Chris Jackson's Semantic Consonance : Application Compatibility

Why don’t I see any data for Vendor Assessment for Windows 7 in ACT 5.5?

Chris Jackson — Tue, 22 Dec 2009 18:03:46 GMT

A few weeks ago, I spoke about how our information on vendor data was slowly making it through the channel, beginning with the compatibility center (complete), moving on to the downloadable Application Compatibility List for IT Pros (complete), and finally getting to ACT. I suggested, “The target date for this integration is mid-December 2009.” To call December 22 “mid-December” is already stretching it, and yet it’s still not showing up in ACT. What gives?

Well, let’s talk a little bit about the data and how it has to move through the system. In the end, it all comes from the same database. The compat center, the downloadable list, the data that feeds the upgrade advisor – all from the same source. What is taking so long to turn on the spigot for ACT?

Well, the big challenge is data transformation. First, the App ID has to be translated. The 3 live services all use a new algorithm for determining an application ID. ACT hopes to transition to use this new algorithm in the next version, but it’s one of those “running in place” changes where, after spending a lot of time and money, the end result looks identical to the user, so it’s difficult to justify rushing the transition (particularly since invalidating an existing inventory full of old App IDs is a terrible idea, so the application will need to support both old and new, and be able to differentiate between them). That translation needs to be automated so it can run in perpetuity, and that process has to be build. Then, the web service that feeds ACT is the old version (v1) while the others are using a much newer version (v4), so the old web service interface has to be modified to leverage the new database feeding it. So, there are two feats of engineering that need to be implemented, tested, and proven at scale.

We’re still hoping to have this done the first week of January, but vacations and winter colds are making this more challenging. Rest assured, this data is coming and we are terrible sorry for any inconvenience the delay is causing – we really do want the data to be accessible and convenient and are not neglecting the value this has to customers.

Windows 7 Debugging Demo: Troubleshooting the Broken Microsoft Time Zone Utility

Chris Jackson — Wed, 16 Dec 2009 20:12:11 GMT

Earlier today, I received this request from a customer:

This (http://www.microsoft.com/downloads/details.aspx?FamilyID=07fb0bd8-f390-458d-a629-6f0258ac7cdf) is a .NET 1.1 app and I have installed .NET 1.1 SP1 on Windows 7 32-bit and all .NET 1.1 SP1 security patches but it doesn't run. Gives me this error: An internal error has occurred: Object reference not set to an instance of an object" and then it quits.

Always being up for a challenge, I decided to have a look and see what wasn’t working. Reproducing the error is pretty straightforward. Just run the app – it’ll gladly crash for you. But the question is, why? And can you fix it?

If you hit this with a debugger, you’ll find the following stack when you hit an AV:

0:000> !dumpstack -ee
Current frame: (MethodDesc 0x2098d28 +0x1c SystemTimeZone.ConvertToTimeZoneInfoStructure)
ChildEBP RetAddr Caller,Callee
0018f4f4 0206d4ab (MethodDesc 0x2098d08 +0x43 SystemTimeZone.ToLocalTime)
0018f55c 0206cfc0 (MethodDesc 0x2098cd8 +0x38 SystemTimeZone.Convert)
0018f574 0206a484 (MethodDesc 0x2e5680 +0x15c frmMain.ShowCurrentTimes_Click)
0018f5d8 02067686 (MethodDesc 0x2e56d0 +0x446 frmMain.frmMain_Load)
0018f61c 02060365 (MethodDesc 0x2e5620 +0x2ed frmMain.Main)

Now, you could take a stab at this with SOS and start pulling out objects, but I didn’t believe that this would be the easiest way to solve the problem. Instead, I decided to reverse engineer the code and have a look. If you take a peek at the structure you’re trying to create from the SystemTimeZone class, you’ll find where the instance of the time zone came from – the code was rampaging through the registry looking for it. Here’s the method in question:

