I’m running Windows 2003 server on my laptop as my main machine and I installed SP1 on Friday. For the most part this was an uneventful install, but the install broke a few things for me.

 

Kill.exe no longer works

 

I use Kill.exe frequently to kill processes from the command line and in a number of scripts. At first Kill.exe would crash completely on every attempt to kill a process. Then I logged off and later came back and a new Windows Message dialog popped up (I can’t dupe this now of course and there’s no way to find this dialog again) – some sort of Application protection application (DEP - Data execution prevention) and it let me know that it considers Kill dangerous – do I want to not allow it. So I add it to the list of exceptions and off I go.

 

Now Kill.exe runs but it doesn’t work correctly – it only works if I specify a process id. It doesn’t work with the process name any more.

 

I also thought maybe my version of KILL is a bit dated, maybe I get it out of the Windows 2003 resource kit. Aaack! Denied again – the resource kit no longer includes it. Or maybe I’m not downloading the right thing – I downloaded Resource Kit Tools. If that’s not the same thing then damn Microsoft for choosing a name so close to the real thing…

 

Anyway this is annoying.

 

True Image

 

True image is no longer able to mount drives of backed up images. TI goes off trying to read the image and mount it as a mapped drive, but it fails after a few minutes of trying. This just in time as I was stoked to get TI working for regularily managed full backups onto my huge backup drive.

 

I haven’t gotten around to trying a reinstall or repair, but I’m hoping that might do the trick.

 

DCOMCNFG

The DCOM Configuration dialog has a couple of new buttons that allow you to ‘Edit Limitation…’ of the default COM permissions for the server.

 

I’m at a loss what this setting does. The default COM security for the computer in the past has allowed you to configure which users or groups globally have access to access EXE based COM servers. I’ve never really understood how this works frankly because the default setting alone in many cases does not work for individual servers. It’s always taken having both the global and specific server settings set in order to enable an object.

 

The new dialogs make this confusion even worse by providing options that seem at first blush identical to the existing global settings.

 

The Edit Limits dialog like the Edit Default dialog both allow users to be added and both allow setting local and remote access. The default adds the same users into both dialogs. What the heck does that mean? When I think of limits I would have guessed an exception list, but that’s not how that works. Maybe somebody has some  insight into this.

 

The Edit Limits… dialog for Launch and Activation is no better, but here you get 4 checks for local activation and local launch, remote launch and remote activation. The same as the Edit Default… dialog. The dialogs are exactly identical except for the captions.

  

I think the idea is to allow you to specify a broad list of users that are not allowed access:

 

Service Pack 1 makes the significant change to the Remote Procedure Call (RPC) service in Windows Server 2003 with the addition of the RestrictRemoteClients registry key. This key enables users to modify the behavior of all RPC interfaces on the system and can be used to eliminate remote anonymous access to RPC interfaces on the system (with some exceptions). Additional changes include the EnableAuthEpResolution registry key and three new interface registration flags.

 

But the UI really doesn’t make sense for this – I can’t tell whether you are adding a selection list or a refusal list. After all anything you enter gets to choose between allow or deny? So why two dialogs?  If this was ever silly UI design I don’t know what is. Of course F1 doesn’t provide help to clarify. I couldn’t really find anything in the SP1 release notes about this either about these dialogs.

 

As far as I can tell SP1 doesn't affect existing Web Connection applications so the update should go OK on that. The way Web Connection installs specific security rights also should override any of the default settings and thus should be Ok as it stands right now. I've been working with Michel Fournier on working out a bad configuration problem on a new Win2003 server and I was very worried for a while that it was due to SP1. But after double checking here locally everything seems Ok at least on my end.