AeroSnaps In Windows PE

Over at OS Attack they have noticed that Microsoft has inlcuded AeroSnaps in the next version of Windows PE that comes with Windows 7.  This is a good indication that there have been other things added to the new PE as well.  

Via: OS Attack

UPDATE:: It appears as if all of the standard shortcuts for AeroSnaps that work in Windows 7 also work in Windows PE.

Maximize Keyboard shortcut: WINKEY + UP ARROW Maximize vertically Keyboard shortcut: WINKEY + SHIFT + UP ARROW Snap to the left side of screen Keyboard shortcut: WINKEY + LEFT ARROW Snap to the right side of screen Keyboard shortcut: WINKEY + RIGHT ARROW Restore Keyboard shortcut: WINKEY + DOWN ARROW

My Absence

Thanks to everyone that is still visiting even with my long absence.  I have had a rather large amount of changes in my life since I last posted including marriage, change of job, moving to another country.  So needless to say I have been extremely busy.

In the last several months Windows 7 has been making some serious headway which also includes some Windows PE changes.  Over the next few months I will start to outline some of those new changes and how they can benefit us.

Commercially produced WinPE's

Some commercially available PE based boot CD's are available, however they are rare due to the licensing restrictions.   Most frequently these are utilized by larger corporations that do not want to spend time developing their own PE solution.  If anyone knows of any additional versions commercially available feel free to let me know.

Portlock Boot CD

Microsoft DART (Formerly ERD Commander)

WMI Tracing

When you add the WMI package to your WinPE a problem that most people are unaware of us the default action of WMI in PE to create an in depth log file.  The real problem is that this file grows to be very large within a short period of time if WMI intensive applications are used.  Typically it grows to be about 16 MB in size before it stops logging.  This log file is then taking up precious space inside of the ram drive.  Thankfully its easy to toggle off this setting during the customization of your WIM.  After adding the WMI package change the following registry to the value shown:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI] "SessionEnabled"=dword:00000000

Add Defrag to PE

One of the benefits of WinPE is that it allows you to work with an offline operating system without the problems of files being in use.  This is most evident when it comes to Defragging a hard drive.  Many files such as the pagefile or the regsitry hives cant be defragmented when they are in use.  Thankfully this task can still be accomplished with PE with the right modifications.

By adding these registry keys to your PE and then the files you will have the full capabilities of defrag inside of your PE.

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4901-33A8-11d1-A213-0080C88593A5}] @="Defrag NTFS engine" [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4901-33A8-11d1-A213-0080C88593A5}\LocalServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\   00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,66,00,\   72,00,67,00,4e,00,74,00,66,00,73,00,2e,00,65,00,78,00,65,00,00,00 [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4902-33A8-11d1-A213-0080C88593A5}] @="Defrag FAT engine" [HKEY_LOCAL_MACHINE\EXTERNALSOFTWARE\Classes\CLSID\{80EE4902-33A8-11d1-A213-0080C88593A5}\LocalServer32] @=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\   00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,66,00,\   72,00,67,00,46,00,61,00,74,00,2e,00,65,00,78,00,65,00,00,00

For these files you can copy them from  a Vista machine but make sure that the Vista service pack version matches the WinPE service pack version.  Place them in the same locations as they are located on Vista.  

System32\Defrag.exe

System32\dfrgfat.exe

System32\DfrgNtfs.exe

System32\DfrgRes.dll

System32\en-US\Defrag.exe.mui

System32\en-US\DfrgFat.exe.mui

System32\en-US\DfrgNtfs.exe.mui

System32\en-US\DfrgRes.dll.mui

How to make a PE boot from a hard drive

This process works very well with a USB hard drive as long as you follow some basic steps. I have done it with USB pendrives as well but it tends to only work with some drives. For the size of the partition I have had the best luck with setting them as Fat and no bigger than 3 GB. Open a command prompt (cmd.exe) and enter the following commands diskpart list disk select disk 1 (where 1 is you will need to select your USB hard drive) clean disk (THIS WILL ERASE EVERYTHING ON THE DISK!) create partition primary size=3000 list partition select partition 1 format fs=fat select partition 1 (Some systems lose the selected partition during the format process and this selects it again) active assign Now we will copy the files we will need for our PE. Replace "C:\PE\winpe_x86\ISO\" and "D:\" with the location of where your PE files are and the location of your USB drive. xcopy C:\PE\winpe_x86\ISO\*.* /e /f D:\

Map a network drive

I have been getting quite a few questions about networking in WinPE and how to map a network drive correctly. There are many different components to this whether that is automatically or manually. The quickest way to do it via command prompt is with the following command format... net use O: \\%servername%\%sharename% /user:%user% %password% Or net use Z:\\HAL2008\machineimages /user:Admin1 YMYF Remember when doing this that you should never setup a network drive to map the drive letter "X:" because WinPE uses this drive as the default drive letter for the operating system much as regular windows uses the default of C:\.