public TimeZoneList()
{
    m_TZHash = new Hashtable();
    m_TZList = new ArrayList();
    RegistryKey key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\");
    string[] subKeyNames = key.GetSubKeyNames();
    Type t = typeof(TZIStructure);
    int num2 = Marshal.SizeOf(t);
    int num3 = subKeyNames.Length - 1;
    for (int i = 0; i <= num3; i++)
    {
        RegistryKey key2 = key.OpenSubKey(subKeyNames[i]);
        SystemTimeZone zone = new SystemTimeZone();
        SystemTimeZone zone2 = zone;
        zone2.DaylightName = StringType.FromObject(key2.GetValue("Dlt"));
        zone2.DisplayName = StringType.FromObject(key2.GetValue("Display"));
        zone2.Index = IntegerType.FromObject(key2.GetValue("Index"));
        zone2.MapId = StringType.FromObject(key2.GetValue("MapID"));
        zone2.StandardName = StringType.FromObject(key2.GetValue("Std"));
        zone2.Name = key2.Name.Substring(key2.Name.LastIndexOf(@"\") + 1);
        zone2 = null;
        byte[] buffer = (byte[]) key2.GetValue("TZI");
        key2.Close();
        if ((buffer != null) && (buffer.Length >= num2))
        {
            GCHandle handle = GCHandle.Alloc(buffer, GCHandleType.Pinned);
            IntPtr ptr = handle.AddrOfPinnedObject();
            zone.TZI = (TZIStructure) Marshal.PtrToStructure(ptr, t);
            handle.Free();
            if (!m_TZHash.Contains(zone.Index))
            {
                m_TZHash.Add(zone.Index, zone);
                m_TZList.Add(zone);
            }
        }
    }
    key.Close();
}

If you spend enough time with the !do command, you can eventually stumble upon the answer, but the easier approach is, again, to stay out of the debugger and leverage your favorite search engine. Here’s a KB article that points out the problem:

http://support.microsoft.com/kb/935369

Relevant information: “The Index registry value does not exist in Windows Vista and in Windows Server 2008.”

Aha. See the source code above? It wants that value, and it’s not there. Root cause found.

Now, on to solutions.

First of all, I wonder if you need a solution at all. If you click on the clock, and then click on Change date and time settings… you will get to the Date and Time control panel. Click on the Additional Clocks tab, and you can add 2 additional clocks for 2 new time zones. If you need more, you can always use Gadgets to fill the rest of your needs. So, for most people, this should provide a built-in solution to the problem – you don’t need the app any more because the OS provides 2 solutions already.

But, if you really really love that particular app, you could always copy that piece of the registry from Windows XP onto your Windows 7 computer, drop it in a new place inside of the registry, and then use the VirtualRegistry shim to redirect that app’s checks of the timezone portion of the registry to the copy you brought over.

Special thanks to my friend Gov for pointing me to the KB article, and for coming up with the VirtualRegistry workaround idea.

Flexera Software Webinar: Best Practices for Windows 7 Application Compatibility

Chris Jackson — Tue, 15 Dec 2009 16:33:39 GMT

Are your business-critical applications compatible with Windows 7? Join Microsoft's "App Compat Guy" Chris Jackson to learn best practices for how IT teams are resolving Windows 7 application compatibility issues. Hear about his experiences with early Windows 7 adopters, including the most common application compatibility issues and their root causes. Tips in this webinar will help your IT team minimize risk and make a smoother move to Windows 7.

Webinar Details
Thursday, December 17
12pm EST (9am PST, 5pm GMT)

One curious observation I have made while doing app compat work over the past few years: The ownership of the project is assigned to the packaging team more so than any other team. Perhaps that’s because it’s the only centralized group dealing with every application, or perhaps it’s because installation failures on the new OS are the first things you notice – the rationale varies. But regardless, the team responsible for packaging definitely is an extremely interested party, if not the outright owner of the project.

As a result, when I sat down for dinner with several execs from Flexera Software (makers of InstallShield and AdminStudio, among other things), they expressed this as an area of great concern for their customers. So, in between our discussion of which tapas was the tastiest (I assure you, there was some extremely tasty tapas), we were brainstorming how we can better work together to help people who are interested in packaging be more successful when an app compat project comes along.

One idea? Let’s work on a webinar together. Flexera has a pretty successful webinar series, so let’s just partner up on one of those. So, on Thursday, December 17, 2009 at 11:00 am Central, we’ll be doing that. It will be relatively quick and will be presented at an overview level, so if you’re looking for a debugging deep dive this probably isn’t your best bet, but one thing it will emphatically not be is marketing speak. If this perspective is useful to you, come and join us. Feel free to ask the hardest, nastiest questions you can think of!

http://mktg.flexerasoftware.com/mk/get/BPWin7CompatApp_wbnr

Sometimes, an apparently broken operating system is an app compat problem: Symantec solution available for “Network Path Not Found” and other errors

Chris Jackson — Sat, 12 Dec 2009 01:53:59 GMT

In the world of app compat, sometimes you get lucky and have the app itself clearly not working, and you debug it. (Well, I guess if you’re really going to get lucky, you’ll have the app just work.) Things get murkier when an app has a bad interaction with another app, but not stand-alone (in which case you could miss the interaction until you’ve deployed to end users, since labs generally start with a clean slate). This is where the finger pointing begins – the great “blame game” where each support organization points their finger at the other one.

