Security
User Account Control
User Account Control in Windows Vista gives administrators the option of restricting permissions while still enabling most applications to run.
To help provide this combination of security and compatibility, File and Registry Virtualization automatically redirects writes and subsequent reads to areas that the standard user does not have access to. Changes made to the virtualized registry settings and folders are visible to only that user account and the applications the user runs, so the integrity of the computer is protected. If an application does require administrator credentials, Windows Vista will prompt the user for the credentials before allowing the application to run.
Windows Firewall with Advanced Security and Windows Service Hardening
Every aspect of Windows Vista's firewall can be configured using Group Policy settings, so client security settings remain constant. For the first time in a Windows operating system, Windows Vista firewall management is integrated with IPsec. The firewall works closely with Windows Service Hardening to restrict what services can do on the system, providing defense-in-depth and reducing opportunities for attackers to compromise vulnerable computers. Windows Service Hardening restricts critical Windows services from doing abnormal activities in the file system, registry, network, or any other resources that could be used to allow malware to install itself or attack other computers. For example, the Remote Procedure Call (RPC) service can be restricted from replacing system files or modifying the registry.
Internet Explorer Enhancements
Windows Vista builds upon the User Account Control initiative to limit Internet Explorer to just enough privileges to browse the Web, but not enough to modify user files or settings by default. This Windows Vista-only feature, known as Protected mode, will be in Beta 2. As a result, even if a malicious site attacks a potential vulnerability in Internet Explorer, the site's code won't have enough privileges to install software, copy files to the user's Startup folder, or hijack the settings for the browser's homepage or search provider.
To help protect a user's personal information, Internet Explorer:
- Highlights the new security status bar when visiting a Secure Sockets Layer-protected site and lets the user easily check the validity of a site's security certificate.
- Has a phishing filter, which helps users browse more safely by advising them when Web sites may be attempting to steal their confidential information. The filter works by analyzing Web site content, looking for known characteristics of phishing techniques and using a global network of data sources to decide if the Web site should be trusted. Filter data is updated several times an hour, which is important given the speed with which phishing sites can appear and potentially collect a user's data.
- Clears all cached data with a single click.
Network Access Protection
Windows Vista includes an agent that can provide information about a client's health state and configuration to network access servers or peers. With Network Access Protection, clients that lack current security updates, lack virus signatures, or otherwise fail to meet your computer health requirements cannot communicate on your private network. Network Access Protection can be used to protect your network from remote access clients as well as local area network (LAN) clients using wired or wireless connections. The agent reports Windows Vista client health status, such as having current updates and up-to-date virus signatures installed, to a server-based Network Access Protection enforcement service. A Network Access Protection infrastructure, included with Windows Server "Longhorn", determines whether to grant the client access to your private network or to a restricted network.
Routing Compartments
To prevent unwanted forwarding of traffic between interfaces for virtual private network (VPN), Terminal Server, and multi-user logon configurations, the Next Generation TCP/IP stack supports routing compartments. A routing compartment is the combination of a set of interfaces with a login session that has its own IP routing tables. A computer can have multiple routing compartments that are isolated from each other. Each interface can only belong to a single compartment. For example, when a user initiates a VPN connection across the Internet with the current TCP/IP stack, the user's computer has partial connectivity to both the Internet and a private intranet by manipulating entries in the IPv4 routing table. In some situations, it is possible for traffic from the Internet to be forwarded across the VPN connection to the private intranet. Routing compartments in the Next Generation TCP/IP stack isolate the Internet connectivity from the private intranet connectivity with separate IP routing tables.
Wireless Single Sign-On
The deployment of wireless networks has promoted the use of Layer 2 network authentication, such as 802.1X, to ensure that only an appropriate user or device is allowed on the protected network and that their data is secure at the radio transmission level. The Single Sign-On feature executes Layer 2 network authentication at the appropriate time given the network security configuration, while at the same time seamlessly integrating with the user's Windows log-on experience. Administrators can use Group Policy or the Command Line Interface to deploy Single Sign-On profiles to client machines. Once a Single Sign-On profile is configured, 802.1X authentication will precede the Windows logon. This feature enables scenarios such GPO updates, Log-On scripts and wireless Bootstrap, which require network connectivity prior to user logon.
