Friday, February 11, 2005

Default Password List Website Links

http://www.phenoelit.de/dpl/dpl.html

CIRT.Net
http://www.cirt.net/cgi-bin/passwd.pl
System Preparation Tool (Sysprep) Script File Keys

Article ID : 196667
Last Review : September 9, 2002
Revision : 1.0
This article was previously published under Q196667


On this page
SUMMARY
MORE INFORMATION
REFERENCES

SUMMARY
When you use the Microsoft System Preparation (Sysprep) tool, a wizard runs the next time the computer is started after the tool prepares the computer and copies an image to the computer. You can automate this process by creating a script file. To use Sysprep with a script file, use the following syntax

sysprep.exe

where is the name of the script file.

Note that the script file must contain one section called [NT4Preinstall].
MORE INFORMATION
Script File Keys
You can use the following keys in the Sysprep script file:
Key name: OemSkipEula
Values: Yes | No
Description: This key disables the display of the End User License
Agreement (EULA) when the value is set to Yes. The default
value is No.

Key name: ProductID
Value: xxx-xxxxxxx OR xxxxx-OEM-xxxxxx-xxxxx
Description: This key specifies whether the Product ID screen should be
displayed. The Product ID key is displayed by default.

Key name: FullName
Value:
Description: This key specifies the user's name. If this key is not
specified or the string value is blank, the User Name And
Organization screen is displayed.

Key name: OrgName
Value:
Description: This key specifies the user's organization or company name.
If this key is not specified or the string value is blank,
the User Name And Organization screen is displayed, unless
the FullName key is specified with a valid string value.

Key name: ComputerName
Values: | "Auto"
Description: This key specifies the computer name. If this key is not
specified or the string value is blank, the Computer Name
screen is displayed. The string value must be a minimum of 1
non-white-space character and a maximum of 15 non-white-space
characters.

If this string value is set to "Auto," Setup automatically
generates a unique computer name based on a random number.
This provides a mechanism to install multiple computers with
a unique computer name.

Key name: AdminPassword
Value:
Description: This key specifies the password for the administrator
account. If this key is not specified or the string value is
blank, the Administrator Password screen is displayed. The
string value must be a minimum of 1 non-white-space character
and a maximum of 15 non-white-space characters. To specify a
blank or NULL password use "*".

Key name: OEMBannerText
Value:
Description: This key specifies a string to be displayed in the upper-left
corner of the screen. The text must contain the "Windows NT"
sub-string or it is ignored. You can specify multiple lines
by using the "*" character as a separator.

Key name: OEMLogoBitmapFile
Values: [, ]
Description: This key specifies a bitmap to be displayed in the upper-
right corner of the screen. If this key has only one field,
it is assumed to be a bitmap (.bmp) file located in the
folder in which the System Preparation tool resides. If two
fields are specified, the first field is the name of a
dynamic-link library (DLL) and the second field is a decimal
number that represents the resource ID of the bitmap in the
DLL. The DLL should be located in the folder that contains
Sysprep.exe.

Key name: OEMBackgroundBitmapFile
Values: [,]
Description: This key specifies a background bitmap to display. If this
key has only one field, it is assumed to be a bitmap (.bmp)
file located in the folder in which Sysprep.exe resides. If
two fields are specified, the first field is the name of a
dynamic-link library (DLL) and the second field is a decimal
number that represents the resource ID of the bitmap in the
DLL. The DLL should be located in the folder that contains
Sysprep.exe.

Key name: OEMSkipWelcome
Values: 0 | 1
Description: If this key is set to 1, the Welcome page is skipped. If the
key is set to 0, the Welcome page is displayed.

Key name: OEMNoWaitAfterGUIMode
Values: 0 | 1
Description: If this key is set to 1, the Finished page is not displayed
and the computer is automatically restarted when the wizard
is finished. If the key is set to 0, the Finished page is
displayed and the computer does not automatically restart.

Key name: NoSidGen
Value: Yes | No
Description: This key disables the Security Identification (SID)
modification code. Set this key to Yes to disable the SID
modification code. You might use this value if the computer
is to be preconfigured with system services and access (ACL)
permissions. This allows a system integrator or administrator
to preconfigure a computer and set the computer name,
administrator password, and other settings at the final
location.