And, of course, the most fun is when you have an app compat problem where it makes it look like the operating system just plain doesn’t work. When you see a message like, “The network path was not found” or “File or network path no longer exists”, do you think app compat problem? No, you think you were sold a busted up old operating system. Sometimes you’re right. (We have bugs too.) Sometimes it’s your network. And, yes, sometimes it’s an app compat problem.

Such is the case for a number of support incidents we’ve seen recently with Windows Server. We debug each one, and what we found was a deadlock in srtsp.sys / srtsp64.sys. I’ve seen deadlocks all over the place – they’re one of those equal-opportunity-style bugs, because multi-threaded programming is insanely hard to do perfectly. It just so happened that these deadlocks would rather unluckily take place on the kernel mode threads servicing SMB negotiation requests.

The vendor, of course, wants happy customers, so they released a patch. If you are running older versions of Symantec Endpoint Protection 11 and Symantec Antivirus 10.2 you should get the solution from Symantec. Symantec confirms that this is a known issue and there are updates to resolve the problem. This is one of those insanely useful patches to get (as opposed to patches that fix problems that you may never see in your lifetime). See: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007102613484948

My friend Robert put together a post on this over in the Windows Server Division Weblog.

I’m kind of disappointed that there isn’t a disturbing amount of debugger information in the post, given who wrote it (though you’ll see there is enough to communicate the message). Robert is the kind of guy where it only takes a few minutes of watching him work to realize just how profoundly dumb you are. I had one app I was debugging once, and I was just plain stuck. (It happens.) So, I asked him for his thoughts. He dumped hex to the screen, pointed to a bit of it, said, “there’s the problem, try this fix.” And he was right. (Of course, I later realized that I was just as bad when I told my friend Gov a joke in hex, and he got it.)

How to Hack your Application Compatibility Toolkit 5.5 (ACT 5.5) Database to Locate 16-bit Files in your Application Inventory

Chris Jackson — Tue, 08 Dec 2009 22:02:46 GMT

(Wow, I’m doing a lot more posting today than normal. Things kind of piled up while I was on leave.)

There is a ton of activity going on in the world regarding Windows 7 deployments, and one of the hottest topics we’re finding is x64. People are very interested in moving to the 64-bit version of the operating system, but one obvious question is, will my applications be broken?

The next version of the Application Compatibility Toolkit, ACT 6.0, is scheduled to have far more robust x64 support. (It’s scheduled to support it at all, which is already a bonus.) But what about in the interim?

First of all, there is the Setup Analysis Tool. This will detect 16-bit binaries (probably a problem for 64-bit Windows, unless setup is detecting the bitness of the OS and dropping file appropriately) and driver installation (possibly a problem for 64-bit Windows, unless setup is detecting the bitness of the OS and dropping files appropriately). But this requires a fair amount of work to get configured and running, and it also means that you have to have the setup files. Depending on how managed your environment is, that may be a problem.

If you’re the sort that doesn’t mind undocumented secrets, I’ll let you in on one: ACT already collects the bitness of the files it finds in an inventory scan, it just doesn’t surface that in the UI today. So, how can you view this information? Why, hack the database of course. My SQL skills are so rusty these days I’m beyond embarrassed of what I crufted together, but here is a query I hacked up to display all of the files that are neither 32-bit (user mode 32-bit is probably OK) nor 64-bit (definitely OK) in your ACT database:

USE ACT55
GO

SELECT DISTINCT Applications.appName, Static_App_Properties.fileName, fileModuleType

FROM Static_App_Properties
INNER JOIN Application_Instance_Files
ON Static_App_Properties.identity_hash = Application_Instance_Files.filePropertyID
INNER JOIN Applications
ON Application_Instance_Files.appID = Applications.identity_hash

WHERE fileModuleType<>'32BIT' AND fileModuleType<>'64BIT' AND propertyType='File'

ORDER BY appName
GO

The schema is, as always, undocumented and subject to change, but I have found this helpful in a few scenarios to quickly zero in on apps to specifically test on 64-bit when targeting a mixed environment. I suspect you’ll have to do less hacking with ACT 6.0.

Localized Documentation for the Application Compatibility Toolkit 5.5 (ACT 5.5) Available in 10 Languages

Chris Jackson — Tue, 08 Dec 2009 16:12:47 GMT

今日は。Guten Tag. Bonjour. ¡Hola! 안녕하세요. 你好. Ciao. Здравствуйте. Olá.

