1. Windows NT® 5.0: New Architecture And APIs Jeffrey Richter Trainer / Consultant / Author

2. Jeffrey Richter Author Training: www.SolSem.com
Advanced Windows, 3rd Edition, Microsoft Press, 1996
Windows 95: A Developer’s Guide, M & T Books, 1995
Contributing Editor to Microsoft Systems Journal and Microsoft Interactive Developer
Training:
Consulting:

3. Windows NT 5.0 Feature Overview
This session offers a brief introduction to many of the new features of Windows NT 5.0
The purpose is to help you decide which sessions you’d like to attend during the rest of the conference

4. Windows NT Setup

5. Setup No questions asked upgrade Can upgrade from Windows® 95/98
Accessibility
Plug and Play detection of hardware
Safe boot (F8)
Safe mode, safe mode w/networking, safe mode w/command prompt, last known good config., directory services restore mode (DC only), debugging mode, IntelliMirror™

6. Migration DLLs
Allows Windows 95/98-installed app to be fully functional when user upgrades to Windows NT 5.0
Called on Windows 95/98 and Windows NT 5.0 side of setup
Called for every user
DLL should fix registry, copy/move files
Register the migration DLL
HKLM/Software/Microsoft/ CurrentVersion/Setup/Migration DLLs
MyAppName = C:\MigrationDllPathname
DLL must be digitally signed

7. Hardware Support

8. General Hardware Support
Plug and Play
New INF file format for device drivers
WDM: Windows Driver Model
Common architecture for Windows 98 and Windows NT 5.0
Device Manager (similar to Windows 95/98)

9. Hardware Devices USB: Universal Serial Bus IEEE 1394: Firewire
Fibre Channel (1GB/sec transfer)
Infrared
DVD video/ROM support
AGP: Advanced Graphics Port
Broadcast PC (TV)
Fax

10. Plug and Play Messages WM_DEVICECHANGE
wParam (event type)
Add device (DBT_DEVICEARRIVAL)
Remove device (DBT_DEVICEQUERYREMOVE, …)
Configuration change (dock -> undocked) (DBT_CONFIGCHANGED)
lParam (ptr to event-specific structure)
Return TRUE / BROADCAST_QUERY_DENY

11. Power Management

12. Goals Conserve battery power Apps are notified of power-related events
Without data corruption/loss
Apps are notified of power-related events
Apps can retrieve power status
Apps can inform Windows of power requirements

13. System Power Status Status Notifications GetSystemPowerStatus()
AC/battery, low power
WM_POWERBROADCAST, PBT_APMPOWERSTATUSCHANGE
GetSystemPowerStatus()
Battery or AC
Battery power (critical, low, high, charging)
Remaining battery life
Battery life on full charge

14. Suspending the Machine SetSystemPowerState()
Pass RAM/hibernate, force
PBT_APMQUERYSUSPEND
TRUE / BROADCAST_QUERY_DENY
PBT_APMSUSPEND
No UI, save removable drive files
On power-up, apps get notification
PBT_RESUMEAUTOMATIC (fax arrived)
PBT_APMRESUMESUSPEND (user present)
PBT_APMRESUMECRITICAL (new battery)

15. Power State Summary ON Processes running Devices on as needed
SLEEPING Processes suspended Devices off RAM maintained by power
SetSystemPowerState Idle timer Low battery ExitWindowsEx Power button
User input Waitable timers Device
Power button
HIBERNATING RAM saved to disk Processes suspended No power usage
OFF No saved state No power usage

16. Multiple Monitor Support

17. Three Methods
Virtual desktop: Each monitor is part of a single desktop
User configures size/position of each monitor
Windows move between monitors
Screen duplication/remote display: Each screen shows the same thing
Multiple independent displays: Apps have exclusive access to a display
Games, presentation

