The BitLocker Drive Preparation Tool is available. You can use this tool to prepare the computer for BitLocker Drive Encryption.

This article describes how to obtain this tool. This article also provides an operational overview of the tool. This overview includes system requirements and command-line parameters. Finally, this article describes the most common problems that you may encounter when you use the tool.

Back to the top

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1.	Click Start, type Windows Update in the Start Search box, and then press ENTER.
2.	Click Check for updates.
3.	Click View available Extras.
4.	Click to select the BitLocker and EFS enhancements check box, and then click Install.

Windows Vista Enterprise

If you are using Windows Vista Enterprise, use the following services to obtain this tool:

•

Microsoft Customer Support Services For a complete list of Microsoft Customer Support Services telephone numbers, visit the following Microsoft Web site:For more information, visit the following Microsoft Web page: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Back to the top

When you install this tool, the tool adds an item to the Start menu. To start the BitLocker Drive Preparation Tool, use one of the following methods:

•	Click Start, point to All Programs, click Accessories, click System Tools, click BitLocker, and then double-click BitLocker Drive Preparation Tool.
•	Click Start, type BitLocker in the Start Search text box, and then click BitLocker Drive Preparation Tool in the Programs list.

After the tool finishes preparing the drive, you must restart the computer. Then, you can use the Security item in Control Panel to enable BitLocker.

Back to the top

How to prepare the hard disk for BitLocker Drive Encryption

To encrypt drives and to verify boot integrity, BitLocker requires at least two partitions. These two partitions make up a split-load configuration. A split-load configuration separates the main operating system partition from the active system partition from which the computer starts.

The BitLocker Drive Preparation Tool automates the following processes to make the computer ready for BitLocker:

•	Creating the second volume that BitLocker requires
•	Migrating the boot files to the new volume
•	Making the volume an active volume

When the tool finishes, you must restart the computer to change the system volume to the newly created volume. After you restart the computer, the drive will be configured correctly for BitLocker. You may also have to initialize the Trusted Platform Module (TPM) before you turn BitLocker on.

Back to the top

System requirements

To create a new partition or to merge unallocated space with an existing partition, the target system must meet the following requirements:

•	A genuine version of Windows Vista Ultimate or Windows Vista Enterprise must be installed.
•	The active partition must contain boot configuration data and boot files.
•	The target partition must meet the following requirements: • The partition must be on a simple disk that is initialized for basic storage. • The partition must be a primary partition. Extended drives and logical drives are not supported. • The partition must be formatted by using the NTFS file system. • The partition must not be compressed. • The cluster size of the partition must be less than 4 KB or equal to 4 KB. • The partition is not using software spanning, software mirroring, or software RAID. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 314343 (/Feedback.aspx?kbNumber=314343/) Basic storage versus dynamic storage in Windows XP Note This tool works correctly in hardware RAID configurations. • For a split operation, at least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). • For a merge operation, the partition’s total capacity must be at least 1.5 GB. Also, the partition must have at least 800 MB of free disk space.

The following chart shows the target system requirements.

Back to the top

Operational overview

Target system configurations

The BitLocker Drive Preparation Tool supports Windows Vista Ultimate and Windows Vista Ultimate Enterprise. This tool successfully creates a split-load configuration when the active state, the system state and the boot state are all assigned to the same simple volume.

Default operational procedure

When the BitLocker Drive Preparation Tool starts, it tries to create a split-load configuration by using the following methods, in order of preference:

•	Merge unallocated space with a type 0×7 Windows Recovery (WinRE) partition
•	Create a new partition from unallocated space
•	Split an existing partition Note The tool tries to split the current active partition. If this action fails, the tool splits the largest available partition.
•	Merge unallocated space with the smallest suitable partition

Preferred order of operations

The following chart shows the preferred order of operations that the BitLocker Drive Preparation Tool follows.

Back to the top

Command-line parameters

The BitLocker Drive Preparation Tool uses a simple set of command-line parameters. These parameters make integration with enterprise deployment tools more flexible. Enterprise deployment tools include Microsoft Systems Management Server (SMS) and Microsoft Business Desktop Deployment (BDD). The parameters also provide customized deployment options. The following table lists the parameters. The parameters are not case-sensitive.

