AeroSnaps In Windows PE

Over at OS Attack they have noticed that Microsoft has inlcuded AeroSnaps in the next version of Windows PE that comes with Windows 7.  This is a good indication that there have been other things added to the new PE as well.  

Via: OS Attack

UPDATE:: It appears as if all of the standard shortcuts for AeroSnaps that work in Windows 7 also work in Windows PE.

Maximize Keyboard shortcut: WINKEY + UP ARROW Maximize vertically Keyboard shortcut: WINKEY + SHIFT + UP ARROW Snap to the left side of screen Keyboard shortcut: WINKEY + LEFT ARROW Snap to the right side of screen Keyboard shortcut: WINKEY + RIGHT ARROW Restore Keyboard shortcut: WINKEY + DOWN ARROW

My Absence

Thanks to everyone that is still visiting even with my long absence.  I have had a rather large amount of changes in my life since I last posted including marriage, change of job, moving to another country.  So needless to say I have been extremely busy.

In the last several months Windows 7 has been making some serious headway which also includes some Windows PE changes.  Over the next few months I will start to outline some of those new changes and how they can benefit us.

Commercially produced WinPE's

Some commercially available PE based boot CD's are available, however they are rare due to the licensing restrictions.   Most frequently these are utilized by larger corporations that do not want to spend time developing their own PE solution.  If anyone knows of any additional versions commercially available feel free to let me know.

Portlock Boot CD

Microsoft DART (Formerly ERD Commander)

WMI Tracing

When you add the WMI package to your WinPE a problem that most people are unaware of us the default action of WMI in PE to create an in depth log file.  The real problem is that this file grows to be very large within a short period of time if WMI intensive applications are used.  Typically it grows to be about 16 MB in size before it stops logging.  This log file is then taking up precious space inside of the ram drive.  Thankfully its easy to toggle off this setting during the customization of your WIM.  After adding the WMI package change the following registry to the value shown:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI] "SessionEnabled"=dword:00000000

Add Defrag to PE

One of the benefits of WinPE is that it allows you to work with an offline operating system without the problems of files being in use.  This is most evident when it comes to Defragging a hard drive.  Many files such as the pagefile or the regsitry hives cant be defragmented when they are in use.  Thankfully this task can still be accomplished with PE with the right modifications.

By adding these registry keys to your PE and then the files you will have the full capabilities of defrag inside of your PE.

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4901-33A8-11d1-A213-0080C88593A5}] @="Defrag NTFS engine" [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4901-33A8-11d1-A213-0080C88593A5}\LocalServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\   00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,66,00,\   72,00,67,00,4e,00,74,00,66,00,73,00,2e,00,65,00,78,00,65,00,00,00 [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4902-33A8-11d1-A213-0080C88593A5}] @="Defrag FAT engine" [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4902-33A8-11d1-A213-0080C88593A5}\LocalServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\   00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,66,00,\   72,00,67,00,46,00,61,00,74,00,2e,00,65,00,78,00,65,00,00,00

For these files you can copy them from  a Vista machine but make sure that the Vista service pack version matches the WinPE service pack version.  Place them in the same locations as they are located on Vista.  

System32\Defrag.exe

System32\dfrgfat.exe

System32\DfrgNtfs.exe

System32\DfrgRes.dll

System32\en-US\Defrag.exe.mui

System32\en-US\DfrgFat.exe.mui

System32\en-US\DfrgNtfs.exe.mui

System32\en-US\DfrgRes.dll.mui

How to make a PE boot from a hard drive

This process works very well with a USB hard drive as long as you follow some basic steps. I have done it with USB pendrives as well but it tends to only work with some drives. For the size of the partition I have had the best luck with setting them as Fat and no bigger than 3 GB. Open a command prompt (cmd.exe) and enter the following commands diskpart list disk select disk 1 (where 1 is you will need to select your USB hard drive) clean disk (THIS WILL ERASE EVERYTHING ON THE DISK!) create partition primary size=3000 list partition select partition 1 format fs=fat select partition 1 (Some systems lose the selected partition during the format process and this selects it again) active assign Now we will copy the files we will need for our PE. Replace "C:\PE\winpe_x86\ISO\" and "D:\" with the location of where your PE files are and the location of your USB drive. xcopy C:\PE\winpe_x86\ISO\*.* /e /f D:\