18. Virtual Desktop Spans multiple, touching monitors
One monitor is primary
Used for app compatibility
(left, top) = (0, 0) always
Other monitors can have negative coordinates
System metrics/device caps refer to primary
Bounding rectangle is virtual desktop
Each monitor has its own work area, resolution, and color depth

19. Virtual Desktop

20. Virtual Desktop And GetSystemMetrics
(SM_XVIRTUALSCREEN, SM_YVIRTUALSCREEN)
Virtual Screen
Display2
(0,0)
Display3
Display1
Primary
SM_CXSCREEN
SM_CYVIRTUALSCREEN
SM_CXVIRTUALSCREEN

21. Monitor Ownership And Rules
Owning monitor has most of window
Child/owned windows stay on same monitor
Windows maximize to a single monitor
Menus never span across monitors

22. Functions MonitorFromPoint/Rect/Window() GetMonitorInfo() returns
Returns desktop HMONITOR
Flags change default to NULL, nearest, or primary
GetMonitorInfo() returns
Desktop coordinates (may be negative)
Workarea coordinates (may be negative)
Flags: primary or secondary
Device name (“\\.\Display1”) for CreateDC/ChangeDisplaySettingsEx

23. More Functions ChangeDisplaySettingsEx() EnumDisplayDevices()
Change resolution, color depth, position on desktop
Normally used by Control Panel
Sends WM_DISPLAYCHANGE
EnumDisplayDevices()
Allows app to use a dedicated display

24. Compatibility Issues Screen savers only cover primary
Some apps don’t like negative coordinates
Some apps restrict windows to primary
Patch GDI or the DISPLAY driver (remote control apps)
Some apps require user to disable secondary displays

25. Microsoft Management Console (MMC)

26. Microsoft Management Console
MMC simplifies systems management
Single UI for all management tools
“Consoles” contain a set of Snap-Ins
Grouping of tools that work well together
MMC has Author mode and User Mode
Snap-Ins extend the namespace (left pane)
Extend menus, toolbars, and property pages

27. Index Server

28. Index Server Windows NT Service indexing files and their content
Allows search by properties
Name, author, content, summary, type, etc.
Filters parse files for indexer
System ships with standard filters
.doc, .xls, .txt, .ppt, html, etc.
Extensible to custom file formats by implementing the IFilter interface
MMC Management

29. Index Server Client Example
Set Q = CreateObject("ixsso.Query")
Q.Catalog = "System"
Q.SortBy = "rank[d]"
Q.Columns = "DocTitle, path, size"
Q.Query = "microsoft and not #filename *.vbs "
Set RS = Q.CreateRecordSet("nonsequential")

30. Index Server Client Example
sz = "# hits: " & RS.RecordCount & Chr(10)
For i = 1 To RS.RecordCount
sz = sz & RS("Path") & Chr(10)
RS.MoveNext
Next
MsgBox sz
Set RS = Nothing
Set Q = Nothing

31. Active Directory

32. Active Directory Mimics the organization of an enterprise
Organize by location and department
Search across an enterprise
Find printers/people/machines/etc.
Searching is FAST
Searching is EASY - through UI and APIs
Windows NT ACL security on entries

33. Active Directory
Enterprise wide searchable, extensible, replicated, hierarchical, scalable, distributed namespace
Exposed to administrators through MMC Snap-in
Exposed to apps through Object Model (ADSI), and API’s (LDAP, X.500, etc.)
Exposed to users through ‘Search…’
Exposed to ISVs for extensibility

34. AD Printer Publishing

35. AD Printer Publishing

36. Don’t Use The AD For... Huge data Rapidly changing, short useful life
Difficult to replicate large objects without increasing latency for small ones a lot
Rapidly changing, short useful life
Local interest information
Needs total consistency between replicas
Needs total consistency within a replica
Example: debit-credit

37. Zero Admin Windows (Clean Apps Initiative)

38. Goals Make customer experience enjoyable
Easy for novice to setup/use software
Many people use a single machine
Single person use multiple machines
Machines can be taken on the road
Simple to administer
Cheap to deploy, maintain, and update software
Less than 5% of ownership cost is app cost today!

