As of writing this, I am working as an apprentice in IT and one of my duties is administering our System Center Configuration Manager (SCCM) server, taking care mostly of application and operating system deployments.

SCCM is a device management software by Microsoft, used to automatically install operating systems, provision applications and keeping computers (and the installed software) up to date on a large scale.

One of the things we've previously had a lot of trouble with, is deploying the Redistributable(s) of the Microsoft Visual C++ runtime. As many will know, there are quite a lot of these things, and different applications will use different versions of this runtime, so it's rarely sufficient to install just one of them. So to solve this issue, we've opted to install all currently available packages on our computers.

To deploy an application, SCCM needs a way to detect if that application is already installed, or whether a deployment initiated through SCCM succeeded. There's several different ways to that, three of them being rather simple, the last one not so much:

1. Windows Installer: For applications that utilize MSI packages to install, the SCCM client can use the integrated Windows Installer database to detect if an application deployment succeeded. For that you will need to provide the MSI's so called product code.
2. Windows Registry: Most if not all applications leave some entries in the Windows registry, therefore the SCCM client can check for a specific key and value, and optionally even check if that entry conforms to certain requirements the SCCM administrator specified.
3. Files: Likewise to the Windows Registry method, the SCCM client can check for the existance of a specific file in the local file system (and again optionally for certain requirements on that file).

The last method and the one I've employed for detecting this specific application, is using a custom script. This can be a PowerShell script, a VBScript or a JScript script. I'm using a PowerShell script both because it's the most modern one, and because it's the language I know best of the three:

# Collection of all versions of the runtime the script should check for,
# adjust to fit your needs. In its current state it will detect all
# Visual C++ Redistributables from 2005 to 2019 in both x86 and x64 flavors.

$PackagesFound = @{
    "2005" = $False;
    "2008x86" = $False;
    "2010x86" = $False;
    "2012x86" = $False;
    "2013x86" = $False;
    "2015-2019x86" = $False;
    
    "2005x64" = $False;
    "2008x64" = $False;
    "2010x64" = $False;
    "2012x64" = $False;
    "2013x64" = $False;
    "2015-2019x64" = $False;
}

# Variable initialization
$Year = ""
$Architecture = ""

# Iterate through below mentioned registry keys
& {
    Get-ChildItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*
    Get-ChildItem HKLM:\SOFTWARE\WoW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*
} | ForEach-Object { 
    $CurDisplayName = $_.GetValue("DisplayName") # Get DisplayName
    # Check if Display Name begins with "Microsoft Visual C++" and if so extract the year.
    if( $CurDisplayName -match "^Microsoft Visual C\+\+\D*(?<Year>(\d|-){4,9}).*Redistributable.*" ) {
        $Year = $Matches.Year
        [Void] ($CurDisplayName -match "(?<Arch>(x86|x64))") # Extract Architecture
        $Architecture = $Matches.Arch
        $PackagesFound[ ''+$Year+$Architecture ] = $True
    }
}


# Report result back to SCCM
If ( $PackagesFound.Values -notcontains $False) {
    "All required versions of Microsoft Visual C++ were found"
    $PackagesFound
} Else {
    ### DO NOT OUTPUT ANYTHING HERE ###
}

If you look at the last few lines of the code, you will see that this script doesn't use exit codes to convey its result. This is because SCCM in the end doesn't care about those. What it does care about is if there is any output from the detection script. If there is, SCCM considers the application detected. I've combined this script with a script (utilizing the excellent PowerShell App Deployment Toolkit) that executes each of the 12 Visual C++ Redistributable installers, one after another. With this I have finally managed to properly deploy this runtime for good. If in the future a new version of the runtime is released, it will be easy to adjust the script to accompany it.

This script is free to use and adapt to your own needs, though providing a link to this page would be appreciated. Likewise I'm grateful for any sort of feedback on this script, as this is my first dabble into writing application detection scripts for SCCM. Just reach out to me on Twitter @niemalsnever. Huge thanks go out to my buddy M., who helped me a great deal to come up with this script!

Hi,

against better knowledge, I recently spent a week in England and Scotland. During my stay, I noticed the decidedly pleasant and subtle way of the British in both surveilling their citizens and warning them of terrorism.

