Management features new to Windows Vista

Windows Vista contains a range of new technologies and features that are intended to help network administrators and power users better manage their systems. Notable changes include a complete replacement of both the Windows Setup and the Windows startup processes, completely rewritten deployment mechanisms, new diagnostic and health monitoring tools such as random access memory diagnostic program, support for per-application Remote Desktop sessions, a completely new Task Scheduler, and a range of new Group Policy settings covering many of the features new to Windows Vista. Subsystem for UNIX Applications, which provides a POSIX-compatible environment is also introduced.

Setup

The setup process for Windows Vista has been completely rewritten and is now image-based instead of being sector-based as previous versions of Windows were. The Windows Preinstallation Environment (WinPE) has been updated to host the entire setup process in a graphical environment (as opposed to text-based environments of previous versions of Windows), which allows the use of input devices other than the keyboard throughout the entire setup process. The new interface resembles Windows Vista itself, with features such as ClearType fonts and Windows Aero visual effects. Prior to copying the setup image to disk, users can create, format, and graphically resize disk partitions. The new image-based setup also reduces the duration of the installation procedure when contrasted with Windows XP; Microsoft estimates that Windows Vista can install in as few as 20 minutes despite being more than three times the size of its predecessor.^[1]

Windows XP only supported loading storage drivers from floppy diskettes during initialization of the setup process; Windows Vista supports loading drivers for SATA, SCSI, and RAID controllers from any external source in addition to floppy diskettes prior to its installation.^[2]

At the end of the setup process, Windows Vista can also automatically download and apply security and device-driver updates from Windows Update. Previous versions of Windows could only configure updates to be installed after the operating system installation.

System recovery

The new Windows Recovery Environment (WinRE) detects and repairs various operating system problems; it presents a set of options dedicated to diagnostics including Startup Repair, System Restore, Backup and Restore, Windows Memory Diagnostics Tool, Command Prompt, and options specific to original equipment manufacturers. WinRE is accessible by pressing F8 during operating system boot or by booting from a Windows installation source such as optical media.

Component Based Servicing

Package Manager, part of the Windows Vista servicing stack, replaces the previous Package Installer (Update.exe) and Update Installer (Hotfix.exe). Microsoft delivers updates for Windows Vista as files and resources only. Package Manager, Windows Update, and the Control Panel item to turn Windows features on and off, all use the Windows Vista servicing stack. Package Manager can also install updates to an offline Windows image, including updates, boot-critical device drivers, and language packs.

Windows Vista introduced Component-Based Servicing (CBS) as an architecture for installation and servicing.^[7][8][9]

Deployment

The deployment of Windows Vista uses a hardware-independent image, the Windows Imaging Format (WIM). The image file contains the necessary bits of the operating system, and its contents are copied as is to the target system. Other system specific software, such as device drivers and other applications, are installed and configured afterwards. This reduces the time taken for installation of Windows Vista.

Corporations can author their own image files (using the WIM format) which might include all the applications that the organization wants to deploy. Also multiple images can be kept in a single image file, to target multiple scenarios. This ability is used by Microsoft to include all editions of Windows Vista on the same disc,^[10] and install the proper version based on the provided product key. In addition, initial configuration, such as locale settings, account names, etc. can be supplied in XML Answer Files to automate installation.^[11]

Microsoft provides a tool called ImageX to support creation of custom images, and edit images after they have been created. It can also be used to generate an image from a running installation, including all data and applications, for backup purposes. WIM images can also be controlled using the Windows System Image Manager, which can be used to edit images and to create XML Answer Files for unattended installations. Sysprep is also included as part of Windows Vista, and is HAL-independent.

Also included in Windows Vista is an improved version of the Files and Settings Transfer Wizard now known as Windows Easy Transfer which allows settings to be inherited from previous installations. User State Migration Tool allows migrating user accounts during large automated deployments.

ClickOnce is a deployment technology for "smart client" applications that enables self-updating Windows-based applications that can be installed and run with minimal user interaction, and in a fashion that does not require administrator access.

