I'm going to start posting updates on Twitter documenting the development on RD Tabs 3.1.  I'll probably continue this for newer versions as well.  If you want to follow along and see the exciting new features as they come, follow me at @AvianWaves.  I'll be using the hashtag #RDTabsDev.

I was experimenting with RDS Shadowing, which is something I've rarely used up until this point, and noticed it just doesn't work on my Windows 10 boxes.  It's a super cool feature, where admins can peak in on desktop sessions and provide remote assistance, just like you could with a third party screen sharing app, but all within the well established Remote Desktop Protocol.  I want to add this to RD Tabs for help desk users so they can remotely assist in addition to remotely manage.

I did some searching and saw that the Meltdown/Spectre OS patch from January seems to have broken shadowing.  A later cumulative update fixed it, but then the cumulative updates after that one don't contain the fix.  It's kind of a mess.  It may be more complicated than that.  Now, I can't say for sure, I don't have good logs, but I'm pretty sure I applied all the cumulatives in order each month and yet I'm still exhibiting this issue in my test lab and live systems I manage.

I was going to add shadowing support to RD Tabs 3.1, the next major release, but now I think I'm going to hold off on that for a little while until the dust settles.  I can't even get it to work with mstsc.exe with Windows 10 (oddly, my Server 2016 boxes with basically the same patches work fine), so it would make debugging adding the feature very difficult.

Bugs happen, but this response seems like a strange mess right now.  I'll have to see if I am able to open a support case with MS to get to the bottom of it.

For those interested, basically what happens is when you try to shadow a session, you get an error that just say Shadow Error / Unspecified error.  Great error!

Here's a thread talking about it: https://community.spiceworks.com/topic/1295608-windows-2012r2-rds-shadowing-unspecified-error

There are some who apparently no longer have the issue if they installed the (now old) cumulative update.  I am guessing I must have some how missed it, but I don't see how, it was a normal cumulative that would have gone through my normal patch process.  *shrug*  I do know I'm not alone, I see there are others that still have the issue.  And it seems with build 1709, it may never have been even patched (I'm seeing conflicting messages).

Well, anyway, if anybody was looking forward to this RD Tabs feature, you'll have to wait a little longer.  Hopefully Microsoft will get this all fixed soon.

I fixed several bugs discovered after the general release of RD Tabs 3.0.7.  The update is avialable now right here.  More information is available in the forums.

Here's one that's at the intersection of my fields: tech and music.

I bought a new virtual instrument (Wave Alchemy's Evolution) that happens to use Native Instruments Kontakt as the platform.  For those not familiar with electronic music production, Kontakt is a synth platform that runs on your computer that other people can create instruments with.  It's also a fine sampler.  Native Instruments (the company that makes it) makes buckets of money with this stuff.  But I digress!

So I bought this new instrument and it just was NOT showing up in the library section of Kontakt.  However, if I ran Kontakt as an admin, it did show up.  Well, unfortunately, in the music business it's not uncommon for users to run as admin all the time because the developers and users of these products sometimes have a poor understanding of the Windows security model being this is a Mac-first industry.  And musicians, god love them, just want stuff to work, they aren't going to troubleshoot it.  So admin all the time it is.

But not me.  I can't go against the very core of my nature with regard to IT security!  It just feels *wrong*.

So I fired up ProcMon.exe to see what's going on.  I mean it has to be a permissions thing right?  

Well this one was easy.  After filtering on the Kontakt exeutable and searching for "access denied" I found an interesting file.  The file "C:\Program Files\Common Files\Native Instruments\Service Center\NativeAccess.xml" was showing as "access denied."  I tried to open the file and was denied.  So I looked at the properties and saw it had exclusive (non-inheriting) permissions that only allowed SYSTEM and Administrator access.  No other file in the folder did that, so I'm going to assume this is a mistake/bug/whatever.  And previous instruments I bought always installed okay, so maybe this only happened after an NI update?  Not sure.

The file looks like it's just a master record of everything installed from Native Instruments, so that would make sense that if a normal user couldn't see that, they couldn't see newly installed instruments (presumably the other instruments' installation are cached in the per-user data somewhere).

So, I reset permissions on that file, allowing inheritance, and now it works.

Easy.

The 3.0.7 release is now available on Chocolatey, but it hasn't finished going through all the automated tests and moderation.  You can still install it (and it appears a few dozen of you already have), but the installer may have issus. 

I also submitted the new installer to CNet Download.com and TUCOWs.  Surprisingly, people still use both of those.  RD Tabs still gets hundreds of downloads per week from Download.com.  I'm trying to get them to merge the 32-bit and 64-bit listings as well since RD Tabs has a unified installer now.  My previous submission to TUCOWs was never approved.  That attempt looked like it was going to have a comically long waiting period to process, but it did end up taking only a year.  This time they claim it will be processed in 57 days.  We will see.

