Chapter 7. Installing and maintaining applications
Desktop programs are applications that you can install and configure. Most desktop programs use the Windows Installer to make application management tasks easier. Administrators and support staff often install and configure the programs that are used on desktop computers. You might need to install and configure programs before deploying new computers, install new programs on computers when the programs are requested, and update programs when new versions become available. Also, as users install additional programs, you might be called on to help troubleshoot installation problems or to help uninstall programs.
Most program installation problems are fairly easy to solve if you know what to look for. Other problems are fairly difficult to resolve and require more work than you might expect. In this chapter, you’ll learn how User Account Control (UAC) affects the way you install and run programs. You’ll also learn about techniques for installing, uninstalling, and maintaining programs and installing and configuring desktop apps. Although the terms applications and software generally refer to both desktop programs and desktop apps elsewhere in this book—and an app is a program in the most general sense—it is important now to distinguish between desktop programs and desktop apps.
The focus of this chapter is on programs. I will use the term app in this chapter strictly to refer to desktop apps, and I will discuss apps first to give a context for the rest of the chapter.
Managing desktop apps
Apps can be purchased in the Windows Store and installed over the Internet. They also can be developed in-house or by third-party developers and deployed by using Group Policy. Although apps can be managed by using techniques similar to those used for desktop programs, apps have many distinct characteristics.
Working with apps: the essentials
On Windows 8.1, the Start screen replaces the traditional Start menu. A desktop app is automatically added to Start when you install it and will have a Start tile. A Start tile makes it easy to start and manage the app. You can press and hold or right-click the tile to display management options. Management options for tiles depend on the type of tile. Live tiles can update their content, and these updates can be turned on or off. Some tiles can be displayed in several sizes, and you might be able to make a tile smaller or larger. If you no longer want a tile to be displayed on Start, you can choose the Unpin From Start option.
You can start and manage apps that you unpin in several ways, including through the Apps list. Apps is the Windows 8.1 equivalent to the Programs menu in earlier releases of Windows. From the Start screen, you can display Apps by selecting the down button on the Start screen.
Note
Desktop programs might not be added to Start or Apps automatically. For more information, see the Making programs available to all or selected users section later in this chapter.
When working with apps and tiles, you should be aware of a few handy keyboard shortcuts, which work with desktop programs as well:
Windows key + Left Arrow or Right Arrow. Toggles the screen snap position of the app. Snap splits the screen, so if the app is being displayed normally, Windows key + Left Arrow snaps it to the left and Windows key + Right Arrow snaps it to the right.
Windows key + Up Arrow. Displays the app in Full Screen mode.
Windows key + Down Arrow. Exits Screen Mode and returns the app to its original window state.
Windows 8.1 has important improvements when it comes to working with apps. With Windows 8.1, apps can use four tile sizes: small (70 x 70 pixels), medium (150 x 150 pixels), wide (310 x 150 pixels), and large (310 x 310 pixels). Because more than two apps can share the screen at the same time, you can open one app and have it remain in the foreground when you open another app that also is in the foreground. Apps can open other apps and share the screen with them. A single app can also use multiple monitors.
Windows 8.1 apps with live tiles start updating immediately after installation. Previously, you needed to run the app after installation to start receiving updates.
In Windows 8.1, one of the lock screen slots is available for alarm apps. When you place an alarm app in this slot, it becomes the system alarm app and can generate alarm notifications. The default alarm app is Alarms, which has timer, stopwatch, and alarm features. Although other apps could issue alarm notifications, the notifications are handled as normal notifications rather than priority alarm notifications. In the Administrative Templates policies for User Configuration under Start Menu And TaskbarNotification, you’ll find options for managing times when notifications should be allowed or blocked.
Configuring trusted apps and Windows Store access
Generally, apps are installed and updated over a network or the Internet. By default, computers running Windows 8.1 can install only trusted app packages that come from the Windows Store. If you want to install trusted apps developed in-house or by third-party developers, you’ll need to enable the Allow All Trusted Apps To Install policy in the Administrative Templates policies for Computer Configuration under Windows ComponentsApp Package Deployment.
You can manage user access to the Windows Store in several ways, including the following:
Control the use of Microsoft accounts on a computer by enabling the Accounts: Block Microsoft Accounts policy. This policy is found in the Security Options policies for Computer Configuration under Windows SettingsSecurity SettingsLocal Policies. When you enable this policy, you have two options. You can use the Users Can’t Add Microsoft Accounts setting to prevent users from creating Microsoft accounts, or you can use the User Can’t Add Or Log On With Microsoft Accounts setting to block users from logging on with and creating Microsoft accounts.
Prevent users from accessing the Windows Store by enabling Turn Off The Store Application in the Administrative Templates policies for Computer Configuration under Windows ComponentsStore.
Prevent computers from automatically downloading app updates by enabling Turn Off Automatic Download Of Updates On Win8 Machines in the Administrative Templates policies for Computer Configuration under Windows ComponentsStore. Alternatively, you can use Turn Off Automatic Download And Install Of Updates to prevent computers from automatically downloading and installing updates.
Enhancing security for apps and overriding default settings
Apps run in a unique context and have a lower integrity level than desktop programs. The lower integrity level might allow apps to perform tasks that could compromise security because you’d otherwise need to provide consent to continue, and you don’t need to provide consent in these instances with apps. For example, by default, apps can open a file in a desktop program. With an unhandled file type or protocol, users get an Open With dialog box and can select a local application to open the unknown file type or protocol or use the Store service to find an application to do the same.
You can use several policies to enhance security and prevent these behaviors, including the following:
To prevent an app from opening a desktop program associated with a file type automatically, enable Block Launching Desktop Apps Associated With A File in the Administrative Templates policies for User Configuration or Computer Configuration under Windows ComponentsApp Runtime.
To prevent an app from opening a desktop program associated with URL protocols (except for HTTP, HTTPS, and mailto, which are hardened), enable Block Launching Desktop Apps Associated With A URI Scheme in the Administrative Templates policies for User Configuration or Computer Configuration under Windows ComponentsApp Runtime.
To remove the Windows Store option in the Open With dialog box, enable Turn Off Access To The Store in the Administrative Templates policies for Computer Configuration under SystemInternet Communication ManagementInternet Communication Settings.
It’s also important to point out that some apps can display notifications on the lock screen and that a notification history is maintained by default. The notification history allows users to log off and then log back on later and see the tile just as they did prior to logging off. To block notifications on the lock screen, enable Turn Off App Notifications On the Lock Screen in the Administrative Templates policies for Computer Configuration under SystemLogon. To clear the notification history when a user logs off, enable Clear History Of Tile Notifications On Exit in the Administrative Templates policies for User Configuration under Start Menu And Taskbar.
Apps receive notifications through the Windows Push Notification Service (WNS). Live apps use WNS to update the content on their tiles, to display notifications, and to receive notifications. By using Administrative Templates policies for User Configuration under Start Menu And TaskbarNotifications, you can control the use of WNS in several ways, including the following:
To block the display of alerts that pop up on the screen (known as toast notifications) in Windows, generally you can enable Turn Off Toast Notifications. This setting doesn’t affect taskbar notification balloons.