The ActiveX Installer Service is an optional component included with the Business, Enterprise and Ultimate editions that provides a method for network administrators in a domain to authorize the installation and upgrade of specific ActiveX controls while operating as a standard user. ActiveX components that have been listed in Group Policy can be installed without a User Account Control consent dialog being displayed.^[12]

Event logging and reporting

Windows Vista includes a number of self-diagnostic features which help identify various problems and, if possible, suggest corrective actions. The event logging subsystem in Windows Vista also has been completely overhauled and rewritten around XML to allow applications to more precisely log events. Event Viewer has also been rewritten to take advantage of these new features. There are a large number of different types of event logs that can be monitored including Administrative, Operational, Analytic, and Debug log types. For instance, selecting the Application Logs node in the Scope pane reveals numerous new subcategorized event logs, including many labeled as diagnostic logs. Event logs can now be configured to be automatically forwarded to other systems running Windows Vista or Windows Server 2008. Event logs can also be remotely viewed from other computers or multiple event logs can be centrally logged and managed from a single computer. Event logs can be filtered by one or more criteria, and custom views can be created for one or more events. Such categorizing and advanced filtering allows viewing logs related only to a certain subsystem or an issue with only a certain component. Events can also be directly associated with tasks, via the redesigned Event Viewer.

Windows Error Reporting

Windows Error Reporting has been improved significantly in Windows Vista. Most importantly a new set of public APIs have been created for reporting failures other than application crashes and hangs.^[13] Developers can create custom reports and customize the reporting user interface. The new APIs are documented in MSDN. The architecture of Windows Error Reporting has been revamped with a focus on reliability and user experience. WER can now report errors even when the process is in a very bad state for example if the process has encountered stack exhaustions, PEB/TEB corruptions, heap corruptions etc. In Windows XP, the process terminated silently without generating an error report in these conditions.

A new feature called Problem Reports and Solutions has also been added. It is a Control Panel applet that keeps a record of all system and application errors and issues, as well as presents probable solutions to problems.

Diagnostics and performance

Windows Vista introduces major diagnostic capabilities, which include new feature additions for monitoring performance and for reporting issues:^[14]

• A new Performance Information and Tools Control Panel applet includes details and features related to performance.
• A new Resource Monitor includes System Stability Reports that graph daily events such as application crashes and hangs, device driver and hardware issues, software installations, and system crashes on a System Stability Chart so that users can view system performance over time. Generic details on the chart are signified by an information sign; errors are denoted by a red hazard symbol and potential issues are denoted by a yellow caution symbol. System Stability Reports assign a daily System Reliability Index, with a value of 10.0 indicating no problems; if an issue occurs, the daily value of a system will decrease, but it will gradually increase with each subsequent day where no issue has occurred. Users can view the history of System Stability Reports.^[15] The Resource Monitor uses system statistics from the Reliability Analysis Component (RAC).^[16][17]
• A Program Compatibility Assistant automatically detects known application compatibility issues (such as conflicts with User Account Control) and presents options for problem resolution; the Program Compatibility Wizard that allows for manually changing compatibility settings is still available.^[18]
• Client performance degradation such as application or driver interference with power transitions, increased boot, hibernation, or resume times, and reduced system performance due to system visual settings are monitored and reported to the user with options for problem resolution.^[14]
• Disk Diagnostics detect impending hard disk drive failures and prompt the user to perform backups, and to repair or replace the hard disk drive after Windows Vista detects a hard disk problem.^[14]
• Memory Diagnostics (comprising the Windows Memory Diagnostics Tool) check for issues caused by random access memory modules.^[14]
• Network Diagnostics, part of an extensible Network Diagnostics Framework, check for network connection problems and repair most of them automatically; options for resolution are presented when a problem is not repaired automatically.^[14] With the release of Service Pack 1, Network Diagnostics can also solve the most common file sharing problems.^[6]
• Resource Exhaustion Prevention can detect when memory is low and determine which applications are causing this. A memory leak diagnostic can provide information about application that may have memory leaks.^[19]
• Performance Monitor includes several new performance counters and various tools for tuning and monitoring system performance and resources. It shows the activities of the CPU, disk I/O, network, memory and other resources in the "Resource View". It supports new graph types, the selection of multiple counters, the retrieval of counter values from a point on the graph, the saving of graphed counter values to a log file, and the option to have a line graph continuously scroll in the graph window instead of wrapping-around on itself.
  • When run from an elevated command prompt, the perfmon /report command and parameter produce a comprehensive System Diagnostics Report complete with details such as hard disk throughout and Wi-Fi performance.^[20]
• When users attach an external storage device with potential file system errors, the user will be prompted to scan for and fix the file system corruption (Do you want to scan and fix Removable Disk?).
• When Windows is rebooted after an unexpected shutdown (such as those caused by a blue screen of death), the user is informed that the shutdown was unexpected (Windows has recovered from an unexpected shutdown) and is provided an option to report the incident to Microsoft for problem analysis and resolution.
• Task Manager presents more detailed system information and monitoring. Memory consumption is now displayed as a percentage value instead of as separate commit charge values. A Services page displays all services, with descriptions, names, process IDs, groups, and statuses, and there are Go To Process, Start Service, and Stop Service context menu options. The following changes were also made to Task Manager pages:^[21]
  • The Applications page includes a new Create Dump File context menu option
  • The Performance page includes an option to open the new Resource Monitor, and now shows memory usage (in addition to page file usage) and system uptime
  • The Processes page includes new Command Line, Description, Data Execution Prevention, Image Path Name, and Virtualization column options
  • The Processes page also includes new Open File Location and Properties context menu options
• Unresponsive application windows receive visual treatment — they are superimposed with window frosting — to indicate the application has ceased to respond.
• Windows Vista contains diagnostic tracing hooks around plug and play operations; because of this users can, for example, view devices that have failed to start, or view unsuccessful plug and play operations such as failed ejections of removable storage devices, with information about the application path, process id, and veto time of the application that caused the ejection to fail.^[22]
• Windows Vista introduces a new help and support architecture and interface based on the Assistance Platform client and MAML; the new architecture is not backward-compatible with previous versions of Windows.^[23]