NOTE: Do not use this key if you plan to duplicate the
system.

Sample Script File
The following sample file is an example of a Windows NT 4.0 Mini-Setup wizard script:
[NT4Preinstall]
OemSkipEula = Yes
ProductID = 123-4567890
FullName = "Sample Company User"
OrgName = "Sample Company Inc."
ComputerName = "auto"
AdminPassword = "password"

Sysprep.exe Command-Line Switches
Sysprep supports the following command-line switches:
Switch:
Description: Instructs the Windows NT 4.0 Mini-Setup wizard to use the
settings in the specified script file automatically. For
example, the following command specifies that the Mini-Setup
wizard should use the settings in the Nt4setup.inf file:

sysprep nt4setup.inf

NOTE: There is no dash preceding the script file name.

Switch: -quiet
Description: Instructs Sysprep to run without displaying a warning dialog
box. For example, the following command specifies that only
the license information screen should be displayed:

sysprep -quiet

The warning message stating that the computer is going to be
prepared for disk imaging and automatically shut down is not
displayed, and the computer shuts down automatically.

NOTE: The preceding dash is required.

Switch: -reboot
Description: Instructs Sysprep to automatically restart the computer. For
example, the following command specifies that the computer is
restarted automatically instead of being shut down after
Sysprep has finished:

sysprep -reboot

You should not use this switch if you are preparing the
computer for disk imaging. This switch may be useful if you
plan to automate a test process designed to run after Sysprep
has finished.

NOTE: The preceding dash is required.

Switch: -defeat
Description: Instructs Sysprep to run on a computer that has retail
versions of Windows NT 4.0 Workstation or Windows NT 4.0
Server and Microsoft Office 97. Normally, Sysprep requires
a Microsoft Select Volume CD-ROM or an OEM (Original
Equipment Manufacturer) CD-ROM installation to run.


The following sample Sysprep command uses all the command-line switches:

sysprep setupscript.inf -quiet -reboot -defeat

REFERENCES
For additional information about Sysprep, please review the Sysprep.doc file that is included with the Sysprep tool.

Wednesday, January 12, 2005

Cannot Start Windows XP After You Install Windows 2000

Article ID : 283433
Last Review : November 18, 2003
Revision : 1.0
This article was previously published under Q283433


On this Page
SYMPTOMS
CAUSE
RESOLUTION
STATUS
MORE INFORMATION

SYMPTOMS
When you attempt to start Windows XP after you install Windows 2000, you may receive the following error message:
"Starting Windows...
Windows 2000 could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM.

You can attempt to repair this file by starting Windows 2000 Setup using the original Setup floppy disk or CD-ROM.
Select 'r' at the first screen to start repair."
If the Windows XP install was an upgrade from Windows 2000, you may instead receive the following error message on a blue screen while attempting to start Windows XP:
BAD_SYSTEM_CONFIG_INFO
STOP 0x00000074
CAUSE
This issue occurs because Windows XP did not exist when Windows 2000 was released. The Windows 2000 bootstrap loader files are not aware of the changes that have been made in Windows XP. The computer needs these changes to load Windows XP.

NOTE: If you attempt to install Windows 2000 in a different partition while the computer is running Windows XP, you may receive the following error message:
This CD-ROM is from an older version of Windows than the one you are presently using. Setup functionality from this disk will be disabled.
RESOLUTION
To work around this issue, start the computer in Windows 2000, and then copy the NTLDR and Ntdetect.com files from the I386 folder on the Windows XP CD-ROM to the root of the system drive.

Even though a workaround for this issue is described in this article, you can only perform a dual Startup when you install Windows XP in a different partition after you install Windows 2000.
STATUS
This behavior is by design. In general, products are not forward compatible with future products because the design updates of future versions are unknown.
MORE INFORMATION
If you want to start multiple operating systems, install each operating system in a different partition in the following order: 1. Microsoft Windows 95, Microsoft Windows 98, or Microsoft Windows Millennium Edition (Me)
2. Microsoft Windows NT 4.0
3. Microsoft Windows 2000
4. Microsoft Windows XP
If you do not want to start the computer in all the operating systems that are listed, skip the ones that you do not need. NOTE: Do not convert the hard disk from Basic Disk to Dynamic Disk until you install all of the operating systems that you intend to use. Once you convert the hard disk from Basic Disk to Dynamic Disk, you may be unable to install any other operating systems on that hard disk.

