Policy Plus - User policy, computer policy

Today I put together a way of handling the user/computer policy split for Policy Plus. There's now a dropdown box above the categories tree that lets you select whether you want user policies, computer policies, or both. There's also a new View menu, which currently contains only a single item, Empty Categories. When that option is unchecked, categories that don't contain any relevant policies (considering the aforementioned dropdown's setting) are hidden. Changes to those viewing options cause Policy Plus to take you up to the nearest level in the tree that's still visible.

The State column now takes into account the current policy set. That gets interesting when you choose to see both user and computer policies. In that case, it will show "(2)" next to the state if both instances have the same state; it will show a "(U)" or a "(C)" next to the state if only one has any setting, and it will just say "Mixed" if the two instances have different settings.

A policy that's only enabled for the computer

I pushed these and yesterday's changes to GitHub.

Policy Plus - Policy states

One staple of the Group Policy Editor is the State column, which shows whether each policy setting is Enabled, Disabled, or Not Configured. Determining that is surprisingly tricky, since there's nowhere that the actual policy state is stored; it's serialized to and reverse-engineered from normal Registry entries (stored in POL files, not the actual Registry). Today, I wrote a function that gathers evidence from those entries to determine the state of a given policy setting.

I also updated the PolFile class to have a Save method, though it's not used yet.

I would have pushed these changes, but I haven't yet figured out a good way of handling the user/machine policy split. Currently, Policy Plus uses the machine POL file to determine policy state.

Showing the State column

Policy Plus - Open ADMX folder

Policy Plus could already list the contents of a category in the right pane and navigate the category tree using the left pane. Clicking on subcategories in the right pane, however, did nothing, since I haven't added a policy setting editor yet. Today I added a double-click event for categories in that right pane; it opens the category and updates the left tree view control appropriately. I also added a faux-category in the listing of subcategories that takes the user up one level.

I also added function to the existing menu items. Most notably, Open ADMX Folder to easily load policies from the system's PolicyDefinitions folder, the domain's SYSVOL (only available on domains with centralized definitions, of course), and an arbitrary custom path.

The "Open ADMX Folder" dialog

Banned from Dropbox public linking

Today I published Abiathar 2.8.5 to the update server, which is actually my public Dropbox. Soon after, I found that all my public links had been deactivated with a message about too much traffic. I'm almost certain that's the incorrect reason. Dropbox also issues that message when the public hosting is deactivated because of abuse: malware. I ran a VirusTotal scan on the new files and I found that unlzexe.exe triggers 10 scanners and the newest Abiathar.exe triggers one.

I removed the UNLZEXE program and sent Dropbox a message explaining the situation. Temporarily, I'm using Amazon S3 to host Abiathar and the optional UNLZEXE component. I even bit-twiddled unlzexe.exe so that it won't trigger any hosts' scanners; Abiathar now undoes that twiddling after the download. Hopefully this will be resolved soon.

FMod - Online UNLZEXE

For a while, I have been slightly displeased at the fact that UNLZEXE accounts for a full fourth of the Abiathar executable's size. That feature is rarely used, and Abiathar is fairly large, so I really wanted to get rid of it. Today I tried compressing that embedded program, but no LZW bit count would take off enough size to matter, and .NET 4 doesn't support ZIP files (though .NET 4.5 does).

So I just took out that resource entirely. Abiathar will now check to see if UNLZEXE is in the current folder, and if not, it will download the program from the update server. The download doesn't take long at all. This arrangement won't affect AbiatharOS (WinPE, possibly network-less) installations either, because all the Keen executables there are already unpacked.

The Abiathar program is now just 3MB.

Quick fix for Device Manager Code 43

I just investigated a Bluetooth issue that I traced back to the Bluetooth controller (which apparently connects internally via USB) not getting registered properly. It appeared in Device Manager with Code 43. I tried uninstalling it and rebooting, but that did nothing - the device just came back with the same error.

Some Googling turned up a Microsoft document that recommended not rebooting after uninstalling the device, but clicking Scan for hardware changes under the Action menu. Interestingly enough, that fixed the problem - Bluetooth devices immediately began working.

PATH surprise: Adds to the DLL search order

The most desired effect of adding a folder to the PATH environment variable is that typing the name of a program in that folder can run it. There is one other, more subtle effect.

The DLL search order specifies where Windows will look for a DLL file when a program loads it only by file name. The last thing searched is the collection of folders on the PATH. Therefore, if a program attempts to load a DLL that's usually absent (e.g. it's an optional module), it might accidentally find it if you have an appropriately named file in a PATH folder. This could lead to security issues if you put a per-user folder on the system PATH.

Fortunately, loading a DLL by file name only is inadvisable, so well-written programs shouldn't do that.

Based on my Super User answer.