Remote management

Remote Desktop Protocol 6.0 incorporates support for application-level remoting, improved security (TLS 1.0), support for connections via an SSL gateway, improved remoting of devices, support for .NET remoting including support for remoting of Windows Presentation Foundation applications, WMI scripting, 32-bit color support, dual-monitor support, Network Level Authentication and more.

Remote Assistance, which helps in troubleshooting remotely, is now a full-fledged standalone application and does not use the Help and Support Center or Windows Messenger. It is now based on the Windows Desktop Sharing API. Two administrators can connect to a remote computer simultaneously. Also, a session automatically reconnects after restarting the computer. It also supports session pausing, built-in diagnostics, and XML-based logging. It has been reworked to use less bandwidth for low-speed connections. NAT traversals are also supported, so a session can be established even if the user is behind a NAT device. Remote Assistance is configurable using Group Policy and supports command-line switches so that custom shortcuts can be deployed.

Windows Vista also includes Windows Remote Management (WinRM), which is Microsoft's implementation of WS-Management standard which allows remote computers to be easily managed through a SOAP-based web service. WinRM allows obtaining data (including WMI and other management information) from local and remote computers running Windows XP and Windows Server 2003 (if WinRM is installed on those computers), Windows Server 2008 and all WS-Management protocol implementations on other operating systems. Using WinRM scripting objects along with compatible command-line tools (WinRM or WinRS), allows administrators to remotely run management scripts. A WinRM session is authenticated to minimize security risks.

System tools

• New /B switch in CHKDSK for NTFS volumes which clears marked bad sectors on a volume and reevaluates them.^[24]
• Windows System Assessment Tool, a built-in benchmarking tool, analyzes the different subsystems (graphics, memory, etc.), produces a Windows Experience Index (formerly Windows Performance Rating) and uses the results to allow for comparison to other Windows Vista systems, and for software optimizations. The optimizations can be made by both Windows and third-party software.^[25]
• Windows Backup (code-named SafeDocs) allows automatic backup of files, recovery of specific files and folders, recovery of specific file types, or recovery of all files. With Windows Vista Business, Enterprise or Ultimate, the entire disk can be backed up to a Complete PC Backup and Restore image and restored when required. Complete PC Restore can be initiated from within Windows Vista, or from the Windows Vista installation disc in the event that Windows cannot start up normally from the hard disk. Backups are created in Virtual PC format and therefore can be mounted using Microsoft Virtual PC. The Backup and Restore Center gives users the ability to schedule periodic backups of files on their computer, as well as recovery from previous backups.