Smile, you're on CCTV – this funny slogan boasted at the door of every store even back in 2007 when I last visited England, and informed people that this business employed video surveillance. This time it was much worse…

Whether you're on public transport, walking in the streets, in a museum, at a train station, or at the airport – no matter where you are, you are constantly reminded of the surveillance. Not only via a poster, or a sign, but even acoustically. No 10 minutes pass in which you don't hear this announcement at a station or an airport: "For your safety and security CCTV is in operation!". No 5 minutes in which you don't see a poster, that reminds you to watch your belongings and report any suspicious behaviour to the authorities.

It's probably nothing, but… – with this beautiful saying the major security authorities encourage the common British to increased attention. Everybody watches everybody else permanently on every step. I'd like to emphasize two key experiences which made me think. Both of them cover an everyday problem, I wanted to get rid of some garbage:

1. Edinburgh Waverly Station

As I previously mentioned, I wanted to get rid of some garbage and was looking for a litter bin at Edinburgh Central Station (Edinburgh Waverly). When I was unable to find a single litter bin even after an extensive search, I asked the station staff, who told me that there were no garbage bins at the station, due to the risk of terror attacks…

2. London St. Pancras International Station

At London St. Pancras International, I was faced with the same problem, I wanted to throw away some trash, so I asked another passenger waiting at the station to watch my backpack, while I look for a trash bin. He responded politely but firmly that he would like to do that, but he didn't expect the security personal to believe him, that he was just watching the stuff for me, so he refused.

I think these two experiences show on one hand the "paranoia" of the security organisations in the UK, and on the other hand the lack of trust of the public in the authorities.

In retrospective I must say I felt the same. This kind and this omnipresence of surveillance is too much. I didn't feel safe, I felt restricted, watched and even patronized. And looking at the current development I doubt things will change in the forseeable future…

It saddens me. deeply.

In a [not so] recent post, I wrote about my Internet Service Provider (ISP) Unitymedia and the problems I had with them. In the weeks after I wrote my blogpost, everything seemed fine. Until two weeks ago, when Münster (and the rest of Germany) was hit by quite a few thunderstorms. During one of them my modem (Technicolor TC7200) rebooted. At first I did not notice a change, but a few days later, I tried to connect to my home network from work, and realized it didn't work.

The Return of IPv6

When I returned home, I restarted my Raspberry Pi thinking it had crashed. Still no incoming connectivity from outside my home network. I rebooted my router to be sure it didn't crash. I checked my router's config, because sometimes the TC7200 gives it a wrong IP address, not this time. Then I went to check on the DMZ (De-Militarized Zone) configuration of my modem and it hit me. The DMZ configuration menu was gone, I checked on the IP information screen and saw my modem acquired an IPv6 address and switched back to IPv6 mode – the one utilizing my provider's CGN (Carrier Grade NAT, see my older post). Fed up about my ISP’s incompetence I sent them an e-mail describing my problem.

The next day I got an e-mail from Unitymedia telling me they tried to call me (at home, in the middle of the day). Back home I dialed the telephone number I was told to call in the e-mail and sure thing I reached the main support hotline. I was told that all their systems showed my modem still received an IPv4 address, but my modem disagreed. They told me to disconnect my modem from power for a few minutes to reset it and then reconnect it. Guess what, it didn’t work. Also since my landline telephone connects through my modem, restarting my modem means hanging up on the support hotline. Before hanging up, their support agent told me he was forwarding my ticket to the tech department. Then nothing happened... for about a week.

The issue gets annoying

Not only that my devices were not available from the internet, but also certain services weren’t usable from inside my network. The most annoying thing was Netflix. Somehow, and I don’t know who is to blame, Netflix is only available via the IPv4 Unitymedia network, IPv6 won’t load at all – at least the apps. Netflix seems to have major problems with IPv6 in general and their recommendation is basically “switch off IPv6” to which my answer usually would be “switch off Netflix”.