To block the display of alerts that pop up on the lock screen, you can enable Turn Off Toast Notifications On The Lock Screen.
To block updating of tiles and tile badges on the Start screen, you can enable Turn Off Tile Notifications.
To block apps from sending notifications for updates and alerts, you can enable Turn Off Notifications Network Usage. Enabling this setting turns off the connection to Windows and WNS.
Enhancing networking security for apps
Windows 8.1 supports several important networking features related to applications in general and apps specifically. Windows 8.1 uses a feature called Windows Network Isolation to automatically discover proxies and private network hosts when a computer is connected to a domain. By default, any proxy detected is considered authoritative and any network host can be discovered via the private subnets available to the computer.
Proxy discovery and private host discovery are separate features. You control the proxy discovery process by using policies in the Administrative Templates policies for Computer Configuration under NetworkNetwork Isolation. Enable the Internet Proxy Servers For Apps policy, and then enter a comma-separated list of authorized proxies that apps running on domain-connected computers can use for accessing the Internet. By default, this list of proxies is merged with the list of automatically discovered proxies. If you want only your listed proxies to be authoritative, enable Proxy Definitions Are Authoritative.
You can use the Intranet Proxy Servers For Apps policy to define authorized private network proxies. Enable this policy and then enter a comma-separated list of proxies that provide access to intranet resources. If you want only your listed proxies to be authoritative, enable Proxy Definitions Are Authoritative.
Policies in the Administrative Templates policies for Computer Configuration under NetworkNetwork Isolation are also used to control private host discovery. Hosts discovered in this way are designated as private. Normally, private host discovery will not go across subnet boundaries.
You can enhance the discovery process by enabling the Private Network Ranges For Apps policy and then entering a comma-separated list of your company’s IPv4 and IPv6 subnets. This tells Windows about the available subnets so that they can be used for private host discovery. By default, this list of subnets is merged with the list of automatically discovered subnets. If you enable Subnet Definitions Are Authoritative, only network hosts within address ranges specific in Group Policy will be discovered and considered private.
Managing application virtualization and run levels
User Account Control (UAC) changes the way that applications are installed and run, where applications write data, and what permissions applications have. In this section, I’ll look at how UAC affects application installation, from application security tokens to file and registry virtualization to run levels. This information is essential when you are installing and maintaining applications on Windows 8.1.
Application access tokens and location virtualization
All applications used with Windows 8.1 are divided into two general categories:
UAC-compliant. Any application written specifically for Windows Vista or later is considered a compliant application. Applications certified as complying with the Windows 8.1 architecture have the UAC-compliant logo.
Legacy. Any application written for earlier versions of Windows is considered a legacy application.
The distinction between UAC-compliant applications and legacy applications is important because of the architectural changes required to support UAC. UAC-compliant applications use UAC to reduce the attack surface of the operating system. They do this by preventing unauthorized applications from installing or running without the user’s consent and by restricting the default privileges granted to applications. These measures make it harder for malicious software to take over a computer.
Note
The Windows 8.1 component responsible for UAC is the Application Information service. This service facilitates the running of interactive applications with an “administrator” access token. You can tell the difference between the administrator user and standard user access tokens by opening two Command Prompt windows, running one with elevation (press and hold or right-click, and then tap or click Run As Administrator), and the other as a standard user. In each window, enter whoami/all and compare the results. Both access tokens have the same security identifiers (SIDs), but the elevated administrator user access token has more privileges than the standard user access token.
All applications that run on Windows 8.1 derive their security context from the current user’s access token. By default, UAC turns all users into standard users even if they are members of the Administrators group. If an administrator user consents to the use of her administrator privileges, a new access token is created for the user. It contains all the user’s privileges, and this access token—rather than the user’s standard access token—is used to start an application or process.
In Windows 8.1, most applications can run using a standard user access token. Whether applications need to run with standard or administrator privileges depends on the actions the application performs. Applications that require administrator privileges, referred to as administrator user applications, differ from applications that require standard user privileges, referred to as standard user applications, in the following ways:
Administrator user applications require elevated privileges to run and perform core tasks. After it is started in elevated mode, an application with a user’s administrator access token can perform tasks that require administrator privileges and can also write to system locations of the registry and the file system.
Standard user applications do not require elevated privileges to run or to perform core tasks. After it is started in standard user mode, an application with a user’s standard access token must request elevated privileges to perform administration tasks. For all other tasks, the application should not run by using elevated privileges. Further, the application should write data only to nonsystem locations of the registry and the file system.
Applications not written for Windows 8.1 run with a user’s standard access token by default. To support the UAC architecture, these applications run in a special compatibility mode and use file system and registry virtualization to provide “virtualized” views of file and registry locations. When an application attempts to write to a system location, Windows 8.1 gives the application a private copy of the file or registry value. Any changes are then written to the private copy, and this private copy is then stored in the user’s profile data. If the application attempts to read or write to this system location again, it is given the private copy from the user’s profile with which to work. By default, if an error occurs when the application is working with virtualized data, the error notification and logging information show the virtualized location rather than the actual location where the application was trying to work.
Application integrity and run levels
The focus on standard user and administrator privileges also changes the general permissions required to install and run applications. In early versions of Windows, the Power Users group gave users specific administrator privileges to perform basic system tasks when installing and running applications. Applications written for Windows 8.1 do not require the use of the Power Users group. Windows 8.1 maintains it only for legacy application compatibility.
As part of UAC, Windows 8.1 by default detects application installations and prompts users for elevation to continue the installation. Installation packages for UAC-compliant applications use application manifests that contain run-level designations to help track required privileges. Application manifests define the application’s privileges as one of the following:
RunAsInvoker. Run the application with the same privileges as the user. Any user can run the application. For a standard user or a user who is a member of the Administrators group, the application runs with a standard access token. The application runs with higher privileges only if the parent process from which it is started has an administrator access token. For example, if you open an elevated Command Prompt window and then start an application from this window, the application runs with an administrator access token.
RunAsHighest. Run the application with the highest privileges of the user. The application can be run by both administrator users and standard users. The tasks the application can perform depend on the user’s privileges. For a standard user, the application runs with a standard access token. For a user who is a member of a group with additional privileges, such as the Backup Operators, Server Operators, or Account Operators group, the application runs with a partial administrator access token that contains only the privileges the user has been granted. For a user who is a member of the Administrators group, the application runs with a full administrator access token.
RunAsAdmin. Run the application with administrator privileges. Only administrators can run the application. For a standard user or a user who is a member of a group with additional privileges, the application runs only if the user can be prompted for credentials required to run in elevated mode or if the application is started from an elevated process, such as an elevated Command Prompt window. For a user who is a member of the Administrators group, the application runs with an administrator access token.
To protect application processes, Windows 8.1 labels them with integrity levels ranging from high to low. Applications that modify system data, such as Disk Management, are considered high integrity. Applications performing tasks that could compromise the operating system, such as Internet Explorer, are considered low integrity. Applications with lower integrity levels cannot modify data in applications with higher integrity levels.