I’ve been on leave for a while, so my apologies for being quiet lately. I’ve been sitting on this news for a while, though I think these links might come in handy if you are touching a global audience. We have localized the documentation for ACT into 10 different languages:

汉语 (Chinese - Mainland)

汉语 - 台灣 (Chinese – Taiwan)

Italiano (Italian)

русский язык (Russian)

Português (Portuguese – Brazil)

If there is one thing I have noticed in my travels, it’s that language is a hard barrier to cross. This is a small but important step. As group after group stretches their brains to understand my English (or my horrible Japanese), we’re taking a few more steps to meet in the middle. I’ve also been doing some work to build more labs – things with fewer words that let the products and experiences do the teaching so they are shorter and less expensive to translate, but still deliver the core knowledge. Because, no matter where you are in this little world of ours, we’re all in this together.

Windows 7 Application Compatibility List for IT Professionals

Chris Jackson — Tue, 17 Nov 2009 15:21:07 GMT

It’s finally here!

We released the Windows 7 Compatibility Center a few weeks ago. This lets you look up one application at a time. You can find that at http://windows.com/compatibility.

Today, we have a downloadable list indicating vendor support. If you want to write some automated matching against your list of application, you can use this – it is an Excel download of all known information from vendors. You can find that at http://www.microsoft.com/downloads/details.aspx?FamilyID=890e522e-e39e-4278-aebc-186f81e29173&displaylang=en.

The final step will be to have this information integrated directly into ACT. The target date for this integration is mid-December 2009. We’re getting there! We’re also planning to keep this data updated bi-weekly.

Enjoy!

How to Remove the RC Designation from the Windows 7 Reports in ACT 5.5

Chris Jackson — Fri, 06 Nov 2009 20:56:30 GMT

We shipped ACT 5.5 back in April 2009, several months before we shipped Windows 7. Helpfully (I guess) we decided to label it Windows 7 RC in the UI so you could specifically track your testing against the release candidate. We had the idea that we could update this via our web service, so that once we hit RTM we could just push out an update to modify this.

And apparently we forgot to turn this little bit of code on.

So, now we have a bunch of folks around the world who wonder why ACT seems to be in a beta phase and not ready for Windows 7 RTM.

Well, it is ready for Windows 7 RTM, and I bet some of you would like it to look ready. We’re really sorry we can’t do that using the mechanisms we planned to use, so I figured I’d let you in on the secret to the planned update.

We were going to update 2 fields in the database.

So, if you want your ACT UI to look ready for the ~~future~~ present, you can run this bit of SQL:

UPDATE dbo.OS
SET osName='Windows 7'
WHERE osName='Windows 7 RC'
GO
UPDATE dbo.OS
SET osName='Windows Server 2008 R2'
WHERE osName='Windows Server 2008 R2 RC'
GO

Enjoy, and sorry for the inconvenience.

Windows 7 Compatibility Center Live on the Web

Chris Jackson — Wed, 21 Oct 2009 16:45:10 GMT

Hooray – I can stop pasting this link into emails!

The Windows 7 Compatibility Center is now live.

Using the uiAccess attribute of requestedExecutionLevel to Improve Applications Providing Remote Control of the Desktop

Chris Jackson — Fri, 16 Oct 2009 01:47:04 GMT

I’ve run into this exact same problem 3 times now in one week, so I figure that probably doesn’t bode well and I should attempt to do something about it.

With 3 different pieces of software (one of them ours), the remote control functionality is imperfectly implemented. Let’s see if this sounds familiar to anyone. You are the helpdesk. You attempt to connect to a user’s desktop. You have to elevate an application. When you do, you (the helpdesk who actually has the password) doesn’t see the UAC dialog – instead, the end user (who does not have the password) does. Even if you decide to give the user the password (it happens), you then can’t control or even see the elevated application.

Kind of makes it hard to be a helpdesk when that happens.

Here are the 3 solutions that I have seen to this problem:

Do nothing. That’s what our solution did. It just failed every time elevation was involved.
Install a service. That’s what company X did. It requires the user to know an admin password, and that’s a problem for my customers
Run the application elevated. That’s what company Y did. It requires the user to know an admin password (a problem with my customers), and also won’t allow you to interact with any windows running at System integrity level (so an incomplete solution)

Here’s what I wish all 3 had done:

Manifest with uiAccess = true

Now, most people don’t really understand what this is for, and the UAC manifest is typically just a copy/paste affair. But it pays for the remote desktop developer to pay attention to it. For any regular piece of software, you generally want to stay away from it – it’s dangerous, and sidesteps a significant security feature (UIPI). But if you are remoting the desktop, it’s precisely what you want – you need to be able to see everything!