After that week I called the support hotline again, asking what happened with my ticket, they told me they sent a text message to my mobile, but I didn’t receive anything… So they told me to disconnect and reconnect my modem again, that didn’t work either.
The next evening I called them yet again, and was told I needed to disconnect and reconnect my modem once more for ten minutes, because otherwise their support software wouldn’t let them initiate the next step – great customer experience :-/
I did that, didn’t help. So I called them yet again – each time having to describe my issue from scratch – when I finally got a competent support agent who understood my problem, documented it properly and also wrote down that this connection was also used for business purposes. The next day I got a text message apologizing for taking so long to resolve the issue and telling me it might take a bit longer. Next morning I got another text message telling me the issue would be resolved shortly. Ten minutes later my connection died because my modem suddenly rebooted – great if your provider suddenly has more control about a device on your network than you do, isn’t it?

After the reboot my modem suddenly had proper IPv4 connectivity again – yet it is still unclear to me what caused the problem.

Atom is a modern, hackable text editor developed by GitHub. It's based on modern web technologies like NodeJS and is quite popular in the web developer community. Recently I had to come up with a way to automatically install it on multiple computers at work. Unfortunately that's a use case that probably was overlooked by the Atom development team.

As I've said, Atom uses modern technology, unfortunately that also goes for its installer. Atom uses Squirrel.Windows, a framework for packaging Windows applications. Squirrel's and therefore Atom's philosophy is:

No UAC elevation needed

meaning applications packaged with Squirrel will only ever install in the user context. This is needed for automatic updates and is basically a good idea, the only problem is, it renders those applications almost unusable for enterprises. I don't want my users to install applications on their computers only for themselves, and I'm even less eager to have that happen on semi-public computers, like in a computer lab. In our case we reset the user profiles on those machines once every week.
We use Microsoft System Center Configuration Manager 2012 (SCCM) for our automatic software deployments. The easiest way to deploy software with SCCM is providing a Windows Installer Package (.msi), but other methods like batch scripts are supported too.

After some fiddling with the setup executable the Atom developers provide, I finally realised it wasn't feasible. The installer even provides a machine-wide-installation switch (--machine) – don't use that! Using this switch installs Atom for the current user, and – this is the perfidious thing – creates a key in the Windows registry under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, causing the installer to be called for every user on every logon. This is an absolute nogo, and also a horrible way to do a machine wide installation. Even worse is that the installer does not provide a switch to get rid of this registry key, so you have to look through the registry yourself to find and delete it. The --machine switch has been deprecated by the Squirrel.Windows team and replaced by an .msi that probably does the same thing, but the Atom developers team didn't update their releases yet, and even if they did, it doesn't do anything to solve the problems the --machine-switch had in the first place.

Thankfully GitHub also provides a ZIP-archive, which does not feature automatic updates and can therefore be used to install Atom in an enterprise context. When I found out about that, I wrote a quick and dirty batch script, which copies the folder to the "Program Files"-folder and creates shortcuts in the Start menu for all users and on the desktop:

@echo off
REM This script installs Atom on a computer and creates shortcuts in the start menu and desktop for all users.
REM Copy program files
if not exist "%programfiles%\Atom\" ( 
  xcopy ".\Atom" "%programfiles%\Atom\" /s /h /q /y
)
REM Create shortcuts
xcopy ".\Atom.lnk" "C:\Users\Public\Desktop\" /q /y
xcopy ".\Atom.lnk" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\" /q /y

With this script I was finally able to deploy atom to our computer labs, and also make it available for installation for the whole department. This script expects to be placed next to  the extracted contents of the ZIP-archive, in a folder called "Atom". Next to the folder and the script I placed a shortcut I created pointing to %programfiles%\Atom\Atom.exe, which will be copied by my script. I didn't feel like fiddling around with a script to create the shortcuts, so I chose the cheaty route. Using the ZIP has the additional advantage that we as the IT department have an eye on which version of Atom is installed on our computers, because it won't auto-update. It's unfortunate that the Atom developers didn't really think about this use case, but I'm glad I found a way to do it anyways – even if it's a bit dirty and cheaty.

This story began in February of 2015 and I was hoping it would be over by now, but unfortunately it still isn't. My Internet Service Provider (ISP) is Unitymedia Germany and has been for the last three-and-a-half years. When I first ordered their service everything was great. The technician who had to come to set up my internet connection came within two days after I signed the contract, the monthly fee was reasonable, and the internet speed I got was supremely fast. I rarely had any problems with that connection, until one day in 2013 my internet connection went dead.

