Pieces of “8”: Prospecting for Windows 8 Gold(the fun stuff no one talks about and the publicized stuff that’s hard to figure out) 3:05-4:20Presented by Mark Minasihelp@minasi.comTwitter: mminasiNewsletters at www.minasi.com© Mark Minasi 2013

WCA-B360

Hi! I'm Mark. Thanks for Coming! • My name is Mark Minasi, and I…• wrote my first app in 1973• wrote my first tech article three years later• have written over a thousand columns about Windows, other OSes,

hardware, AI, PCs, etc• have written 37 technical books• Speak, consult and the like on OSes and networks• do not work for Microsoft

• But mostly I like talking about operating systems, and so I’ve been poking around Windows 8 looking for the fun stuff… here’s what I’ve found 3

Agenda• Why Win 8's Worth a Look• Touchless Start Screen

Speed• Controlling the Start

Screen• Removing Store apps• Sideloading Store apps• Storage goodies• A kinder, gentler CHKDSK• Recovery and Safe Mode,

8 Style• PowerShell Becomes

Inevitable

• Rootkit-proof Windows• Understanding Refresh

and Restore• Bootable USB sticks are

easier and more powerful• What's a primary PC and

why do I want it?

Windows 8 is Worth Trying Out• Honestly I was not looking forward to Win 8 on a non-touch laptop• But it surprised me and I’m finding it an improvement over 7

generally• Basically, think of Win 8 like this:• The familiar Start menu is gone, replaced with a new program icon manager

called the “Start Screen” that acts as a sort of second desktop, so there are things to learn about getting around it and customizing it

• There are the new tablet-oriented apps, which will be a big upgrade for some • Then there are upgrades that have nothing to do with the tablet stuff and that

many will like: storage, security, admin tools and a pile of useful new PowerShell cmdlets

• In this talk, I’ll pass along some tips and tricks about the things I’ve found useful in the hopes of saving you some time

5

Touchless Start Screen Speed• Replaces start menus with one big, flat

menu• Touch is the best way to do it, but we don’t

have touch on a lot of laptops and desktops• Ditto for accessing charms – easy with

touch, but without a touch interface it’s slow

• The answer is to learn a few key combinations

• Almost all start with the “Windows” key6

7

Useful Keystrokes ([w]=Windows key)• [w]: to Start Screen• [w]+D: Desktop• [w]+E: File Explorer• [w]+I: Settings• [w]+C: charms• [w]+X: useful links• [w]+Z: Show all possible

settings• [w]+PgUp/PgDn:swap

monitors

• [w]+./shift-. : cycle app through snap/full screen

• [w]+F: search for files• [w]+O: lock orientation• And the golden oldies:• [w]+R: “Run” dialog• [w]+L: lock computer• [w]+P: screens

• Find an app in the Start Screen: just type on the screen

Controlling the "New" AppsInstalling, Preinstallling, Removing and Seeing the new-to-Windows-8 "Windows Store apps"(you know… the things we used to call "Metro" apps)

8

Warning! This is a huge topic.

But… it's so important to anyone rolling out and supporting Windows 8, and because I hear so much confusion about it, I wanted to include this section. So we'll briefly see…• Listing installed apps• Removing the new apps• Concepts and keywords in adding new apps• Steps in installing home-grown apps, or

"sideloading"And, most important, I want you to see how to do this stuff automatically, with some easy PowerShell recipes/examples

App Overview: Concepts and Terms• The new-to-8, tablet-y sandboxed

applications we once called "Metro" apps are called "Windows Store Apps," and I'll just call them "apps" for short

• They are tied not to computers but to users and their "Microsoft" IDs (once called "Live" IDs)

• Two kinds of apps: Store and "Non-Store"• A user gets an app in one of three ways• It's pre-installed or "provisioned" on her system• She installs it from the Store via the "Store" app• Her local IT pros install it via PowerShell add-AppxPackage