For additional information about dynamic disks, click the article numbers below to view the articles in the Microsoft Knowledge Base:
175761 Dynamic vs. Basic Storage in Windows 2000
114841 Windows NT Boot Process and Hard Disk Constraints

Monday, January 10, 2005

Read-Only USB Storage

If you've been concerned about the possibility that users in your Windows XP environment might plug in a USB storage key and walk away with hundreds of megabytes of proprietary corporate information, XP Service Pack 2 (SP 2) lets you make USB storage devices read only, removing the possibility of leaking data via a USB key. To configure USB storage for read only, perform the following steps:

1. Launch the registry editor.

2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

3. You should see a key called StorageDevicePolicies. If it doesn't exist, create a new key with that name.

4. In the StorageDevicePolicy key, create a REG_DWORD value called WriteProtect.

5. Set the data value of WriteProtect to 1.

6. This value will make USB storage read only. To enable read/write over USB, set the value to 0.

7. Exit the editor.

Make sure that you aren't using other USB storage devices such as hard drives or a CD/DVD writer before you set this registry value.

Wednesday, December 01, 2004

Daily News
Planet Alignment Could Crash Net
By Martin Stone, Newsbytes.
February 03, 2000


Doomsday forecasters have shifted their attention from the Millennium Bug, which proved to have little bite, to an extraterrestrial occurrence destined to take place May 5, when a cluster of planets will align with the Earth.

Some say the phenomenon has the potential of creating colossal cosmic forces which could severely impact our planet.

Occurring only once every 6,000 years or so, the rare alignment of Mercury, Venus, Mars, Jupiter, Saturn, the Earth, the Sun, and the Moon could cause a magnetic surge with the potential to crash power grids, blind satellites, and seriously disrupt radio and landline communications, taking the Internet down in the process.

However, not all astronomers agree that the so-called "grand alignment" will have an effect on terra firma. According to a Canadian newspaper report this week, John Mosely, an astronomer at the Griffith Observatory in Los Angeles, has proclaimed, "There will be no effect whatsoever. It's just complete nonsense." An astronomer at St. Mary's University in Halifax was blunter, calling the fears, "Just a load of crap."

But the same article, filed by the Canadian Press wire service and carried by Monday's Montreal Gazette newspaper, quoted Georgia-based futurist Richard Noone as saying the alignment could trigger a massive magnetic flux and a huge solar storm. "We're talking about a solar mass ejection in which a billion-tonne wave of super-hot, electrically charged gas is discharged from the Sun and crosses space like a giant tidal wave. It would crash into Earth's electromagnetic field at 620 miles a second."

As well as the communications systems wipeout, Noone predicts the cosmic event could produce a spectacular display of northern lights, which he said might be visible as far south as Florida.

Survival Center Website operator Craig Smith told Newsbytes, "Yes, the potential does exist. The big question is - but will it?" He refers to Noone's article "Are We Approaching the Abyss?" and quotes, "Past solar storms have caused incredible damage, including disruptions of radio, television, telephone, satellites, radar, power lines, power company grids and other sophisticated electronic technologies. These past solar storms will be mere blips of inconvenience to us, compared to The Storm of the Millennium coming this spring."

More of Noone's predictions can be found at http://rnoone.com .

However, Philip Plait, operator of an astronomy-focused Website, told Newsbytes, "There will be no natural ramifications whatsoever from this alignment. The gravitational and tidal effects are so puny that they will be unmeasurable. Last December's full Moon was unusually close. I did a quick calculation and showed that the gravity of that full Moon was much larger than the Moon and planets in this upcoming alignment. We weren't destroyed on Dec. 22, and we won't be in May.