39. Key Problems Setup problems DLL conflicts
Inconsistent; can’t mass deploy (not silent)
Requires user be a local administrator
DLL conflicts
Inability to protect user’s data
Hard to replace machine with new one
Hard to lockdown a system
Bank tellers, hospitals, kiosk, etc.

40. State Separation User-specific settings Don’t initialize at setup
Use HKEY_CURRENT_USER
Use single user’s special folders
Documents, pictures, start menu, favorites, send to, templates, temp, app data
SHGetSpecialFolderPath()

41. State Separation Machine-specific settings Do initialize at setup
Use HKEY_LOCAL_MACHINE
Use all user’s special folders
Start menu, programs, startup, desktop, app data

42. Desktop Management Give admins (parents) full control
Force standard desktops (reduce futzing)
System Policy: OS and shell behavior
CreateProcess versus ShellExecute
Application Policy: Apps provide admin control over features
Apps MUST adhere to system policy too!
System Security: Admin restricts access to files, folders, and registry

43. Application Policies Suggested Application Policies
Overall Policy On/Off
Default file format
Default open/save location
Default data population
Disable new, high TCO, and advanced features
Allow policies to be set per-user/ per-machine
Expose policies using ADM file

44. Group Policy Editor
MMC Snap-In allowing management of local or Active Directory policies
ADM ‘script’ language lets you put a UI on Registry settings
On/Off (Check box)
One of many strings (Combo/List box)
User entered strings (Edit box)
Settings are stored and applied to user when logged on to domain controller

45. System Security Don’t assume users are administrators
Don’t assume file system/registry is writeable
Open resources with appropriate permission
Ex: Use KEY_READ versus KEY_ALL_ACCESS
Handle access-denied errors gracefully
Temp dir (%TEMP%) is per-user and writeable

46. The Windows Installer (MSI)
Windows NT Service running with higher privs
Versions available for Windows NT 4.0 /Windows 95/98
Setup is ongoing; not a one-time process
Protects OS and shared components
Offers Admin network deployment, update, and uninstall
Missing/damaged files can be reinstalled
Apps tune disk usage to each user’s preferences

47. IntelliMirror Allows remote install/update
Users are assigned programs and OS
Admin updates server with new versions
User gets new version with next logon
User’s environment mirrored on server
Allows machine reconstruction for hard disk crash or new computer
Allows user to roam to other machine
You can work off-line and files will automatically synchronize on reconnect

48. NTFS File System Changes

49. Hard Links (Files Only)
Single file with multiple path names
Saves file replication; eases organization
All attribs (including data) shared
Win32® function: CreateHardLink
Increment hardlink count and adds name attribute
DeleteFile deletes name, decrements count
If 0, MFT entry is deleted

50. Stream Compression Stream split into compression units
16 clusters long
Example: 120KB file (2KB cluster size) Offset Clusters Notes Compressed Not compressed Compressed Not compressed

51. Stream Compression API
DeviceIoControl
FSCTL_SET_COMPRESSION
Dir: new streams/subdirs created compressed
FSCTL_GET_COMPRESSION
GetFileAttributes
FILE_ATTRIBUTE_COMPRESSED
GetFileSize/GetCompressedFileSize
GetVolumeInformation
FS_FILE_COMPRESSION

52. Sparse Streams Large streams with “holes” Example: Queue
“Holes” don’t require disk space
Example: Queue
Always write to end (64-bit offset)
Delete read records from beginning
64-bit file sizes
16 billion billion bytes
1KB/record, 10 record/second = 57 million years

53. Sparse Streams Stream split into compression units Example: 120KB file
16 clusters long
Example: 120KB file
Offset Clusters Notes______________ Compressed; not sparse Sparse Compressed; not sparse Not compressed/sparse