("sideloading")

App Delivery 1: "Provisioned:" Apps• "Provisioned" means "pre-installed in the

Windows image"• Microsoft delivers Win 8 with 15 provisioned

apps (Bing News, Weather, etc), Win 8 can support up to 24

• A Store app is delivered as a particular file/folder structure containing a file with the extension ".appx" that you'll need to try the "installing apps" stuff out

• I have a trivially lame, simple 8 app at www.minasi.com/sampleapp.zip

• Unzip it to c:\sampleapp for these examples

Seeing Your Provisioned Apps• get-AppxProvisionedPackage -online, or• get-AppxProvisionedPackage -path root-of-image

• You'll get a lot of items for each package, but in general you'll just need "DisplayName" (most human-friendly) and "PackageName," and many appx-related cmdlets need PackageName

• Use Select to trim the output, as in the following example, and "ft -a" which tightens the output

Sample Get-AppxProvisionedPackage

Removing/Adding a Provisioned App• Given our short time, I just want to offer

some examples -- use these as pointers to more info

• Use add- and remove- to grow/trim provisions; ex:

• remove-AppxProvisionedPackage -packagename Microsoft.BingSports_1.2.0.135_x64__8wekyb3d8bbwe -online

• add-AppxProvisionedPackage -online -FolderPath c:\sampleapp

• (That needs a group policy change and either a domain-joined Enterprise 8 system or a system with a "sideloading" license -- covered soon)

Cleaning up the Start Screen: Method 2• So you’ve just rolled out a Windows 8 system but

you want to get rid of Bing Sports, Travel, that sort of stuff but didn't mess with provisioning

• Again, let’s avoid clicking, and do it with PowerShell

• Every Store app is built as a package with extension “.appx”

• See all installed packages with get-appxpackage• We’re particularly interested in the attribute

“packagefullname”• It’s the key to removing an app automatically with

the command remove-appxpackage 15

Get-AppxPackage

16

Removing Packages: Quick Examples• Remove-appxpackage just needs the

packagefullname, as in• Remove-appxpackage

Microsoft.BingSports_1.8.0.51_x64__8wekyb3d8bbwe• Or just do a “where” and pipe the output to remove-

appxpackage, like• get-appxpackage|? {$_.packagefullname -like

"*bingsports*"} | remove-appxpackage• If you’re not sure of how many results you’ll get, add

“-whatif” to the end of the remove-appxpackage command

• Once you know the packagefullnames of the things you don’t want, it’s easy to collect the “remove” commands into a PowerShell script

17

Adding Packages: Sideloading• Normally not possible, as Windows 8

tablet-type apps have the “post-PC” model whereby you must go to a company store

• But if you’ve created your own app, you can install it without involving the Windows Store via “sideloading”

18

Sideloading Ingredients•Get/build a Windows 8 tablet app as an appx•Flip a Registry/group policy bit to allow sideloading•Apps are all signed, so you must trust its certificate•Get a license to sideload• Install with add-appxpackage

Try It Yourself• First install my sample app in c:\

sampleapp• import-certificate c:\sampleapp\cert.cer

-certstorelocation cert:\localmachine\root• reg add hklm\software\policies\microsoft\

windows /v AllowAllTrustedApps /t REG_DWORD /d 1 /f

20

Sideloading Example, Continued• Getting the license:• If you are an Enterprise customer, it's on your licensing page• You can get a 30-day to play with• You can buy licenses to sideload Professional at $30 apiece, minimum

sale 100 licenses

• Get a 30-day temporary one immediately: Show-WindowsDeveloperLicenseRegistration and then follow the prompts

Now Install the App• Inside the folder with the app, there's always a file

with the extension .appx – the PowerShell cmdlet needs an absolute or relative path to that .appx file

• Use that with PowerShell and add-appxpackage:• Add-appxpackage –path “C:\sampleapp\