"There won't be any electromagnetic effects either. The Sun is the only real contributor of these kinds of effects to the Earth. The sunspot cycle and therefore solar activity will be at a maximum this year. However, this has nothing to do with the alignment."

Plait has posted a wealth of grand alignment information on his site at http://www.badastronomy.co/bad/misc/planets.html .

Other doomsayers fear an extraordinary gravitational pull on our planet, which would wreak havoc in many ways, including causing the Earth's tilt to change, not to mention earthquakes and floods.

Many scientists anticipate a major solar disturbance this year but most insist the grand alignment will have no effect on solar storms, which occur in predictable 11-year cycles. Major storms and eruptions on the Sun's surface have been known to affect communications systems and are blamed for a province-wide blackout in Quebec in 1989.

Plait summed up the controversy by declaring, "There will be a lot of people trying to tell you something different than what I am saying here. Chances are, they're trying to sell something."

Reported by Newsbytes.com

Friday, November 26, 2004

Windows Server 2003 10 in 1 CD


The Windows Server 2003 family builds on the proven reliability,
scalability, and manageability of Windows 2000 Server while improving
essential services. Now with enhanced security and better performance,
the Windows Server 2003 family offers the best server infrastructure
for increasing IT efficiency, developing applications quickly, and
enhancing productivity.

This release includes both corporate (VLK) and Retail versions of:
Microsoft Windows Server 2003, Enterprise Edition (32-Bit)
Microsoft Windows Server 2003, Datacenter Edition (32-Bit)
Microsoft Windows Server 2003, Small Business Edition CD1
Microsoft Windows Server 2003, Standard Edition
Microsoft Windows Server 2003, Web Edition

This is the all-in-one release of Windows Server 2003,
with the Datacenter, Enterprise, Small Business, Standard and Web
Editions. Also this is a Volume License ISO, which never needs to be
activated. This version also includes the patched uxtheme.dll in every
version so no patching is required. Use the included Reset 5.02 to bypass
activation for non-vlk installations. CD-Keys are automatically entered
in each setup. Download Small Business CD2/3 to complete the install of
Windows Server 2003 Small Business.

o------------------------ I N S T A L L N O T E S ------------------------o

1. Instert CD and install your favorite flavor of Windows 2003 or boot
from CD and install.

2. CD Keys: illegal to provide this info
Enterprise/Datacenter: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
Small Business: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
Standard: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
VLK: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
Web: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Thursday, November 18, 2004

Generic Product Keys

Deploying Windows XP Using Windows Product Activation

All of the examples provided above used a beta key for illustration purposes. The product keys listed in this section can be used with any of the answer files and scripted examples. They are blocked at the Microsoft clearinghouse and therefore cannot be used to activate any systems. They provide a number of days (assume 14 days) for you to complete the activation process.

It is absolutely essential that you use the correct type of key, which is a function of the platform type and the media. Choose the key and corresponding sequence number for your scripts from the following table:

Generic Product Keys

Applicability
Product Key
Sequence Number

Whistler Tech Beta Program
(All Platforms)
PXRQ3-7VPMV-CQWXR-8Y4KX-RD786
010053298

Windows XP
Home Edition
Full product
JKTVX-HCRXC-J2YC9-MX3K4-G9X26
005037750

Windows XP
Home Edition
Upgrade
C84VB-JYVFD-P7HF4-6KKRJ-7M6XH
010000182

Windows XP Professional
Full product
DR8GV-C8V6J-BYXHG-7PYJR-DB66Y
005072760

Windows XP Professional
Upgrade
FKTW8-Q7MJ7-JK6GW-9J9RV-HC3C2
010000212

Windows XP
Home Edition
System Builder (Full)
KGVXT-F9HVW-XGW9X-QVYVX-HQ9RD
120000613

Windows XP Professional
System Builder (Full)
TTGHK-3RC33-BT9DR-3BVYV-BTQ98
120000607


Original Link : http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/wpadepl.mspx
Unlocking WinXP's setupp.ini

WinXP's setupp.ini controls how the CD acts. IE is it an OEM version or retail? First, find your setupp.ini file in the i386 directory on your WinXP CD. Open it up, it'll look something like this:

ExtraData=707A667567736F696F697911AE7E05
Pid=55034000

The Pid value is what we're interested in. What's there now looks like a standard default. There are special numbers that determine if it's a retail, oem, or volume license edition. First, we break down that number into two parts. The first five digits determines how the CD will behave, ie is it a retail cd that lets you clean install or upgrade, or an oem cd that only lets you perform a clean install? The last three digits determines what CD key it will accept. You are able to mix and match these values. For example you could make a WinXP cd that acted like a retail cd, yet accepted OEM keys.