Parameter	Description	Notes
[-?] [/?]	Help – Provides a brief description of the tool’s purpose and parameters
[-driveinfo]	Displays the drive letter, the total size, the maximum free space, and the partition characteristics	Only valid partitions are listed. Characteristics are noted only for WinRE, operating system, and unallocated partitions.
[-target {unallocated ¦ drive: {shrink ¦ merge}}]	Indicates the desired operation for target partition: create a new partition from unallocated disk space, split the target partition to create a new partition, or merge unallocated space with the target partition	Cannot merge unallocated spaced with the operating system partition. Unallocated space is not listed if four primary or extended partitions already exist.
[-newdriveletter] ¦ DriveLetter:]	Indicates the drive letter for the newly created partition	Letters A, B, and C are excluded. If no letter is indicated, the first available drive letter backward from S is applied.
[-size ¦ SizeInMegabytes]	Indicates the size in megabytes for the new partition	The minimum size is 1500 MB. At least 10 percent of the target partition must be free after the new partition is created.
[-quiet]	Suppresses confirmation text to avoid user interaction
[-restart]	Restarts the system immediately after all operations are complete	Restarts immediately, regardless of open files or other users logged in.

Example scenario 1

The target system has a single partition. To prepare the computer for BitLocker, you want to split the operating system partition. You want the following conditions to be true:

•	The size of the new partition is 1500 MB.
•	The new partition uses X for the drive letter.
•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Example scenario 2

The target system has more than one partition. To prepare the computer for BitLocker, you want to merge unallocated space with an existing partition. You want the following conditions to be true:

•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Back to the top

A common problem

You may receive the following error message when you use the BitLocker Drive Preparation Tool:

This error may occur in one of the following scenarios.

Scenario 1: You do not have sufficient free disk space

At least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). To resolve this error, move files to another partition or delete files.

Scenario 2: The partition contains files that cannot be moved

The BitLocker Drive Preparation Tool may resize partitions to prepare a hard disk for BitLocker. Occasionally, some unmovable files may prevent the tool from defragmenting and resizing partitions. These files may include any of the following items:

•	Page files
•	Hibernation files (Hiberfil.sys)
•	The registry
•	NTFS metadata files. These files include the following files and others: • $mftmirr • $secure • $volume

This issue may occur even if the operating system is newly installed.

To work around this error, use one of the following methods:

•	Temporarily disable hibernation option and hard disk paging. Then, use the Windows Preinstallation Environment to delete the Hiberfil.sys file and the Pagefile.sys file. Restart the computer in Windows Vista. Then, run the BitLocker Drive Preparation Tool again.
•	Reinstall Windows Vista.

Back to the top

You receive an error message when you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer

When you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer that is running Windows Vista, you may receive the following error message:

To resolve this problem, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1.	Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management
3.	Verify the data type of the PagingFiles registry entry. If the data type is REG_SZ, follow these steps: a. Note the value data for the PagingFiles registry entry. b. Back up the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management c. Right-click PagingFiles, and then click Delete. d. Click Yes when you are prompted. e. On the Edit menu, point to New, and then click Multi-String Value. f. Type PagingFiles, and then press ENTER. g. On the Edit menu, click Modify. h. In the Value data box, type the value data that you noted in step 3a, and then click OK. i. Exit Registry Editor.
4.	Restart the computer.

For more information about security for portable computers that are running Windows Vista, visit the following Lenovo Web site:

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

This article discusses the Firewall application requirements necessary for Toredo to coexist with those firewalls on a Windows operating system-based computer.

In order for client firewalls to coexist with Teredo, the firewalls must follow the guidelines listed below.

 

 

1. The client firewall must allow resolution of teredo.IPv6.microsoft.com.

2. The client firewall must exempt UDP IPv4 traffic to/ from remote UDP port 3544.

        a. Port 3544 allows the client to communicate to the Teredo Server.

3. Client firewalls must support the following ICMPv6 error messages & discovery functions:

        a. ICMPv6 Neighbor Solicitation / Neighbor Advertisement

                1. The codes for these are 135 and 136

        b. ICMPv6 Echo Request/ Reply

                1. The codes for these are 128 and 129

        c. Packet Too Big

                1. The code for this is 2

        d. Parameter Problem

                1. The code for this  is 4

        e. Time Exceeded

                1. The codes for this is 3

        f. Destination Unreachable

                1. The code for this is 1

 

Note:  If the above ICMPv6 messages cannot be specifically allowed, then the exemption of all ICMPv6 messages should be enabled on the firewall

 

4. The client firewall should allow the system to send and receive UDP/IPv4 packets to UDP port 1900 

        a. Port 1900 allows UPnP discovery traffic to flow, and while is not necessary, will improve connectivity rates.