Platform Improvements
Windows Vista's authentication capabilities are more flexible, providing a variety of choices for customized authentication mechanisms such as fingerprint scanners and smart cards. Deployment and management tools, such as self-service personal identification number (PIN) reset tools, make smart cards easier to manage and deploy. Smart cards can now be used to log on to Windows Vista, too. Further, Windows Vista enables authentication using Internet Protocol version 6 (IPv6) or Web services.
Certificate enrollment is made easier because Windows Vista includes Credential Manager enhancements that enable backing up and restoring credentials stored on the local computer. The new Digital Identity Management Service (DIMS) provides certificate and credential roaming within an Active Directory forest and end-to-end certificate life cycle management scenarios.
Windows Vista's auditing capabilities make it easier to track what users do. Auditing categories now include multiple subcategories, reducing the number of irrelevant events. Windows Vista integrated audit event forwarding collects and forwards critical audit data to a central location, enabling enterprises to better organize and analyze audit data.
Multi-Tiered Data Protection
Theft or loss of corporate intellectual property is an increasing concern for organizations. Windows Vista has improved support for data protection at the document, file, directory, and machine levels. The integrated Rights Management client allows organizations to enforce policies around document usage. The Encrypting File System, which provides user-based file and directory encryption, has been enhanced to allow storage of encryption keys on smart cards, providing better protection of encryption keys. In addition, the new BitLocker™ Drive Encryption enterprise feature adds machine-level data protection. It provides full volume encryption of the system volume, including Windows system files and the hibernation file, which helps protect data from being compromised on a lost, stolen or decommissioned machine. In order to provide a solution that is easy to deploy and manage, a Trusted Platform Module (TPM) 1.2 chip is used to store the keys that encrypt and decrypt sectors on the Windows hard drive. It requires the TPM and an enterprise management infrastructure to ensure that the feature is easy to use for end users.
Reliability and Performance
Automatic Recovery
With Windows Vista, most service failures are not noticeable to users, because Windows Vista will automatically restart most services in the unlikely event that they fail. If necessary, Windows Vista can automatically address service dependencies and restart multiple services to maintain the reliability of the operating system. Because users often restarted their computer to resolve problems with failed services, automatic recovery also reduces the number of restarts.
Built-in Diagnostics
Windows Vista can self-diagnose and resolve a number of common problems. For example, Windows Disk Diagnostics proactively detects impending disk failures and can alert the support centre to replace the failing hard disk before total failure occurs. For administrators, Windows Vista will guide them through the process of backing up their data so the hard disk can be replaced without data loss.
Windows Vista also includes memory diagnostics to help administrators track down problems with unreliable memory. Previously, memory diagnostics were available only as a download and were difficult for many IT professionals to use. In Windows Vista, if Windows Error Reporting (WER) or Microsoft Online Crash Analysis (MOCA) determines that a failure may be caused by failing memory, Windows Vista prompts the user to perform memory diagnostics without requiring an additional download or separate boot disk. If memory diagnostics identifies a memory problem, Windows Vista can avoid using the affected portion of physical memory to enable the operating system to start successfully and to avoid application crashes. Upon startup, Windows Vista provides an easy-to-understand report detailing the problem. Windows Vista also includes the Network Diagnostics Framework (NDF). The NDF provides users with advanced means to assist in problem resolution for network-related issues. When unable to connect to a network resource, the user is presented with clear repair options rather than error messages which can be difficult to understand. If Windows Vista can repair the issue automatically, it will; if not, the user is directed to perform simple steps to correct the problem without having to call for support.
Startup Repair Tool
Windows Vista includes the Startup Repair Tool (StR) to automatically fix many common problems and enable end users and IT professionals to quickly diagnose and repair more complex startup problems. When a startup failure is detected, the system fails over into StR. Once started, StR performs diagnostics to determine the cause of the startup failure. StR even analyzes startup log files so that you don't have to. Once StR determines the cause of the failure, it attempts to fix the problem automatically. The entire process requires little to no user input. Problems StR can automatically repair include:
- Incompatible drivers
- Missing or corrupted startup configuration settings
- Corrupted disk metadata
After the operating system has been repaired, Windows Vista notifies the user of the repairs and provides logging so that IT professionals can determine exactly which steps StR performed. StR also includes tools to assist IT professionals in manually troubleshooting startup problems. StR reduces support calls related to startup problems, and when users do need assistance, StR enables you to quickly solve the problem.
