Fbreseal problesm with SP2.

[Mark K Vallevand]

I've been having problems with fbreseal in SP2. It works differently from
SP1. We've had no problems with SP1. We do things correctly, AFAIK.

Include System Cloning Tool. Reseal phase 0. Other advanced flags set as
we want them.
Boot thru FBA on HD.
Create CF with RAM REG EWF.
Boot CF. Configure and adjust OS. Install our applications. Commit EWF,
reboot, test. Repeat until golden.
Commit EWF. Fbreseal. Shutdown. Capture CF image.
Duplicate CF image.
Boot duplicated image at customer site or in factory during customer's
personal setup..
First boot takes a longer time because the SID change is occurring.
Fbreseal.exe self-deleted.
Commit EWF, reboot, perform the customer-unique setup.

Using SP2, when the first boot of a duplicated image is done, the
fbreseal.exe file is still present. The first boot takes a long time and
the SID change seems to occur. But, fbreseal didn't self-delete.
*** Did a SID change occur? ***
*** Why is fbreseal.exe still present? ***

If you commit EWF and run fbreseal again, it behaves correctly. The first
boot takes a long time and the SID change seems to occur and fbreseal.exe is
deleted.

I've been told that running fbreseal with EWF enabled isn't a good idea. If
so, how do you clone? It probably won't hurt the CF to disable EWF,
fbreseal, enable. But, that takes a couple of reboots. The
commitanddisable live feature causes a BSOD, so I'm not considering that
seriously yet. Sysinternals's NewSid is attractive, but broken. NewSid
doesn't update COM security information correctly.

I'm considering releasing CF with fbreseal run twice.

 

[Doug Hoeffel]

Mark:

*** Did a SID change occur? ***

Try running this before and after reaseal to see if the SID actually
changes:

WScript.Echo "User SID: " & GetUserSID

Function GetUserSID()
Dim sUserSID, oWshNetwork, oUserAccount
Set oWshNetwork = CreateObject("WScript.Network")
sUserSID = ""

On Error Resume Next
Set oUserAccount=GetObject( _
"winmgmts://" & oWshNetwork.UserDomain & "/root/cimv2") _
.Get("Win32_UserAccount.Domain='" & oWshNetwork.ComputerName & "'" _
& ",Name='" & oWshNetwork.UserName & "'")

GetUserSID = oUserAccount.SID
End Function

HTH... Doug

 

[Mark K Vallevand]

I'll try it.

I'm pretty sure that its changing the SID the first time. After the second
time, there are some security settings that are messed up in IIS and COM.

Anyone else see this problem?
Anyone using fbreseal and SP2?

 

[Mark K Vallevand]

OK. What kind of file is this? I put this in UserSID.vbs and there are no
errors when it runs, but the User SID is blank.

 

[Doug Hoeffel]

Mark:

vbs is correct. I've run this on my XP Pro and XPe boxes without issue.
What WMI components do you have in your image?

.... Doug

 

[KM]

Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList] and see if the SIDs have changed.

 

[Mark K Vallevand]

Actually, I tried it on my WinXP Pro SP1 machine. Do I need to install WMI
on XP Pro? I have it (I think) on XPe. I'll try it there, too.

 

[Mark K Vallevand]

Well, that should be easy! I'm just about to test again...

--
Regards.
Mark K Vallevand

Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\ProfileList] and see if the SIDs have changed.

 

[Doug Hoeffel]

Mark:

Not sure what the deal is as I've not had problems with it.

Just go with KM's solution of looking in the registry if all else fails ;-)

.... Doug

 

[Mark K Vallevand]

I couldn't see any changes in that key after fbreseal. I should have
exported the registry key and compared in detail. But, it appears that no
changes occured.

Microsoft? Anyone?
Does fbreseal work in SP2?

--
Regards.
Mark K Vallevand

Well, that should be easy! I'm just about to test again...

--
Regards.
Mark K Vallevand

Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\ProfileList] and see if the SIDs have changed. are

no

 

[Doug Hoeffel]

Mark:

FWIW... I also see a blank sid using my vbs app. when I log onto my box with
a domain account. I do see a sid when I log on with a local account. This
was with XP Pro SP2. Also, WMI is built in with a standard install of XP
Pro, ie. you don;t have to load extra options to get WMI.