 

To troubleshoot if you are having a Teredo problem, please run the command from a command prompt:

netsh int teredo show state

 

Review the “State field in the Teredo parameters using the command above and do the following:

·         If the Teredo State is offline then follow steps 1, 2 and 3 above

·         If the Teredo State is dormant or qualified, then do step 3 only

 

Note: Perform step 4 to achieve best performance.

 

For more information on Teredo please refer to the following article below

http://www.microsoft.com/technet/network/ipv6/teredo.mspx (http://www.microsoft.com/technet/network/ipv6/teredo.mspx)

 

Note: Windows XP SP1 must have the Advanced Networking Pack for Windows XP (http://www.microsoft.com/downloads/details.aspx?familyid=E88CC382-8CE6-4739-97C0-1A52A6F005E4&displaylang=en) installed

 

 

 

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Microsoft has released security bulletin MS08-068. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx)

  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:

  http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx)

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Known issues with this security update

Symptoms

After you apply this security update, applications such as Microsoft SQL Server or Internet Information Services (IIS) may fail when they make local NTLM authentication requests.

Cause

This problem occurs because of the way that NT LAN Manager (NTLM) treats different naming conventions as remote entities instead of as local entities. A local authentication failure might occur when the client calculates and caches the correct response to the NTLM challenge that is sent by the server in local lsass memory before the response is sent back to the server. When the server code for NTLM finds the received response in the local lsass cache, the code does not honor the authentication request and treats it as a replay attack. This behavior leads to a local authentication failure.

Resolution

To resolve this problem, you must disable reflection protection so that the affected systems can be authenticated. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

How to disable NTLM reflection protection

ImportantThis section, method, or task contains steps that tell you how to change the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To disable NTLM reflection protection, you must modify a registry key on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck for the name of the DWORD, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection

Because the NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system by setting DisableLoopbackCheck to 1 returns the system to a vulnerable state. Therefore, we strongly recommend that you use the BackConnectionHostNames registry key if needed.

How to re-enable NTLM reflection protection

To re-enable NTLM reflection protection, you must modify a registry entry on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. Right-click DisableLoopbackCheck, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

How to disable NTLM reflection protection for a particular SPN

You can disable NTLM reflection protection for a particular Service Principal Name (SPN) that is causing the corresponding authentication to break.To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames for the name of the Multi-String Value, and then press ENTER.

   Note If the BackConnectionHostNames registry entry exists as a REG_DWORD, you must delete the BackConnectionHostNames registry entry.

5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection for a particular SPN

Because NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system will return the system to a vulnerable state for the particular SPN for which the reflection protection was disabled.

How to re-enable NTLM reflection protection for a particular SPN

To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. Right-click BackConnectionHostNames, and then click Modify.
4. In the Value data box, delete the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information notes

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the SP requirement and Service branch columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that has a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) have a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Consider the following scenario:

·         You log in to a Windows 2008 Server using Remote Desktop.

·         You are using a roaming profile.

·         Icons are viewed as Large or Middle size icons (shortcut (.url)) on desktop.

·         You have changed an Icon image to be different than its default icon.

In this scenario when you use remote desktop you notice that the icon that is displayed for Internet shortcut files changes to the default system icon.

When you log in to Windows 2008 server by using Remote Desktop, Internet Explorer 7 has a limitation in that the .url handler for IExtractIcon will fail all requests for icons larger than 48×48, and if asked for a 48×48 icon, will return a default page icon.

Right click on desktop and choose Classic icons from view.

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Consider the following scenario:

•	You are running a Windows Server 2008-based computer.
•	In Windows Explorer, you click Open Sync Center on the Tools menu.

In this scenario, nothing happens. Sync Center does not start as expected.

Back to the top

This problem occurs if you did not install the Windows Desktop Experience component of Windows Server 2008. To run Sync Center, the system requires Windows Desktop Experience.

Back to the top

To resolve this problem, install Windows Desktop Experience. To do this, follow these steps:

1.	Click Start, click Administrative Tools, and then double-click Server Manager.
2.	In Server Manager, click Add Features under Features Summary.
3.	In the Add Features Wizard dialog box, make sure that the Desktop Experience option is selected.
4.	Click Next, and then click Install.
5.	After the installation process is complete, click Close, and then close Server Manager.