• 

  Windows Update has been revised, and now runs completely as a control panel application, not as a web application as in prior versions of Windows.
• System Restore is now based on Shadow Copy technology instead of a file-based filter and is therefore more proactive at creating useful restore points. Restore points are now "volume-level", meaning that performing a restore will capture the state of an entire system at a point in time. These can also be restored using the Windows Recovery Environment when booting from the Windows Vista DVD, and an "undo" restore point can be created prior to a restore, in case a user wishes to return to the pre-restored state.
• System File Checker is integrated with Windows Resource Protection which protects registry keys and folders too besides critical system files. Using sfc.exe, specific folder paths can be checked, including the Windows folder and the boot folder. Also, scans can be performed against an offline Windows installation folder to replace corrupt files, in case the Windows installation is not bootable. For performing offline scans, System File Checker must be run from another working installation of Windows Vista or a later operating system or from the Windows setup DVD which gives access to the Windows Recovery Environment.
• System Configuration (MSConfig) allows configuring various switches for Windows Boot Manager and Boot Configuration Data. It can also launch a variety of tools, such as system information, network diagnostics etc. and enable or disable User Account Control.
• Windows Installer 4.0 (MSI 4.0) includes support for features such as User Account Control, Restart Manager, and Multilingual User Interface.
• Problem Reports and Solutions is a new control panel user interface for Windows Error Reporting which allows users to see previously sent problems and any solutions or additional information that is available.
• Windows Task Manager has a new "Services" tab which gives access to the list of all Windows services, and offers the ability to start and stop any service as well as enable/disable the UAC file and registry virtualization of a process. Additionally, file properties, the full path and command line of started processes, and DEP status of processes can be viewed. It also allows creating a dump file which can be useful for debugging.
• Disk Defragmenter can be configured to automatically defragment the hard drive on a regular basis. It features cancellable, low I/O priority, shadow copy-aware defragmentation.^[26] It can also defragment the NTFS Master File Table (MFT). The user interface has been simplified, with the color graph, progress indicator and other information such as file system, free space etc., being removed entirely. Chunks of data over 64MB in size will not be defragmented; Microsoft has stated that this is because there is no discernible performance benefit in doing so.^[27] The defragmenter is not based on an MMC snap-in. The command line utility defrag.exe offers more control over the defragmentation process.^[28] This utility can be used to defragment specific volumes and to just analyze volumes as the defragmenter would in Windows XP. Windows Vista Service Pack 1 adds back the ability to specify which volumes are to be defragmented to the GUI.
• The Disk Management console has been improved to allow the creation and the resizing of disk volumes without any data loss. Partitions (volumes) can be resized before starting Windows Vista setup or after installation.
• Group Policy settings let administrators set ACLs for the volume interface for disks, CD or DVD drives, tape and floppy disk drives, USB flash drives and other portable devices.

Management Console

Windows Vista includes Microsoft Management Console 3.0 (MMC), which introduced several enhancements, including support for writing .NET snap-ins using Windows Forms and running multiple tasks in parallel. In addition, snap-ins present their UI in a different thread than that in which the operation runs, thus keeping the snap-in responsive, even while doing a computationally intensive task.

The new MMC interface includes support for better graphics and as well as featuring a task pane that shows actions available for a snap-in, when it is selected. Task Scheduler and Windows Firewall are also thoroughly configurable through the management console.

Print Management enables centralized installation and management of all printers in an organization. It allows installation of network-attached printers to a group of clients simultaneously, and provides continually updated status information for the printers and print servers. It also supports finding printers needing operator attention by filtering the display of printers based on error conditions, such as out-of-paper, and can also send e-mail notifications or run scripts when a printer encounters the error condition.