Windows 8.1 identifies the publisher of any application that attempts to run with an administrator’s full access token. Then, depending on that publisher, Windows 8.1 marks the application as belonging to one of the following three categories:
Windows Vista or later
Publisher verified (signed)
Publisher not verified (unsigned)
To help you quickly identify the potential security risk of installing or running the application, a color-coded elevation prompt displays a different message depending on the category to which the application belongs:
If the application is from a blocked publisher or is blocked by Group Policy, the elevation prompt has a red background and displays the message “The application is blocked from running.”
If the application is administrative (such as Computer Management), the elevation prompt has a blue-green background and displays the message “Windows needs your permission to continue.”
If the application has been signed by Authenticode and is trusted by the local computer, the elevation prompt has a gray background and displays the message “A program needs your permission to continue.”
If the application is unsigned (or is signed but not yet trusted), the elevation prompt has a yellow background and red shield icon and displays the message “An unidentified program wants access to your computer.”
Prompting on the secure desktop can be used to further secure the elevation process. The secure desktop safeguards the elevation process by preventing spoofing of the elevation prompt. The secure desktop is enabled by default in Group Policy, as discussed in the section Optimizing UAC and Admin Approval Mode in Chapter 5.
Setting run levels
By default, only applications running with a user’s administrator access token run in elevated mode. Sometimes you’ll want an application running with a user’s standard access token to be in elevated mode. For example, you might want to open the Command Prompt window in elevated mode so that you can perform administration tasks.
In addition to application manifests (discussed in the previous section), Windows 8.1 provides two different ways to set the run level for applications:
Run an application once as an administrator
Always run an application as an administrator
To run an application once as an administrator, press and hold or right-click the application’s shortcut or menu item, and then tap or click Run As Administrator. If you are using a standard account and prompting is enabled, you are prompted for consent before the application is started. If you are using a standard user account and prompting is disabled, the application will fail to run. If you are using an administrator account and prompting for consent is enabled, you are prompted for consent before the application is started.
Windows 8.1 also enables you to mark an application so that it always runs with administrator privileges. This approach is useful for resolving compatibility issues with legacy applications that require administrator privileges. It is also useful for UAC-compliant applications that normally run in standard mode but that you use to perform administration tasks. As examples, consider the following:
A standard application written for Windows 8.1 is routinely run in elevated mode and used for administration tasks. To eliminate the need to press and hold or right-click the application shortcut and choose Run As Administrator before running the application, you can mark it to always run as an administrator.
An application written for early versions of Windows requires administrator privileges. Because this application is configured to use standard mode by default under Windows 8.1, the application isn’t running properly and is generating numerous errors. To resolve the compatibility problem, you could create an application compatibility shim by using the Windows Application Compatibility Toolkit (ACT) version 5.5 or later. As a temporary solution, you can mark the application to always run as an administrator.
Note
You cannot mark system applications or processes to always run with administrator privileges. Only nonsystem applications and processes can be marked to always run at this level.
Real World
The Windows Application Compatibility Toolkit (ACT) is a solution for administrators that requires no reprogramming of an application. ACT can help you resolve common compatibility problems. For example, some applications run only on a specific operating system or when the user is an administrator. By using ACT, you can create a shim that responds to the application inquiry about the operating system or user level with a True statement, which allows the application to run. ACT also can help you create more in-depth solutions for applications that try to write to protected areas of the operating system or use elevated privileges when they don’t need to. ACT can be downloaded from the Microsoft Download Center (http://download.microsoft.com).
You can mark a program to always run as an administrator by following these steps:
On the desktop, or in File Explorer, locate the program that you want to always run as an administrator.
Press and hold or right-click the program’s shortcut, and then tap or click Properties.
In the Properties dialog box, tap or click the Compatibility tab, shown in Figure 7-1.
To apply the setting to the currently logged-on user, select the Run This Program As An Administrator check box, and then tap or click OK.
To apply the setting to all users on the computer and regardless of which shortcut is used to start the application, tap or click Change Settings For All Users to display the Properties dialog box for the application’s .exe file, select the Run This Program As An Administrator check box, and then tap or click OK twice.
Note
If the Run This Program As An Administrator option is unavailable, it means that the application is blocked from always running at an elevated level, the application does not require administrator credentials to run, or you are not logged on as an administrator.
The program will now always run by using an administrator access token. Keep in mind that if you are using a standard account and prompting is disabled, the program will fail to run.
Optimizing virtualization and installation prompting for elevation
With regard to applications, several areas of UAC can be customized, including:
Automatic installation detection and prompting
Virtualization of write failures
In Group Policy, you can configure these features by using settings for Computer Configuration under Windows SettingsSecurity SettingsLocal PoliciesSecurity Options. The security settings are as follows:
User Account Control: Detect Application Installations And Prompt For Elevation. Determines whether Windows 8.1 automatically detects application installation and prompts for elevation or consent. (This setting is enabled by default in Windows 8.1.) If you disable this setting, users are not prompted, so they will not be able to elevate permissions by supplying administrator credentials.
User Account Control: Virtualize File And Registry Write Failures To Per-User Locations. Determines whether file and registry virtualization is on or off. Because this setting is enabled by default, error notifications and error logging related to virtualized files and registry values are written to the virtualized location rather than the actual location to which the application was trying to write. If you disable this setting, the application will silently fail when trying to write to protected folders or protected areas of the registry.
Note
Other related settings were discussed previously in Chapter 5, in the Optimizing UAC and Admin Approval Mode section.
In a domain environment, you can use Active Directory–based Group Policy to apply the security configuration you want to a particular set of computers. You can also configure these settings on a per-computer basis by using local security policy. To do this, follow these steps:
Open Local Security Policy. One way to do this is by pressing the Windows key, typing secpol.msc, and then pressing Enter. If you’ve enabled Show Administrative Tools as a Start setting, you’ll also find a related tile on the Start screen.
In the console tree, under Security Settings, expand Local Policies, and then select Security Options.
Double-tap or double-click the setting with which you want to work, make any necessary changes, and then tap or click OK.
Installing programs: the essentials
Program installation is fairly straightforward. On the other hand, troubleshooting the many things that can go wrong and fixing problems are not so straightforward. To solve problems that might occur, you first need to understand the installation process. In many cases, the typical installation process starts when Autorun is triggered. Autorun in turn invokes a setup program. After the setup program starts, the installation process can begin. Part of the installation process involves checking the user’s credentials to ensure that he or she has the appropriate privileges to install the program and prompting for consent if the user doesn’t. As part of installing a program, you might also need to make the program available to all or only some users on a computer.
Occasionally, Windows might not be successful in detecting the required installation permissions. This can occur if the installation manifest for the program has an embedded RequestedExecutionLevel setting that has a value set as RequireAdministrator. Because the RequestedExecutionLevel setting overrides what the installer detects in Windows, the installation process fails any time you run the installer with standard user permissions. To solve this problem, back out of the failed installation by exiting, canceling the installation, or taking another appropriate action. Next, locate the executable file for the installer. Press and hold or right-click this file, and then tap or click Run As Administrator to restart the installation process with administrator privileges.