NoteAfter you install Windows Desktop Experience, you must restart the computer.

Back to the top

Sync Center is a feature of Windows Server 2008 that lets you synchronize information between your computer and the following:

•	Mobile devices that you plug in to your computer or devices to which you connect wirelessly. These may include portable music players, digital cameras, and mobile phones.
•	Files that are stored in folders on servers. These are known as offline files because you can access them even when the computer or the server is not connected to the network.
•	Programs that support Sync Center.

This synchronization functionality is part of Windows Desktop Experience.

Back to the top

For more information about Windows Desktop Experience, view the TechNet Support WebCast How to configure offline files and folders in a Windows Server 2003 and Windows XP environment. To do this, visit the following Microsoft Web site:

Back to the top

This article describes the Web folders issues that are fixed in the Software Update for Web Folders that is dated May 18, 2007.

•	The issues that the update fixes.
•	The prerequisites for installing the update.
•	Whether you must restart the computer after you install the update.
•	Whether the update is replaced by any other update.
•	Whether you must make any registry changes.
•	The files that the update contains.

Back to the top

List of issues fixed

This update fixes various issues that may occur when you use Web folders from the client computer to connect to a server that supports Web Distributed Authoring and Versioning (WebDAV).

This update fixes the following issues:

•	A document that is opened from a Microsoft Office SharePoint Server 2007site may be downloaded two times when you click Edit in Microsoft Office program.
•	The download progress indicator does not work for some documents on the SharePoint site.
•	You cannot rename or copy files that have a display name in a non-Internet Information Services (IIS) Web folder.

Additionally, this update includes security enhancements to Web folders.

Back to the top

Update information

The following file is available for download from the Microsoft Download Center:
Download the Software Update for Web Folders package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=17C36612-632E-4C04-9382-987622ED1D64)

Release Date: May 18, 2007

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Restart information

You may have to restart the computer after you apply this update.

Update replacement information

This update replaces the Software Update for Web Folders that is dated January 25, 2005.

For more information about the Software Update for Web Folders that is dated January 25, 2005, click the following article number to view the article in the Microsoft Knowledge Base:

File information

After the update is installed, the English version of this update has the file attributes, or a later version of the file attributes, that are listed in the following table:

File name	File version	File size	Date	Time
Fp4autl.dll	4.0.2.3216	589,880	17-Nov-2004	22:33
Fp4awec.dll	4.0.2.2611	450,669	17-Nov-2004	22:33
Fpext_fp4.msg	Not Applicable	78,706	17-Nov-2004	22:33
Msdaipp.dll	12.0.4518.1014	1,011,488	27-Oct-2006	00:49
Msdapml.dll	12.0.4518.1014	163,104	27-Oct-2006	00:49
Msonsext.dll	12.0.4518.1014	970,528	27-Oct-2006	00:49
Nsextint.dll	12.0.4518.1014	75,552	27-Oct-2006	00:49

Additional notes

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Windows writes Group Policy data to domain controller other than the one displayed.

Group Policy Administrators may target any domain controller regardless of the policy setting’s value.

The following scenarios may cause this problem:

·         Using GPMC to edit Group Policy objects over high-latency or transient network connections.

·         Incorrectly configured sites and subnets in Active Directory

 

There is no resolution at this time.

 

Best Practices:

·         Edit Group Policy object directly on the domain controller where you want to receive changes. (NOTE: this is not ideal for delegated environments).

·         Ensure the computer from which you edit Group Policy is in the same site as the domain controller where you want to receive changes.

·         Do not edit Group Policy over transient or high-latency connections. Use Remote Desktop or Terminal Services and connect to a computer located in the same site as the domain controller and edit or create Group Policy on that computer.

·         Do not leave Group Policy tools open for an extended period of time, most importantly when editing domain-based Group Policy objects.  Save changes as soon as possible.

 

User Interface behavior:

Group Policy Management Tools, at startup, attempt to locate and connect to the domain controller in the current domain that holds the Primary Domain Controller (PDC) emulator role. The “Group Policy domain controller selection” Group Policy setting enforces the initial connection to only use the domain controller defined in the policy setting. The policy setting does not prevent you from targeting another domain controller after you have loaded the Group Policy object in the appropriate editor.

 

Saving Policy Information:

Active Directory:

Group Policy editors save Group Policy object data to two locations: Active Directory and the system Volume (SYSVOL), which is hosted on all domain controllers within each domain. Group Policy editor use Directory Service Application Programming Interfaces (APIs) to locate the domain controllers. The domain controller returned by these API’s is displayed in the User Interface of the Group Policy Management tools. This is the server that receives Active Directory updates when you save a Group Policy object.