It’s dangerous enough, in fact, that we won’t allow you to set it without digitally signing your application. By default, you also have to have it installed in a secure location (such as Program Files). You can set a group policy to not require a secure location, but there is no option to not require a signature.

However, once set up, it’s really powerful. You’ll be able to remote every possible kind of window – any integrity level at all. No more blank, unresponsive screens. Everything comes across, regardless of integrity level.

You’ll also be able to leverage the group policy that lets you prompt NOT on the secure desktop if you are a UIAccess application – that way you don’t have to lose the defense in depth of using the secure desktop for normal elevation, but you also avoid writing code to remote the secure desktop when your remote desktop application is running.

All in all, you are just full of win.

Now, it’s my job to fix up apps that are written suboptimally, so you may be wondering how I did getting these working?

Our application, rather conveniently, used an external manifest. All I had to do was open up the manifest in Notepad, and type four characters (t-r-u-e) in the uiAccess attribute. Done. Now it works great. (Of course, everyone who downloads it will download a new broken one, so they’ll have to text edit it too – clearly we want to work with the team that makes this to fix it on their end, but you aren’t stuck – you can fix it without depending on anyone else.)
Company x, the one that used a service (claiming of course that it was UACs fault that they had to do this)? I can’t fix it. They used an internal manifest, which has precedence over any external one I might lay down there. I could extract that manifest with mt.exe, edit it, and then re-inject it, but then I invalidate the digital signature. Remember that this is a non-optional requirement for a uiAccess app! So, there is nothing I can do. I’m trying to contact the vendor.
Company y, the one that elevates to admin – this one I didn’t have time to examine – they do a “just in time” install and uninstall, so I couldn’t explore the manifest, but since it’s so transitive it’d be hard for me to do much anyway that would last.

Anyone writing desktop remoting applications, please consider using this. And feel free to contact me if you have questions. I would be delighted to help you.

For the record, here is the corrected manifest for the one I was able to fix:

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1'
manifestVersion='1.0'>
<assemblyIdentity
   version="1.0.0.0"
   processorArchitecture="X86"
   name="Microsoft.FixedUpApp.SupportConsole"
   type="win32"
/>
<description>Fixed Up App</description>
    <dependency>
      <dependentAssembly>
        <assemblyIdentity type='win32'
         name='Microsoft.Windows.Common-Controls'
         version='6.0.0.0'
         processorArchitecture='x86'
         publicKeyToken='6595b64144ccf1df'
         language='*'
        />
      </dependentAssembly>
    </dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker"
         uiAccess="true"/>
      </requestedPrivileges>
    </security>
</trustInfo>
</assembly>

Why You Shouldn’t Listen to Me, and Why You Should

Chris Jackson — Sat, 26 Sep 2009 01:34:50 GMT

Ah, Karma, you rise up at the least convenient times. (This blog post is not meant to imply a belief in preordained futures, divine intervention, or the existence of the Perfectly Normal Beast.)

Yesterday, I had somebody ask me not to speak about something at the Springboard Virtual Round Table. I didn’t react particularly well to this particular piece of … erm … guidance, so in retribution Karma decided to pair me up with a completely drained car battery and an emergency service technician with the world’s worst sense of direction. Which of course gave me plenty of time to think about things.

And I concluded that you shouldn’t listen to me, or, really, anybody. And, at the same time, you should.

(Perhaps I should have put the fact that you should first, to avoid losing readers.)

So, what happened?

I demonstrated Access 2007 and Access 2003 running side by side. What you didn’t see is that I also sequenced (and yes, ran on Windows 7) Access 2.0. Hello 1994. If you ever attend my talks at conferences, you may see me occasionally do something like that – a quick firing up of an app that brings back a wave of nostalgia that sends approximately 5% (max) of the people in the room on a trip down memory lane, and is done quickly enough that the 95% who don’t remember that ancient piece of software aren’t annoyed. Seeing it again positively delighted me, while making me wonder how we possibly ever thought that was good. (Teal with blue shadows? Seriously?)

But I was told (not asked) flat out that I could not run that. It gives the wrong impression. We are trying to convince people that App-V is not an app compat solution, and if it doesn’t run natively on the OS we don’t want to show it running in App-V, because that applies that App-V is a remediation solution.