After calling the support hotline, they sent out a technician who found the issue. Apparently Unitymedia had sent out one of their employees to cut the connection for someone who hadn't payed their bill, but they cut my connection by mistake. That was easily fixed and there were no more big issues until the aforementioned February of 2015.

Upgrading my Contract

In February of 2015 I decided to upgrade my contract with Unitymedia to a higher tier because that would more than double the speed I got before, while only paying about one Euro more. Little did I know that I would spend at least one day per week on Unitymedia's support hotline for the next two months. First they sent me a new cable modem, it's a Technicolor TC7200, easily the worst piece of hardware I've ever had to connect to my network. This thing ready-to-go support for Wi-Fi connectivity (in both the 2.4 and 5 GHz ranges), but it is disabled by default and Unitymedia demands demanded paying a one-time 30€ fee to enable that functionality. Thankfully I don't need this feature, as I have my own Wi-Fi-router, so I thought I could safely ignore the matter. But then I saw that the Wi-Fi LED was inexplicably lit on the TC7200, and also I was able to see and join the networks the TC7200 was said to provide. So I tried to use the config page of the router to switch them off. Unfortunately the software didn't let me do this, because you can't access the Wi-Fi settings page, if you didn't pay that 30€ fee.

So I called Unitymedia, to have the issue fixed, because it bothered me having two Wi-Fi connections on my network, outside of my control.

Let the Odyssey begin

The first time I called, I was told that the Wi-Fi could not be switched-on, and that it would deactivate after restarting my modem. (Which of course I can't do while I'm on the phone with them). Next time I called, they told me the Wi-Fi was on to demo the function and it would deactivate within the next two weeks. Obviously... it didn't.

Next time I called them, I told the employee on the other end about the alleged demo mode. They told me it didn't exist and reputedly regenerate my cable modem's config file. Spoiler: That didn't work either. I had to call 3 more times until they finally agreed to enable the Wi-Fi function for me for free, so that I could finally disable that annoying Wi-Fi feature. We have reached April of 2015 by now and I generally want get rid of Unitymedia as soon as possible. But, I signed a two-year contract.

All in all this minor annoyance led to me spending about 3-5 hours in the Unitymedia support hotline, which was not free at the time, also due to that unusual free booking of the Wi-Fi-function, they somehow messed up things so badly, they had to give me a new phone number.

IPv6... or not

One more reason I wanted to upgrade was that I finally wanted to get IPv6. Unfortunately this led to another chain of problems. We all know that IPv4 addresses have run out for good, that is why we need to make the switch to IPv6. Unitymedia chose the most dickish approach for switching to IPv6, called Dualstack-Lite (DS-Lite). Everybody knows the joy of NAT, that pesky little thing some people mistake for a firewall. NAT enables you to have different devices behind the same one public IPv4 address by mapping services on different computers to TCP/UPD ports in the router. This works more or less great, so Unitymedia thought:

"Well, darn, we don't have enough public IPv4 addresses to give everyone of our clients their own address. Let's use another layer of NAT to map several clients to one public IPv4 address."

This approach is called Carrier Grade NAT (CGN) and is generally a horrible idea. CGNs cause many problems for more technically affine users. This means you can't reach your computer from anywhere in the world, because it doesn't have a public IPv4 address. DS-Lite combines CGN for IPv4 with IPv6 for all other connections. IPv6 would fix the problem of not having a public address to connect to your own computer, but unfortunately IPv6 is not yet widely available, so it cannot yet serve as an alternative.

Since I need to connect to my home network quite frequently using DS-Lite was not an alternative for me, so I had them switch it back, which I could because I had an IPv4 address from them before. Unfortunately doing so meant that I lost my IPv6 connectivity again.

Return of the Wi-Fi

About three weeks ago, I received an e-mail from Unitymedia which sparked quite some rage in me. It reads something like this:

Dear Mr. <blank>,

did you notice? We have enabled Wi-Fi for free on your Technicolor TC7200. Maybe you surfed the internet wirelessly using it already in the last couple of months.