SYSVOL:

Each domain controller in the domain hosts a replicated copy of the System Volume. Group Policy stores most of the policy setting data on the sysvol, which then replicates to each domain controller.  Group Policy editors save Group Policy data to a serverless path ( domainname.com sysvol policies [guidfolder]).  Each domain supports this special named path through Distributed File System (DFS) redirection.   The actual path domainname.com sysvol  does not physically exist. The network redirector considers this a special named path and creates a list of domain controllers that host sysvol.  Entries in this list are known as link targets and included server names in the path ( servername sysvol).  This list is ordered differently on each client based on site configurations in Active Directory, thereby ensuring computers connecting to this path connect to the closest domain controller hosting this path.  The redirector reviews this list when a connection to domainnanme.com sysvol  is requested.  The redirector chooses a link target form this list, ensures the link target is responsive, and redirect the connection domainname.com sysvol to the path included in the link target, which includes a server name. This link then becomes the active link target for domainname.com sysvol.  If the active link path is unavailable, the computer consults the list again and chooses the next link target in the list, ensures it is responsive, and makes it the active link target for domainname.com sysvol.

Saving to Sysvol:

Domain Controllers are the only servers that host Sysvol. Therefore, the domain controller returned from the Active Directory API, in theory, should be included in the list of link targets. The Group Policy API attempts to prioritize this server as the active link target; attempting to ensure saving Group Policy data to Sysvol occurs on the same domain controller that received the saved Active Directory data.  However, it is possible the name of the domain controller returned from Active Directory is not in the link target list or that the link target may change when editing a Group Policy object.

This change is normal as domainname.com sysvol is purposefully dynamic to ensure the path always resolves to working location. Then nature of redirecting sysvol allows Group Policy to save SYSVOL information to domain controller that is not listed in the Group Policy Management UI. This also prevents the “Group Policy domain controller selection” policy setting from being absolute.

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

This article describes the relationship between Windows Firewall and Windows Security Center in Windows Vista.

Back to the top

Windows Security Center displays the status of the Windows Firewall. The status is green when Windows Firewall is enabled and when Windows Firewall is using the recommended settings. The status is red when Windows Firewall is disabled or when Windows Firewall is not using the recommended settings.

The following settings are the recommended Windows Firewall settings:

•	Windows Firewall service is enabled.
•	Windows Firewall state is on for all profiles.
•	Windows Firewall is enabled on all interfaces.
•	By default, the incoming action for the firewall is set to Block for all profiles. Or, the incoming action for the firewall is set to Allow on any profile, and at least one block rule is present.

Note The recommended settings that are discussed here are the minimum settings that we recommend to help maintain a balance between functionality and increased security.

To be recognized as recommended settings, these settings must exist in local policy and in any policy that is implemented through Group Policy. For example, Windows Security Center indicates a red status if the local policy states that the firewall is off for the domain profile. This occurs even if Group Policy states that the firewall is on for the domain profile. This is true even though Group Policy has precedence over local policy so that the effective Windows Firewall state is enabled for the domain profile.

When Windows Firewall does not use the recommended settings, a banner appears on the Windows Firewall Control Panel icon to indicate that the recommended settings are not used. Local administrators have the option to update the settings to change all the settings back to the recommended settings if it is possible. If the policy comes from Group Policy and contains settings that are not the recommended firewall settings, a message indicates that the settings could not be updated. The Windows Firewall Control Panel icon also displays a yellow information banner to indicate that the policy comes from Group Policy.

If you use a Windows Firewall policy that we do not recommend when you configure Group Policy, you may also consider disabling Windows Security Center. For example, you may set incoming connections to be allowed by default. In this case, disabling Windows Security Center prevents it from displaying warning notifications and reporting the firewall status as red. This can result in fewer help desk calls.

You can use Group Policy to centrally manage the Windows Security Center feature for computers in a Windows domain. To access the Turn on Security Center (Domain PCs only) policy setting, locate the Computer Configuration Administrative Templates Windows Components Security Center node in the Group Policy Object Editor (Gpedit.msc).

If you use a third-party firewall that is registered with Windows Security Center, the Windows Security Center firewall indicator will be green unless the third-party firewall reports that it is disabled. For example, if you turn off Windows Firewall because a different firewall is enabled, and that third-party firewall reports to Windows Security Center that it is on, the Windows Security Center firewall indicator will be green.

