Problems With WindowsUpdate

When it comes to keeping your computer stable and secure, one of the most necessary utilities available is WindowsUpdate. Whether you run WindowsUpdate manually, or let your computer download and update automatically as updates are offered by Microsoft, WindowsUpdate just has to run.

What do you do if it doesn't run successfully? Well, you don't have to accept its failings blindly; you can interrogate the Windowsupdate.log file. In (KB902093): How to read the Windowsupdate.log file, you can see how to diagnose problems with WindowsUpdate.

There is one immediately possible cause for a problem here. If you are the victim of a DNS problem, whether an actual DNS server issue, or a Hosts file problem, WindowsUpdate access can be blocked. This could be due to either your error in configuration, or a DNS hijack by malicious code (aka hacking).

Server Access Authorisation

Authorisation for network access, to shared data on any Windows server, requires you to make appropriate permissioning entries in two distinctly separate Access Control Lists. Both lists are accessed, as indicated, from Folder Properties.

• Share Permissions ("Sharing - Permissions").
  
• NTFS Permissions ("Security").
  

Note that the term Windows server can refer to a computer running any actual server Operating System, such as:

• Windows NT Server
  
• Windows 2000 Server
  
• Windows Server 2003
  

or it can refer to a computer running any desktop operating system, and working as a server. Any Windows desktop operating system will run as a server, unless otherwise configured.

• Windows NT Workstation
  
• Windows 2000 Professional
  
• Windows XP Home
  
• Windows XP Professional
  

Also note that, while XP Home uses ACLs, you cannot generally view or edit them without special procedures.

Share Permissions are explicitly for network access, and NTFS permissions are for local access. Network access requires the sum of the two. You need either Everyone, a relevant Local Group, or the specific account, setup with sufficient rights in BOTH lists.

A simple procedure is to grant Full rights to Everyone, on the share permissions, then grant restrictive rights to the individual accounts or groups, on the NTFS permissions. A more complex procedure is to set both share permissions, and NTFS permissions, precisely as required (and no higher than required) for each specific account or group.

The resulting network rights are the more restrictive of the two lists, if different.

• If Everyone has Full Control for Share Permissions, and an individual account has Read for NTFS Permissions, network access, for the individual account, will be Read. The owner of that account will have read-only access, whether accessing network shares, or when using the server from its desktop.
  
• If Everyone has Read Access for Share Permissions, and an individual account has Full Control for NTFS Permissions, network access, for the individual account, will still be Read. The owner of the account will have write access when using the server from its desktop, but like everybody else, will have read access when accessing network shares.
  

In cases where some files or folders are accessible, but not others, the NTFS permissions may be corrupt. You have various possible remedies here.

• Correct the problem from the Security tab.
  
• Correct the problem using the CACLS utility. CACLS is a simple solution, when you need all files and folders permissioned identically.
  
  
  
  • Open a command window.
    
  • Position yourself ("cd ...") in the folder corresponding to the share in question (maybe C:, for instance).
    
  • Identify the account or group to which you wish permissions be granted (In this example, the group Everyone), and the type of permission to be granted (in this example, Full permission).
    
  • Enter:
    

    
    cacls *.* /t /g Everyone:F
    

    
    Note carefully the words (sequence of non-blank characters), separated by spaces, in the example above. The spaces in the example are essential. There are 5 words in this example: "cacls", "*.*", "/t", "/g", and "Everyone:F". Don't omit the spaces between the words!
    
  
  This is a simple example; the CACLS command has many options. Read the article linked above, or enter "cacls /?" in the command window for details.
  
• Correct the problem using alternate techniques.
  

>> Top

Driver Updates From Microsoft? Please Pass.

To have a stable and secure system, you need to keep your software current. This includes downloading and updating both Microsoft, and third party, software.

Microsoft provides the Windows Update, and Automatic Update, facilities. On a monthly basis (or sometimes more often), Microsoft will issue recommended updates to the Operating System, to Microsoft applications, and even to third party drivers which may be relevant to your computer.

Whether you enable Automatic Updates, or retain control and monitor recommendations by Windows Update, is not the question here. Both have their advantages. But please, whatever you do, don't routinely download third party drivers from Microsoft.

Any time that you install a new computer accessory, consider the possibility that a firmware upgrade, for your product, was applied to units in the product line after your unit was packaged at the factory. The vendors aren't going to open each box, containing a given product, to apply a firmware upgrade. You have to do this yourself. So make it a consistent practice.