Security of your data is important to us! That is why we've already informed you on January 15 that the factory set Wi-Fi passwords in your router are not safe enough. They may be recovered and used by unauthorized individuals using specialized software.

Translated from German, no liability assumed, Source*

As you can see, Unitymedia has the guts to enable a feature on devices in their clients' home, many of these clients don't want and they announce it in the same e-mail in which they admit this feature might harm the security of their clients' network and data.

I called the support hotline about 10 minutes after receiving this e-mail, and the employee on the other end of the line told me all hell broke loose in the wake of this e-mail. The support department was not briefed before this measure and generally I have great doubts whether anyone so much as thought for even a second before pushing the roll-out button for this function.

I also wrote an e-mail to the complaint management department of Unitymedia and got a very cocky answer back. In the first few lines I feel like they thought I was a child, then they somehow claim to be a "Wi-Fi company" whatever that's supposed to mean. They also told me that this was an automatic rollout - d'uh - so that individual cases could not be respected. They did however not elaborate on my most important point: The boldness it takes to announce such an update while at the same time admitting it's a possibly security flaw.

Utilizing your Customers

Just a few days ago I've received another letter from Unitymedia, announcing a new feature to be included in every internet contract with them... They call it WiFiSpot, and as you probably guessed, it's a Wi-Fi hotspot... with a slight quirk.

Unitymedia plans to enable a seperate Wi-Fi network on every single one of their customers' cable modems, which can be used by other Unitymedia clients to surf for free when they are in reach. Sounds like a good idea, until you think about what hardware you got from them. As said before, the TC7200 is at best a toy. Customers have rather no control over this thing and every single setting can be read and (re-)set by Unitymedia at will. When you try to put it in a mode that Unitymedia doesn't want you to use, it reboots, and if  you are really lucky resets all your settings. This thing can for example not be put into a simple bridge mode, where it acts like just a cable modem but not like a router. If you try that, it reboots. This is probably due to DS-Lite, but I don't use that, which is why I don't see any reason for this limitation – except for the obvious one of course: They want to force you to use the device they provided, so that they can have control.

At least with this feature they gave an easy method to opt out, even though that it means you won't be able to use the WiFiSpots. I think this is fair, but I still think utilizing your clients is bad.

Last weekend I was asked to downgrade the Samsung NP355-E7C of a family member to Windows 7. Even though this wasn't the first time I had to do such a thing and though Samsung provides quite detailed instructions on how to get this done, it took me about 4 hours to get this done. This does not include any backing up of data, any personal setup or anything similar.

The instructions start with telling you, how to go to the BIOS to set the boot order and also, as this notebook comes with a UEFI-system rather than a BIOS, you need to tell it, that the upcoming OS doesn't feature a native UEFI support.

Then you can start the normal Windows 7 Setup routine using a DVD or an USB-stick. That routine runs through just like expected, the only problem is, you need to delete ALL preconfigured partitions, this includes the recovery partitions. Next up, configuring the main user account, everything works as expected, until you get to the first boot.

The first boot

When the system first starts up, you will be greeted by a message that says:

"Some drivers could not be installed".

Well Some drivers is an understatement as in fact Windows is unable to find drivers for almost any of the main components, except the graphics chip. I connected an ethernet-cable to the laptop, yet it told me, it didn't have any network connectivity.

Next step: Opening the Device Manager

Opening the Device Manager is even more deflating, as Windows blatantly shows you that you won't have any possibility to get data in and out of this laptop except optical media.

That is:

• No USB
• No Ethernet
• No WiFi

But thankfully I had a device to create optical discs at my disposal.

The odyssey begins

Okay, I thought, no drivers, great, well thankfully I can get them from the Samsung website. So I navigated to the support page for the laptop, went to the download section and was presented with lots and lots of manuals. Not a chance to find any drivers wherever I looked. But then I saw the link to SWUpdate.exe, the downloader Samsung provides to get drivers for their laptops, not great I thought, but okay, I'll give it a chance. No sooner said than done, I downloaded the software, burned it to a CD, hoping it came with a basic set of drivers for the laptop, installed it, but no such luck, still no connectivity whatsoever and the software won't work without an internet connection.