The engineer in me thought that, while I certainly don’t want to mislead people into thinking App-V is an app compat solution of any significant merit, if you try to make things cut and dry, then you’ll be disappointed. Because the reality we’re trying to portray with messaging collides rather inconveniently with the actual reality where App-V does fix the one problem that keeps Access 2.0 from running natively on Windows 7, and you’d have to apply RunAsAdmin, CorrectFilePaths, or loosen ACLs to get it running without App-V. You see, in my world, the theory never gets to win, it’s reality that gets to win, and reality had spoken loud and clear via my perfectly functional and incredibly silly demo.

But here’s the problem with that thinking: in my world, it’s my job 100% of the time to understand the system top to bottom. I have time to understand subtlety. I have the ability to dive as deep as I want, so long as it helps solve somebody’s problem somewhere. But for the rest of the world, you just want to get done. You don’t have the same luxury of time that I do. And, if my demos were the only information you ever received about App-V because you never had any more time to learn about this one little niche of technology, you’d come out having watched with your own eyes one app not being fixed by it, one app being fixed by it, and you wouldn’t know what the h*ll to think, you’d conclude that we’re all mental, and you’d go off and become a sheep farmer.

As a result, it’s really important that, if we’re the only message you see, we don’t self-contradict (even though the contradiction exists only because we haven’t gone deep enough to resolve the paradox), and we give you the one high-level message that helps you make the best decision, even if the abstraction we give you is a leaky one. We’d rather err on the side of whatever approximation saves you the most time, money, and heartache if we have to approximate.

The same is true of tools. I’ve looked at all kinds of output that suggests that something might have gone wrong, only to find that it works perfectly well. Believe me, the people who make these tools know that they’ll get some things wrong – they just want to get the high-level numbers that you depend on to make decisions right just as often as they can.

I have the same problem when building a hypothesis while debugging an application. I use my imperfect knowledge of a huge system to make what is, hopefully, a pretty good guess about what’s going to happen next, but I’ve concluded and believed stuff really strongly countless times when one small failed assumption along the way led me to the completely wrong conclusion and I wasted a ton of my time.

So, keep in mind that, while we’re always working really hard to distill this enormously complex and sometimes fiercely non-deterministic system into a set of rules you can use to actually get done with your job before we release Windows 14, that rule can be an oversimplification that isn’t always true. No matter how clever the source, nothing should trump what you see with your own eyes. A good source should always lead you to saved time, but in this world you always have to trust but verify.

Also, if you ever have somebody tell you something that you don’t initially agree with, you should spend the time right then and there to understand why they believe so strongly in what they’re saying, in a respectful manner. Unless you like hanging out in parking lots waiting for service vehicles.

Springboard Series Virtual Roundtable - Windows 7 Application Compatibility Part 2: Virtualization

Chris Jackson — Wed, 23 Sep 2009 23:35:05 GMT

Date: Thursday, September 24
Time: 9:00am Pacific Time

https://ms.istreamplanet.com/springboard

The reviews on Windows 7 have been really great so far, but you obviously can’t start using it if, after installing it, all of the stuff you need in order to get your work done breaks. Application compatibility is so important, in fact, that we managed to get Mark Russinovich to come and talk about it not once, but twice!

In our first episode, Mark talked about the overall challenge, the process, and tools to help you get there. We spoke a little bit about remediation as well, specifically in the context of what we’ve been calling the lightweight remediation. Things like shims or policy changes.

Alas, I was unable to attend this event, because they kind of forgot to invite me. They didn’t forget to script me in, mind you, they just forgot to tell me about it until I already had a customer commitment (which I never back out of). All kinds of formulations on how I could get from Ottawa, ON, Canada to Seattle and back without the customer noticing then ensued, until eventually everyone realized the futility of this discussion. So I recommended several folks who are far smarter than me to join the panel in my stead.

Apparently all of these people were unavailable for this round, because this time, they actually not only remembered to invite me, but actually chose to.

This time around, we’ll be discussing the more heavyweight fixes for app compat problems. Specifically, how does virtualization fit into your application compatibility strategies? We’ll be discussing all of the different flavors of virtualization, dispelling myths, showcasing truths, and helping you get the information you need to develop a comprehensive and sensible strategy.

We hope you’re able to join us live tomorrow!

FAQ: When is the Application Compatibility List (Currently Focused on Windows Vista) Going to be Updated for Windows 7?