I'm looking into submitting RD Tabs to Windows Store.  To do that I'll need to do some work getting Desktop Bridge / Project Centennial stuff set up.  I'm not sure how heavy of a lift that is. 

Keep in mind, if you are rely on any third party site for RD Tabs updates, you will be lagging behind the latest version.  But you will possibly have peace of mind that the app is more deeply vetted.  The fastest updates will always come from this website.

---

SO HEY RD TABS FANS.  Can you spread the word?  Get people hooked?  I'm trying to make this something worthwhile for myelf to dedicate more time to and that means increasing the user base so I can eventually make some money on premium subscriptions.  Everybody benefits from this.  You get sweet new enterprise features.  I get motivation to turn this into something more than a hobby and just doing tweaks for myself in the ways I use it for my day job.  There's not a lot of apps in this space for Windows Admin types and the better ones are pretty expensive.  I think RD Tabs's premium features can compete pretty nicely and at a very reasonable price point since I don't have a huge amount of overhead.

So what I'm saying is, get active on social media.  Follow @AvianWaves (upper-right corner of this page) and like, share, and retweet my posts.  Tell colleagues about this app.  If you are an influencer, maybe this thing can break out of it's little niche and get some legs.

What else is in it for you?  Well...... Anybody that verifiably spreads the word on social media and anybody who has donated to Avian Waves at any time in the past will be eligible for free subscription to premium features when that arrives later this year.  More details on that to come!

---

Last thing, 3.0.8 will be ready in a few days.  Yea, things are moving quick.  The general release led to some new good bug reports.  So keep posting in the forums and submitting error reports if the app crashes, it's helping!

RD Tabs 3.0 reaches RTM! The beta is over, thanks for everybody who tested. The update is available right now right here. Users with any beta build of RD Tabs (3.0.0 through 3.0.6) will receive the 3.0.7 automatic update notification first, within the next 12-24 hours. In 24-48 hours, users on any older version of RD Tabs will receive the update notification. Thank you for your patience and enjoy!

More information in the forums here.

Tonight I updated to a new blog module for the website.  The old one was so very slow and the author isn't really supporting it anymore, so I bit the bullet and bought a new one.  This one seems pretty great and it's a lot more powerful and fast.  I might make enhancements in the future, but the goal was just to get all the articles imported and for the look and feel to be basically the same.  Use the contact form to notify me of any bugs.  And hopefully the RSS feeds (if anybody still uses that) still work.

This has taken way too long, but RD Tabs is BACK.  The 3.0.0 to 3.0.6 change log is in the forum post.  Leave feedback here or in the forums.

DOWNLOAD RD TABS 3.0.6 HERE

I've been using the alpha versions for some time and they are quite stable now, so I can recommend the beta version for general use.  There are likely plenty of minor bugs left to tweak, so please report them as you find them.

And now I need to get some sleep.

Normally this isn't much of an issue, but for some outgoing connections you want to use a specific IP address on your server that has many IP addresses set.  An example might be if you have a VPN set up to a remote location and you want to whitelist one IP address, not every single IP address on that server.  Windows does not use the first IP address you set in the Network Properties.  It instead chooses from that and all alternative IP addresses and guesses what the best one might be to use.  This is sometimes not the one you want to use.  And if you added an IP address in the future, who's to say it will stay the same and not choose a different one?  Then the above firewall rule would become broken.

Well, luckily, PowerShell to the rescue.  There is a property on all IP addresses called "Skip As Source" which is not exposed through the GUI.  What it does is allow you exclude an IP address from consideration as the primary / outgoing IP address.  You can use Set-NetIPAddress to assign this manually, but we can do better.  Using a couple lines of PowerShell, you can create a ps1 script and then run it via a Scheduled Task, say, hourly, so that if at any time in the future you add a new IP address, the primary IP will consistently be correct, at least within an hour.

The script looks like this.  Assuming the IP address you want to be primary is 192.168.33.129.

$primaryIP = "192.168.33.129"
Set-NetIPAddress -IPAddress $primaryIP -SkipAsSource $false
Get-NetAdapter | Get-NetIPAddress | ? { $_.IPAddress -ne $primaryIP } | % {
    Set-NetIPAddress -IPAddress $_.IPAddress -SkipAsSource $true
}

Now all IP addresses, except the one you are designating as "primary," will be excluded from consideration as primary.  We can verify this using...

Get-NetAdapter | Get-NetIPAddress | Select-Object IPAddress,SkipAsSource

Now if you save that segment to a PS1 file, then schedule it to run hourly using the SYSTEM account, your primary IP address is now automated.

Today Microsoft released a PowerShell script that can be run on any Windows system to detect if the system is vulnerably to Meltdown and Spectre.  If you haven't heard about it yet, go here: https://support.microsoft.com/en-us/help/4073119.

Building on this, I created a PowerShell script (download below) that will find every Windows computer in your domain and run the Microsoft script and return the results.  This allows you to see the status of the patch deployment for your entire domain run from a single PC.

