developers totally mess up). So always try to go for publisher rules, certificates are here to stay :)

Can be run in 3 modes: Enforce policy, Enforce Policy using Group Policy Inheritance  and Audit Only mode! The latter is pretty cool, as you can configure a Software Restriction Policy, and test it out before you go “live”.

AppLocker supports import and export of rules, which can be very useful, but one of the best new features is, that there’s no need to create all the rules manually – you have the option to “automatically generate rule”, this feature will analyze a “reference machine” (not sure if this has to be the local machine yet) and files in a given folder on that machine (not sure if this can be a share yet). You can compare this to a “snapshot” feature, take all files in this folder (and subfolders), and make an allow rule from that (certificate based preferably).

The new rule creation tools and wizards seem pretty straight forward – but you really need to think about the SRP design before you go for it, and test intensively, or else you’ll end up in serious trouble ;-)

I just can’t wait to test this deeply and bring you more information!

Previous article series on SRP:
Default Deny All Applications (Part 1)
Default Deny All Applications (Part 2)

Microsoft AppLocker description:
http://www.microsoft.com

.

These are some quick notes from a session on UAC by Paul A. Cooke, Tech-Ed EMEA 2008:

Microsoft Windows 7 will reduce the number of OS applications and tasks, that require elevation – this has been done by re-factoring apps and tasks into elevated and non-elevated pieces.

UAC v2 will provide a more flexible prompt behavior for administrators, also administrators will see less UAC elevation prompts.

Users can do even more as standard user (eg. parts of Bitlocker, Windows Update etc.), they will also be able to ‘read’ system settings without needing to elevate.

Windows 7 will be better spotting human vs. application changes, this way “human administrator” changes will be allowed without too many prompts.

UAC can now easily be graduated into 4 levels (from the strict Vista default to totally off) - everything can of course be handled using group policy.

To me this is all pretty cool – but to be honest, I’m one of those weird guys, who don’t care about Vista UAC prompts… I just press ALT+C… How hard can it be? ;-)

.

The PowerPoint slides from last week’s Microsoft TechEd Australia 2007 conference keynote presentation has now been officially published on CommNet for public download and viewing. The PowerPoint file comes at a whopping 29.8MB with high-resolution images spanning over 107 slides.

This is the Full-Monty - everything from the actual presentation, including Frank Arrigo’s LOLCat pictures and Michael Twigg of Animal Logic’s high-resolution renders and concept arts. There’s only headings and pictures here, so most of this probably won’t make much sense for anyone who didn’t attend keynote to listen to what the presenters had to say, but there’s still quite a bit of eye-candy from Animal Logic to enjoy.

I’ve extracted some of the Animal Logic images below. Some of these make great wallpapers, as suggested.

Animal Logic banners (I’ve removed the “Make your mark” text from the right image)

More Animal Logic banners

Even more Animal Logic banners

“Mumbles” renders from Happy Feet

On the second last day of Microsoft TechEd Australia 2007, everyone was invited to attend the closing party at Warner Brother’s Movie World theme park on the Gold Coast. It was a good time to wind down after two days of 8-to-6 learning. There was free food, drinks and best of all, rides! “Sci-Fi” was the theme of the event. I was too busy having fun so here’s only a very brief overview.

It took at least two dozen coaches to transport no fewer than 2500 delegates and staff to the event somewhat 30 minutes away. Everyone was asked to queue at the convention center from 6:15pm. It was an obvious logistical problem and I’m not sure this was the best solution, but everyone got to Movie World by around 8:30pm.

At the entrance, everyone walked through a somewhat obvious Stargate replica. Standing alongside were some not-so-obvious character actors.

Star-Trek reference on the big screens.

Not too sure what the light projection and smoke effect was intended for, but was still pretty cool.

Food.

And more food.

Everyone having a pretty good time.

Most of the rides were open including Batwing Spaceshot, Superman Escape, Wild West Falls Adventure Ride, Lethal Weapon - The Ride and Scooby-Doo Spooky Coaster. Being subjective to motion sickness, I only opted for the Scooby-Doo ride which was an unexpectedly enjoyable. Not spooky by any standards, but had some great dips and corners.

Overall, it was a great night well organized. Hats off to Jack Morton for their events management expertise.