Alexander’s Blog

If you don’t see the Security tab on your Exchange organization’s Properties tab, obviously you won’t be able to modify the security.

Here’s how you can enable the Security tab by modifying the registry.

1. Start the registry editor (regedit.exe).
2. Locate the following subkey: HKEY_CURRENT_USER\Software\Microsoft\Exchange\EXAdmin.
3. From the Edit menu, select New, and then select DWORD value.
4. Type ShowSecurityPage and press Enter.
5. Double-click the entry you just created and set the value to 1.

Close the registry editor. You should now have the Security tab in the Properties of your Exchange organization.

If you want to quickly empty your recycle bin, instead of minimizing the desktop and going to the Recycle Bin you can simply right click any file on your computer and select Empty Recycle Bin. Here’s how.

Save the following entries in a text editor as a .REG file (e.g. emptybin.reg). Logon with an account that has administrative privileges. Double-click the .reg file to modify the registry. You will be prompted to add the information to the registry. You should see the Empty Recycle Bin added to the context menu for all files.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\Empty Recycle Bin]
@=”{645FF040-5081-101B-9F08-00AA002F954E}”

I’ve tested this successfully on Windows XP Professional computers. If you can’t get it to work, feel free to contact me.

Update: May 23, 2007: I tested the .reg file successfully on 32-bit Windows Vista.

Here’s the procedure for configuring remote access client accounts for lockout. Keep in mind that the account lockout for remote access accounts is managed differently than the Active Directory user account lockouts. If you are using Windows authentication on your RAS server then edit the registry on that server, if you are using RADIUS authentication then you need to configure the registry on the RADIUS (IAS) server. Here’s the step-by-step procedure.

1. Run regedt32.exe
2. Go to HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout. By default the MaxDenials value is set to 0 (i.e. account lockout is disabled). Enter a new value (e.g. 3) for MaxDenials to configure the number of failed attempts before the account is locked out.
3. Double-click “ResetTime (mins)” and enter a new value in minutes. The default value in hexadecimal is 0xb40 (2,880 minutes), or two days. You could leave this value alone so once the account is locked out it won’t be reset for at least two days. Or you can enter a shorter time period, such as 60 minutes, to unlock the account automatically after one hour.
4. You could wait for the timer to reset the account lockout parameter, depending on the value you configured, or you can manually unlock the account. To manually unlock the remote access user’s account you’ll have to delete the registry key HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout.

A lot of companies with higher security requirements are concerned about the possibility of users copying confidential data on to their USB memory sticks and taking it off site. Luckily Windows XP Service Pack 2 offers a solution. It supports a registry entry that will make the USB drive read-only. Here’s the procedure.

1. Start the registry editor (regedit.exe).

2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control.

3. From the Edit menu, select New, Key, and type StorageDevicePolicies. If this key already exists then skip to the next step.

4. Highlight the newly created key StorageDevicePolicies and from the Edit menu select New, DWORD Value, type WriteProtect and press Enter.

5. Double-click WriteProtect and enter 1 for Value data. The value 1 makes all the USB drives read-only, a value of 0 will make them writable.

6. Close the registry editor and restart the computer.

Make sure that your users aren’t using any other USB storage devices such as hard drives or rewritable CD/DVD drives because the above registry modification will make all USB storage devices read-only.

If you try to add or remove a program that uses Windows Installer Microsoft Software Installation (MSI) package file (.msi), you may have seen the following error.

I ran into this when I was trying to remove Microsoft AntiSpyware Beta 1 software from Add or Remove Programs in Windows XP. You may experience this error with Microsoft Office or any other software that uses .msi to install a program. The reason for the error is typically corrupted or missing Windows Installer files on your computer. There are a couple of solutions to fix the problem. You can either try to re-register (Plan A) or re-install (Plan B) the Windows Installer.

Plan A
To re-register Windows Installer, first locate the Msiexec.exe file on your computer (typically in C:\Windows\System32) and then verify in the registry that the location is pointing to the correct path. Run regedit.exe and go to this location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer. Double-click on the ImagePath entry in the right-hand pane and make sure it matches with the actual path for Msiexec.exe, if not correct the path. Typically the enry would look like this: C:\Windows\System32\Msiexec.exe /V. Reboot your computer into Safe Mode and at the command prompt run msiexec /regserver to re-register the Windows Installer and then reboot your computer in normal mode.

Plan B
If Plan A doesn’t fix the problem then try re-installing the Windows Installer. Reboot in Safe Mode, rename the following three files and then reboot your computer.

msi.dll
msiexec.exe
msihnd.dll

Windows XP already includes Windows Installer version 2.0 but you can download Windows Installer version 3.1 for Windows XP here. For other operating systems, such as NT, Windows 2000, or Windows 9x, go to the downloads page on TechGalaxy.net and download the Windows Installer version 2.0. Reboot your computer in the normal mode. For more information on this topic, check out Microsoft’s KB article Q315346.

More info…