Application Reliability
Windows Vista is engineered to reduce the frequency and impact of user disruptions. It includes fixes for known crashes and hangs, and enhanced instrumentation that will provide greater insight into what causes unresponsive conditions.
Windows Vista will offer improved application reliability from the first day that businesses deploy it, and the new error reporting capabilities will enable applications to continue to become more reliable over time. With earlier versions of Windows, application hangs were very hard for developers to troubleshoot because error reporting provided limited or no information about hangs. Windows Vista improves error reporting to give developers the information they need identify the root cause of problems. This enables continuous improvements in reliability.
Performance Improvements
Windows Vista can automatically detect problems related to long startup times or an unresponsive user interface, and add an event to the event log that describes the condition and that possibly provides information about the root cause of the performance problem. Administrators can use this information to troubleshoot problems on a case-by-case basis, or aggregate the event log data by using a tool such as Microsoft Operations Manager (MOM) to analyze performance for the entire enterprise.
The Next-Generation TCP/IP stack automatically senses the network environment and adjusts key performance settings, such as the TCP receive window. Improved stack auto-tuning and configuration reduces the need for manual configuration of TCP/IP settings. It enables faster network transfers, more intelligent bandwidth usage, and fewer retransmissions of lost data on the network. This can lead to a significant reduction in the time required to transfer a large file or back up a hard drive across the network.
Deployment
Modularization
Windows Vista is modularized, which makes it easier to customize. When preparing to distribute Windows Vista to an organization, IT professionals configure and add optional components to distribute to a given set of computers. Languages, for example, are components, so the English language can be distributed to one set of computers, while French, German, and Spanish go to a different group. Drivers and updates are also components, making it easy to update images as hardware and software requirements change.
Windows Imaging
WIM is a file-based image format, which provides significant benefits as compared to the more common sector-based image formats. The WIM image format is hardware-agnostic, enabling you to maintain only a single image for multiple hardware configurations. WIM can also store multiple images within a single image file, making image management easier and saving disk space by storing only a single copy of each file. For example, you might store two images in a single WIM file - one image that contains only the Windows Vista operating system and a second image that also contains core applications. The WIM format reduces image file sizes significantly by using a compressed file format and single-instance storage techniques. (The image file contains one physical copy of a file for each instance of it in the image file, which significantly reduces the size of image files that contain multiple images.)
Maintaining WIM images is easy, because drivers, updates, and some other Windows components can be added and removed offline without ever starting the operating system image. Windows Vista includes tools to directly edit images to change general and regional settings, apply operating system updates, add drivers, and install updates. This feature saves hours of work maintaining setup images, because there is no need to start the image to make configuration changes.
Additionally, the WIM image format allows for non-destructive deployment. This means that you can leave data on the volume to which you apply the image because the application of the image does not erase the disk's existing contents.
Either modularization or WIM alone can dramatically simplify deployment; but together, they revolutionize the way client operating systems are installed. In other words, the combination of the two technologies provides a greater benefit than the two technologies would if offered separately. Most notably, the two technologies significantly reduce the number of operating system images that must be maintained. In other words, IT departments that previously maintained different images for each language and computer type can probably use just one or two Windows Vista images, thereby freeing the staff for other priorities.
Nondestructive Imaging
With previous versions of Windows, imaging could only be used for new Windows installations since deploying an image would overwrite the computer's hard disk. To upgrade a user's computer, IT professionals had to copy the user's files and settings to a different computer, and then restore the files and settings after deploying the image. Windows Vista includes nondestructive imaging using the WIM image format, which copies files and settings to a reserved portion of the computer's hard disk before deploying the Windows Vista image. After the Windows Vista image is deployed, Windows Vista migrates the files and settings and then restores the portion of the computer's hard disk that had been reserved. Overall, migrating to Windows Vista is much more reliable than migrating to Windows XP.
Unattended Installations
Most Windows Vista administrative tools, including Windows System Image Manager and the Microsoft Windows User State Migration Tool (USMT), can be controlled from a command line or script. This functionality saves time when the user must repeatedly perform the same, or similar, tasks. IT departments that do not use scripting will still save time configuring unattended setup by editing a single file: Unattend.xml. Windows Vista includes graphical tools that make it simple to configure an unattended installation without manually editing the file. Because Extensible Markup Language (XML) files are text-based, they can be edited manually or programmatically using a script.
