Operating System Myths—v.1

[GreNME]

GreNME: I have tried to get the same "no frills" logon effect by turning off fast user switching... It gives you the classic logon, but its still skinned... I suppose I could use tweakUI and copy my theme settings to the logon and get rid of it, but i've just been disabling it for so long and have never had a problem in doing so, its a lot like a habit now. Could you tell me a possible problem that may arise by disabling themes? Remember I never actually use any other themes or theming utilities... If there is something horrible that may occur, I may re-enable it.

Well, luckily, with the theme service, you're not going to run into many dependancy issues. However, if you decide to change something later (using a different theme) and want to implement it, you will run into problems if you forget to turn it back on. I know it sounds silly, but if I had a nickel for each time someone's forgotten settings were the source of a conflict...

As for the logon, I'm not sure I get what you mean by "it's still skinned." You mean the border and the "X" button? Are you positive that you have classic chosen instead of a theme? I mean, even on my themed XP laptop with fast user switching turned off, I can get a classic logon...

Wait, I think I gave you the directions backwards. <--- embarrassed

Start >> Control Panel >> User Accounts

select "Change the way users log on and off"
uncheck "Use the Welcome Screen"

The effect of that is that fast user switching is turned off, which is what I had backwards. That is how to get the classic logon. As far as I know, if your 'theme' is set to classic (meaning no theme in reality), the whole logon process is just as classic as the rest of the UI. Let me know if that helps.

Oh, and kleptophobiac: yeah, you pretty much have it set up like I figured it had to. Even the thin client version I'm playing with uses ~16MB on average. I knew you had to be using a stripped-down kernel with some highly tweaked settings. Now, how many complete newbies to Linux are going to do that as their first foray into Linux? Was it yours? I highly doubt it (kudos if so), and it sure as hell wasn't mine. Instead, it began from the CLI up (though I remember far less than I should) for me, and even the GUI experience I've had leaves me preferring the all-inclusiveness of KDE instead of the more no-frills lighter WMs. Still, as a rule of thumb, it should be noted that your lappie install is far less able to handle changes with configuration, PnP, and hardware than a vanilla kernel is. Will a current vanilla Linux kernel run on a 486? Absolutely. It won't work very well under 64MB of memory, though, and you can forget about XFree unless you do some major stripping-down (which you have). On the other side of that coin, the same stripping-down can be done by using something other than Explorer in Windows, so the trade-off is applicable on both platforms, if you know what I mean.

Perhaps I should add in the list that it is a myth unless followed by a few very important caveats?

 

[HHunt]

I've used FreeBSD+iceWM on a 486 with 20mb ram. It's bordering on unusable, granted, but it was ok for launching xterms

Oh, and even without the welcome screen, I get themed dialog boxes on login/logout with the theme service running. IIRC.
(I'll try and come back to you)
edit: Yep. With the theme service running, no welcome screen, and classic selected as theme for all accounts, I get a bubbly blue login box.
Disable themes, and I get a square, though still baby-blue, login box.

(Ok, only the titlebar is blue.)

 

[GreNME]

MSKB article

So, what you're saying is that the title bar is blue and the "X" is the bright red one, yes?

 

[HHunt]

MSKB article

So, what you're saying is that the title bar is blue and the "X" is the bright red one, yes?

Yep. It's the classic Login-box, but with a Luna look.

 

[Spleeze]

Yeah thats what I was saying... I assume I could use TweakUI to copy my preferences to the logon screen, but by default, none of your preferences are applied untill you log in... like themes etc... so the themes will crank on and then crank off... Which is why i've been disabling it altogether...

edit.. I think using tweakUI to change the logon settings is a much better choice then having people muck about in thier registry...

 

[GreNME]

Yeah thats what I was saying... I assume I could use TweakUI to copy my preferences to the logon screen, but by default, none of your preferences are applied untill you log in... like themes etc... so the themes will crank on and then crank off... Which is why i've been disabling it altogether...

edit.. I think using tweakUI to change the logon settings is a much better choice then having people muck about in thier registry...

You guys could be right here. Let me know your results if you try to do it using TweakUI, since that will be helpful for lots of people later if the question arises. Good thinking with using TweakUI, though. Kudos!

 

[HHunt]

Indeed. It just feels like some sort of waste to start up, load the luna theme, log in, and drop it again.
(Especially if you don't use any themes when logged in.)