Now, for the actual values. Remember the first and last values are interchangable, but usually you'd keep them as a pair:

Retail = 51882 335
Volume License = 51883 270
OEM = 82503 OEM
So if you wanted a retail CD that took retail keys, the last line of your setupp.ini file would read:

Pid=51882335

And if you wanted a retail CD that took OEM keys, you'd use:

Pid=51882OEM

Note that this does NOT get rid of WinXP's activation. Changing the Pid to a Volume License will not bypass activation. You must have a volume license (corporate) key to do so.

Just some random screenshots:
Here we have an OEM version of WinXP letting us know we can't upgrade:















Remove Saved Passwords

Windows XP offers the ability to save passwords for web sites and network resources. This can be very convenient as opposed to remembering and entering the username and password each time you need access, but it poses a security risk because anyone who has physical access to your computer would also be able to log into those sites using your saved credentials. While biometrics and other user authentication methods have become more widely used and accepted in recent years, the prevailing method of user athentication remains the username and password. Users have passwords to access their computer, shared network resources, web sites, business applications and other resources.
Different sites and applications have different policies regarding how to create the passwords and standard security practices suggest that users should use a different and unique password for each login. For many users it becomes unruly to recall the various usernames and passwords and they may write them down on a notepad in their desk drawer or put it on a sticky note on their monitor so they can remember them all. Of course, anyone else can also come along and read the passwords as well.
Windows XP offers users the ability to retain passwords so that the authentication information required to login is automatically pre-populated when the different sites or resources are accessed rather than the user having to enter them each time. Because this requires being logged into the computer in the first place it provides some convenience for the user while remaining more secure than writing everything on a sticky note on the monitor. Unfortunately, it is still counter-productive from a security perspective because anyone who sits down at the computer while it is logged in or gains access to your computer user account will subsequently be able to access all of the various sites and resources as if they were the user because of the cached login credentials.
Windows XP does not offer a very easy way to review or remove the saved passwords though. If you follow the steps below though you can access a graphical interface to add, remove or edit the saved passwords on a given system.

1. Click Start and select Run
2. In the Open field type "rundll32.exe keymgr.dll, KRShowKeyMgr"
3. Once the Stored Usernames and Passwords interface opens you can select any of the entries and select Properties to view the existing information
4. To remove a saved password you can select one of the entries and select Remove. A confirmation screen will appear. Click on OK and the account will be removed
5. You can add additional saved passwords as well by clicking on the Add button and entering the appropriate information
6. Repeat the steps above as needed to add, remove or edit saved passwords
7. When you are done using the interface click the Close button

Tony Bradley is a consultant and writer with a focus on network security, antivirus and incident response. He is the About.com Guide for Internet / Network Security (http://netsecurity.about.com), providing a broad range of information security tips, advice, reviews and information. Tony also contributes frequently to other industry publications. For a complete list of his freelance contributions you can visit Essential Computer Security (http://www.tonybradley.com).

Saturday, October 23, 2004

Registry Reference for Windows Server 2003


ProductType HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions

Data type Range Default value
REG_SZ Platform identifier Windows XP Professional: WinNT
Windows Server 2003: ServerNT or LanmanNT

Description
Stores data that identifies the operating system platform running on the computer. This data lets programs identify and customize their features to the platform.

In Windows Server 2003, the following entries identify the platform options.

Value Meaning
WinNT Windows XP Professional
ServerNT Windows Server 2003
LanmanNT Windows Server 2003

Tip

To view this data, programs can use the GetVersionEx and VerifyVersionInfo application programming interfaces.