Back to the top

For more information about settings that we recommend for Windows Security Center and for Windows Firewall in Windows Vista, visit the following Microsoft Web sites:

Back to the top

When you print multiple slides per page in Microsoft PowerPoint 2002, in Microsoft Office PowerPoint 2003, or in Microsoft Office PowerPoint 2007, some slides are offset and are not centered. This behavior occurs when use one of the following PostScript system drivers to print the slides:

•	Lexmark C920 PS System driver
•	Lexmark C912 PS System driver
•	HP Color LaserJet 9500 PS driver
•	HP Color LaserJet 4600 PS driver
•	Lexmark C912 PS driver for Windows Vista
•	Lexmark C910 PS driver for Windows Vista

Back to the top

To work around this issue, use one of the following methods.

Back to the top

Method 1: Download a different printer driver

Download a different printer driver to use with your printer. For example, download a custom printer driver from the Web site of the manufacturer of your printer.

For more information about how to install a Windows PostScript driver, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Method 2: Print slides as handouts

To print a presentation as handouts, follow these steps.

PowerPoint 2003 or PowerPoint 2002

1.	Open the presentation that you want to print.
2.	On the File menu, click Print Preview.
3.	On the toolbar, select the handout layout option that you want in the Print What list.
4.	On the toolbar, click Print.

PowerPoint 2007

1.	Open the presentation that you want to print.
2.	Click the Microsoft Office Button , point to Print, and then click Print Preview.
3.	On the Print Preview tab, select the handout layout option that you want from the Print What list in the Page Setup group.
4.	In the Print group, click Print.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top

Microsoft has released security bulletin MS07-017. The security bulletin contains all the relevant information about the security update. This information includes file manifest information and deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites:

•	Home users: http://www.microsoft.com/athome/security/update/bulletins/200704oob.mspx (http://www.microsoft.com/athome/security/update/bulletins/200704oob.mspx)
•	IT professionals: http://www.microsoft.com/technet/security/bulletin/ms07-017.mspx (http://www.microsoft.com/technet/security/bulletin/ms07-017.mspx)

Back to the top

Known issues

•

Microsoft is aware of an issue that affects a limited number of printer drivers. When you try to print by using one of these drivers, you may experience the following symptoms: • Your computer automatically restarts. • After you log on, you receive the following error message: Microsoft Windows The system has recovered from a serious error.A log of this error has been created. Please tell Microsoft about this problem.We have created an error report that you can send to help us improve Microsoft Windows. We will treat this report as confidential and anonymous. To see what data this error report contains, click here. When you click the link at the bottom of the message box, you see error signature information that resembles the following: BCCode : 0x0000007f (0×00000000, 0×00000000, 0×00000000, 0×00000000) OSVer : 5_1_2600 SP : 0_0 Product : 256_1 • You receive the following Stop error message: A problem has been detected and Windows has been shut down to prevent damage to your computer… Technical information: *** Stop 0x0000007f (0×00000000, 0×00000000, 0×00000000, 0×00000000) UNEXPECTED_KERNEL_MODE_TRAP For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base: 935843 (/Feedback.aspx?kbNumber=935843/) Stop 0x0000007F error when you print from Windows XP or Windows 2000 with GDI security update 925902 installed

•

After you install this security update on a computer that is running Windows XP with Service Pack 2, certain third-party applications may not start. Additionally, you receive an error message that resembles the following: application_executable_name – Illegal System DLL Relocation The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C: Windows System32 Hhctrl.ocx occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL. For more information about this issue, and to see a list of third-party programs that Microsoft has confirmed are affected by this problem, click the following article number to view the article in the Microsoft Knowledge Base: 935448 (/Feedback.aspx?kbNumber=935448/) Certain programs may not start, and you receive an error message on a computer that is running Windows XP Service Pack 2: Illegal System DLL Relocation If you receive a similar message when you use other programs, install update 935448. If we confirm that other programs are affected by this problem, we will update Microsoft Knowledge Base article 935448 with more information.

Back to the top

The revision number and the review dates for this article may reflect minor editorial revisions or structural revisions to this content. The major technical revisions to this content are listed in this table.

Date	Revisions
April 17, 2007	Updated the Known issues section to include information about a Stop error that you may receive after you install this security update. Added this table.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top