Aaron Margosis' "Non-Admin" and App-Compat WebLog

Microsoft's Trustworthy Computing (TWC) has just published a whitepaper, Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques , of which I am a co-author. It discusses PtH attacks against Windows operating systems, how the attack...

This paper describes a simple way to mitigate some types of application compatibility problems with legacy applications installed on 64-bit editions of Windows Vista and newer, including Windows 7 and Windows 8.  The technique relies on creating an NTFS junction or symbolic link, effectively “joining” two otherwise separate directory structures.  The paper provides technical details on the underlying concepts and on how to implement the mitigation.

...

Announcing the release of LUA Buglight 2.2, including support for Windows 8. LUA Buglight is an interactive utility that identifies admin-permissions issues (" LUA bugs ") in desktop applications. Version 2.2 (attached to this blog post) adds support...

The Windows Sysinternals Administrator's Reference that I co-authored with Mark Russinovich is now available in Russian! http://www.amazon.co.uk/Sysinternals-Spravochnik-administratora-Margozis-Russinovich/dp/5750204111/ref=sr_1_23?ie=UTF8&qid...

It’s one thing to have one's name associated with Mark Russinovich , but quite another to be quoted by Raymond Chen . I’m absolutely thrilled that Raymond quoted me in his Windows Confidential column in this month’s TechNet Magazine...

My colleague and debug super-guru Andrew Richards sent this announcement out earlier today: Larry Larsen , Andrew Richards and Chad Beeder are pleased to announce our new Channel 9 show called Defrag Tools . http://channel9.msdn.com/Shows/Defrag...

Part of my Sysinternals Primer: Gems presentation at TechEd last month covered the topics of terminal services sessions, window stations and desktops. To illustrate the concepts, I used a utility I wrote called TSSessions. As promised, I have attached...

The two sessions I delivered at TechEd this year are now available online, as is the recording of my live Channel 9 webcast with Microsoft Technical Fellow (and my co-author) Mark Russinovich from TechEd Europe. And as I promised attendees of my Sysinternals...

I'm presenting a couple of sessions at TechEd North America 2012 in Orlando (June 11-14) and at TechEd Europe 2012 in Amsterdam (June 26-29). The first session is " Sysinternals Primer: Gems ", the latest in the Sysinternals Primer series (*). In...

I'm DJing a 2-hour Lucinda Williams show this Friday, and you can listen in!

...

Let's Talk Computers ranks as one of the longest-running computer radio talk shows. I enjoyed it recently when they interviewed me about the Windows Sysinternals Administrator's Reference. They published Part 1 of that interview on March 3. Check it out...

Last May at TechEd US, I sat down for a six-minute interview with Matt Hester about the Windows Sysinternals Administrators Reference (the book I co-authored with Mark Russinovich ) and issues I see in my work with customers .  That interview, part...

My colleague Shelly Bird , a highly esteemed Architect in Microsoft Public Sector Services, has years of experience in desktop and server deployments.  She has seen what works and a whole lot of what doesn’t.  Now she is bringing her observations...

The correct ways to identify folder paths to store files depends on the programming technology you use. This blog post shows how to do it in C++, C# and VB. NET, PowerShell, Windows Script Host (VBScript and JScript), and as a last resort, environment variables.

...

The venerable PrivBar toolbar for IE and Explorer now shows the Integrity Level of the current page.  (Helps mitigate the removal of the Protected Mode indicator from the IE9 toolbar.)

...

We have a lot of really smart people at Microsoft, but among those there are a handful who are the most knowledgeable and the most helpful, the go-to people upon whom I can reliably depend for accurate and detailed answers to rarely-asked or never-before...

Many of you have long wished for comprehensive, detailed documentation of the Sysinternals utilities. It has finally arrived . Over two years in the making, the Windows Sysinternals Administrator’s Reference (written by Mark Russinovich and me) is now...

The two sessions I presented last week at Tech-Ed North America 2011 are now available for on-demand online viewing: Unintended Consequences of Security Lockdowns (which got an unexpected and appreciated plug from Raymond Chen ) is here: http://channel9...

I just posted a major update to IEZoneAnalyzer, my IE security zone analysis and comparison utility, over on the Microsoft FDCC/USGCB blog. Lots of new features, including saving settings so they can be viewed and compared later and on other computers...

Getting Law Manager v2.4 to run on Windows 7 Overview Several of my customers run old versions (circa 2003) of a legal case management application called Law Manager , since acquired by Bridgeway. These customers reported that their old versions of Law...

LUA Buglight 2.1.1 is was attached to this blog post and replaces v2.1. It adds support for Windows 7 SP1 and Windows Server 2008 R2 SP1. It also fixes a localization bug. Now that I've (pretty much) finished work on the Windows Sysinternals Administrators...

I'm presenting a couple of sessions at Tech-Ed in Atlanta (May 16-19, 2011) : The first is " Unintended Consequences of Security Lockdowns ", which was very highly rated when I presented it last month at TechReady, Microsoft's internal training event...

[Update May 17, 2011: this blog post has been republished as Microsoft Knowledge Base article 2526083 ] Applies To Windows Server 2008 (all editions except Server Core) Windows Server 2008 R2 (all editions except Server Core) Summary Under...

TechEd sessions are available for on-demand viewing. Here are some recent ones that Chris Jackson (The App Compat Guy) and I have delivered recently on Application Compatibility and more... What Everyone Should Know about Application Compatibility...

Many of our customers make Adobe Reader part of their standard desktop image, or at least have it on the majority of their systems. Because of its ubiquity, Reader has become a major target for cybercriminals, with a scary increase in the number of exploited...