Windows XP Service Pack 2 (SP2) is more than a simple roll-up of bug fixes. SP2 includes a series of security and maintenance enhancements--many of which have special significance to mobile users--that amount to a whole new OS release. When preloaded on new Tablet PCs, SP2 is called Windows XP Tablet PC Edition 2005.
The SP2 features that you're likely to hear most about--and the ones with the greatest impact on application compatibility--are related to security. SP2's security features include a built-in software firewall that's on by default. Built-in applications, including Microsoft Internet Explorer (IE), Outlook Express, and Windows Messenger have also undergone significant changes. For Tablet PC users, SP2 includes a set of enhancements, including handwriting recognition that's actually good enough to use.
The downside to SP2's many changes is compatibility problems. XP users who upgrade to SP2 (or users who start out with XP Tablet PC Edition 2005) are likely to experience problems when using network and Web applications. In enterprise environments, testing SP2 before rolling it out is crucial to determine what compatibility problems exist and how to work around them.
As I write this article, SP2 isn't yet available, but I've been testing SP2 Release Candidates 1 and 2 for some time now. Here's a rundown on the features of most interest to mobile users--and the administrators who support them.
Windows Firewall
When a user restarts after installing SP2, the computer boots with the firewall enabled. SP2 will probably prompt users with network applications to enable them to communicate through the firewall. Configuring such "exceptions" is simple but can be unnerving for a user who doesn't expect it. In an Active Directory (AD) environment, you can use Group Policy to specify exceptions to minimize user impact. SP2 also has a Don't Allow Exceptions mode that blocks all communications originating outside the firewall and an option to turn the firewall off--although Microsoft doesn't recommend the latter option. In my opinion, mobile users connecting to the Internet while away from the office should be encouraged (or required) to use the Don't Allow Exceptions mode to minimize the risk of infection by network worms when the user isn't protected by a corporate firewall.
By default, SP2's firewall blocks the ports required for file and printer sharing, so users who depend on files and printers shared from other workstations will find that these features don't work properly after SP2 is installed. To change the default setting, you use the Exceptions tab of the new Windows Firewall Control Panel applet, which Figure 1 shows. Select the File and Printer Sharing box, and sharing will work through the firewall. By default in SP2, only computers on the same subnet have access to shared files and printers, but you can change this behavior by using the Windows Firewall applet's Advanced tab. You can also use Group Policy to control these settings.
Browsing, Email, and Messaging
Users will likely experience some compatibility problems with SP2's version of IE. In a nutshell, IE now defaults to asking the user's permission before displaying pop-up or active content. To avoid annoying the user by repeatedly displaying a dialog box that asks the user whether to show the active content, SP2 IE provides a new UI element called the Information Bar, which pops up as an extra line below the Address bar, as Figure 2 shows. The Information Bar lets the user know that IE is blocking active content; the user can click the bar to see a context menu that lets him or her choose to show the content, or the user can ignore the bar, in which case the active content isn't displayed. Organizations that use active content and pop-ups in intranet applications can control this behavior on a per-zone basis through Group Policy.
Another security-related change in the browser--and in the SP2 versions of Outlook Express and Windows Messenger--can create unexpected results. A new feature called Attachment Execution Service (AES) checks all files that a user might want to download and attachments that he or she might want to save. If a file's content doesn't match its MIME type or file extension, SP2 will display the content in a safe format, typically text. This feature is designed to block the spread of virus and worm content that's masquerading as something else; but it also exposes bugs in some Web pages that work perfectly well with pre-SP2 versions of IE.
SP2 Outlook Express has a text-only option that prevents display of any graphical content. And SP2 Windows Messenger requires the user's sign-in name to be different from his or her email address.
Automatic Updates
Some of SP2's best features relate to maintenance: You can now fully automate the update process. A revised version of Windows Update includes application and device driver patches as well as OS updates, and the same update procedure now applies to security patches and will be used for future service packs. Multiple updates are prioritized--a small crucial update is installed before a large noncrucial update--and updates are transmitted via the Background Intelligent Transfer Service (BITS) 2.0 protocol, which transmits only compressed changes to components rather than complete components. Obviously, transmitting changes only is particularly good news for mobile users who are using slow connections. In enterprise environments, IT can set up BITS servers and users can download updates from the nearest server rather than from their home domain to help reduce unnecessary WAN traffic. You can even limit the bandwidth that the update servers use. By default, updates are installed automatically when the user logs off.