Chris Jackson — Mon, 07 Sep 2009 14:41:52 GMT

There is a huge amount of excitement about Windows 7, and people are looking to get moving with app compat immediately so they can start deploying Windows 7 right away! In the enterprise, however, there are a number of risk mitigation strategies that most administrators put into place, which typically includes (among other things) ensuring that the most business critical applications are supported on Windows 7 by the vendor.

We have tried to simplify the process of finding these support statements by creating a portal site, making this list downloadable, and integrating it into the Application Compatibility Toolkit. People like this so much that, an average of around infinity times a day, I’m asked when it’s going to be updated for Windows 7.

It is scheduled to be updated for GA (General Availability). That’s October 22, 2009.

What’s with the delay?

Well, a couple of reasons.

First of all, “compatible” and “supported” are two different things. What matters to most people is supported.

Before most software makers support an application, they test it pretty thoroughly to ensure that there are no significant bugs that could expose them to major risks and/or higher than acceptable support costs. This takes time. Now, we’ve been giving ISVs access to builds for quite some time, and they can use the interim builds to perform software testing and identify any significant issues which will require quite a bit of time to resolve. However, the ISV can’t even begin the thorough testing to ensure that they have a supportable solution on Windows 7 RTM until they actually had access to Windows 7 RTM. So, the same day that many enterprises were able to get that build and wanted this data, ISVs received it and could start their validation for supportability. Being able to instantaneously tell if you can afford to support your software on a given platform is asking rather a lot of any ISV. This gap between RTM and GA provides each ISV a brief window of time to perform thorough testing before customers can reasonably demand to know a support statement.

We then also leverage this time to reach out to those ISVs and find the support statement. You see, ISVs don’t have to report in to us when they make new software or create new support statements – in fact, they never have to call us at all. We tried changing the nature of this relationship once with the Works With Windows Vista logo program, and it was a colossal failure. So, in addition to an ISV needing time to test and validate something, we also need time to find these results and support statements and consolidate them into the database which you can access.

So, we both have a lot of work to do in order to get these lists put together, so much so that 3 months is really kind of stretching it. I know of several vendors already who are pushing out their supported dates for Windows 7 into 2010. What do I do when I find that? I debug their apps. It’s much easier to fix and support an app once the hard part – debugging it – is already done. :-)

Now, compatible is a different story. If you want to be a purist, compatible means it has no bugs on the given platform. Since no bugs on a given platform is, for this purpose, the same as saying no bugs, I can safely say that there is no compatible software for any platform that has ever been made. So, we’re forced to use a different definition – compatible meaning that there are no bugs that *stop me from getting my work done* on a given platform. So, since nobody else knows precisely how you get your work done, the only person who can fairly answer that question is you.

More Application Compatibility Resources for Windows 7

Chris Jackson — Tue, 25 Aug 2009 22:46:28 GMT

There are a number of efforts going on to help organize application compatibility for Windows 7, in or ongoing effort to improve in this space. Now, the technical information remains fairly stable, but there are a number of different ways to organize that information based on the perspective with which you are approaching that problem.

In fact, that’s probably the hardest part of talking about application compatibility – it crosses pretty much every discipline in IT, from management down the individual contributor. Even within individual contributors, it’s divided between the IT Professional and the Developer audiences.

(As a side note, in nearly every audience I speak to where there are representatives of both disciplines, they tend to completely sort based on discipline. All of the IT Pros will sit on one side of the room, all of the developers sit on the other. You almost never find a situation where people are naturally distributed. And we wonder why communication between these teams, while critical, doesn’t happen as often as we would like – I know I am guilt of that myself!)

So, we’re trying to organize and sort the information and knowledge for you as best we can. Here are just a few ways we have organized things to help out:

Windows XP to Windows 7 Migration Guidance

http://technet.microsoft.com/en-us/windows/ee150430.aspx – this is one way to map out information by the process itself. It’s fairly high level (no kernel debugging tips here) and more geared towards the IT Professional (hence the Technet home). Instead of a big list, there is a flowchart navigation system. Click on the stage in the flowchart you are sitting at, and it lists out resources, with pros and cons, of the tools which are there to help you through that state! Quite a clever navigation scheme.

Application Compatibility Factory

OK, this is one that’s confusing. I know I pick on folks in the marketing discipline from time to time, but that’s only because I think they can act in ways that are as unengineer-like as possible. Sometimes that’s good, sometimes that’s … confusing. This is one of those confusing times.

We took an existing program and brand – Application Compatibility Factory. The name made sense – it used a (predominantly offshore) factory model, optimized for churning through bulk. The program for Windows Vista consisted of around 6 global system integrators.