Application Control policies replace Software Restriction policies. Software Restriction policies control the applications that users can install and run on Windows Vista and earlier versions of Windows. Application Control policies control the applications that users can install and run on Windows 7 and later, as well as Windows Server 2008 Release 2 and later. Keep the following in mind:
When you are editing a Group Policy Object, you can create and manage Software Restriction policies by using settings for computers under Computer ConfigurationPoliciesWindows SettingsSecurity SettingsSoftware Restriction Policies, and settings for users under User ConfigurationPoliciesWindows SettingsSecurity SettingsSoftware Restriction Policies. Enforcement settings control how restrictions are applied. Designated file types determine what is and what is not considered an executable program.
When you are editing a Group Policy Object, you can create and manage Application Control policies by using settings for computers under Computer ConfigurationPoliciesWindows SettingsSecurity SettingsApplication Control Policies. You can now create separate rules for executable files, Windows installer files, and script files. Rules can be applied by publisher, file path, or file hash. A publisher rule gives you the most flexibility, enabling you to specify which products and versions to allow. For example, you could allow Microsoft Word 2010 or later.
Working with Autorun
When you insert an application disc, Windows 8.1 checks for a file named Autorun.inf. If present, Autorun.inf specifies the action that the operating system should take and might also define other installation parameters. Autorun.inf is a text-based file that can be opened in any standard text editor. If you were to examine the contents of an Autorun.inf file, you’d find something similar to the following code:
[autorun] OPEN=SETUP.EXE AUTORUN=1 ICON=SETUP.EXE,4 SHELL=OPEN DisplayName=Microsoft Digital Image Suite 9 ShortName=PIS PISETUP=PIPpisetup.exe
This Autorun.inf file opens a file named Setup.exe when a disc is inserted into a drive. Because Setup.exe is an actual program, this program is invoked. The Autorun.inf file also specifies an icon to use, the status of the shell, the program display name, the program’s short name, and an additional parameter, which in this case is the location of another setup program to run.
The file that Autorun.inf specifies to open won’t always be a program. Consider the following example:
[autorun] OPEN=AutorunShelExec default.htm
This Autorun.inf file executes via the shell and opens a file named Default.htm in the computer’s web browser. It’s important to note that even in this case, the document opened in the web browser contains links that point to a setup program.
Managing application setup and compatibility
Most applications have a setup program that uses InstallShield, Wise Install, or Windows Installer. When you start the setup program, the installer helps track the installation process and should also make it possible to easily uninstall the program when necessary. If you are installing an older application, the setup program might use an older version of one of these installers, and this might mean the uninstall process won’t completely uninstall the program.
Even if you are absolutely certain that a program has a current installer, you should consider the possibility that you will need to recover the system if something goes wrong with the installation. To help ensure that you can recover your system, check that System Restore is enabled for the drive on which you are installing the program so that System Restore can create an automatic checkpoint before installing the program.
Although the installers for most current programs automatically trigger the creation of a restore point before making any changes to a computer, the installers for older programs might not. You can manually create a restore point, as discussed in Chapter 9. Then, if you run into problems, you can try to uninstall the program or use System Restore to recover the system to the state it was in prior to the program’s installation.
Before installing any application, you should check to determine whether it is compatible with Windows 8.1. To determine compatibility, you can do the following:
Check the software packaging, which should specify whether the program is compatible. Look for the Windows 8 logo.
Check the software developer’s website for a list of compatible operating systems.
Note
As part of the compatibility check, look for updates or patches for the program. If any are available, install them after installing the program.
Windows 8.1 attempts to recognize potential compatibility problems before you install applications. If it detects one, you might get a Program Compatibility Assistant dialog box after you start a program’s installer. Often, this dialog box contains information about the known compatibility issues with the program, and in many cases, it displays a possible solution. For example, you might be advised to install the latest service pack for the program before running the program on the computer. In some cases, the Program Compatibility Assistant might display the message “This program is blocked due to compatibility issues.” Here, the program is blocked because it causes a known stability issue with Windows, and you can’t create an immediate fix to work around the problem. Your only options are to tap or click the Check For Solutions Online button or tap or click Cancel. If you check for solutions online, the typical solution requires you to purchase an updated version of the program. If you cancel, you stop the installation process without checking for possible solutions.
If the installation continues but fails for any reason before it is fully complete (or fails to properly notify the operating system regarding completion), you’ll also get a Program Compatibility Assistant dialog box. In this case, if the program installed correctly, tap or click This Program Installed Correctly. If the program didn’t install correctly, tap or click Reinstall Using Recommended Settings to allow the Program Compatibility Assistant to apply one or more compatibility fixes, and then try again to run the installer.
When you start programs, Windows 8.1 uses the Program Compatibility Assistant to automatically make changes for known compatibility issues as well. If the Program Compatibility Assistant detects a known compatibility issue when you run an application, it notifies you about the problem and provides possible solutions for resolving the problem automatically. You can then allow the Program Compatibility Assistant to reconfigure the application for you, or you can manually configure compatibility as discussed in the section Configuring program compatibility later in this chapter.
Policies in the Administrative Templates policies for Computer Configuration under Windows ComponentsApplication Compatibility are also used to control compatibility settings. The policies are as follows:
Prevent Access To 16-Bit Applications. If enabled, this policy prevents the MS-DOS subsystem from running on computers. This also means any 32-bit program with 16-bit installers or other 16-bit components can’t run.
Remove Program Compatibility Property Page. If enabled, this policy makes the Compatibility tab unavailable on Properties dialog boxes for programs.
Turn Off Application Compatibility Engine. If enabled, this policy prevents Windows from checking the compatibility database for known issues when programs are started. Although this might boost system performance when starting applications, it can result in a stop error on a blue screen if incompatible programs are run on the system and not configured properly.
Turn Off Inventory Collector. If enabled, this policy prevents the Inventory Collector from collecting system inventories and sending this information to Microsoft as part of compatibility diagnostics. Collected information includes details on applications, files, devices, and drivers, and in secure environments you might not want this information to be sent to Microsoft.
Turn Off Program Compatibility Assistant. If enabled, this policy allows legacy applications to run without Switchback protection. Switchback is a compatibility feature that works with legacy applications to address general compatibility issues that legacy applications are known to have when running on current Windows releases. Although this might boost application performance, applications with incompatibilities might become unresponsive or cause other problems on the system.
Turn Off Steps Recorder. If enabled, this policy disables Steps Recorder, which might be required in some secure environments in which you wouldn’t want user actions, including keyboard input, to be recorded at any time.
Turn Off Switchback Compatibility Engine. If enabled, this policy prevents Windows from using the Switchback compatibility engine, which is otherwise enabled. The Switchback compatibility engine automatically provides legacy behavior to legacy applications while allowing current applications to use current application architecture. Typically you would only enable this policy setting if you must explicitly set the compatibility level for all your applications. You must restart the computer if you change this setting and want to apply the change.
Making programs available to all or selected users
After installation, most desktop programs should have related tiles on the Start screen and related options on the Apps list. This occurs because a program’s shortcuts are placed in the appropriate subfolder of the Start MenuPrograms folder (%SystemDrive%ProgramDataMicrosoftWindowsStart MenuPrograms) for all users so that any user who logs on to the system has access to that program. Some programs prompt you during installation to choose whether you want to install the program for all users or only for the currently logged-on user. Other programs simply install themselves only for the current user.
