I got a question from Mike this week:

“Hi steve. Hope all is well. I am the IT manager at a small bank in Texas. We have lots of patch management tools…so I am not looking for that. Before an audit I would like to quickly force all of my machines to download and install the latest security patches from MS. Is there any way to force Windows to do this from the command line? And I mean like right now! Not next Tuesday. Thanks!”

I came across a script right on Microsoft’s website that can do something close to what you want:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa387102(v=vs.85).aspx

It has a few issues. First, it tries to install all patches. Like the latest version of Internet Explorer, major service packs, and that ridiculous Windows Search 4.0. These require user intervention, and might even break things.

Another issue with the script is that it does not let you know when it failed because the network is down.

We took that script changed it to only include security updates. That way it gets to the core of the issue – getting the latest security patches, without any extra stuff.

With our new version of the script we created a plugin for Network Administrator. This will allow you to remotely install the latest security patches across your network:

If the computer already is up to date, it will say: “This computer is up to date”

You can tell it to just download, or download and install. There is even an option to reboot when the install is complete:

The free version allows you to work with three computers at a time. You can get it from our download page:

http://www.intelliadmin.com/index.php/downloads/

What about that script? If you want to do it yourself without Network Administrator, here is the updated version:

http://www.intelliadmin.com/ForceAU.dat

Just rename it to ForceAU.vbs, and call it like this from the command line:

cscript.exe ForceAU.vbs

Once it starts, it will zoom through and install the latest security patches:

The script, and the plugin work with Windows XP, 2003, Windows Vista, Windows 7, and Windows 2008.

It does require administrator access, so if your users have a limited account you will need to either use the task scheduler, group policy, or Network Administrator.

One other thing to note, is that it does not install service packs – So keep that in mind when using the plugin, or the script.

I am not sure if you are aware of it, but starting next year Microsoft is changing their Internet Explorer upgrade policy.

Specifically, they will be putting IE updates into the standard automatic update cycle. This means if you have an older version of IE, it will automatically get upgraded.

Many organizations have piles of Web applications that cannot work on anything but a specific version of Internet Explorer.

I would not want to come into the office one morning to find out a few hundred computers now have IE 7, when a critical web app requires IE 6.

How can you prevent this from happening?

Thankfully Microsoft has provided three registry keys that will prevent the automatic install.

There is one for each version of IE (IE 7, IE 8, IE 9)

These are the keys:

For IE 9

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\9.0\
Value
DoNotAllowIE90 1 = Block Install, 0 = Allow Install

For IE 8

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\8.0\
Value
DoNotAllowIE80 1 = Block Install, 0 = Allow Install

For IE 7

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\7.0\
Value
DoNotAllowIE70 1 = Block Install, 0 = Allow Install

A quick and easy way to make these changes is to use our tool, Network Administrator.

We added a plugin that will make it easy to block the automatic install:

You can even pick and choose what version of Internet Explorer you want to block:

It is free for personal and commercial use (up to three computers at a time).

You can find it on our downloads page:

http://www.intelliadmin.com/index.php/downloads/

I got a question from Lewis this week:

“I hope this email finds you well. I have a plotter here at my company, and the driver is really temperamental. At least twice a week the driver crashes, and then all of the jobs get stuck in the spooler. To fix it I need to stop the spooler service, delete all the jobs and start the service again. Is there any easy way to do this remotely with a script? Have a Merry Christmas Steve, and thanks for all the tips”

Good question. A script in this case won’t always work. This is because with Vista, Windows 7, and 2008 the print spooler folder is restricted. Only the system account can access it.

A way around this is to use our Network Administrator tool. It will remotely execute the script in the system account context.

This is how the script would look if we wanted to stop the print spooler, delete the files, and start it again:

net stop spooler
del %systemroot%\System32\spool\printers\*.shd /q
del %systemroot%\System32\spool\printers\*.spl /q
net start spooler


.shd, and .spl files are print job files. If you delete them, it will wipe away any pending jobs.

You could put this into a bat file, and simply use the remote execute option of Network Administrator. To make it a smoother experience, we created a plugin that will handle everything for you:

You can also tell it if you want to delete all the pending jobs:

This can be quite helpful if you have a huge backlog of print jobs:

Using Network Administrator to do this is quicker than manually deleting the jobs since it does not have to talk back and forth with the printer driver to do it.

Get your free copy from our download page:

http://www.intelliadmin.com/index.php/downloads/

The free version is free for commercial and personal use. No spyware or adware – only software goodness.

If you have been using Windows 7 (Or even Vista) for a while, you might have noticed something really annoying.

When you have drives mapped in explorer:

They don’t show up in a command prompt if it is elevated with administrator permissions:

There is a simple reason for this – The feature known as User Account Control, or UAC. When you want to launch a program with admin rights, you see that familiar window:

This causes the application to execute under a different user token, and in turn it means that you have a totally different set of mapped drives (Usually none!)

Personally I will take the security risk of the standard apps and the elevated apps sharing the same set of mapped drives – before you do this you need to determine if this risk is too high for your situation.

To get windows to share the list of mapped drives between both, you need to make a registry change.

Drill down to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Under that key create a DWORD value named:

EnableLinkedConnections

And set it to 1

If you don’t want to plunk around in the registry, we have updated Network Administrator to do it for you.

Download your copy from here:

http://www.intelliadmin.com/NetworkAdministratorTrial.exe

Just make sure you reboot after the change – it won’t take effect until you do.