This is especially a relevant practice if one of the computers in your network is running Windows Vista. Right now, Windows Vista is subject to change; the drivers developed for Vista are, likewise, subject to change. Every change in Vista (and there have been a lot of changes since it was officially RTM) may affect a driver already released. Always check for new Vista drivers.

If there is a third party driver update that's relevant to your system, get it directly from the vendor, or from the manufacturer of the chip itself - that's what Microsoft does. Sometimes, what Microsoft may have available thru Windows Update is out of date, or is simply defective. You can get anything that's available directly from the manufacturer or the vendor, whenever you need it. If you need help locating the appropriate website, use Google, or websites like Network-Drivers.com.

But, whether you get updates from the vendor of the packaged product (whoever sold the computer to you), or from the manufacturer of the individual chip itself (who built the chip that needs the driver update), be selective about what you install.

• Find the manufacturer / vendor website.
• Read the documentation about the updates that are available, and decide whether what they offer will help you, with your specific problem.
• Download what they're offering, if you decide that you need it.
• Install the update, selectively removing the crap that you don't need.

Note that you need to be selective, when installing (or not) any driver update.

• Unless you see a security warning regarding your product in question, or you see mention of a specific problem that you're experiencing, be selective in what updates you apply. Don't waste time trying to fix what isn't broken.
• Any vendor of a consumer product probably bundles "extra offers" to "increase the consumer value" of what you install. Extra software, maybe trial offers of security products, is routinely added to many driver packages. Don't waste time applying software that you don't need.

Use Windows Update to keep your computer up to date with Microsoft products, but take its driver update notices simply as reminders. Then, if appropriate, follow the reminder, and get updates from the manufacturer or vendor, selectively choosing what you're offered.

>> Top

Better Protection - Hardware or Software Firewall?

A firewall is a specialised computer which has but one purpose - to prevent bad network traffic from passing between an untrusted network, like the Internet, and a trusted network, like your LAN, your computers, and the programs that you run on them.

A hardware, or appliance, firewall runs on a separate piece of equipment, and provides perimeter protection, to a group of computers. A software, or personal, firewall runs on a host computer, and protects only that computer. There are variations which may use the hardware of a personal computer, and provide perimeter protection.

Please don't confuse the concept of a firewall with that of a router - NAT router, or enterprise network router. A firewall is neither of those.

Both hardware and software firewalls require an operating system, or some interface between the user and the hardware.

The hardware firewall contains a stripped down operating system or code processor of some type, that provides the ability to examine, filter, and / or pass packets between the interfaces (WAN and LAN). It may also contain a small web server or configuration processor, so the user can change the filtering. The software firewall runs under an external operating system, that also lets you use your computer for non-firewall purposes, and lets you change how you use your computer.

There are advantages and disadvantages to both. Saying that one is better than the other is like saying Coke is better than Pepsi, or Chevrolet better than Ford. You can only compare the two, when considering the specific environment where protection is needed.

Hardware Firewall

Advantages:

• A hardware firewall filters malicious incoming traffic, before it hits the protected computers. This lessens the load on the protected computers, and their filtering and logging software.
  
• A hardware firewall has a dedicated processor, and dedicated storage. This further reduces the load on the protected computers.
  
• A hardware firewall is smaller and more efficient. It contains just the code to filter network traffic, and to let the administrator make changes to the filtering. If it uses a web interface for changes, it needs only network connections, no video, keyboard, or mouse connections.
  
• A hardware firewall contains minimal code that can be misused. It does not contain a web browser, word processor, multimedia player, or other accessory that can be exploited by malware.
  

Disadvantages:

• A hardware firewall filters malicious network traffic only, and only at the perimeter. If your LAN uses only perimeter protection, any malicious activity that gets onto the LAN in any way will be unstoppable. All computers on the LAN are vulnerable.
  
• A hardware firewall, and its dedicated processor, and dedicated storage, is finite in capacity, and must be carefully chosen for the intended workload. If the firewall is overloaded, it can do only one of two things:
  
  
  
  • Fail closed. When overloaded, the firewall may simply pass traffic, unfiltered.
    
  • Fail open. When overloaded, the firewall may simply drop traffic.
    
  
  Neither of these solutions are desirable. Any specialised hardware protection, such as a hardware firewall, MUST br carefully chaosen to fit your network. It must provide the capacity, and the functionality, needed, by YOUR network.
  
• A hardware firewall can't effectively filter outgoing traffic, as it has no knowledge of what programs are running on the protected computers.
  