54. Sparse Stream API DeviceIoControl GetFileAttributes
FSCTL_SET_SPARSE
FSCTL_SET_ZERO_DATA
FSCTL_QUERY_ALLOCATED_RANGES
GetFileAttributes
FILE_ATTRIBUTE_SPARSE_FILE
GetFileSize/GetCompressedFileSize
GetVolumeInformation
FILE_SUPPORTS_SPARSE_FILES

55. File Encryption/Decryption
Protects files from users with physical access to computer
Boot of other OS floppy
Multiple users share a single machine
Stolen laptop
Unattended desktop systems
EncryptFile/DecryptFile
Open/CloseEncryptedFileRaw, Read/WriteEncryptedFileRaw

56. Reparse Points Execute code when file/dir is opened
Code is in file system filter
Examples
Directory junction
C:\CDROM redirects to CD-ROM (X:\)
HSM
Files content relocated to off-line storage
Accessing on-line file faults in off-line content

57. Reparse Point API CreateFile DeviceIoControl GetFileAttributes
FILE_FLAG_OPEN_REPARSE_POINT
Open’s file stream ignoring reparse point
DeviceIoControl
FSCTL_SET_REPARSE_POINT
FSCTL_GET_REPARSE_POINT
FSCTL_DELETE_REPARSE_POINT
GetFileAttributes
FILE_ATTRIBUTE_REPARSE_POINT
GetVolumeInformation
FILE_SUPPORTS_REPARSE_POINTS

58. Reliable Change Journal
Tracks ALL volume changes (by time)
Size adjustable (or disabled)
Usual size = 16MB, record = ~128 bytes, changes = ~4/sec, Time until full= ~8 hours
Sparse file used to implement RCJ buffer
Single stream accessed by all apps
Avoids volume traverses
Saves time, saves code, saves memory
Entries get ever-increasing 64-bit unique sequence number (USN)

59. Change Reasons (USN_REASON_*)
DATA_OVERWRITE DATA_EXTEND DATA_TRUNCATION NAMED_DATA_OVERWRITE NAMED_DATA_EXTEND NAMED_DATA_TRUNCATION FILE_CREATE FILE_DELETE PROPERTY_CHANGE SECURITY_CHANGE RENAME_OLD_NAME RENAME_NEW_NAME INDEXABLE_CHANGE BASIC_INFO_CHANGE HARD_LINK_CHANGE COMPRESSION_CHANGE ENCRYPTION_CHANGE OBJECT_ID_CHANGE REPARSE_POINT_CHANGE STREAM_CHANGE
End of all changes marker: USN_REASON_CLOSE

60. RCJ API Create/Query/Destroy RCJ (size, delta) Read Entry
FSCTL_CREATE_USN_JOURNAL
FSCTL_QUERY_USN_JOURNAL
FSCTL_DELETE_USN_JOURNAL
Read Entry
FSCTL_READ_USN_JOURNAL
FSCTL_READ_FILE_USN_DATA (by hfile)
Force Write of Close
FSCTL_WRITE_USN_CLOSE_RECORD

61. Disk Quotas Administrators control disk space/user
Transparent to users/software
Attempt to exceed quota returns disk full
GetVolumeInformation()
FILE_VOLUME_QUOTAS
GetDiskFreeSpaceEx()
Returns caller/volume’s free bytes\
Checks on stream extend

62. File System Services

63. Hierarchical Storage Management (HSM)
Not on Windows NT® Workstation
Administrator sets policy (per-volume)
File types to consider (Ex: No EXEs)
# of days since use/minimum file size
Desired free disk space on volume
Scan copies files to remote storage
File contents deleted; reparse point added
Accessing file copies storage back
CreateFile w/ FILE_FLAG_OPEN_NO_RECALL opens remote file (no local copy)