SP2 Administration
I've mentioned several times that you can use Group Policy to control SP2 security features. Microsoft also introduced a revised version of the netsh.exe command-line utility firewall helper in the Advanced Networking Pack for Windows XP. Netsh can be used to show and modify firewall settings on local or remote computers running SP2 and is scriptable. You'll need to use it to open TCP port 445 for the client administration tools included with XP--the SP2 firewall blocks the port by default. For a quick look at the options, after you install SP2, type
netsh firewall show
at a command prompt. You can find a discussion of the nine new Group Policy settings for the firewall and their corresponding Netsh commands in "Fine-Tuning Windows Firewall," June 2004, Instant Doc ID 42594.
Tablet PC Enhancements
When you upgrade a Tablet PC with SP2, the OS is updated to XP Tablet PC Edition 2005, which includes all the SP2 features plus a series of Tablet PCÂspecific upgrades. The most visible of the latter is the revised Tablet PC Input Panel. By default, the Input Panel is still at the bottom of the display, as in the original XP for Tablet PC, but now an icon appears when you hover the stylus over a text field. Tapping that icon opens an Input Panel that "floats" over the field, as Figure 3 shows. This minimizes the need to move the stylus from the text field to the fixed Input Panel, which makes using a Tablet PC less tiring. The Input Panel continues to include options for handwriting (cursive or printing) and a pop-up keyboard and offers a new option specifically designed for entering one letter at a time. Handwriting recognition has improved considerably; with the original XP Tablet PC Edition, I avoided handwriting and mainly used the pop-up keyboard, but with SP2, I'm finding that the handwriting recognizer is actually accurate enough to make handwriting an option.
You can further improve recognition for vertical and line-of-business applications by adding an XML-based context tag for fields that have a restricted set of acceptable input. For example, if a field accepts only two-letter state abbreviations, tagging it causes the recognizer to accept only appropriate abbreviations in that field. You can put the tags in one or more XML files and add the files to the same directory as the application--you don't need to change the application code. You can find more information about adding XML tags in the software development kit (SDK) for XP Tablet PC Edition 2005: SDK 1.7. SDK 1.7 is available from the Microsoft Download Center at http://www.microsoft.com/downloads (select Windows XP Tablet PC Edition from the Product/Technology drop-down list and type SDK into the Keyword field).
SP2 Deployment
As with past service packs, the standard method to deploy SP2 uses the update.exe program and either local source files (the fastest method) or a network share. The command syntax for update.exe has changed for SP2 and includes new options including command-line switches to uninstall the service pack and ignore (or replace) OEM driver files and extended error codes to help debug deployment scripts. For details, see "Changes to Functionality in Microsoft Windows XP Service Pack 2" and "Guide for Installing and Deploying the Beta Version of Service Pack 2 for Microsoft Windows XP Home Edition and Windows XP Professional (SPDeploy)"; URLs for these articles are in the Learning Path box. You can also deploy SP2 by using Windows Installer and Group Policy.
Given the range of compatibility problems that SP2 can create, many administrators might be tempted to ignore it. That would be a serious mistake. SP2's security changes cut the OS's attack surface (i.e., the number of interfaces exposed to the outside world) approximately in half. Thus, an XP SP2 computer is significantly more resistant to virus and worm attacks. Many SP2 features are also previews of what we're likely to see in future versions of Windows. I believe that administrators who support XP users--especially those who support mobile users, who frequently use their computers outside corporate firewalls--should upgrade them to SP2. Planning and doing a proper roll-out will take time, but the security and maintenance improvements are well worth it.
| WINDOWS IT PRO RESOURCES |
|
If you want to get a feel for Tablet PCs: "Living with a Tablet PC," John D. Ruley, April 2004, InstantDoc ID 41973 If you're thinking of upgrading: "Windows XP SP2 Will Bring Tablet PC Improvements," Paul Thurrott, Web Exclusive, April 7, 2004, InstantDoc ID 42306 If you're ready to use the new Netsh commands: "Fine-Tuning Windows Firewall," Mark Minasi, June 2004, InstantDoc ID 42594" Check out Tablet PC reviews and a Buyer's Guide: "Tablet PCs," John D. Ruley, July 2004, InstantDoc ID 42927 (Buyer's Guide) "Tablet PCs," John D. Ruley, August 2003, InstantDoc ID 39524 (5 reviews) OTHER RESOURCES Windows XP Service Pack 2 Resources for IT Professionals http://www.microsoft.com/technet/prodtechnol/winxppro/sp2preview.mspx Changes to Functionality in Microsoft Windows XP Service Pack 2 http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2chngs.mspx Group Policy Settings Reference for .adm files included with Windows XP Professional Service Pack 2 http://go.microsoft.com/fwlink/?linkid=22031 Guide for Installing and Deploying Microsoft Windows XP Service Pack 2 http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/spdeploy.mspx Microsoft Windows XP Tablet PC Edition 2005 http://www.microsoft.com/windowsxp/tabletpc/evaluation/lonestar/default.mspx |