App1_1.0.0.0_AnyCPU_Debug_Test\App1_1.0.0.0_AnyCPU_Debug.appx“

• (Relative paths work, also)• Look on the Start Screen and you’ll have a new

icon of a black box with a white cross on its face… that’s Sampleapp

• Just shows some text, that’s all 22

Running Windows 7.5(okay, it's not really called that)

Beyond Windows Store Apps…• The new apps get all the press, but

Windows 8 includes a bunch of useful things that have nothing to do with the new RT-based apps

• I think of them as "Windows 7.5"• You know File History and Windows to Go,

but let's look at a few lesser-known new upgrades

24

Storage-Related Upgrades• Native 4K support means you can use

“4Kn” drives which are bigger and cheaper

• Windows 8 recognizes solid state drives and knows not to defrag them and to use the TRIM command when deleting files

• Most of the new SAN-like Storage Spaces goodies from Server 2012 are in Windows 8

• You can mount ISOs and VHDs via Explorer (or PowerShell)

25

CHKDSK Gets Way Smarter• Chkdsk /F will scan and fix all in one shot in Win 7

& earlier• Now, Chkdsk /scan runs at low priority several

times a day• Fixes easy stuff• Notes the locations of problem areas and suspected problem areas

in new files called $corrupt and $verify• Flags the dirty bit if necessary

• Then you can run Chkdsk /spotfix which does not try to scan the whole drive, it just goes to the locations named in $corrupt and $verify, fixes them and stops… so it’s very fast

• Chkdsk /f /sdcleanup driveletter: finds and removes dead SIDs on ACLs

26

PowerShell as Well• repair-volume E is chkdsk-like• Add other options:• repair-volume E -spotfix (-spotfix is default

BTW)• repair-volume E -scan• repair-volume E -OfflineScanAndFix• One note, however… repair-volume does

not confirm before taking a volume offline, so be careful about pointing it to a non-C: volume

Knowing What Chkdsk Knows• Both have logs accessible with fsutil:• fsutil repair enumerate C: $corrupt• fsutil repair enumerate E: $verify

• Query current repair state:• fsutil repair state C:

Recovery Tip• F8 doesn’t take you to Safe Mode any more• Neither does shift-F8, for most systems (too fast)• The standard way to Safe Boot is to tell the system

to reboot into Safe Boot, which won’t help if you can’t boot all of a sudden

• So create a Recovery Disk on a USB stick (it’s in Control Panel)

• Another approach: create a second BCDEDIT entry, which enables Boot Manager and gives you control much earlier

• (You could do that on a failing system with WinPE)29

Security Upgrades• UEFI BIOS support means “Secure Boot”

which means• BIOS code is digitally signed• Chains to OS code, which is also signed• … rootkits and bootkits become essentially impossible

• Early Launch Anti-Malware Protection (ELAM)• Does a pre-boot malware scan• Default is to find and note corrupted drivers but that's all • Configure via group policies in Computer Configuration\

Administrative Templates\System\Early Launch Antimalware in Group Policies to opt to change its behavior such that it will not load bad drivers 30

More Security• Defender protects against malware now• Offline Defender simplifies checking for

rootkits

31

PowerShell Becomes Inevitable• There are a lot of really useful cmdlets amongst

the 2000 new ones that Windows 8 and Server 2012 acquired; here are a few examples

• Get-volume lets you quickly find out what drive letters are free

• Get-disk lets you get disk IDs without having to start DISKPART

• If you do BitLocker, get-tpm and initialize-tpm are great improvements over the previous tools

• Set-Partition re-letters volumes very easily• set-partition -driveletter X -newdriveletter Y

32

Bootable USB Sticks are Easier• Tool is now called the "Assessment and

Deployment Toolkit" (ADK), not WAIK• Still lets you build WinPEs with copype• But making a bootable USB with WinPE is

now just one command, makewinpemedia; example:

• makewinpemedia /ufd c:\winpe4-64 h:• And… WinPE 4 runs PowerShell!