64. Native Structured Storage (NSS)
NSS reparse point filter maps COMs IStorage/IStream to NTFS file streams
NTFS file can be copied to non-NTFS partition and back without data loss
Storage within file is not wasted
Deleted objects have space reclaimed
More efficient storage
Better performance

65. Distributed File System
Organizes network resources in tree
Junction point (dir) has alternate paths
Accessing junction point selects a path
Server down, another path is chosen
Servers can be added, moved, and removed without affecting user’s access
Improves load balancing
Only NTFS can have junction points; any file system can have leaf nodes

66. Kernel Changes

67. Very Large Memory (Vlm) DEC Alpha Only
Break 2-GB barrier on DEC Alpha
First step past 32-bit system
Target large database servers
Alpha Windows NT 5.0 Enterprise Server only

68. 32-Bit x86 Address Space 0xFFFFFFFF 2GB Kernel space 0x80000000
0x7FFFFFFF 2GB User Space 0x

69. 64-bit Alpha Address Space
0xFFFFFFFF FFFFFFFF 2GB Kernel space 0xFFFFFFFF
0xFFFFFFFF 7FFFFFFF VLM Allocations 0x
0x FFFFFFF 2GB User Space 0x

70. VLM Functions typedef void * __ptr64 PVOID64; Functions:
Memory: MoveMemoryVlm
MMF: MapViewOfFileVlm
Virtual: VirtualAllocVlm
Process: ReadProcessMemoryVlm
Status: GlobalMemoryStatusVlm
File I/O: ReadFileVlm

71. Job Object New kernel object Group of related processes
Can be named
Can be secured
Group of related processes
Manage and track process group
System enforces job quotas and security context

72. Job Object Functions CreateJobObject OpenJobObject
AssignProcessToJobObject
TerminateJobObject
QueryInformationJobObject
SetInformationJobObject
UserHandleGrantAccess

73. What You Can Set Basic Limits UI Restrictions Security Limits
Per-process and per-job user time limit, minimum/maximum working set size, # of processes, processor affinity, priority
UI Restrictions
ExitWindowEx, access to non-job USER objects, reading/writing clipboard, SystemParametersInfo for change
Security Limits
No Administrators token, only restricted token, only specific token, filter token

74. What You Can Query Accounting information Process ID List
Total user/kernel time, this period user/kernel time, total page faults, total processes, active processes, total terminated processes
Process ID List
IDs of all running processes in job

75. Thread Pooling APIs Register a wait with callback function
RegisterWaitForSingleObject(hObj, pfn, pvData, dwTimeout)
Queue asynchronous function call
QueryUserWorkItem(pfn, pvData, fPreferIO)
Timer Queue
SetTimerQueueTimer(hQueue, pfn, pvData, dwDueTime, dwPeriod, fPreferIO)
ChangeTimerQueueTimer / CancelTimerQueueTimer
CreateTimerQueue / DeleteTimerQueue

76. Miscellaneous CreateProcessWithLogon ToolHelp functions
GetVersionInfo and OSVERSIONINFOEX
Build/service pack info
IsDebuggerPresent
IsProcessorFeaturePresent
Pentium floating point bug, is floating-point emulated in software, MMX available, and more

77. User/GDI Changes

78. Message Windows Pass HWND_MESSAGE as parent HWND to CreateWindow(Ex)
Allows send/receive of messages
Not visible, no Z-order, not normally enumerated, doesn’t receive broadcast messages
FindWindowEx
Finds if hwndParent is HWND_MESSAGE
Finds is hwndParent and hwndChild are NULL

79. Layered Windows Alpha Blending
WS_EX_LAYERED
BOOL UpdateLayeredWindow( HWND hWnd, HDC hdcDst, PPOINT pptDst, PSIZE psize, HDC hdcSrc, PPOINT pptSrc, COLORREF crKey, PBLENDFUNCTION pblend, DWORD dwFlags);
Alpha Blending
AlphaBlend function like StretchBlt w/BLENDFUNCTION struct