If setup installs a program so that it is available only to the currently logged-on user and you want other users to have access to the program, you need to take one of the following actions:
Log on to the computer with each user account that should have access to the program, and then rerun Setup to make the program available to these users. You also need to run Setup again when a new user account is added to the computer and that user needs access to the program.
For programs that don’t require per-user settings to be added to the registry before running, you can in some cases make the program available to all users on a computer by adding the appropriate shortcuts to the Start MenuPrograms folder for all users. Copy or move the program shortcuts from the currently logged-on user’s profile to the Start MenuPrograms folder for all users.
If you want to make a program available to all users on a computer, you can copy or move a program’s shortcuts by completing the following steps:
In File Explorer, navigate to the currently logged-on user’s Programs folder. This is a hidden folder under %UserProfile%AppDataRoamingMicrosoftWindowsStart Menu. In File Explorer, you view hidden items by selecting the Hidden Items check box on the View tab.
In the Programs folder, press and hold or right-click the folder for the program group or the shortcut with which you want to work, and then tap or click Copy or Cut on the shortcut menu.
Next, navigate to the Start MenuPrograms folder for all users. This hidden folder is under %SystemDrive%ProgramDataMicrosoftWindows.
In the Programs folder, press and hold or right-click an open space, and then tap or click Paste. The program group or shortcut should now be available to all users of the computer.
If you want to make a program available only to the currently logged-on user rather than all users on a computer, you can move a program’s shortcuts by completing the following steps:
In File Explorer, navigate to the all-users Start Menu folder. This hidden folder is under %SystemDrive%ProgramDataMicrosoftWindowsStart Menu.
In the Programs folder, press and hold or right-click the folder for a program group or the program shortcut that you want to work with, and then tap or click Cut.
In File Explorer, navigate to the currently logged-on user’s Programs folder. This is a hidden folder under %UserProfile%AppDataRoamingMicrosoftWindowsStart Menu.
In the Programs folder, press and hold or right-click an open space, and then tap or click Paste. The program group or shortcut should now be available only to the currently logged-on user.
Deploying applications through Group Policy
You can make applications available to users over the network through Group Policy. When you use Group Policy to deploy applications, you have the following two distribution options:
Assign the application to users or computers. When an application is assigned to a computer, it is installed the next time the computer is started and is available to all users of that computer the next time users log on. When an application is assigned to a user, it is installed the next time the user logs on to the network. An assigned application can also be configured to be installed on first use. In this configuration, the application is made available through shortcuts on the user’s desktop or Start screen. With install-on-first-use configured, the application is installed when the user clicks a shortcut to start the application.
Publish the application and make it available for installation. When you publish an application, the application can be made available through extension activation. With extension activation configured, the program is installed when a user opens any file with an extension associated with the application. For example, if a user double-taps or double-clicks a file with a .doc or .docx extension, Microsoft Word could be installed automatically.
You deploy applications for computers by using a Windows Installer Package (.msi file) and policies under Computer ConfigurationPoliciesSoftware SettingsSoftware Installation. You deploy applications for users by using a Windows Installer Package (.msi file) and policies under User ConfigurationPoliciesSoftware SettingsSoftware Installation. The basic steps required to deploy applications through Group Policy are as follows:
For clients to access the Windows Installer Package, it must be located on a network share. As necessary, copy the Windows Installer Package (.msi file) to a network share that is accessible to the appropriate users.
In the Group Policy Management Editor, open the Group Policy Object from which you want to deploy the application. After it is deployed, the application is available to all clients to which the Group Policy Object applies. This means the application is available to computers and users in the related domain, site, or organizational unit (OU).
Expand Computer ConfigurationPoliciesSoftware Settings or User ConfigurationPoliciesSoftware Settings, press and hold or right-click Software Installation, point to New, and then tap or click Package.
Use the Open dialog box to locate the Windows Installer Package (.msi file) for the application, and then tap or click Open. You are then given the choice to select the deployment method: Published, Assigned, or Advanced.
To publish or assign the program, select Published or Assigned, and then tap or click OK. If you are configuring computer policy, the program is available the next time a computer affected by the Group Policy Object is started. If you are configuring user policy, the program is available to users in the domain, site, or OU the next time users log on. Currently logged-on users need to log off and then log on.
To configure additional deployment options for the program, select Advanced. You can then set additional deployment options as necessary.
Configuring program compatibility
If you want to install 16-bit or MS-DOS-based programs, you might need to make special considerations. Additionally, to get older programs to run, you might sometimes need to adjust compatibility options. Techniques for handling these situations are discussed in the following sections.
Special installation considerations for 16-bit and MS-DOS-based programs
The Prevent Access To 16-bit Applications setting under Computer ConfigurationWindows ComponentsApplication Compatibility controls whether 16-bit applications can run on Windows computers. If this setting is not configured, 16-bit applications might require elevated administrator privileges to run. If this setting is enabled, 16-bit applications are prevented from running; and if the setting is disabled, 16-bit applications can run and don’t require elevated administrator privileges.
Many 16-bit and MS-DOS-based programs that don’t require direct access to hardware can be installed and run on Windows 8.1 without any problems; however, most 16-bit and MS-DOS-based programs do not support long file names. To help ensure compatibility with these programs, Windows 8.1 maps long and short file names as necessary to ensure that long file names are protected when they are modified by a 16-bit or an MS-DOS-based program. Additionally, it’s important to note that some 16-bit and MS-DOS-based programs require 16-bit drivers, which are not supported on Windows 8.1. As a result, these programs won’t run.
Most existing 16-bit and MS-DOS-based programs were originally written for very early Windows operating systems. Windows 8.1 runs these older programs by using a virtual machine that mimics the 386-enhanced mode used by these very early Windows operating systems. Unlike on other recent releases of Windows, on Windows 8.1 each 16-bit and MS-DOS-based program runs as a thread within a single virtual machine. This means that if you run multiple 16-bit and MS-DOS-based programs, they all share a common memory space. Unfortunately, if one of these programs stops responding or “hangs,” it usually means the others will also.
You can help prevent one 16-bit or MS-DOS-based program from causing others to hang or crash by running it in a separate memory space. To do this, follow these steps:
Press and hold or right-click the program’s shortcut icon, and then tap or click Properties. If the program doesn’t have a shortcut, create one, and then open the shortcut’s Properties dialog box.
On the Shortcut tab, tap or click Advanced. This displays the Advanced Properties dialog box.
Select the Run In Separate Memory Space check box.
Tap or click OK twice to close all open dialog boxes and save the changes.
Forcing program compatibility
Some programs won’t install or run on Windows 8.1 even if they work on previous versions of the Windows operating system. If you try to install a program that has known compatibility problems, Windows 8.1 should display a warning prompt telling you about the compatibility issue. In most cases, you should not continue installing or running a program with known compatibility problems, especially if the program is a system utility such as an antivirus program or a disk partitioning program, because running an incompatible system utility can cause serious problems. Running other types of incompatible programs can also cause problems, especially if they write to system locations on disk.
That said, if a program will not install or run on Windows 8.1, you might be able to run the program by adjusting its compatibility settings. Windows 8.1 provides two mechanisms for managing compatibility settings. You can use the Program Compatibility Troubleshooter Wizard, or you can edit the program’s compatibility settings directly by using the program’s Properties dialog box. Both techniques work the same way. However, the Program Compatibility Troubleshooter Wizard is the only way you can change compatibility settings for programs that are on shared network drives, CD or DVD drives, or other types of removable media drives. As a result, you can sometimes use the Program Compatibility Troubleshooter Wizard to install and run programs that would not otherwise install and run.