(edit: This post makes more sense if seen if seen as a reply to Spleeze's post.)

 

[Spleeze]

I just tried to copy settings to the logon with tweakUI and it didnt work me for, even after a restart... Luna still loads at the logon prompt..

 

[GreNME]

Well, you've given me something to look into. I guarantee I'll be bugging some people about the "why"s of it ASAP.

 

[Phoenix86]

Services...

Stability > Speed

Even mad OCers will tell you this. No matter how high you up your voltages, if it ain't stable, it's ain't a good OC.

Stability rules the roost, lets apply that logic to service tweaks and do a quick and dirty cost/benefit analysis.

Benefit: Disableing services saves some RAM and possibly a hair of boot times (faster boot times are, in general, not a good tweak, you just don't boot that often).
Cost: Can introduce instability if the service becomes required. This may not be obvious if it's a dependant service that's disabled leading to increased troubleshooting times.

So I save a little bit of RAM at the cost of stability, at best this is a risky tweak. At worse, it's a troubleshooting nightmare (imagine I hand you a box to fix, and no one knows it's been tweaked, much less how).

If you know EVERYTHING about the service, and how it's used, some may be set to manual fairly safely. However, you had better know what your changing and remember come troubleshooting time.

As far as security, the services I consider 'safer' to disable have nothing to do with security. In fact, like SJConsultant said, if they can use these services to 'exploit' the machine, it's already been compromised at another level.

edit:

Secondary logon service...I don't want anybody else logging on to my machine...disabled.

Sigged.

 

[GeForceX]

I do know that disabling/manualing 3rd party services (diskeeper, ati smart, etc) would affect directly them. But I do recommend setting most services to manual (if it is at automatic and you know they aren't needed).

Here's what I put manually and/or disabled (for windows xp sp2). And I seriously doubt they will cause stability problems because they will not be used (and b/c it is set at manual, it will be ran when requested-- stability problems? ehhhhh not sure on that).

Indexing Service - Disabled - Have not seen ANY problems as of yet and I have already unchecked "use indexing on drive" options on the main drive so it makes this pointless.

Print Spooler - Disabled - I will not ever use a printer on this computer. It's for gaming, not printing stuff. Will it ever cause problems? UNLIKELY because i will never hook up a printer to it. Besides it was set at automatic default and i dont see the reason why. (If it's auto-- it will take up memory).

Themes - Disabled - No need. I will post a picture of my desktop -- looks sweet

ATI Smart - Disabled - No need. Takes up 3 MB.

ATI Hotkey Poller - Disabled - No problems after disabling. Takes up 3 MB.

Diskeeper - Manual - It will have an error when you try to run the program if it is set to disabled.

Help and Support - Manual - I never use this so it will be set to manual for the sake of memory.

NetMeeting Remote Desktop Sharing - Manual - I uninstalled NetMeeting anyway. And I never will add a camera to use NetMeeting nor do I intend on using it for any purpose on a *gaming PC*.

Smart Card - Manual - Well, I don't use it. Why else?

Wireless Zero Configuration - Manual - It was set to automatic but I switched it to manual. There may or may not be a stability problem with this if it was set to disabled. And I don't use any wireless connection in any way or form in this house.

SP2 actually made it much easier to do the services. This "tweak" is very minimal. And I have gone through reboots without problems (because originally it did when I "over-tweaked" a bit.

-J.

 

[Phoenix86]

FYI - Setting to manual *may* not be a workaround to disableing the service.

Ranma_Sao said he found a problem where a manual service was set, and it still generated errors for the application calling the service. I believe he thought it was a timing issue, the service wasn't starting fast enough. Honestly I think that's the apps fault, not waiting long enough, but that's neither here, nor there, since it was a problem.

I have never seen this issue, and it may work for 99.5% of the scenarios, so YMMV.

 

[Josh_B]

You can turn off fast user switching and get the same result with less potential for problems later (if you ever change your mind and forget about the disabled service).

Are we seeing a trend here? Lots of those things that get disabled can either be turned off or left alone with the same amount of security and performance and a better chance of later stability. Sure, people have the right to disable whatever they want, but when the issue is security or performance, disabling services hasn't a leg to stand on.

Which is why it's a myth.