Group Policy

Windows Vista introduces a new XML based file format, ADMX as a replacement for now legacy ADM files to manage Group Policy settings, as well as a new ADML file format for Administrative Templates. Windows Vista additionally introduces a Central Store for ADMX files; Group Policy tools use ADMX files in the Central Store, and these files are replicated to all domain controllers in a domain.^[29]

Windows Vista includes over 2400 options for Group Policy,^[30] many of which relate to its new features, and which allow administrators to specify configuration for connected groups of computers, especially in a . Windows Vista supports Multiple Local Group Policy Objects which allows setting different levels of Local Group Policy for individual users.^[31] A new XML based policy definition file format, known as ADMX has been introduced. ADMX files contain the configuration settings for individual Group Policy Objects (GPO). For domain based GPOs, the ADMX files can be centrally stored, and all computers on the domain will retrieve them to configure themselves, using the File Replication Service, which is used to replicate files on a configured system from a remote location. The Group Policy service is no longer attached with the Winlogon service, rather it runs as a service on its own. Group Policy event messages are now logged in the system event log. Group Policy uses Network Location Awareness to refresh the policy configuration as soon as a network configuration change is detected.

New categories for policy settings include power management, device installations, security settings, Internet Explorer settings, and printer settings, among others. Group Policy settings also need to be used, to enable two way communication filtering in the Windows Firewall, which by default enables only incoming data filtering. Printer settings can be used to install printers based on the network location. Whenever the user connects to a different network, the available printers are updated for the new network. Group Policy settings specify which printer is available on which network. Also, printer settings can be used to allow standard users to install printers. Group Policy can also be used for specifying quality of service (QoS) settings. Device installation settings can be used to prevent users from connecting external storage devices, as a means to prevent data theft.^[30]

Windows Vista improves Folder Redirection by introducing the ability to independently redirect up to 10 user profile sub-folders to a network location.^[32] Up to Windows XP, only the Application Data, Desktop, My Documents, My Pictures, and Start Menu folders can be redirected to a file server. There is also a Management Console snap-in in Windows Vista to allow users to configure Folder Redirection for clients running Windows Vista, Windows XP, and Windows 2000.

Task Scheduler

The redesigned Task Scheduler is now based on Management Console and can be used to automate management and configuration tasks. It already has a number of preconfigured system-level tasks scheduled to run at various times. In addition to time-based triggers, Task Scheduler also supports calendar and event-based triggers, such as starting a task when a particular event is logged to the event log, or even only when multiple events have occurred. Also, several tasks that are triggered by the same event can be configured to run either simultaneously or in a pre-determined chained sequence of a series of actions, instead of having to create multiple scheduled tasks. Tasks can also be configured to run based on system status such as being idle for a pre-configured amount of time, on startup, logoff, or only during or for a specified time. Tasks can be triggered by an XPath expression for filtering events from the Windows Event Log. Tasks can also be delayed for a specified time after the triggering event has occurred, or repeat until some other event occurs. Actions that need to be done if a task fails can also be configured. There are several actions defined across various categories of applications and components. Task Scheduler keeps a history log of all execution details of all the tasks.^[33] Other features of Task Scheduler include:

• Several new actions: A task can be scheduled to send an e-mail, show a message box, start an executable, or fire a COM handler when it is triggered.
• Task Scheduler schema: Task Scheduler allows creating and managing tasks through XML-formatted documents.
• New security features, including using Credential Manager to store passwords for tasks on workgroup computers and using Active Directory for task credentials on domain-joined computers so that they cannot be retrieved easily. Also, scheduled tasks are executed in their own session, instead of the same session as system services or the current user.
• Ability to wake up a machine remotely or using BIOS timer from sleep or hibernation to execute a scheduled task or run a previously scheduled task after a machine gets turned on.
• Ability to attach tasks to events directly from the Event Viewer.
• The Task Scheduler 2.0 API is now fully available to VBScript, JScript, PowerShell and other scripting languages.

Command-line tools

Several new command-line tools are included in Windows Vista.^[34] Several existing tools have also been updated and some of the tools from the Windows Resource Kit are now built-in into the operating system.