Manageability
Configuration Management
Windows Vista technology ensures that changes to Windows files and settings happen in a predictable and reliable way. Windows Resource Protection (WRP) technology allows the system to protect itself from undesirable changes to system files, folders, or registry keys - changes that could render a computer or application inoperable. System settings in the registry are protected from inadvertent changes by users or unauthorized software; only the Windows trusted installer can make changes to protected system files and settings.
Group Policy
Almost every new configuration setting in Windows Vista can be controlled using Group Policy. Additionally, Group Policy Management Console (GPMC) is now included with Windows Vista. To make Windows Vista more flexible in environments in which multiple users use a single computer, such as schools and libraries, Windows Vista can have multiple Local Group Policy objects applied. This feature improves security and manageability in such shared-use environments as libraries and schools.
Policy-based Quality of Service
With Policy-based QoS, an IT department will be able to define flexible QoS policies to prioritize and/or throttle outbound network traffic without requiring modifications to applications. These QoS policies will apply to outbound traffic based on any or all of the following conditions: sending application; deployment through Group Policy (such as a set of users, machines); source/destination IP address; source/destination port; and protocol.
Eventing, Instrumentation, and Error Reporting
Windows Vista is easier to manage, saving IT professionals both time and effort. Event descriptions contain more data to help you identify the root cause of a problem and include event information in XML format, making it easy to expose events data to be leveraged by the management tools. For common problems, the process can be automated to launch tasks when a specific event appears. Windows Vista makes manually analyzing events easier, too, by enabling you to customize how the Event Viewer displays them. Additionally, Windows Vista can forward events to a central location to make identifying, tracking, and troubleshooting problems easier.
Automation
Windows Vista automation capabilities let repetitive management tasks be performed without human intervention, reducing the likelihood of manual errors. Windows Vista adds several key automation capabilities:
- Web Services for Management (WS-Management), an industry-standard Web services protocol for protected remote management of hardware and software components, makes Windows Vista easier to manage across a network by allowing administrators to remotely run scripts and perform other management tasks.
- Key administrative tasks that can be performed from a user interface (UI) can also be completed from a command line, expanding the Windows XP command-line interface even further. This feature enables scripting and one-to-many administration.
- An improved Task Scheduler lets administrators launch a set of tasks in a specific sequence, ensuring they do not run simultaneously, and automatically launch tasks in response to events or when the computer is idle. The credentials used to launch the tasks can now be stored in Active Directory rather than on the local computer in order to improve the security of the passwords and simplify mandatory password changes.
Supportability
Windows Vista is designed to drive down user support costs in four key ways:
- Reduce the number of incidents. Windows Vista features such as Windows Resource Protection and User Account Control help users be productive while preventing them from making system changes that would affect the system's performance. Additionally, Windows Vista's failure recovery automatically resolves many common problems.
- Help users help themselves. Windows Vista is engineered to help users help themselves, greatly reducing the need for support from IT administrators or support center professionals. User Assistance - Windows Vista's version of help files - in Windows Vista provides better search capabilities, is easier for end users to understand, and can be customized by the IT department.
- Reduce support time. When problems occur, Windows Vista provides IT and support center professionals with tools, detailed events, and performance counters to make it easier to determine what happened and how to fix it. The ability to detect failing disks and memory allows IT professionals to proactively replace hardware before a problem becomes catastrophic, enabling the problem to be resolved in a few minutes rather than several hours.
- Reduce the cost of supporting remote users. Windows Vista's improved Remote Assistance tool makes it easier and less costly to service computers in remote locations. To reduce bandwidth costs, the greatly improved Background Intelligent Transfer Service (BITS) enables clients on a local area network (LAN) to share updates directly, instead of downloading the same files repeatedly across wide area networks (WANs).
Productivity
Usability and End-User Productivity
Microsoft has improved the usability of almost every aspect of Windows Vista, including the Start menu, Windows Explorer, and Control Panel. For example, the Control Panel now lists specific tasks that the user may want to perform, such as changing the screen's resolution. Users can even use the Quick Search text box to search for applications on the Start menu or for specific Control Panel tasks. These usability improvements mean users spend less time figuring out how to use the operating system and more time completing their work.
