Using eExamine to Verify Suitability
This topic illustrates the impact of making the ownership, access permissions and security changes which are described in the other topics. Since the eExamine wizard requires no “installation” and makes no changes itself, simply running it on the same new Windows 7 PC as was evaluated for the “Identifying security issues before deployment of a “legacy” application” topic will make the impact of the changes preparatory to installation of a “legacy” application clearly visible.
The only changes made since since that example was captured were:
- Administrators group now “owns” the Windows® directory, as shown under the “How to Take Ownership of the Windows® Directory” topic.
- Administrators group now has “Full Control” of the Windows® directory (but not its subfolders), as described in the same topic.
- User Access Control has enabled LSA “linked” access tokens, as described in the “How Windows 7 default security settings can affect “legacy” applications” topic.
No other security changes were made!
Because the computer and its Window® software are the same and nothing has been installed since the previous example this example omits the first several pages of the wizard from its illustrations. The first four captures [below] are the first of the eExamine wizard pages that have changed:
Note that the user logon now has the full 23 “privileges” that define true administrative capability under Windows 7! This set includes the Security privilege and others that allow management of processes, priorities, profiles, disks and system settings. They also enable creation of “shortcuts” [symbolic links] and “impersonation” of other security entities (e.g. a user running as Administrator).
The next change detected by the eExamine wizard is in access permissions to the folders used by the application:
In fact, as the next capture proves, no security issues exist that would prevent installation or use of Syscob applications on this machine! Solely as a result of the change to Windows® directory ownership and access permissions plus “linking” access tokens to grant the user the administrative “privileges” of the group to which the user belongs.
Of course, the eExamine wizard can also be a useful tool for a computer with Syscob software installed after changes to a “server” machine (especially a domain controller or Active Directory control node) or changes to a PC configuration or a user profile. Simply download and run the wizard via this link:
Remember that the eExamine wizard is completely “safe” to run on any Windows® machine. It makes no changes to anything, but only examines the computer and user environment to produce a list of issues found and a list of actions that should correct them. For any new Windows 7 (or Windows Server 2008) machine Syscob very strongly recommends that this wizard be run, and identified issues resolved, before any attempt to install a Syscob export application on that computer.