Using the Program Compatibility Troubleshooter Wizard
You can configure compatibility settings only for programs you’ve installed. You can’t configure compatibility settings for programs included with the operating system. To try to automatically detect compatibility issues by using the Program Compatibility Troubleshooter Wizard, follow these steps:
Locate the program shortcut. Press and hold or right-click the program shortcut, and then tap or click Troubleshoot Compatibility. This starts the Program Compatibility Troubleshooter Wizard, as shown in Figure 7-2.
The wizard automatically tries to detect compatibility issues. To try to run the program you are troubleshooting with the recommended fixes, tap or click Try Recommended Settings. Next, review the settings that will be applied, and then tap or click Test The Program.
After running the program, tap or click Next, and then do one of the following:
Tap or click Yes, Save These Settings For This Program if the compatibility settings resolved the problem and you want to keep the settings.
Tap or click No, Try Again Using Different Settings if the compatibility settings didn’t resolve the problem and you want to repeat this process from the beginning.
Tap or click No, Report The Problem To Microsoft And Check Online For A Solution if the compatibility settings didn’t resolve the problem and you’d like to check for an online solution.
Tap or click Cancel if you want to discard the compatibility settings and exit the wizard.
To perform advanced troubleshooting and use the Program Compatibility Troubleshooter Wizard to specify the compatibility settings to use, follow these steps:
In File Explorer, locate the program shortcut by navigating the menus under %SystemDrive%ProgramDataMicrosoftWindowsStart MenuPrograms. Press and hold or right-click the program shortcut, and then tap or click Troubleshoot Compatibility. This starts the Program Compatibility Troubleshooter Wizard.
Tap or click Troubleshoot Program. On the What Problems Do You Notice? page, you can specify information about problems you’ve found. The selections you make determine the wizard pages you get when you tap or click Next. They include the following:
The Program Worked In Earlier Versions Of Windows But Won’t Install Or Run Now. If you select this option, you are prompted on one of the subsequent wizard pages to specify which version. Because your choice sets the compatibility mode, choose the operating system for which the program was designed. When running the program, Windows 8.1 simulates the environment for the specified operating system.
The Program Opens But Doesn’t Display Correctly. If you are trying to run a game, an educational program, or any other program that requires specific display settings, such as a program designed for early versions of Windows, you can select this option and then choose the type of display problem you are having. Your selections restrict the video display: when you use 256 colors, 640 × 480 screen resolution, or both, Windows restricts the video display. This can help with programs that have problems running at higher screen resolutions and greater color depths. Your selections can also disable themes, desktop compositing (which prevents special visual effects on the desktop), and display scaling of high dots-per-inch (DPI) settings.
The Program Requires Additional Permissions. If you choose this option, the program will be configured to run with administrator privileges.
I Don’t See My Problem Listed. If you choose this option, the wizard displays optional pages for operating system and display issue selection. The wizard also sets the program to run as an administrator. Ultimately, choosing this option has the same effect as if you had selected all three of the previous options.
Review the compatibility settings that will be applied. If you don’t want to apply these settings, tap or click Cancel and repeat this procedure to select different options. If you want to apply these settings, tap or click Test The Program, and the wizard runs the program with the compatibility settings you specified.
After running the program, tap or click Next to continue. When you continue, you are prompted to confirm whether the changes fixed the problem. Do one of the following:
If the compatibility settings resolved the problem and you want to keep the settings, tap or click Yes, Save These Settings For This Program.
If the compatibility settings didn’t resolve the problem and you want to repeat this process from the beginning, tap or click No, Try Again Using Different Settings.
If the compatibility settings didn’t resolve the problem and you’d like to check for an online solution, tap or click No, Report The Problem To Microsoft And Check Online For A Solution.
If you want to discard the compatibility settings and exit the wizard, tap or click Cancel.
Setting compatibility options directly
If a program you have already installed won’t run correctly, you might want to edit the compatibility settings directly rather than by using the wizard. To do this, follow these steps:
Press and hold or right-click the program’s shortcut icon, and then tap or click Properties.
In the Properties dialog box, tap or click the Compatibility tab. Any option you select is applied to the currently logged-on user for the program shortcut. To apply the setting to all users on the computer and regardless of which shortcut is used to start the program, tap or click Change Setting For All Users to display the Properties dialog box for the program’s .exe file, and then select the compatibility settings that you want to use for all users who log on to the computer.
Select the Run This Program In Compatibility Mode For check box, and then use the selection menu to choose the operating system for which the program was designed.
If necessary, use the options in the Settings panel to restrict the video display settings for the program. Select Reduced Color Mode and then select either 8-bit (256) color or 16-bit (65536) color, as required. Select Run In 640 × 480 Screen Resolution, as required.
If necessary, you can also disable visual themes, desktop compositing, and display scaling of high DPI settings.
Tap or click OK. Double-tap or double-click the shortcut to run the program and test the compatibility settings. If you still have problems running the program, you might need to modify the compatibility settings again.
Managing installed and running programs
Windows 8.1 provides several management tools for working with programs. These tools include the following:
Task Manager. Provides options for viewing and managing running programs, as well as options for viewing resource usage and performance
Programs. Provides tasks for viewing installed programs, adding and removing programs, viewing installed updates, and more
Default Programs. Helps you track and configure global default programs for the computer, personal default programs for individual users, AutoPlay settings for multimedia, and file associations for programs
Windows Features. Helps you view and manage the Windows components installed on a computer
Assoc. Helps you view and manage file type associations
Ftype. Helps you view and manage file type definitions
These tools and related configuration options are discussed in the sections that follow.
Managing currently running programs
In Windows 8.1, you can view and work with a computer’s currently running programs and processes by using Task Manager. You can open Task Manager by pressing Ctrl+Shift+Esc. Alternatively, press and hold or right-click the lower-left corner of the screen, and then tap or click Task Manager on the shortcut menu.
By default, Task Manager displays a summary list of running applications, as shown in Figure 7-3. You can manage an application by tapping or clicking it in the list. To exit an application (which might be necessary when it’s not responding), tap or click the application in the Task list, and then tap or click End Task. To display other management options, press and hold or right-click the application in the Task list.
When working with the summary view, you can tap or click More Details to open the full Task Manager. You’ll then find detailed information about running applications and processes, as shown in Figure 7-4. The Processes tab lists applications and processes running on the computer. Generally, items listed under the Apps heading are applications that you’ve started, processes being run in the background by Windows are listed under Background Processes, and all other processes running on the computer are listed under Windows Processes.
Each application or process is listed by name, status, CPU usage, memory usage, disk usage, and network usage. A blank status means the application or process is in a normal state. As with the summary view, you can exit an application or stop a running process by tapping or clicking the application or process in the Task list, and then tapping or clicking End Task.