HTH... Doug

I couldn't see any changes in that key after fbreseal. I should have
exported the registry key and compared in detail. But, it appears that no
changes occured.

Microsoft? Anyone?
Does fbreseal work in SP2?

--
Regards.
Mark K Vallevand

Well, that should be easy! I'm just about to test again...

--
Regards.
Mark K Vallevand

Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\ProfileList] and see if the SIDs have changed.

--
Regards,
KM, BSquare Corp.


OK. What kind of file is this? I put this in UserSID.vbs and there

are

no
errors when it runs, but the User SID is blank.

--
Regards.
Mark K Vallevand
I'll try it.

I'm pretty sure that its changing the SID the first time. After the
second
time, there are some security settings that are messed up in IIS

and
COM.

Anyone else see this problem?
Anyone using fbreseal and SP2?

--
Regards.
Mark K Vallevand
Mark:

*** Did a SID change occur? ***

Try running this before and after reaseal to see if the SID actually
changes:

WScript.Echo "User SID: " & GetUserSID

Function GetUserSID()
Dim sUserSID, oWshNetwork, oUserAccount
Set oWshNetwork = CreateObject("WScript.Network")
sUserSID = ""

On Error Resume Next
Set oUserAccount=GetObject( _
"winmgmts://" & oWshNetwork.UserDomain & "/root/cimv2") _
.Get("Win32_UserAccount.Domain='" & oWshNetwork.ComputerName

&
"'" _

& ",Name='" & oWshNetwork.UserName & "'")

GetUserSID = oUserAccount.SID
End Function

HTH... Doug
I've been having problems with fbreseal in SP2. It works differently
from
SP1. We've had no problems with SP1. We do things correctly, AFAIK.

Include System Cloning Tool. Reseal phase 0. Other advanced flags
set
as
we want them.
Boot thru FBA on HD.
Create CF with RAM REG EWF.
Boot CF. Configure and adjust OS. Install our applications. Commit
EWF,
reboot, test. Repeat until golden.
Commit EWF. Fbreseal. Shutdown. Capture CF image.
Duplicate CF image.
Boot duplicated image at customer site or in factory during customer's
personal setup..
First boot takes a longer time because the SID change is occurring.
Fbreseal.exe self-deleted.
Commit EWF, reboot, perform the customer-unique setup.

Using SP2, when the first boot of a duplicated image is done, the
fbreseal.exe file is still present. The first boot takes a

long
time

and
the SID change seems to occur. But, fbreseal didn't self-delete.
*** Did a SID change occur? ***
*** Why is fbreseal.exe still present? ***

If you commit EWF and run fbreseal again, it behaves

correctly.
The

first
boot takes a long time and the SID change seems to occur and
fbreseal.exe
is
deleted.

I've been told that running fbreseal with EWF enabled isn't a good
idea.
If
so, how do you clone? It probably won't hurt the CF to

disable
EWF,

fbreseal, enable. But, that takes a couple of reboots. The
commitanddisable live feature causes a BSOD, so I'm not considering
that
seriously yet. Sysinternals's NewSid is attractive, but broken.
NewSid
doesn't update COM security information correctly.

I'm considering releasing CF with fbreseal run twice.

 

[Mark K Vallevand]

Yep. Using domains on my workstation. Login local (XP or XPe) works as
advertised.

I'm still wondering if fbreseal really works in SP2.
If someone at Microsoft has an answer...

--
Regards.
Mark K Vallevand

Mark:

FWIW... I also see a blank sid using my vbs app. when I log onto my box with
a domain account. I do see a sid when I log on with a local account. This
was with XP Pro SP2. Also, WMI is built in with a standard install of XP
Pro, ie. you don;t have to load extra options to get WMI.

HTH... Doug

I couldn't see any changes in that key after fbreseal. I should have
exported the registry key and compared in detail. But, it appears that no
changes occured.

Microsoft? Anyone?
Does fbreseal work in SP2?

--
Regards.
Mark K Vallevand

Well, that should be easy! I'm just about to test again...

--
Regards.
Mark K Vallevand
Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList] and see if the SIDs have changed.

--
Regards,
KM, BSquare Corp.


OK. What kind of file is this? I put this in UserSID.vbs and

there
are

no
errors when it runs, but the User SID is blank.