• A hardware firewall requires one more power connection, and one more network cable. If you have limited resources, space or power, you may find this a problem.
  
• A hardware firewall may not be easily upgradable, except by replacing the firewall itself. Capacity upgrades may require a different model device. Code changes may require replacement of internal components. Firmware upgrades must be done when the network is offline.
  

Software Firewall

Advantages:

• A software firewall is more configurable. Since it sits on your desktop, you can make changes to its filtering, at will.
  
• A software firewall installs components into the operating system, so it knows what programs are running there, and can protect you accordingly.
  
• A software firewall provides individual protection to its host. If one computer in the LAN gets infected with malware, all computers running a software firewall are protected.
  
• A software firewall is easily upgraded. Any necessary capacity upgrades can be made, by adding hardware to the host computer. Any necessary code changes can be made by reinstallation of its drivers, or other components.
  

Disadvantages:

• A software firewall is more configurable. Since it sits on your desktop, you can make changes to its filtering, at will. A CKI Fault can make you instantly vulnerable, as Mark Russinovich discovered, when he busted Sony.
  
• A software firewall can be exploited, thru its many features. Since you control it, bad advice can cause you to disable one or more filters, leaving the host computer unprotected against exploits.
  
• A software firewall filters malicious incoming traffic only after it hits the host computer, and the operating system.
  
• A software firewall uses processor power, and storage, which may compete with use of the host computer. This causes tuning needs, and the temptation to disable various features.
  

Now none of these points are 100% significant by themselves. Some hardware firewalls are more versatile, and more configurable in hardware and software. And there are hooks in software firewalls that restrict exploits, and make them less vulnerable. But these are the key differences between the two classes of protection.

Hybrid Solutions
There are variations in the distinction between hardware and software. Some security experts like to promote a third model, which they call a software firewall. They will take a surplus desktop computer, add a second network card, remove all non-essential accessories like a sound system, and make a perimeter protection device out of it.

The experts who like to build these custom perimeter protection devices claim that they have the advantages of both a personal and perimeter firewall, and none of the disadvantages. But examine these custom devices more closely, and you will find subtle disadvantages.

There is also the possibility of a hardware firewall, sitting inside your computer. The nVidia nForce is probably the first, but surely not the last, device of this type.

A well designed security strategy uses both perimeter and personal protection, and more.

Networking Your Computers

Setting up a computer network, whether to share files, or Internet service, can be a lot of fun. It's more fun, though, if you set it up properly, from the start. I'll try and make that possible, if you work with me.

• Learn about the OSI Network Model.
  
  
• Learn basic networking skills
  • Linksys: Home Networking Basics.
  • Microsoft: (KB813936): How to set up a small network ...
  
  
  
• Learn basic terminology.
  • Microsoft: Glossary of Acronyms for PC and Server Technologies
  • PChuck: Physical Network Components Terminology.
  • PChuck: Windows Networking Terminology.
  
  
  >> Top
  
  
• Design and setup the physical network.
  
  
  
  • I highly recommend, in all cases,
    
    
    
    • Use a LAN (Ethernet, FiberOptic Cable, or WiFi), for any permanent networking needs. Use a PAN (Firewire or USB), for any short term emergency needs. And understand the difference between the two.
    
    
    • If your Internet service is by broadband, a broadband (NAT) router is, by far, a good choice.
    
    
    • If you're setting up a WiFi network, know how to Setup WiFi Effectively.
    
    
    • If you're connecting two or more LANs thru the Internet, use a properly planned and designed Virtual Private Network.
      
  
  
  • I recommend, in most cases,
    
    
    
    • Use Ethernet, not WiFi, for the majority of your network.
    
    
    • Buy premade and tested, Ethernet cables.
    
    
    • Buy a router, whether you have one computer, two computers, or a household of computers.
    
    
  
  
  • I suggest, in specific cases,
    
    
    
    • Consider one specific code and safety issue, where FiberOptic Cable, or WiFi, would be preferred over Ethernet.
    
    
    • Read about installing electrical cable inside your home.
    
    
    • If you are connecting a NAT router between a broadband modem and a previously connected computer, know how to set the modem to recognise the router.
    
    
    • If you have 2 or more computers, you can connect them without using a router / wireless access point, using an ad-hoc network. With Ethernet cards on the computers, the simplest network you can setup is by directly connecting two computers with a cross-over cable; with WiFi adapters, you can setup an ad-hoc WiFi network. Know when and how to use a crossover cable, or how to setup an ad-hoc WiFi network, to connect your computers.
    