Double-tap or double-click the application or process to view related windows or processes. Display more management options by pressing and holding or right-clicking the application or process in the Task list. The options include Open File Location, which opens the folder containing the executable file for the application or process in File Explorer; Create Dump File, which creates a memory dump file for the selected process; Go To Details, which opens the Details tab with the process selected; and Properties, which opens the Properties dialog box for the executable file.
Managing, repairing, and uninstalling programs
Windows 8.1 considers any program you’ve installed on a computer or made available for a network installation to be an installed program. You use the setup program that comes with the program to install programs, and you use the Programs And Features page in Control Panel to manage programs.
You can use the Programs And Features page to view, add, remove, or repair installed programs by following these steps:
In Control Panel, tap or click Programs. Tap or click Programs And Features. You should get a list of installed programs.
In the Name list, press and hold or right-click the program with which you want to work. The options available depend on the program you are working with and include the following:
Uninstall. Uninstalls the program
Uninstall/Change. Uninstalls or modifies the program
Change. Modifies the program’s configuration
Repair. Repairs the program’s installation (if available)
When you are uninstalling programs, keep the following in mind:
Windows warns you if you try to uninstall a program while other users are logged on. Generally, you should be sure that other users are logged off before uninstalling programs. Otherwise, you might cause other users to lose data or experience other problems.
Windows will allow you to remove only those programs that were installed with a Windows-compatible setup program. Although most applications have a setup program that uses InstallShield, Wise Install, or Windows Installer, older programs might have a separate uninstall utility. Some older programs work by copying their data files to a program folder. In this case, you uninstall the program by deleting the related folder.
Many uninstall programs leave behind data either inadvertently or by design. As a result, you often find folders for these applications within the Program Files folder. You could delete these folders, but they might contain important data files or custom user settings that could be used again if you reinstall the program.
Sometimes, the uninstall process fails. Often, you can resolve any problem simply by rerunning the uninstaller for the program. Occasionally, you might need to clean up after the uninstall process. This might require removing program files and deleting remnants of the program in the Windows registry. A program called Microsoft Fix It Portable can help you clean up the registry. To learn more about this program and get the downloadable executable file, visit http://support.microsoft.com/mats/Program_Install_and_Uninstall/. At the Microsoft website, instead of choosing Run Now, click the Advanced options and then click the Download option to save the executable file. After downloading, run the executable file and follow the prompts to install it.
Designating default programs
Default programs determine which programs are used with which types of files and how Windows handles files on CDs, DVDs, and portable devices. You configure default programs based on the types of files those programs support, either globally for all users of a computer or only for the current user. Individual user defaults override global defaults. For example, you could select Windows Media Player as the global default for all types of files it supports, and then all users of the computer would use Windows Media Player to play the sound, audio, and video files it supports. If a specific user wanted to use Apple iTunes instead, for example, as the default player for sound and audio files, you could configure iTunes to be that user’s default player for the types of media files it supports.
You can configure global default programs for all the users of a computer by following these steps:
In Control Panel, select Programs. Select Default Programs, and then select Set Program Access And Computer Defaults. You’ll get the dialog box shown in Figure 7-5.
Choose a configuration from one of the following options:
Microsoft Windows. Sets the currently installed Windows programs as the default programs for browsing the web, sending email messages, playing media files, and so on
Non-Microsoft. Sets the currently installed programs as the default programs for browsing the web, sending email messages, playing media files, and so on
Custom. Enables you to choose programs as the defaults for browsing the web, sending email messages, playing media files, and so on
Select OK to save the settings.
To override global defaults, you can set default programs for individual users. You can configure default programs for the current user by following these steps:
In Control Panel, select Programs. Select Default Programs, and then select Set Your Default Programs.
Select a program in the Programs list with which you want to work.
If you want the program to be the default for all the file types and protocols it supports, select Set This Program As Default.
If you want the program to be the default for specific file types and protocols, select Choose Defaults For This Program. Select the extensions for which the program should be the default, and then select Save.
Managing the command path
Windows uses the command path to locate executable files. You can view the current command path for executable files by using the PATH command. In a command shell, type path on a line by itself, and then press Enter. In a Windows PowerShell console, type $env:path on a line by itself, and then press Enter. In the output from either technique, observe that Windows uses a semicolon (;) to separate individual paths, marking where one file path ends and another begins.
The command path is set during logon by using system and user environment variables. The path defined in the PATH system variable sets the base path. The path defined in the PATH user variable adds to the base path by using the following syntax:
%PATH%;AdditionalPathsHere, %PATH% tells Windows to insert the current system paths, and AdditionalPaths designates the additional user-specific paths to use.
Caution
An improperly set path can cause severe problems. You should always test any command path change before using it in a live environment. The command path is set during logon. Therefore, you must log off and then log on again to view the effects of the revised path.
Don’t forget about the search order that Windows uses. Paths are searched in order, with the last path in the PATH user variable being the last one searched. This can sometimes slow the execution of your programs and scripts. To help Windows find your programs and scripts faster, you should consider placing a required path earlier in the search order.
Be careful when setting the command path. It is easy to overwrite all path information accidentally. For example, if you don’t specify %PATH% when setting the user path, you will delete all other path information. One way to ensure that you can easily re-create the command path is to keep a copy of the command path in a file:
When you are working with the command prompt, you can write the current command path to a file by entering path > orig_path.txt. Keep in mind that if you are using a standard command prompt rather than an administrator command prompt, you won’t be able to write to secure system locations. In this case, you can write to a subdirectory to which you have access or to your personal profile. To write the command path to the command-shell window, enter path.
When you are working with the Windows PowerShell console, you can write the current command path to a file by entering $env:path > orig_path.txt. If you are using a standard console rather than an administrator console, you won’t be able to write to secure system locations. In this case, you can write to a subdirectory to which you have access or to your personal profile. To write the command path to the Windows PowerShell window, enter $env:path.
At the command prompt or in the Windows PowerShell window, you can modify the command path by using the Setx.exe utility. You can also edit the command path by completing the following steps:
In Control Panel, tap or click System And Security, and then tap or click System.
In the System console, tap or click Change Settings, or tap or click Advanced System Settings in the left pane.
On the Advanced tab in the System Properties dialog box, tap or click Environment Variables.
Select the PATH variable in the System Variables list. Under System Variables, tap or click Edit.
By default, the path value is selected. Without pressing any other key, press the Right Arrow key. This should remove the selection highlight and place the insertion point at the end of the variable value.
Type a semicolon, and then enter a path to insert. Repeat this step as necessary, and then tap or click OK three times.
In Group Policy, you can use a preference item to modify the -command path by following these steps:
Open a Group Policy Object for editing in the Group Policy Management Editor. To configure preferences for computers, expand Computer ConfigurationPreferencesWindows Settings, and then select Environment. To configure preferences for users, expand User ConfigurationPreferencesWindows Settings, and then select Environment.
Press and hold or right-click the Environment node, point to New, and then tap or click Environment Variable. This opens the New Environment Properties dialog box.
In the Action list, select Update to update the path variable, or select Replace to delete and then re-create the path variable. Next, select User Variable to work with user variables.
In the Name box, enter Path. In the Value box, enter the variable value. Typically, you’ll enter %PATH%; followed by the paths you want to add, using a semicolon to separate each path. If the affected computers have existing PATH user variable definitions, you must provide the related paths to ensure that these paths are retained.