--
Regards.
Mark K Vallevand
I'll try it.

I'm pretty sure that its changing the SID the first time. After the
second
time, there are some security settings that are messed up in IIS and
COM.

Anyone else see this problem?
Anyone using fbreseal and SP2?

--
Regards.
Mark K Vallevand
Mark:

*** Did a SID change occur? ***

Try running this before and after reaseal to see if the SID actually
changes:

WScript.Echo "User SID: " & GetUserSID

Function GetUserSID()
Dim sUserSID, oWshNetwork, oUserAccount
Set oWshNetwork = CreateObject("WScript.Network")
sUserSID = ""

On Error Resume Next
Set oUserAccount=GetObject( _
"winmgmts://" & oWshNetwork.UserDomain & "/root/cimv2") _
.Get("Win32_UserAccount.Domain='" &

oWshNetwork.ComputerName

& done,
the a
good

 

[Mark K Vallevand]

Still no idea if fbreseal really works with SP2.

--
Regards.
Mark K Vallevand

Yep. Using domains on my workstation. Login local (XP or XPe) works as
advertised.

I'm still wondering if fbreseal really works in SP2.
If someone at Microsoft has an answer...

--
Regards.
Mark K Vallevand

Mark:

FWIW... I also see a blank sid using my vbs app. when I log onto my box with
a domain account. I do see a sid when I log on with a local account. This
was with XP Pro SP2. Also, WMI is built in with a standard install of XP
Pro, ie. you don;t have to load extra options to get WMI.

HTH... Doug

that

no

changes occured.

Microsoft? Anyone?
Does fbreseal work in SP2?

--
Regards.
Mark K Vallevand
Well, that should be easy! I'm just about to test again...

--
Regards.
Mark K Vallevand
Mark,

How about just checking the registry?
Look under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList] and see if the SIDs have changed.

--
Regards,
KM, BSquare Corp.


OK. What kind of file is this? I put this in UserSID.vbs and there
are
no
errors when it runs, but the User SID is blank.

--
Regards.
Mark K Vallevand
I'll try it.

I'm pretty sure that its changing the SID the first time.

After
the

second
time, there are some security settings that are messed up in

IIS
and

COM.

Anyone else see this problem?
Anyone using fbreseal and SP2?

--
Regards.
Mark K Vallevand
Mark:

*** Did a SID change occur? ***

Try running this before and after reaseal to see if the SID
actually
changes:

WScript.Echo "User SID: " & GetUserSID

Function GetUserSID()
Dim sUserSID, oWshNetwork, oUserAccount
Set oWshNetwork = CreateObject("WScript.Network")
sUserSID = ""

On Error Resume Next
Set oUserAccount=GetObject( _
"winmgmts://" & oWshNetwork.UserDomain & "/root/cimv2") _
.Get("Win32_UserAccount.Domain='" &

oWshNetwork.ComputerName

&
"'" _
& ",Name='" & oWshNetwork.UserName & "'")

GetUserSID = oUserAccount.SID
End Function

HTH... Doug
I've been having problems with fbreseal in SP2. It works
differently
from
SP1. We've had no problems with SP1. We do things correctly,
AFAIK.

Include System Cloning Tool. Reseal phase 0. Other advanced
flags
set
as
we want them.
Boot thru FBA on HD.
Create CF with RAM REG EWF.
Boot CF. Configure and adjust OS. Install our applications.
Commit
EWF,
reboot, test. Repeat until golden.
Commit EWF. Fbreseal. Shutdown. Capture CF image.
Duplicate CF image.
Boot duplicated image at customer site or in factory during
customer's
personal setup..
First boot takes a longer time because the SID change is
occurring.
Fbreseal.exe self-deleted.
Commit EWF, reboot, perform the customer-unique setup.

Using SP2, when the first boot of a duplicated image is done,
the
fbreseal.exe file is still present. The first boot takes

a
long

time
and
the SID change seems to occur. But, fbreseal didn't
self-delete.
*** Did a SID change occur? ***
*** Why is fbreseal.exe still present? ***

If you commit EWF and run fbreseal again, it behaves correctly.
The
first
boot takes a long time and the SID change seems to occur and
fbreseal.exe
is
deleted.

I've been told that running fbreseal with EWF enabled

isn't

a