In this blog post I’m trying to explain how-to create a mandatory profile for Server 2012 and Windows 8. This is only for a clean windows installation. The Microsoft best practices are saying that you need to update the Mandatory profile after each software installation/update on the system.

The Test User

First we create a user named: Manny. This user is used to create the profile. You can name it any way you want. Don’t give it any profile. You can create a local user, but my test machine is also a domain controller, so I only can create an AD user.

In Part1 I was talking (euhh typing) about the Citrix Receiver and the Self Service Plugin. Today it’s time for the Merchandising server (I will type MS from now on). The MS is an virtual appliance which helps you deploy/update/configure/maintain the Citrix Receiver and plug-ins for Windows and OSX systems. As you can see in Part1 I want to place the MS in my LAN behind the CAG. But unfortunately this is not possible (well maybe it is but I can’t get it to work ) So there are some things you need before you can setup the MS.

In my previous post I enabled BitLocker on both my partitions (Link). The trick now is to reinstall Windows without decrypting the system. In this example my data is stored on the second partition (Data Partition or D:) and that partition is encrypted and must be preserved.

When booted from media. The installer is asking on which partition it will install Windows. Because BitLocker has encrypted the old system partition, we aren’t able to format the partition. Just delete the partition, recreate it, format and install Windows. (Do not touch the data partition). If you want to preserve the data on the old system partition, you have to recover that partition. (Hmmm new post will come in the future )

I’m positive that working with the keyboard is way faster then working in combination with the mouse. But you must know the shortcuts-keystrokes-etc etc So here is the list I’m using. The list is updated on a regular basis.

Copy, Paste, Cut, Delete

CTRL+C = Copy
CTRL+V = Paste
CTRL+X = Cut
CTRL+Z = Undo
CTRL+Insert = Copy (This one I use very often, learned it in the old days )
Shift+Insert = Paste
Shift+Delete = Permanently Delete

The Windows Key

Windows+R = Run
Windows+P = Projector/monitor/Dual/Etc (Keep Windows key pressed)
Windows+E = Explorer
Windows+D = Show Desktop (Press it again brings back the applications)
Windows+F = Find
Windows+L = Lock Windows
Windows+M = Minimize all the applications
Windows+Pause = Computer Management

Application Switching

ALT+TAB = Good old application switching
Shift+ALT+TAB = Reverse application switching
Windows+TAB = New Aero application switching
Windows+# (Like Windows+1) = The number equals the position of the application or icons in the taskbar.
Windows+T = Switching applications and icons on the taskbar with peak

Windows Explorer (Shortcuts within Windows Explorer)

ALT+Space = Right click on top left (Move, Size, Minimize, Maximize, Close)
TAB = Switching area’s
Shift+F10 = Context menu of selected icon
Space = Select icon
ALT = Activate top menu

Windows

CTRL+Shift+Escape = Task Manager
CTRL+Escape = Start Menu
CTRL+ALT+Delete = Duhhhh

Internet Explorer

CTRL+TAB = Tab’s switching

Outlook

CTRL+Enter = Send composed email

Q: So, how to show the desktop and right click on the recycled bin?
A: Windows+D, Navigate with arrows to recycled bin, SHIFT+F10.

Q: Why are you using SHIFT+F10, CTRL+Escape etc?
A: Long long time ago, there weren’t keyboards with the Windows keys.

I’m using TrueCrypt for a while now, and like any other nerd I’m reinstalling my pc on a regular basis. And there comes the problem. Because TrueCrypt has encrypted the whole disk, I have to enter the password when the computer boots from HDD. When booting from DVD de HDD is still encrypted and the only way to install Windows is to wipe the HDD (repartition and format). I have a second partition (D Drive) with my data. So when reinstalling Windows I only have to format the first partition (C Drive). You get the problem???

The solution is to encrypt only the second partition (D Drive). But the problem then is that my important documents are back upped to the cloud (a DropBox construction) and the agent, responsible for that, is started at boot. When I’m to late entering the password for TrueCrypt password the agent gives an error. But reinstalling Windows is easy

Anyone else who have the same problems? Comments are welcome…

Update:

Oke, time to do some research/”trial on error” about reinstalling Windows…

I have 1 partition with Windows installed, and 1 partition with aprox 40GB data. Both on the same harddisk. The data partition is encrypted with TrueCrypt. I have the recovery disc. When booted from the Windows 7 installation DVD, I can see both the partitions but the encrypted partition is empty (100% free disk space). I choose the Windows partition, format and install…. wait….. After installing the first thing I did was installing TrueCrypt. Then mounted the data partition and all the data was not accessible. I rebooted the computer with the recovery disc, choose F8 (repair options) and then 1 (Permanently decrypt system partition/drive). Type the password and…. “Incorrect Password” WTF…. Oke, option 3 (Restore key data). Modify drive 0? YES Please …. Header restored…Rebooting Windows… Data still not accessible. Damn this is getting frustrating… Rebooting again with the recovery disc. Choose F8 and the option 1. Type in the password… There is a warning that this is much faster in Windows. But I’m not able te decrypt the data partition only in Windows So I select YES. My laptop is doing around 7MB/s and the HardDisk is 150GB…So it’s time to eat, watch The A-Team etc.. The next morning the decryption was ready. All the data is now available. Not an option for me. Reinstalling takes a verry long time so.

Conclusion.. Before you reinstall Windows on a TrueCrypt protected partition/disk, first copy the data to an USB disk. Then install Windows, Encrypt the partitions en copy back the data.

Update2: (On top of this post, just for your convenience)

There is a much easier way

1. Open an elevated command prompt on Windows 7
2. Open Diskpart
3. List volume (remember the volume number of the usb stick)
4. Select volume # (3 = the number of the usb stick)
5. Clean (This will wipe the USB stick)
6. Create partition primary
7. Select partition 1
8. Format fs=fat32 quick
9. Assign
10. Active
11. Leave Diskpart
12. Copy the installation DVD on the usb stick
13. Happy installing

---

In this tutorial I explain how to create a bootable USB stick for installing Windows 2008/2008 R2/Vista/windows 7. First, format the stick. Fat32/ntfs doesn’t matter. (Remember that fat32 doesn’t support files larger then 4GB)

On the Windows 7 / Server 2008 install media in the folder "Boot” there is an executable named: Bootsect.exe

Open a command prompt, navigate to the directory boot (on the media).
And run: Bootsect.exe /nt60 F: (where f: is the formatted USB stick)

Now, copy the installer media to the USB stick. Or, in my case, the Task Sequence Bootable Media. (SCCM 2007)

Your, bootable media is ready.

Update:

Q: Hey Jeroen, bootsect.exe doesn’t work.. I’m getting an access denied.

A: Run you command prompt in elevated mode

When installing a new server/workstation with Server 2008 R2 or Windows 7. I’m having a strange problem.

For instance, my D partition on my laptop (which runs Windows 7) has default the built in USERS group with right to read the partition. Oké lets remove those rights. Now the partition has only Administrators and System with Full Control. But when opening the partition we are getting a Access Denied warning .

How is that possible? Well, the explorer process is still running in ‘User’ mode. When opening the explorer in ‘Admin’ mode we still getting the Access Denied warning.

Why? Well, actually the explorer isn’t started in elevated mode. But only the first process. That triggers a DCOM to open the Explorer, witch runs in ‘User’ mode

How do we disable that? First open regedit en navigate to: HKEY_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E0207520C2}

Rename the RunAs to something else, like: _RunAs (Become owner first )

And now it’s possible to open the explorer in elevated mode. And it’s possible to set the correct permissions without adding your own account first.