Use the options on the Common tab to control how the preference is applied. In most cases, you’ll want to create the PATH variable only once (rather than have Group Policy re-create the variable each time policy is refreshed). If so, select Apply Once And Do Not Reapply.
Tap or click OK. The next time policy is refreshed, the preference item will be applied as appropriate for the Group Policy Object in which you defined the preference item.
Caution
Incorrectly setting the path can cause serious problems. Before deploying an updated path to multiple computers, you should test the configuration. One way to do this is to create a Group Policy Object in Active Directory that applies only to an isolated test computer. Next, create a preference item for this Group Policy Object, and then wait for a policy to refresh or apply policy using GPUpdate. If you are logged on to the computer, you need to log off and then log back on before you can confirm the results.
Managing file name extensions and file associations
File name extensions and file associations also are important for determining how applications run. The types of files that Windows considers to be executable files are determined by the extensions for executable files. File name extensions allow users to execute a command by using just the command name. File associations are what allow users to double-tap or double-click a file and open the file automatically in a related application. Two types of file name extensions are used:
Extensions for executable files. Executable files are defined with the %PATHEXT% environment variable and can be set by using the Environment Variables dialog box or with Group Policy preference items in much the same way as the PATH variable. You can view the current settings by typing set pathext at the command line or by typing $env:pathext at a Windows PowerShell prompt. The default setting is PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC. With this setting, the command line knows which files are executable and which files are not, so you don’t have to specify the file name extension at the command line.
Extensions for applications. File name extensions for applications are referred to as file associations. File associations are what enable you to pass arguments to executable files and to open documents, worksheets, or other application files by double-tapping or double-clicking their file icons. Each known extension on a system has a file association that you can view at a command prompt by typing assoc followed by the extension, such as assoc .doc or assoc .docx. Each file association in turn specifies the file type for the file name extension. This can be viewed at a command prompt by typing ftype followed by the file association, such as ftype Word.Document.8 or ftype Word.Document.12.
Note
Assoc and Ftype are internal commands for the command shell (Cmd.exe). To use the Assoc command in Windows PowerShell, enter cmd /c assoc followed by the extension, such as cmd /c assoc .doc. To use the Ftype command in Windows PowerShell, enter cmd /c ftype followed by the file association, such as cmd /c ftype Word.Document.8.
With executable files, the order of file name extensions in the %PATHEXT% variable sets the search order used by the command line on a per-directory basis. Thus, if a particular directory in the command path has multiple executable files that match the command name provided, a .com file would be executed before an .exe file, and so on.
Every known extension on a system has a corresponding file association and file type—even extensions for executable files. In some cases, the file type is the extension text without the period followed by the keyword file, such as cmdfile, exefile, or batfile, and the file association specifies that the first parameter passed is the command name and that other parameters should be passed on to the application. For example, if you enter assoc .exe to view the file associations for .exe executable files, you then enter ftype exefile. You’ll find the file association is set to the following:
exefile="%1" %*
Thus, when you run an .exe file, Windows knows that the first value is the command that you want to run and anything else provided is a parameter to pass along.
File associations and types are maintained in the Windows registry and can be set by using the Assoc and Ftype commands, respectively. To create the file association at the command line, enter assoc followed by the extension setting, such as assoc .pl=perlfile. To create the file type at the command line, set the file-type mapping, including how to use parameters supplied with the command name, such as ftype perlfile=C:PerlBinPerl.exe “%1” %*.
You can also associate a file type or protocol with a specific application by completing the following steps:
In Control Panel, tap or click Programs. Under Default Programs, tap or click Make A File Type Always Open In A Specific Program.
On the Set Associations page, current file associations are listed by file extension and the current default for that extension. To change the file association for an extension, tap or click the file extension, and then tap or click Change Program.
Do one of the following:
In the How Do You Want To Open This Type Of File? dialog box, programs registered in the operating system as supporting files with the selected extension are listed automatically. Simply tap or click a recommended program to set it as the default for the selected extension.
To view other available programs, click More Options to view other programs that might also support the selected extension. Tap or click a program to set it as the default for the selected extension. Alternatively, tap or click one of the Look For An App options to locate another program to use as the default.
In Group Policy, you can use a preference item to create new file types and file associations. To create a preference item for a new file type, follow these steps:
Open a Group Policy Object for editing in the Group Policy Management Editor. Expand Computer ConfigurationPreferencesControl Panel Settings, and then select Folder Options.
Press and hold or right-click the Folder Options node, point to New, and then tap or click File Type. This opens the New File Type Properties dialog box.
In the Action list, select Create, Update, Replace, or Delete. Each action works as discussed in Chapter 4. You would use the Delete action to create a preference that removes an existing file type preference.
In the File Extension box, enter the extension of the file type without the period, such as pl.
In the Associated Class list, select a registered class to associate with the file type.
Use the options on the Common tab to control how the preference is applied. In most cases, you’ll want to create the new variable only once. If so, select Apply Once And Do Not Reapply.
Tap or click OK. The next time policy is refreshed, the preference item will be applied as appropriate for the Group Policy Object in which you defined the preference item.
To create a preference item for a new file association, follow these steps:
Open a Group Policy Object for editing in the Group Policy Management Editor. Expand User ConfigurationPreferencesControl Panel Settings, and then select Folder Options.
Press and hold or right-click the Folder Options node, point to New, and then tap or click Open With. This opens the New Open With Properties dialog box.
In the Action list, select Create, Update, Replace, or Delete.
In the File Extension box, enter the extension of the file type without the period, such as pl.
Tap or click the options button to the right of the Associated Program box, and then use the Open dialog box to select the program to associate with the file type.
Optionally, select Set As Default to make the associated program the default for files with the previously specified file extension.
Use the options on the Common tab to control how the preference is applied. In most cases, you’ll want to create the new variable only once. If so, select Apply Once And Do Not Reapply.
Tap or click OK. The next time policy is refreshed, the preference item will be applied as appropriate for the Group Policy Object in which you defined the preference item.
Configuring AutoPlay options
In Windows 8.1, AutoPlay options determine how Windows handles files on CDs, DVDs, and portable devices. You can configure separate AutoPlay options for each type of CD, DVD, and other media your computer can handle by following these steps:
In Control Panel, tap or click Programs. Tap or click Default Programs, and then tap or click Change AutoPlay Settings. This displays the AutoPlay page in Control Panel.
As shown in Figure 7-6, use the media selection list to set the default AutoPlay option for each media type.
For removable drives (such as USB memory sticks), you can specify an overall default or a default for each media type. To specify an overall default, clear the Choose What To Do check box and then select a preferred default. To specify individual defaults, select the Choose What To Do check box and then select a default action for each media type.
Tap or click Save to save your settings.
Adding and removing Windows features
Operating system components are considered Windows features that can be turned on or off rather than added or removed. You can turn on or off Windows features by following these steps:
In Control Panel, tap or click Programs. Under Programs And Features, tap or click Turn Windows Features On Or Off. This displays the Windows Features dialog box.
As shown in Figure 7-7, select the check boxes for features to turn them on, or clear the check boxes for features to turn them off.
Tap or click OK, and Windows 8.1 reconfigures components to reflect any changes you made.