Spleeze, Litestep isn't so bad, either. Still, you have a good point: Linux doesn't have the corner market on lightweight window managers.

Wrong.

Disabling unnecessary services is a vital step in hardening any OS. By disabling services, you decrease the number of POTENTIAL vulnerabilities you could be exposed to.

Even if you run as admin, but you have remote reg. service disabled, you're still safer than leaving it enabled. If someone has found an exploit for the remote registry server, then they don't have to have a password necessarily to gain (potientially) admin access to your machine.

This is a basic concept of security. Don't need it? Don't run it.

 

[GreNME]

Wrong.

Disabling unnecessary services is a vital step in hardening any OS. By disabling services, you decrease the number of POTENTIAL vulnerabilities you could be exposed to.

Even if you run as admin, but you have remote reg. service disabled, you're still safer than leaving it enabled. If someone has found an exploit for the remote registry server, then they don't have to have a password necessarily to gain (potientially) admin access to your machine.

This is a basic concept of security. Don't need it? Don't run it.

No, you're wrong. You are wrong first in that thinking because the setting is on "automatic" that it is running. It is not. You are wrong second because you seem to think you are hardening something that there is no way to access unless the OS is already compromised.

Care to name any exploits that actually use an open service instead of exploiting something else? RPC—I dare you to turn that off. There is no service that allows exploitation, because all of them require authentication and proper privileges to begin with.

So, when the services aren't actually running unless you have a program using them, and when the services can't be accessed without authorization and privileges.

Want to see what services you are using at any given time? Fire up a cmd window and type tasklist /svc. It'll list running executables with every service tied to what is actually running (as opposed to what is not that people make stupid conjecture about).

Ignorance may be bliss, but not to those who know better when that ignorance is spread about like gospel.

 

[SJConsultant]

Wrong.

Disabling unnecessary services is a vital step in hardening any OS. By disabling services, you decrease the number of POTENTIAL vulnerabilities you could be exposed to.

Even if you run as admin, but you have remote reg. service disabled, you're still safer than leaving it enabled. If someone has found an exploit for the remote registry server, then they don't have to have a password necessarily to gain (potientially) admin access to your machine.

This is a basic concept of security. Don't need it? Don't run it.

If a service isn't needed, it shouldn't be installed in the first place like IIS, FTP, SMTP, etc.
However the next basic concept of security is only allowing necessary communications in the first place which can be accomplished thru the use of firewalls, TCP/IP filtering and IPsec rules.

What alot of people here are not considering is the basic concept of applying security lock-downs based on the systems use and where it will be placed on a network. Granted, if a system was placed in a DMZ or directly exposed I would perform more lock-downs than a system that sits behind a firewall that explicitly drops all unsolicited packets.

Some of the so called security "vulnerabilities" can be easily mitigated by using a hardware or software firewall. Functionality is still present when/if needed and your not sacrificing security by having it running.

 

[Ranma_Sao]

FYI - Setting to manual *may* not be a workaround to disableing the service.

Ranma_Sao said he found a problem where a manual service was set, and it still generated errors for the application calling the service. I believe he thought it was a timing issue, the service wasn't starting fast enough. Honestly I think that's the apps fault, not waiting long enough, but that's neither here, nor there, since it was a problem.

I have never seen this issue, and it may work for 99.5% of the scenarios, so YMMV.

I've seen two, one where the program had errors due to timing, and the other one, because it just made calls to the service and expected data back from the service, (Which it didn't get back since it didn't start the service, the dev's thought that since it was default automatic windows would start it for them) which caused their app to A/V.
/* Code Discussion
The made a block of memory and expected the service to fill it in, and never checked that the data would be null since it wasn't filled in. In their testing the service always responded and filled it in, but alas, if the service was manual or disabled, it wouldn't get filled in, they'd access the memory block and A/V (Core dump for you unix guys)
*/ End of Code Discussion

I've just been listening to this thread, since I've been very busy in the other world, (The physical one), and haven't had time to respond.

The Printer Spool Service is related to some other functionality, not just printing, since the graphic viewer depends on it, may not be important for a games box, but some game developer may depend on a function in that service, and may not start it, etc...

And as GreNME and I have tried to state in many different ways over the years on this channel, it is your box, you are free to do what you want with it, just make sure you don't cause yourself unintended pain.