Map a network drive

I have been getting quite a few questions about networking in WinPE and how to map a network drive correctly. There are many different components to this whether that is automatically or manually. The quickest way to do it via command prompt is with the following command format... net use O: \\%servername%\%sharename% /user:%user% %password% Or net use Z:\\HAL2008\machineimages /user:Admin1 YMYF Remember when doing this that you should never setup a network drive to map the drive letter "X:" because WinPE uses this drive as the default drive letter for the operating system much as regular windows uses the default of C:\.

Change the Desktop Resolution

The default resolution of Windows PE is 800 x 600. The obvious problem with this is that most applications are designed for 1024 x 768. Modifying the PE resolution is not the easiest of tasks to accomplish automatically but is entirely possible. The most common way to do this is by using an application called Setres. It is created by Ian Sharpe and is widely used by many that utilize Windows PE in a non-corporate environment. The not-so-obvious problem with this is legalities. Using applications that albeit free they may not necessarily be legal to distribute. This can present a legal nightmare to companies that create duplicates of their WinPE disks for different employees. There is a very easy solution to this that not only accomplishes everything Setres does but substantially more. And best of all its already included by default in Windows PE 2. wpeinit.exe It is used for executing an unattended script to allow for automated installation in Windows Vista. There are many different components of this but I will cover only the basics for now. This is my simple unattend.xml script for setting my screen resolution as well as creating a pagefile and starting my networking. SetPEoptions.xml

     <?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
  <settings pass="windowsPE">
    <component name="Microsoft-Windows-Setup" processorArchitecture="x86"
publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"
 xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
          <Display>
          <ColorDepth>32</ColorDepth>
          <HorizontalResolution>1024</HorizontalResolution>
          <VerticalResolution>768</VerticalResolution>
          </Display>
    <EnableNetwork>true</EnableNetwork>
    <EnableFirewall>true</EnableFirewall>
    <PageFile>
          <Path>C:\Pagefile.sys</Path>
          <Size>1024</Size>
    </PageFile>
    </component>
  </settings>
</unattend>

You can manually execute this script each time but it is much better if you have it executed automatically in your startnet.cmd or other batch file. This helps to keep the manual steps to a minnimum when using WinPE. Once you have your xml document created you can place it in your Windows directory in your PE wim or anywhere else so long as you remember where you put it. The command if it is placed in the Windows directory would like this to execute the script: wpeinit.exe /unattend=X:\Windows\SetPEoptions.xml I will expand on the unattended scipts in a future posts to help show more of its features.

Mouse Wheel Support

Lack of mouse wheel support in Windows PE is one of those things that can be annoying. Especially when you are attempting to navigate quickly around the machine and not waste time. It is actually surprising to me that it is not enabled by default in PE. This is something that can be enabled by a simple registry key addition.

[HKEY_LOCAL_MACHINE\EXTERNALSYSTEM\ControlSet001\Services\i8042prt\Parameters] "EnableWheelDetection"=dword:00000002

Ram Drive Compression

One of the lesser known features of the Ram drive is the ability to add compression. This can help when there is a need to have a larger amount of data on the Ram drive without modifying the wim for the specific situation. It also helps for machines with minimal ram to keep the resource usage to a minimum.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FBWF] "CacheType"=dword:00000002

1 = Dynamic 2 = Dynamic Compressed 3 = Pre-Allocated I have tested each of the settings and Dynamic Compressed has worked the best for average usage. At this time I am not aware of another way to modify this cache type other than a registry key change. As far as performance goes I have not noticed any degradation of performance with the compression due to it being in physical ram.

Windows PE Read AND Write the Registry?