80. SystemParametersInfo
Mouse hover dims/time (no click selection)
X-Mouse behavior
ComboBox/ListBox animations
Gradient captions
Accessibility
Power Management
Task switch (disable Alt+Tab/Alt+Esc)
Is screensaver running

81. Miscellaneous GetGuiResources (see Task Manager)
GetLastInputInfo (ms since last input)
LockWorkStation (simulates Ctrl+Alt+Del)
SendInput (simulates input set)
TrackMouseEvent (generates mouse hover/leave msgs)
HTML Resource type
New common controls

82. Keyboard Cues
Reduces visual noise from ‘focus indicators’ and ‘access key underlines’

83. Scheduler Service Task Scheduler UI via Explorer’s My Computer folder
Interfaces
ISchedulingAgent: Creates, destroys, and manages jobs
ITask: Defines a task
ITaskTrigger: Sets the schedule for a task

84. Terminal Server

85. Terminal Server Win32 apps run on PC/non-PC
Thin clients, 100% server-centric
Clients: Windows, Macintosh, UNIX, etc.
Server/client only transmit UI
Screen updates
Keyboard and mouse inputs
User logs on and has independent session
Apps require no change to run

86. Programming Guidelines
No local data in global locations
All users share HKEY_LOCAL_MACHINE
Each user gets HKEY_CURRENT_USER
Store user-preference/temp files in home/user-specified dir
Use file/database locking
Resolve memory leaks
Don't use computer name/IP address to ID user
Server has 1 IP address for all users

87. Optimizations Remove UI from services Reduce CPU time and network I/O
Client won’t see it
Reduce CPU time and network I/O
Rework background tasks
Reduce splash screens, animation
Reduce paints
Create memory images; output once

88. Windows Scripting Host

89. Overview Language-independent scripting host
MS provides Visual Basic® Script and JavaScript engines
Other companies will provide ActiveX® scripting engines for other languages such as Perl, TCL, REXX, and Python
GUI-based (WSCRIPT.EXE)
CUI-based (CSCRIPT.EXE)

90. Architecture Other scripting hosts
Microsoft Internet Explorer
Internet Information Server (IIS)
WSH has smaller footprint than Internet Explorer
File extension tells host which engine to use
Registry settings
VBS: Visual Basic, JS: JavaScript
Context menus
Property page

91. Supplied Scripting Objects
WScript: create/get/delete Active object
WshArguments: cmd-line args
WshShell: Env vars, msg box, spawn, read/write/delete registry settings
WshNetwork: add/enum/remove printers/network drives
WshSpecialFolders: special folder dir
WshShortcut: Create shortcut
WshUrlShortcut: Create URL shortcut

92. Win64

93. Abstract Data Models Goal: Single Win32/Win64 source base
Win32: ILP32 model
ints, longs and pointers are all 32-bit
Safe assumption to make for Win32
Win64: LLP64 model
ints, longs are 32-bit, pointers are 64-bit
Making everything 64-bit wastes space
Communication is much harder
32<->64 apps require lots of thunking
Structures in files require reworking

94. BASETSD.H Defined Types
Fixed-precision types
Same size for Win32/Win64
INT32, UINT32, LONG32, ULONG32
INT64, UINT64, LONG64, ULONG64
Pointer-precision types (ptr-sized ints)
Size varies with platform
INT_PTR, UINT_PTR, etc
Win32: sign-extended, Win64: truncated
SIZE_T (unsigned count), SSIZE_T (signed count)

95. Rules Don't cast ptrs to int, long, ULONG, DWORD
Cast to INT_PTR or UINT_PTR
Truncate ptrs with PtrToLong/PtrToUlong
Avoid if possible
Inline functions
Disable pointer truncation warning
Beware of polymorphic interfaces
Use PVOID/UINT_PTR instead of DWORD