Caution

Do not delete this entry or change its value. This entry stores protected operating system data. Editing this data violates your Windows Server 2003 licensing agreement and disqualifies you from receiving Microsoft Product Support Services service. If a program tries to change the data, the system stops abnormally and displays a blue screen.
Windows 9x install control

Do you need to install Windows from your CD but lost the CD Key and the Certificate of Authenticity? There are a few methods that you can use to get Windows installed. On this page I will discuss two of the easiest methods for installing Windows 9x and Millennium without a key.

The idea here is to get Windows to think it is either an OEM version being installed that does not require the CD Key or make Windows think it is being installed over a network without supervision so that a CD key is not asked for.

To get this accomplished we need to change the setting ProductType in the Setuppp.inf file located inside one of the Precopy?.cab files. Windows Me uses only Precopy1.cab while 9x can use 2 or 3. Since we cannot re-save the file back into the cab file we need to approach this from a different angle.

You may need to try a few different methods to get the one that works for you.

Method One: (easiest)
Start installing Windows from inside of Windows. When you are asked to except the License Agreement do not click on "Next", YET! Now bring up the Start Menu (Ctrl + ESC buttons) and in the Run window type Notepad. Have Notepad open the file WININST0.400\Setuppp.inf. Do a search for the string "ProductType", and change the value from 9 to 1. If the value 1 fails try one of the other values as noted below

ProductType=1: Upgrades without asking for CD KEY (serial number)
ProductType=2: CD Key required
ProductType=5: Asks for CD Key, but won't take valid keys- and you get the option to "ignore" and go on.
ProductType=6: Works OK (?) (?)
ProductType=7: Works on Windows 95 and 95 A
ProductType=9: OEM non upgrade version

Now save the changes and continue the installation.

Method Two:
You will need to copy all the Windows installation files to your hard drive first. Then in the same folder you copied the files to create a new file Msbatch.inf. Add the following:
[Setup]
ProductType=1
(press Enter)
(press Enter)

Save the file and install Windows.

When Windows has completed installing go to the Registry Key in RegEdit HKEY_LOCAL_MACHINE|Software\Microsoft\Windows\CurrentVersion and get the value of the Data "ProductKey", for Windows 95, it will be "ProductID". If you have Windows 98 or ME do not use the value from "ProductID". Save the information, this is your Windows CD Key.
Patriot Games (pg)

Written by: Tom Clancy

First published: 1987

Known translations:
Danish - Patrioternes Spil
Italian - attentato alla corte d'Inghilterra - 1987

Plot:
Jack Ryan is on vacation in London with his wife Cathy and his daughter Sally while doing some research for a book he is writing. As Ryan meets his family at St. James Park, they witness a terrorist attack on a member of British royal family. Ryan, a former US Marine, charges the terrorists and foils their attack killing one and wounding another. The terrorists belong to ULA (Ulster Liberation Army), an offshoot of the IRA, whom doesn't approve of the attack. Sean Miller, fanatic member of the ULA and the mastermind behind the attack, won't let Ryan get away with it. Admiral Greer urges Jack to join the CIA in order to protect the Ryan family from the terrorists' revenge.
The Hunt for Red October (hfro)

Written by: Tom Clancy

First published: 1984

Known translations:
Danish - Jagten på Røde Oktober
Italian - la grande fuga dell'Ottobre rosso
Dutch - De jacht op Red October (1986)

Plot:
Russia's newest Typhoon-class nuclear missile submarine Red October, equipped with a silent propulsion system, sets sail from Murmansk. At the same time a mysterious letter is sent from Red October's captain, Marko Ramius, to the chief political officer of the Soviet Navy. Shortly after almost the entire Soviet fleet in the North Atlantic and Mediterranean sets out for the Atlantic Ocean with the mission to hunt down and destroy the Red October. CIA-analyst Jack Ryan believes that Ramius is trying to defect to the West. The Pentagon and White House generals do not believe in his idea. They believe Soviet's story, that Ramius is a madman and that he will launch his nuclear missiles at the United States. A race between NATO and the Soviet Union begins. Who will find the Red October first? In the middle of all this Ryan is trying to get to Ramius and help him.