 

[GreNME]

The Printer Spool Service is related to some other functionality, not just printing, since the graphic viewer depends on it, may not be important for a games box, but some game developer may depend on a function in that service, and may not start it, etc...

And as GreNME and I have tried to state in many different ways over the years on this channel, it is your box, you are free to do what you want with it, just make sure you don't cause yourself unintended pain.

Any of you Linux guys out there who experienced problems with dependency issues should know what we're talking about here (it's the same thing, basically). With the code discussion thing, that should be another familiar concept to anyone who has learned to tweak the *nix kernel—you have to know what you are enabling/disabling or memory problems abound.

These are just the major issues. There are others that can mostly just be annoying, like causing unnecessary lag or inter-process communication.

Tweaks don't cause instabilities and uncertainties like this. Disabling services is no tweak. And worst of all, the software itself gets blamed when the instabilities or inconsistencies occur because of doing these 'tweaks.'

 

[doh-nut]

heres a quick myth. winxp PRO runs your games at higher framerates than winxp HOME.

bzzt! so many gamers have winxp PRO and they dont use any of its features that it has over Home

 

[Met-AL]

yaa, what does pro give you over home except Remote Desktop, SMP CPU support, and MS IIS?

 

[oldpablo]

I second that one, I actually had some guy tell me the machines I was selling retail wouldn't game very well because they had Home on them instead of Pro. Said the "hardware wouldn't be fullly utilized". Maybe it had something to do with the fact he was thirteen, I don't know...

 

[GreNME]

I second that one, I actually had some guy tell me the machines I was selling retail wouldn't game very well because they had Home on them instead of Pro. Said the "hardware wouldn't be fullly utilized". Maybe it had something to do with the fact he was thirteen, I don't know...

Probably...

 

[BobSutan]

yaa, what does pro give you over home except Remote Desktop, SMP CPU support, and MS IIS?

It also includes some networking functions that are missing from Home. I'm told being part of a domain is one of them. I wouldn't know for sure though... I've never really played with Home besides the one time I burned a DVD on my dad's computer.

 

[GreNME]

It also includes some networking functions that are missing from Home. I'm told being part of a domain is one of them. I wouldn't know for sure though... I've never really played with Home besides the one time I burned a DVD on my dad's computer.

The ability to join a domain is indeed one of them. It is also relegated to simple file sharing (which, outside of a server/client environment, is not used to its fullest capacity to begin with).

 

[BillLeeLee]

Yes, joining a domain is part of Windows XP Pro, not home. My college made this very clear when they said all comps should not have XP Home installed. Though it makes no difference because I have no idea who actually joins the academic domain.

XP Pro also has more advanced security settings. I think in Home, you can only make administrative users and regular users. In Pro, you can have Power users, backup operators, etc. Then there's file encryption.

And apparenly, Sysprep is not available in Home edition. There's more stuff, but I think we've hit upon the major stuff.

 

[SJConsultant]

And apparenly, Sysprep is not available in Home edition. There's more stuff, but I think we've hit upon the major stuff.

Sysprep isn't a tool most people will be using, in fact its a tool designed and geared towards OEMs so they can preinstall the OS on multiple systems.

 

[Ranma_Sao]

Sysprep works on home, otherwise, how would the OEM's image home and install it on all their machines?

Global Policy, Remote Desktop, SMP (Note home supports hyperthreading for one physical CPU, two logical CPU's), EFS, Domain Join, More traditional Client Server networking, IIS, etc...

 

[GeForceX]

I remember reading a benchmarking review of Windows XP Professional vs Home to see if there is any differences in speed. Windows XP Pro came out to be 1-5% faster, mostly 2-3% on average. So, there.

-J.

 

[Met-AL]

I remember reading a benchmarking review of Windows XP Professional vs Home to see if there is any differences in speed. Windows XP Pro came out to be 1-5% faster, mostly 2-3% on average. So, there.

-J.

That is well within the margin for error. I really doubt that there in fact is any difference at all, since they are the same except for some features added to Pro.

 

[Phoenix86]

Sysprep isn't a tool most people will be using, in fact its a tool designed and geared towards OEMs so they can preinstall the OS on multiple systems.