We then re-used the power of that brand on a whole new model. No, really! It doesn’t look anything like the old model – heck, it isn’t even a factory model, despite having the word Factory occupy 1/3 of the words in the name. No longer is ACF the “stroke a 7 figure check and make a big chunk of work disappear” – it’s now a program that delivers 1-week Proof of Concept engagements.

Here’s basically what happens: a partner (or even Microsoft Consulting Services) comes in to your organization and begins the process of taking a software inventory. (Depending on how many desktops you have, they may not be able to finish, but they’ll be sure to let you know how you can finish up.) Next, they get you started on the process of rationalizing that inventory, so you can focus only on those applications that you specifically want to support on your shiny new operating system, and not everything someone managed to successfully install at some point in time after you handed them a computer. Finally, they do a bit of proof of concept work around remediating applications – likely not making much of a dent in that work, but at least showing you the general approach to that problem and giving you both knowledge and hope.

In the end, the same partner will also be very likely to slide a proposal across the table to help you finish that work, and it’s here that they’re likely to include the factory model. But factories have almost nothing to do with the actual free engagement.

Oh yeah, did I mention the free part? So, if you’re still getting started, this is a great way to leverage the investments we’re making in application compatibility and minimize your risk.

To get started, in the USA you can send email to usappcom@microsoft.com. You can also find information here: http://technet.microsoft.com/en-us/windows/bb510132.aspx. This has a list of the ACF partners in many different countries. Yes, even you, Belgium.

This is all great, but I write code

We’ve got you covered. We recently added an FAQ section to our forums at http://social.msdn.microsoft.com/Forums/en-US/windowscompatibility/threads – you can find it at http://social.msdn.microsoft.com/Forums/en-US/windowscompatibility/thread/7d585c05-0b61-45e7-b554-740382ffb7cc. This forum is a great place to get your specific questions answered.

This is just a taste of some of the organizational work we’re investing in. Keep on letting us know how we can do better! Because it’s bad enough that this stuff is hard technically, it shouldn’t be hard to find what you need!

Why Do Some Operating System Modes Include AdditiveRunAsHighest While Others Do Not?

Chris Jackson — Fri, 21 Aug 2009 00:54:20 GMT

A little while back, those of us who explain application compatibility for a living and try to help people get their arms around it ran up against those who implement it in the product on the scale of … the whole earth.

Those of us who explain things for a living really prefer (really, really prefer) when the system is internally consistent, because that makes it easier to explain.

Those who build systems really work to make the investments they can, with finite resources, to fix the greatest percentage of applications they can.

And sometimes those goals are not in alignment.

Case in point: remember back in April when i was talking about how we added the new AdditiveRunAsHighest shim to our operating system layers? Well, it turns out that we didn’t touch quite all of them. The following layers have AdditiveRunAsHighest applied:

Win95
Win98
WinXP
WinXPSP1
WinXPSP2
WinXPSP3

The following layers do not have it applied:

NT4SP5
Win2000
Win2000SP2
Win2000SP3
WinSrv03
WinSrv03SP1
VistaRTM
VistaSP1
VistaSP2
WinSrv08SP1

What’s the rhyme or reason here? Well, you can start to tease out some logical ones. First, most people don’t use compatibility modes on server apps. (They may use them on a server, such as when you use terminal services apps, but if you have a high-throughput server application, shimming it up and running it unsupported is probably not high on your list of acceptable mitigations. So, remove Server 2003 and Server 2008. Next, if it worked on Windows Vista, it has already seen UAC, so we don’t really need to have it there. But … what about NT4 and Windows 2000? If those were included, couldn’t we just say, “ever client operating system prior to Windows Vista includes this shim”?

Yes, we could.

And wouldn’t the same arguments that made sense for the other ones make sense here?

Yes, they would.

So, what gives?

Well, in the game of probability (fix the most apps), internal consistency was not the focus. Fixing the largest number of apps was. And there simply were not enough apps that needed the Windows NT 4 and Windows 2000 modes to bring it on the radar that they needed them too. And those of us who do explain these things for a living didn’t notice it until July, when the bug bar was way too high to get this fix in (since it doesn’t actually block you from getting things done, it just makes it harder to explain why the system behaves the way it does).

So, instead of a nice, logical rule, you have a list to memorize. 95, 98, and XP get AdditiveRunAsHighest. Everything else does not. Sorry for making you memorize a list – I’d much rather you were memorizing rules that you could logically explain, but so it goes.