Okay, more websearching, seemingly the problem was quite known across the web. After some time I found a tip on a web forum telling me, where I could find the wifi-driver for the laptop. So I downloaded that, burned it to a disc, installed it and was suddenly sitting in front of the first PC I know which had WiFi before it understood USB.

Then I started up the downloader again, and oh wonder, it works but here come the next disappointment, I looked through the software they offered and there was every single piece of junkware Samsung puts on their laptops before delivery. But hey, I got my drivers and I could continue setting up the laptop.

How all this could have been prevented

• Samsung provides a downgrade path, on their website, and it starts with "Go to the BIOS and change this and that setting". Okay, but the whole thing (containing about 14 steps) does not mention the fact, that you need to backup the drivers using the "Create a recovery disc"-assistent. That was the first mistake.
• The second mistake was not providing the drivers on the Samsung website, or just mentioning, which components were used in the device in the first place.
• The third mistake, though that is kind of understandable, was not including a basic version of the drivers with the SWUpdate.exe-setup.
• And the fourth mistake was integrating components that don't work with the basic drivers Microsoft provides with every version of Windows.

A bit less than one year ago, I wrote a short blogpost about the devastating situation regarding podcatchers on Android. Today I want to give an update on this topic. As you might remember, I have very high standards considering podcatchers. For those of you, who did not read the aforementioned post, I will start by repeating the criteria I have for a good, usable podcatcher.

Criteria

Critical

• Stability - A podcatcher I want to use needs to be stable and should not crash every five minutes.
• Usability - No lags, no heavily nested menus, no hidden functions
• Clarity - A podcatcher needs to have a clear and simple UI.
• OPML-Import and Export - A podcast-directory, however good it may be, I don't want to use it on a smartphone. So I want to have the possibility to import a list of podcasts in a standardized format, like OPML.
• Adjustable Playback-Speed - I've been hearing podcasts with a higher playback-speed for some years now, so I'm used to high playback-speeds.
• Shownotes - Shownotes need to be reachable at any time and need to be displayed properly and unshorted.
• Full-Reloads of Podcast-Feeds - Podcast-feeds tend to be broken, therefore a method to COMPLETELY reload a feed, without deleting and re-adding the podcast to my subscribed feeds.

Nice-to-have

• Podlove-Simple-Chapters - Chapters in podcast-files
• Flattr-Integration
• Podcast-Streaming
• Sync
• Categories for Feeds
• Support for Paged Feeds [RFC5005]

Bonus Points

• Open Source
• Podlove aware
• Interest in open standards

The Continuation

Eventhough I said, I'd cancel the experiment, I continued testing and ended up using BeyondPod for the last months. BeyondPod is not too bad to use, but it has some issues which are quite annoying. It fulfills most of my critical criteria, but fails to comply with nearly every item on my nice-to-have-list. Additionally BeyondPod isn't open source and the developer showed little interest in continuing the pursuit to open standards.

The Solution

In my previous blogpost I mentioned AntennaPod, which through a recent update manages to fulfill nearly all of my critical criteria, especially the adjustable playback-speed one. AntennaPod is Open Source Software hosted on GitHub which gives some bonus points. It has a clean, plain, simple interface with almost no nested menus and the shownotes viewer is simple and fast. The app features a flattr-integration with optional auto-flattring of heard episodes. Unfortunately the app doesn't yet support paged feeds.

What's Missing?

Since I've been using BeyondPod recently, I've been spoiled a little, so I'm missing some features BeyondPod has, in AntennaPod. First of all, what I'm missing is a list of the downloaded, already played episodes, so I have a chance to manually delete episodes I do not want to hear again, or get rid of all downloaded, played episodes at once. Secondly I've been using BeyondPod's category feature quite a bit, so I kind of miss having that possibility in AntennaPod. Thirdly, I'd love to have support for paged feeds in the app, to access complete archives of my favourite podcasts. Last but not least I should mention that AntennaPod is unfortunately missing a syncing feature at the moment. But since I only have one Android device I use, it doesn't matter too much for me.

In conclusion I want you to start up Google Play and download AntennaPod. The app is available for free on Google Play, if you like it, please flattr the developer.
Have fun and enjoy testing this great app.