Meh, I think they should. If people syspreped these images they make for their rigs, they wouldn't have to rebuild it when they get new hardware... So many people make ghost images, why not sysprep them? It only adds a few seconds to the initial boot to install the drivers.

I think BillLeeLee means sysprep isn't on the Home CD, and it may not. I'm not sure if they include that directory of tools, wouldn't surprise me... But sysprep will indeed run on Home.

 

[Yogi]

XP pro also has support for dynamic disks, something that can help us SCSI people get around the crippled SCSI peformance in XP.

 

[TrechMaggotface]

Great thread!

Just a thought in relation to the win98 for performance issue. As a subnote I've seen it suggested before that fat32 be used for performance vs. NTFS due to the overhead associated with the additional features of NTFS. While this may be true on small volume sizes, its not true at all in relation to the size of modern day volumes. You might or might not wanna toss that in there. Just a thought.

 

[BillLeeLee]

Elaborating on what TrechMaggotFace says...

The FAT32 file system gets really inefficient on partitions larger than 32 GB, and defragmentation starts getting rampant.

I always prefer NTFS these days for Windows partitions because it is much more robust of a file system, though you might suffer a slight performance impact. Anything over 32 GB though, definitely go NTFS - its performance will beat FAT32 on large partitions.

And NTFS has a much better feature set - disk quotas, compression, encryption, and generally better fault tolerance and more.

 

[Ranma_Sao]

XP pro also has support for dynamic disks, something that can help us SCSI people get around the crippled SCSI peformance in XP.

Another Myth. SCSI performance is the same, it's just XP fixed a bug with caching, that made all these tests appear faster, but they forgot to fix the issue with dynamic disks. The speed is still the same, it just gets reported different. StorageREview.com has a full writeup on the mistake they made, and why the benches appear faster.

 

[SJConsultant]

Meh, I think they should. If people syspreped these images they make for their rigs, they wouldn't have to rebuild it when they get new hardware... So many people make ghost images, why not sysprep them? It only adds a few seconds to the initial boot to install the drivers.

Yes it might help those relatively few people in migrating to new hardware.

However, just so people know, sysprepping a system still results in the user having to enter their respective keycode and activate the OS. In no way does it "bypass" activation.

 

[Phoenix86]

Everyone migrates hardware, it's only a matter of time. Sysprepping the image make it last through the inevitable, when it happens.

Why create an non-syspreped image unless your an OEM?

 

[SJConsultant]

Everyone migrates hardware, it's only a matter of time. Sysprepping the image make it last through the inevitable, when it happens.

Why create an non-syspreped image unless your an OEM?

It's users choice as to how he/she wishes to migrate to new hardware, it depends on circumstances at the time the migration occurs and if the user wishes to move their existing OS and Apps to new hardware or start fresh.

 

[Phoenix86]

It's users choice as to how he/she wishes to migrate to new hardware, it depends on circumstances at the time the migration occurs and if the user wishes to move their existing OS and Apps to new hardware or start fresh.

That's not how I mean it...

If you create an image, you can't guarantee it's going on the same hardware, it doesn't matter when you reimage.

If you reimage before a hardware upgrade, there is an extra step in reinstalling the drivers vs. a non-sysprepped image.

If you do it at the time you get new hardware, great, since you sysprepped the image, it's ready. If you didn't, you have to build a new image.

If you reimage sometime after the upgrade, great, you sysprepped the image. If you didn't, you have to build a new image.

There is just VERY little downside to sysprepping an image. If you create one you might as well sysprep it.

We are getting well OT now, but that's why it's v.1 right.

 

[SJConsultant]

There is just VERY little downside to sysprepping an image. If you create one you might as well sysprep it.

There are a few instances in which the use of sysprep is unsupported or will not function correctly. But we'll save that discussion for another thread in the near future.

 

[Phoenix86]

There are a few instances in which the use of sysprep is unsupported or will not function correctly. But we'll save that discussion for another thread in the near future.

Unsupported? Is that like voiding your warranty?

I have *never* called MS for support. At $250 a call, you learn quick to rely on other methods.

 

[Ranma_Sao]

In the case of sysprep, it means your machine will never boot again.

They also forgot one on that list, you can only sysprep from C:, you cannot sysprep from any other drive letter, if you do, it's very unsupported.

(I found one of the issues described in that list, didn't know the kb had that article however, I'll leave it to your imagination which one however. )