• auditpol — Configure, create, back up and restore audit policies on any computer in the organization from the command line with verbose logging. Replaces auditusr.exe.
• bcdedit — Create, delete, and reorder the bootloader (boot.ini is no longer used).
• bitsadmin — BITS administration utility.
• chglogon — Enable or disable session logins.
• chgport — List or change COM port mappings for DOS application compatibility.
• chgusr — Change install mode.
• choice — Allows users to select one item from a list of choices and returns the index of the selected choice.
• clip — Redirects output of command line tools to the Windows clipboard. This text output can then be pasted into other programs.
• cmdkey — Creates, displays, and deletes stored user names and passwords from Credentials Manager.
• diskpart — Expanded to support hard disks with the GUID Partition Table, USB media, and a new "shrink" command has been added which facilitates shrinking a pre-existing NTFS partition.
• diskraid — Launches the Diskraid application.
• dispdiag — Display diagnostics.
• expand — Updated version of expand.exe that allows extracting .MSU files. MSU is a self-contained update format known as a 'Microsoft Update Standalone Installer'. MSU files use Intra-Package Delta (IPD) compression technology. IPD technology reduces the download size of an MSU file but still delivers a self-contained package that contains the updated files.^[35]
• forfiles — Selects a file (or set of files) and executes a command on that file. This is helpful for batch jobs.
• icacls — Updated version of cacls. Displays or modifies access control lists (ACLs) and DACLs of files and directories. It can also backup and restore them and set mandatory labels of an object for interaction with Mandatory Integrity Control.
• iscsicli — Microsoft iSCSI Initiator.
• mklink — create, modify and delete junctions, hard links, and symbolic links.
• muiunattend — Multilingual User Interface unattend actions.
• netcfg — WinPE network installer.
• ocsetup — Windows optional component setup.
• pkgmgr — Windows package manager.
• pnpunattend — Audit system, unattended online driver install.
• pnputil — Microsoft PnP Utility.
• query — Query {Process|Session|TermServer|User}
• quser — Display information about users logged on to the system.
• robocopy — the next version of xcopy with additional features. Compared to the freely available TechNet Magazine version, (XP026), the Windows Vista version additionally supports /EFSRAW switch to copy encrypted files without decrypting them and /SL switch to copy symbolic links instead of their target.
• rpcping — Pings a server using RPC.
• setx — Creates or modifies environment variables in the user or system environment. Can set variables based on arguments, registry keys or file input.
• sxstrace — WinSxS tracing utility.
• takeown — Allows administrators to take ownership of a file for which access is denied.
• timeout — Accepts a timeout parameter to wait for the specified time period (in seconds) or until any key is pressed. It also accepts a parameter to ignore the key press.
• tracerpt — Microsoft TraceRpt.
• waitfor — Sends, or waits for, a signal on a system. When /S is not specified, the signal will be broadcast to all the systems in a domain. If /S is specified, then the signal will be sent only to the specified system.
• wbadmin — Backup command-line tool.
• wecutil — Windows Event collector utility.
• wevtutil — Windows Event command line utility.
• where — Displays the location of files that match the search pattern. By default, the search is done along the current directory and in the paths specified by the PATH environment variable.
• whoami — Can be used to get user name and group information along with the respective Security Identifiers (SID), privileges, logon identifier (logon ID) for the current user (access token) on the local system. i.e. the current logged on user. If no switch is specified, the tool displays the user name in NTLM format (domain\username).
• winrm.cmd — Windows Remote Management command line utility.
• winrs — Windows Remote Shell (WinRS) allows establishing secure Windows Remote Management sessions to multiple remote computers from a single console.
• winsat — Windows System Assessment Tool command line.

Services for UNIX has been renamed Subsystem for UNIX-based Applications, and is included with the Enterprise and Ultimate editions of Windows Vista. Network File System (NFSv3) client support is also included. However, the utilities and SDK are required to be downloaded separately. Also, the server components from the SFU product line (namely Server for NFS, User Name Mapping, Server for NIS, Password Synchronization etc.) are not included.^[36]

Scripting

Windows Vista supports scripting and automation capabilities using Windows PowerShell, an object-oriented command-line shell, released by Microsoft, but not included with the operating system. Also, WMI classes expose all controllable features of the operating system, and can be accessed from scripting languages. 13 new WMI providers are included.^[37] In addition, DHTML coupled with scripting languages or even PowerShell can be used to create desktop gadgets; gadgets can also be created for configuration of various aspects of the system.

References