I got a question from Darren:

“Steve, been using the free edition of Network Administrator. Nice tool, but it is missing something we need. I see you have the ability to shutdown and reboot systems, but what about logging off users?”

Good question. I remember when I would do after hours upgrades – and one of the big issues was a user that would leave an app open that was part of the upgrade. After the it failed we would have to start making the rounds to see who left it up and running.

It would have been great if I could have just hit a few buttons and forced all computers to logoff.

That is now possible with Network Administrator – we have added the option to the shutdown section:

It works on 2000, XP, 2003, Vista, Windows 7, and 2008 – even the 64 bit versions.

Just select the logoff action, pick your machines, and start logging them off:

It is a totally free tool if you don’t need to use it on more than 3 computers at the same time. Get it from our download page:

http://www.intelliadmin.com/index.php/downloads/

I got a question from Thomas this week:

Our office has a licensed copy of Network Administrator 3.0 which allows
me to disable CD/DVD access. Is there an action that will allow me just
disable the CD/DVD burn capability but still allow users to view files
on CD/DVD?

Burn..keep it from burning?

Oops not that kind of burn – Yes excellent question. After a quick search I discovered this is an easy registry change.

If you drill down to this key:

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Create a DWORD value of NoCDBurning, and set it to 1. Reboot, and the built in burn functionality of Windows is gone.

This works on XP through Windows 7. Now one Gotcha with this is that it does *not* prevent third party apps from burning. You would need to handle this with a separate policy.

If you don’t want to plunk around the registry, we updated Network Administrator to make the change for you:

It is a free download from here and it can push this change to computers remotely.

If you are using Windows 7, then you must have run into the “Auto Maximize” feature. Microsoft calls it “Smart Window Arrangement”

Here is a short youtube clip that shows you what I am talking about:

Essentially if you move your window around and touch the corner, it will automatically maximize the window. After a while it can get quite annoying.

So how do you turn it off?

It is one registry key change.

Drill down to

HKCU\Control Panel\Desktop

Look for the value named “WindowArrangementActive” and set it to 0.

You will need to log off, and log on to make it active. After that, windows will no longer automatically maximize.

If you don’t like plunking around in the registry, we have added it as a plugin to Network Administrator:

It is a free download if you want to use it on 3 computers or less.

You can download it from here:

http://www.intelliadmin.com/NetworkAdministrator.exe

I got a question from a customer last week:

Hi Steve,
I just bought your program on Friday and I love it. I have one question though: Is there any way to use IntelliAdmin Network Administrator to set not only the VNC password but also the VNC view only password?

Thanks..

After poking around and playing with TightVNC we found two things that Network Administrator did not support – view only passwords, and the new registry format used in TightVNC 2.0

We have updated Network Administrator to support both of these. (Note that it is a free tool, and you only need to purchase if you want to use it on more than three computers at a time)

You can download the latest from here:

http://www.intelliadmin.com/NetworkAdministrator.exe

How do you use it?

Open the app, pick the action you want to take (In our case that would be set vnc password)

Set your password(s)

Pick the computers you want to target:

Click start, and it will make the change.

Got an idea to improve one of our plugins, or an idea for a new plugin for Network Administrator? Let us know by sending an email to support@intelliadmin.com

Jonathan has been quite patient…I think he originally asked for this plugin last year. Just got another email from him recently:

Hi Steve,

Have a great and healthy new year!

I know what he is talking about, since I get annoyed by it all the time.

Every time you download a file from the Internet, it gets tagged by windows. That way it will warn you – every time you run the file.

This can get annoying if you have a simple utility that is just an exe without an install file. Especially if it needs admin rights in Vista or Windows 7.

Why?

Because you will be prompted twice every time you run it:

First, with the scary Internet Warning:

Then the standard UAC prompt:

Turning it off requires changing four registry values. You can change them under HKEY_LOCAL_MACHINE to make the changes system wide, or under HKEY_CURRENT_USER to apply them just to your account.

Here are the changes:

First go to this key:

Software\Microsoft\Internet Explorer\Download

If they are not there already create:

A string value named CheckExeSignatures and set to to the value no

A dword value named RunInvalidSignatures and set it to 1

Then go to this registry key:

Software\Microsoft\Windows\CurrentVersion\Policies\Attachments

Create a dword value named SaveZoneInformation and set it to 1

Finally, go to this key:

Software\Microsoft\Windows\CurrentVersion\Policies\Associations

Create a string value named LowRiskFileTypes and fill it with the types of files you want to open without the warning.

Like this:

.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;

This can be tedious. If you want the easy way, simply download the latest free version of Network Administrator and it will do it for you:

Remember, the warning is there for a reason – for you to click OK as fast as you can without even looking at it

If you have a question or idea for a tweak or change in windows, let me know by sending an email to support@intelliadmin.com

I got a question from Mark last week:

“Steve, I was wondering if you could add a plugin to Network Administrator that would disable control panel access. I know it is not the best way to keep people out, but it would save me a lot of headaches”

Actually, I have gotten a few requests for this. Disabling control panel access is actually quite easy. If you drill down to this registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

You just need to add a DWORD value of NoControlPanel, and set it to 1:

Windows 7 handles this smoothly. See my start menu before the change:

After the change, the control panel option is missing:

XP is not as nice, it keeps the icon…but you get a nasty message when clicking on it:

We added a plugin to Network Administrator. That way you can easily make the change without plunking around in the registry, plus you can push it remotely against machines on your network:

You can get your free download from here:

http://www.intelliadmin.com/NetworkAdministrator.exe

Disabling the control panel won’t keep everyone out, but in some situations it can really help.