    
    • If you have your computers, connected by an ad-hoc network, and you wish to enjoy Internet service on each, one solution is to connect one directly to your Internet service, run ICS on it, and the others will have service too. Know when and how to use ICS to share Internet service.
    
    
    • If your Internet service is by dial-up, you can still protect yourself, and share service, with a dial-up compatible NAT router.
    
    
  
  


• Having completed the physical setup, test physical connectivity.


>> Top


• Design and setup the logical network.
  
  
  
  • I highly recommend, in all cases,
    
    
    
    • Read and understand the issues of Windows Networking.
    
    
    
    
  • I recommend, in most cases,
    
    
    
    • On a computer running Windows XP, run the Network Setup Wizard on each computer (as neccessary), and enable NetBIOS Over TCP (NetBT), the Microsoft supported networking transport, for file sharing, except for specific conditions.
    
    
    • On a computer running Windows Vista, run the Networking and Sharing Center wizard, and set the Network Location Type to Private.
    
    
  
  
  • I suggest, in specific cases,
    
    
    
    • If your LAN uses just one router, you have a simple broadcast domain, and file sharing should work right out of the box. If your LAN has to use two or more routers, you need to read about File Sharing On A LAN With Two Routers.
    
    
    • If you have two computers, each with its own Internet service, and pay for 2 IP addresses from your ISP, and want to run file sharing also, please disable NBT and use IPX/SPX for file sharing.
    
    
    • There may be legitimate reasons for using IPX/SPX or NetBEUI for file sharing. Know the advantages and disadvantages of using an alternate transport for file sharing.
    
    
    • Be aware of complications that you may experience when connecting different computers or routers directly to your broadband modem.
    
    
  
  


• Having completed the logical setup, test logical connectivity.


>> Top


• Design and setup the applications and security.
  
  
  
  • I highly recommend, in all cases,
    
    
    
    • Understand the differences between the various versions of Windows Vista and XP, and between Windows Vista / XP and other versions of Windows.
      • If you haven't purchased your Windows operating system yet, know about the different editions of Windows XP, and of Windows Vista, and choose the right one.
      • If you are setting up a network, with the operating systems already in place, understand the differences when setting up file sharing between each computer running Windows Vista / XP.
      • Know the issues when networking computers running Windows Vista / XP and older operating systems on the same LAN.
    
    
    • Even if you have just one computer, or especially if you have more than one computer, please Layer Your Defenses.
    
    
    • If you're setting up a WiFi network, know how to Setup WiFi Securely.
    
    
  
  
  • I recommend, in most cases,
    
    
    
    • If you have more than a couple computers, at least consider setting up a domain.
    
    
  
  
  • I suggest, in many cases,
    
    
    
    • If you're setting up a LAN to share a printer, be aware of the complexities of printer sharing, in addition to file sharing.
    
    
  
  


• Having completed the application and security setup, test Windows Networking connectivity.

>> Top

With the basic issues out of the way, you can get detailed instruction from plenty of websites, that will give you illustrated instructions. Here are but five, listed in alphabetical order.

• CableSense


• HomeNetHelp


• Microsoft Home Network Guide


• PracticallyNetworked


• Windows Networking

If you have properly chosen and setup your equipment, advice from any one of the above should get your network in order. The various guides are written by different organisations, and each has a different style, so check them all out if possible. Find the one which works best for you.

>> Top

Solving Problems
If you're here because you have problems, please start by reading Solving Network Problems.

Now, what is your specific problem? Is it accessing the Internet? Then read Troubleshooting Internet Connectivity. Or is the problem with File Sharing? Then read Troubleshooting Network Neighborhood (Windows Networking).

One major issue that the websites listed above won't help you with, if your problem is with file sharing, is the browser. Now when I mention the browser, don't start with "My Internet access is not a problem". The browser is the program that provides the contents of Network Neighborhood on your LAN. It's frequently involved in problems when "I can't see the other computers", or "I get access denied when I try to access another computer". Please read my article Windows NT (NT/2000/XP/2003) and the Browser.

Do you have a LAN with both Windows 9x (95, 98, ME) computers and Windows NT (NT, 2000, XP) computers? Then you should read Windows 9x (95/98/ME) and the Browser.

>> Top

In Conclusion
All of the above articles link to dozens of other articles, so read carefully. And be patient with me, as I add to this blog occasionally. Check back here periodically. Or write to my Guestbook.

>> Top