AERO
Windows Vista's user interface, code-named "AERO" (Authentic, Energetic, Reflective, and Open), is easier and more fun, even as it makes users more productive. Computers designed for Windows Vista create a professional and attractive environment based on a theme of translucent glass. Even applications created before Windows Vista become more attractive because Windows Vista has improved wizards and common dialog boxes that are shared by all applications.
Users with high-resolution monitors can finally take full advantage of their displays because Windows Vista smoothly scales icons and windows. As a result, users do not have to squint to read an e-mail message on their new 1600x1200 laptop display. Users who have previously used lower resolutions to make text more readable can increase the display resolution for added clarity and sharpness without decreasing readability.
Explorers
Windows XP includes several specialized Explorers to enhance users' experience when interacting with specific types of content, such as Documents, Photos, and Music. Windows Vista builds on this concept by including layout, command, and organizational tools that are appropriate for the information the Explorer displays onscreen.
Information Visualization
Windows Vista has amazing information management capabilities that enable users to find documents, e-mail messages, and other information in seconds and then to work with that data in ways that are most intuitive to them. In fact, Windows Vista's new tools are so flexible and so easy to use that users will rarely need to search for information on their computers.
First, the new Document Explorer, replacing the My Documents folder in Windows XP, is much more powerful. Instead of simply showing icons for documents, the Explorer shows high-resolution thumbnails that preview the document's content. Users can dynamically adjust the size of these thumbnails up to 256x256 pixels, which is large enough for users to know whether they've found the right document without opening it.
Search
Users can search documents, e-mail, contacts, and Web sites right from their desktop. Windows Vista searches are not limited to the local computer and can include shared folders, and other network resources. For all those times users think, "I know I've seen that somewhere, but where was it?" search capability makes it easy to find the content that user is looking for.
Start Menu
The Windows Vista Start menu makes it easier to open specific applications and browse all applications. Users can type part of the application's name in the Start menu's Quick Search box to launch the application. For example, to launch the Calculator tool, users press the Windows key, type Calc, and press Enter. Windows Vista makes it easier to browse the applications installed on the computer by replacing the Windows XP All Programs menu with a tree view, similar to Windows Explorer. This feature helps users find applications that are nested in folders several levels deep.
Sharing
Windows Vista makes it easy for users to share files, whether on a single computer or network. First, Windows Vista gives users the option to save their files into a personal or public profile, thereby differentiating whether the content will be available for personal or public use. Next, the new Sharing Wizard shows every person who has an account on that computer or in the Active Directory, enabling the user to choose which individual can access which files. Finally, Windows Vista enables users to more easily keep track of shared content by showing two Search Folders: one that displays all shared content and one that displays all content that has been taken offline.
Mobility Improvements
Windows Vista provides a single, easy interface for connecting to any type of network, including wireless local area networks (WLANs), wireless wide area networks (WWANs), ad hoc wireless networks, and Virtual Private Networks (VPNs). Once connected, the Windows Vista Network Explorer enables users to visually browse all network resources, including computers and devices, people on the network, and shared folders. The speed and reliability of discovering networked computers, servers, and devices is improved significantly over that provided by Windows XP.
Windows Vista provides a single user interface for managing all types of data and device synchronization called SyncManager. SyncManager is capable of managing almost any type of device synchronization, including music files to a portable audio player, calendar information and e-mail messages to a PDA, contact information to a mobile phone, files between two networked computers and lies between a network computer and a file server.
Windows Vista's new default power-off state is Sleep mode. Sleep combines the resume speed of the Windows XP Standby mode with the data protection and low power-consumption characteristics of Hibernate. In the Sleep state, Windows Vista records the contents of memory to the hard disk, just as it would with Hibernate. However, it also maintains the memory for a short period of time, just as Windows XP maintains the memory in Standby mode.
IPv6
IPv6 support in Windows Vista enables enterprises to support a larger network address space while eliminating the need for NAT or other workarounds. IPv6 scales well beyond the IPv4 address space, and provides additional security with full support for IPSec. Enterprises can deploy IPv6 within their infrastructure without having to completely upgrade their network with IPv6 transition tunneling mechanisms to support the tunneling of IPv6 traffic across an IPv4-only infrastructure.