Refresh and Reset• The plan is that you needn't reinstall Windows

to solve some problem, so Windows has "Refresh" and "Reset"

• Reset is the bigger of the two• Both require either a recovery partition on-disk,

or the Setup files nearby• Access from immersive Control Panel

34

What They Do: Refresh• "Refresh" restores your "trusted" things• Any Metro apps you've unpinned remain so• Links to an MS account remain on Store apps• Windows apps are removed, Metro apps aren't• Installed Windows features return to out-of-the-box status• "PC settings are changed back to their defaults," which

seems to mean a lot of HKEY_LOCAL_MACHINE settings but not all • Your data files and user settings don’t change… but that

won't help with all apps, as some won't recognize them when reinstalled

35

What You See in Refresh• The device discovery happens again• When you log on, you get the "Hi" tutorial

again• Took about 15-20 minutes on an i3 with an

ssd

36

What They Do: Reset• Takes quite a while• Wipes data files• Adds an (more lengthy) option to zero the

sectors• Wipes your profile• All Store apps gone• All Window apps gone• Basically it's ready to give to your kids at

that point 37

What's a "Primary PC?"• Part of "user-device affinity"• Changes roaming profiles and folder redirection so

you can tell Win 8, "I use roaming profiles / folder redirection, but only distribute them to systems designated my 'primary PC.'"

• You activate that choosieness on Win 8 with a few group policy settings

• But how to designate a machine as a primary PC?• (BTW, "primary PC" isn't like Highlander)• Easiest with the AD PowerShell tools

Example Primary Computer Work

39

These two lines are the important ones… the others just verify that it did what you want

40

The Specific Settings

• User settings:• Admin Templates/System/Folder Redirection, "Redirect folders on

primary computers only"

• Computer Settings• Admin Templates/System/Folder Redirection, "Redirect folders on

primary computers only"• (note on this: it isn't necessary, but if you use it, it overrides the

"User" setting for anyone logging onto this system)• Admin Templates/System/User Profiles, "Download roaming profiles on

primary computers only"

just three of them: reference

Thank You!I really hope I showed you a few of the little-known and useful goodies in Windows 8. There are lots more but those are some of the ones that I've had the most fun with.

Please do an evaluation, and if you are interested, my site www.minasi.com has info on my PowerShell, Server and Desktop classes coming to many cities in the next few months. Thank you again! 41

Windows Track ResourcesWindows Enterprise: windows.com/enterprise

Windows Springboard: windows.com/ITpro

Microsoft Desktop Optimization Package (MDOP): microsoft.com/mdop

Desktop Virtualization (DV): microsoft.com/dv

Windows To Go: microsoft.com/windows/wtg

Outlook.com: tryoutlook.com

System Center 2012 Configuration Managerhttp://technet.microsoft.com/en-us/evalcenter/hh667640.aspx?wt.mc_id=TEC_105_1_33

Windows Intunehttp://www.microsoft.com/en-us/windows/windowsintune/try-and-buy

Windows Server 2012 http://www.microsoft.com/en-us/server-cloud/windows-server

Windows Server 2012 VDI and Remote Desktop Serviceshttp://technet.microsoft.com/en-us/evalcenter/hh670538.aspx?ocid=&wt.mc_id=TEC_108_1_33

http://www.microsoft.com/en-us/server-cloud/windows-server/virtual-desktop-infrastructure.aspx

More Resources:microsoft.com/workstylemicrosoft.com/server-cloud/user-device-management

For More Information

msdn

Resources for Developers

http://microsoft.com/msdn

Learning

Microsoft Certification & Training Resources

www.microsoft.com/learning

TechNet

Resources

Sessions on Demand

http://channel9.msdn.com/Events/TechEd

Resources for IT Professionals

http://microsoft.com/technet

Evaluate this session

Scan this QR code to evaluate this session.

© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.