Prerequisites:

• PowerShell 5 - This will basically work out of the box for Windows Server 2016 and Windows 10.  This may be a problem for some organizations that have not deployed PowerShell 5 yet for older operating systems.  The good news is that PowerShell 5 is available for Windows Server as old as 2008 R2 and Windows 7.  The script makes use of Install-PackageProvider and Install-Module which reach out to NuGet to retrieve the latest bits of the package Microsoft deployed.  There may be workarounds, hopefully if so somebody can build upon what I have here.
•  
• PowerShell Remoting - You must have set up PowerShell remoting so that Invoke-Command can run against other systems from wherever you execute this from.  It's not hard, but depending on your organization's security requirements, this might also be a blocking issue.
•  
• Run as a domain administrator or other account which has administrator access on all target computers.

How to use:

Just download it and run it (link is at the bottom of this post).  It's really that simple.  For systems that don't meet the prerequisites, you will see an entry in the output status showing "Error."  You can then go back to that machine and try running portions of the script manually if you want to troubleshoot, but at least in my environment, the most common issue is just not having PowerShell 5 installed.  If you want to export it to a CSV, which can then be opened in Excel, add the command line switch -csv followed by the path, like below.

• .\Get-SpeculationControlSettingsOnAllComputersInDomain.ps1 -CSV C:\Users\YourName\Desktop\SpeculationControlOutput.csv

Examining the output:

The first two columns are the computer name and the script execution status.  The script execution status can be OK, Error, or Offline.  I think this is pretty self explanatory.  It either worked, didn't, or the computer wasn't online so the script couldn't be run.

The next columns are as follows (note: they are abbreviated since there are so many and it needs to fit on the screen).

• BTIHWPr - BTIHardwarePresent - Hardware support for branch target injection mitigation is present.
• BTIWinPr - BTIWindowsSupportPresent - Windows OS support for branch target injection mitigation is present.
• BTIWinEn - BTIWindowsSupportEnabled - Windows OS support for branch target injection mitigation is enabled.
• BTIDisSP - BTIDisabledBySystemPolicy - Windows OS support for branch target injection mitigation is disabled by system policy.
• BTINoHWSup - BTIDisabledByNoHardwareSupport - Windows OS support for branch target injection mitigation is disabled by absence of hardware support.
• KVAShdwRq - KVAShadowRequired - Hardware requires kernel VA shadowing.
• KVIWinPr - KVAShadowWindowsSupportPresent - Windows OS support for kernel VA shadow is present.
• KVIWinEn - KVAShadowWindowsSupportEnabled - Windows OS support for kernel VA shadow is enabled.
• KVIPcidEn - KVAShadowPcidEnabled - Windows OS support for PCID performance optimization is enabled.  (Not required for security.)

According to the guidance the main things you want to look for is to have the following columns all show TRUE: BTIHWPr, BTIWinPr, BTIWinEn, KVAShdwRq, KVIWinPr, KVIWinEn.

This script is public domain.  Also, ABSOLUTELY NO WARRANTY.  I do not guarantee at all that the script works correctly in your scenario and I am not responsible for damage!

Here's example output of what it looks like when it's running.  I obfuscated my system names, but you can see how I have systems that are not yet patched below.  The patches are deploying tonight.  :-)  You will also notice that quite a few don't have PowerShell 5 installed.

Computer          Status  BTIHWPr BTIWinPr BTIWinEn BTIDisSP BTINoHWSup KVAShdwRq KVIWinPr KVIWinEn KVIPcidEn
--------          ------  ------- -------- -------- -------- ---------- --------- -------- -------- ---------
SRVDC1.nc.us.d... Error
SRVCA1.nc.us.d... Error
SRVSCOM1.nc.us... Error
SRVMAIL1.nc.us... OK      False   False    False    False    False      True      False    False    False
SRVCCS1.nc.us.... Error
SRVTFS2.nc.us.... Error
SRVWeb2.nc.us.... Error
SRVSQL3.nc.us.... Error
SRVMail2.nc.us... Offline
SRVSQL4.nc.us.... Error
SRVWEB1.nc.us.... Error
SRVWEB3.nc.us.... Error
SRVTFSBUILD2.n... OK      False   False    False    False    False      True      False    False    False
SRVTFSBUILD1.n... OK      False   False    False    False    False      True      False    False    False
SRVTFSBUILD3.n... OK      False   False    False    False    False      True      False    False    False
DESKTOP138.nc.... Offline
SRVWEB1A.nc.us... Error
SRVCACHE1.nc.u... Error
SRVCACHE2.nc.u... Error
DESKTOP923.nc.... Offline
DESKTOP251.nc.... OK      False   False    False    False    False      True      False    False    False
SRVDC2.nc.us.d... OK      False   False    False    False    False      True      False    False    False

Click here to download the script.