I have many different variants of WinPE with varying installation mediums. One of my most recent versions is a Windows PE 2.0 installed to a hard drive. There are many benefits to this, the first of which is how fast it boots. With this particular machine it boots on average in about 3-5 seconds. Yes that's seconds. One of the many problems with PE is that the registry can be written to when it is booted but then when the system reboots it discards all of the changes made to it. With the primary purpose of PE this is not an issue however for those of us looking to expand PE's capabilities and searching for a version of Vista that is actually fast this can be an obstacle to bypass. With Vistas new form of boot.ini called the BCD many of the primary boot options are set with basic command line switches. One of the entries in the BCD is simply called "winpe". This is the switch from previous versions called "MININT". What this switch does when it is enabled is cause the configuration manager to load the registry hives as volatile so that any changes made to it are not saved to the original hives. The command as executed for the BCD would look like this: C:\bcdedit /set {7619dcc8-fafe-11d9-b411-000476eba25f} winpe No The primary issue with this is that once the registry is writeable the boot process changes. The system will no longer simply boot as previously. Once winpeshl.exe is executed it attempts to operate as previously with read only hives. A quick easy way to bypass this problem is simply replaces winpeshl.exe with a shell of your choice. To do this quickly you can simply rename your shell executable to "winpeshl.exe" and then it will be launched. I will continue to post about this in the future as I continue to explore down this path with the hard drive installation of WinPE.

ImageX GUI

For those that do not want to do everything by command line there are a few other options. One of these options is the ImageX GUI made by Jonathan Bennett of AutoIt fame. Its fairly simple to use and just needs to be added to the imageX directory. Personally I find myself using it when I am just looking for some quick information about a particular wim without having to manually use the command prompt to get the information I need.

Download Windows AIK (WinPE)

For those that would like to start working with Windows PE you can start by downloading the Microsoft Windows AIK (Automated Installation Kit). Download Windows AIK Everything you will do be doing with it will be almost entirely by command line. It is designed to script Windows installations however for the purpose of WinPE it is necessary to do most tasks via command line.

Scratch Space aka Ram Drive

One of the many benefits of WinPE 2 is the Ram Drive. This allows you to install applications as well as have more room for the installed applications to work with. This is generally called the Ram Drive by most people and Microsoft calls it the Scratch Space. There are many ways to create or modify the amount of Scratch Space the most common of which is the following registry key.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FBWF] "WinPECacheThreshold"=dword:00000020

;dword:00000010 = 16 ; 0x10 = 16Mb ; 0x18 = 24Mb ; 0x20 = 32Mb ; 0x30 = 48Mb ; 0x40 = 64Mb ; 0x48 = 72Mb ; 0x60 = 96Mb ; 0x80 = 128Mb ; 0x100 = 256Mb

By looking at the values you can see that there are a few different sizes to choose from. The default value for WinPE is 32 MB which you can see equates to a value of "0x20" for this key. There is another less known way to implement this tweak and I feel for most beginners it is also the best route. For this we are going to assume you are using the default PE locations and settings. The default location for the WinPE working directory is "C:\winpe_x86". Personally I suggest you move this a directory deeper to be something along the lines of "C:\PE\winpe_x86" however this is up to personal prefrence. We will use the default for most examples here to help keep everything syncronized with Microsofts documentation. The reasoning for moving it a directory deeper is to have your miscellaneus files in the "C:\PE" directory along with your winpe_x86 directory.

Step 1: Mount your boot.wim to C:\winpe_x86 Step 2: Open a command prompt then navigate to the following directory... C:\Program Files\Windows AIK\Tools\PETools\ Step 3: Type the following command: peimg.exe /scratchspace=256 /image=C:\winpe_x86\mount\Windows

For the /scratchspace command you can specify the values of 32, 64, 128, 256, 512. Something thats intresting to note with using this method is that the smallest you can create is 32 MB. With the above registry tweak you can create an even smaller Scratch Space of 16 MB as well as many other more defined sizes.

Welcome to All About WinPE 2

This website will be a general information website about Windows PE 2. For those that dont know what Windows Pre-installation Environment is, basically it is a minimal Windows based operating system that can be booted off of a CD-Rom. WinPE is becomming increasingly popular with the technical community due to it's usefulness. I have been working with WinPE for about 5 years since its inception with Windows XP. Here are a few more links regarding WinPE: http://en.wikipedia.org/wiki/Windows_Preinstallation_Environment http://www.msfn.org/board/Windows-PE-f81.html http://www.911cd.net/forums//index.php?showforum=19