Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it’s possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

(more…)

Various Citrix knowledge base articles refer to a tool called TraceView.exe to view the output of diagnostic traces.

CTX106233 describes where to download traceview but this article is outdated because it describes an older version of the DDK (the Windows Driver Development).

The current DDK version (7.1.0) can be downloaded here and has the filename “GRMWDK_EN_7600_1.ISO”.

(more…)

I logged remotely to a server with RDP and I noticed that  I had options to restart or shutdown that server. This means we can shutdown or restart a server without physical access and without authentication:

(more…)

Environment
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

Problem
When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

(more…)

I needed to change the drive letter assigned to the cd/dvd station from an Automation Manager project.

Although most systems only have one cd/dvd drive, some machines might be equipped with multiple drives.

A couple of years ago I wrote a tool called ChDrvLetter that can assign a specific drive letter to a partition given it’s volumename. In that tool I also included an option for CD/DVD drives.

Using the CDROM [Letters] parameter you can assign specific letters to the CD/DVD drives.

(more…)

Just some quick code to get the OU Name of the computer we run the script on.

VBS:

PowerShell:

The Citrix Online Plugin has a number of settings that can be changed. This includes things as Window Size and Color Depth:

In my case I wanted to preset the Window size to Full Screen so using Process Monitor I checked where the Online Plugin writes this setting. I Used a Filter that includes only the Online Plugin (PNAMain.exe) and the RegSetValue Operation:

(more…)

Recently I published a Proof of Concept that showed it was possible to launch unauthorized processes with both AppSense Application Manager and RES Workspace Manager.

Although I didn’t test Microsoft Applocker I have no doubt at all that we couldn’t bypass it.

I have named my Proof of Concept the XLSploit because I am using Excel as a trampoline. I choose Excel because this is generally a trusted process and VBA offers access to the Windows API that is needed.

After publishing the XLSploit I have talked to both RES and AppSense and not that they both have a response to my Proof of Concept, I consider it safe to tell a little more about how it works.

If you are merely interested in stopping the XLSploit, please scroll down to the end of the article.

(more…)

A while ago my Windows 7 laptop suddenly refused to go into Hibernation. The strange thing was that the whole process of saving memory to the hibernate file seemed to work correctly. The screen would go black and there was lots of disk activity. Then after the disk activity finished the system would return to the logon screen.

A Google on this issue learned that the most likely cause was a driver preventing the system from going into hibernation. Using the cmdline “powercfg -DEVICEQUERY wake_armed” we can check if there are any devices that can wake the system. Another useful parameter is -ENERGY which generates an html report file.

But in my case this lead to nothing.

(more…)

UPDATE: See this new article by Helge Klein.

Recently Helge Klein wrote a blog titled How to Speed Up Your Windows 7 Boot Time by 20%. He does this by disabling the graphical animation that Windows 7 displays while booting.

After applying this tweak I noticed that a resume from hibernation (which I do far more often than a full boot) still showed the graphical animation (and wasn’t speed up).

So how to disable the animation while resuming?

(more…)