Monday, October 18, 2004

Spoof MAC Address

Goto Start->Run, type "cmd" to goto command prompt

Type "ipconfig /all" and record the MAC address for each network adapter

Goto Start->Run, type "regedit" to bring up registry editor. Make sure you backup your registry in case you screw up. If you screw up important registry entries, you may damage your computer system. Again, MAKE SURE you have a good backup of your registry entry!

Locate "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\\Parameters". should have subkeys like "xyz0000", "xyz0001", "xyz0002" and so on.

Click on each subkey that starts with "0000" and determine your Ethernet card by looking at "DriverDesc" key. If it did not match, then goto "0001", "0002" and so on...

Once you got the right NIC card,

Click on dropdown menu Edit->New->String Value.

Name the new string "NetworkAddress" and click OK.

Double-click on the new "NetworkAddress" string and you will be prompted for "Value data"

Enter the new MAC address you want to assign. The MAC address you enter should be a 12 digit number with NO "-", i.e. "00C095ECB761"

Reboot your system

Verify the new MAC address with "IPCONFIG"

Resources:

Saturday, October 16, 2004

Boot INI Options Reference
Source - Sysinternals.com

There are number of BOOT.INI switches that are useful for driver developers that wish to test their drivers under a variety of different system configurations without having to have a separate machine for every one. For example, limiting the amount of memory NT sees can be useful for stressing memory loads, and limiting the number of processors for testing scalability. I've compiled a complete list of the options that BOOT.INI currently supports. This list is reproduced in the Startup, Shutdown and Crashes chapter of Inside Windows 2000, 3rd Ed., where you'll find more information about the boot process. Entries in red were introduced in Windows 2000 and those in blue introduced in Windows XP or Windows Server 2003.

/3GB
Increases the size of the user process address space from 2 GB to 3 GB (and therefore reduces the size of system space from 2 GB to 1 GB). Giving virtual-memory- intensive applications such as database servers a larger address space can improve their performance. For an application to take advantage of this feature, however, two additional conditions must be met: the system must be running Windows XP, Windows Server 2003, Windows 2000 Advanced Server or Datacenter Server and the application .exe must be flagged as a 3-GB-aware application. (See the section “Address Space Layout” in Chapter 7 for more information.)

/BASEVIDEO
Causes Windows to use the standard VGA display driver for GUI-mode operations.

/BAUDRATE=
Enables kernel-mode debugging and specifies an override for the default baud rate (19200) at which a remote kernel debugger host will connect. Example: /BAUDRATE=115200.

/BOOTLOG
Causes Windows to write a log of the boot to the file %SystemRoot%\Ntbtlog.txt.

/BOOTLOGO
Use this switch to have Windows XP or Windows Server 2003 display an installable splash screen instead of the standard splash screen. First, create a 16-color (any 16 colors) 640x480 bitmap and save it in the Windows directory with the name Boot.bmp. Then add "/bootlogo /noguiboot" to the boot.ini selection.

/BREAK
Causes the hardware abstraction layer (HAL) to stop at a breakpoint at HAL initialization. The first thing the Windows kernel does when it initializes is to initialize the HAL, so this breakpoint is the earliest one possible. The HAL will wait indefinitely at the breakpoint until a kernel-debugger connection is made. If the switch is used without the /DEBUG switch, the system will Blue Screen with a STOP code of 0x00000078 (PHASE0_ EXCEPTION).

/BURNMEMORY=
Specifies an amount of memory Windows can't use (similar to the /MAXMEM switch). The value is specified in megabytes. Example: /BURNMEMORY=128 would indicate that Windows can't use 128 MB of the total physical memory on the machine.

/CHANNEL=
Used on conjunction with /DEBUGPORT=1394 to specify the IEEE 1394 channel through which kernel debugging communications will flow. This can be any number between 0 and 62 and defaults to 0 if not set.

/CLKLVL
Causes the standard x86 multiprocessor HAL (Halmps.dll) to configure itself for a level-sensitive system clock rather then an edge-triggered clock. Level-sensitive and edge-triggered are terms used to describe hardware interrupt types.

/CMDCONS
Passed when booting with into the Recovery Console (described later in this chapter).

/CRASHDEBUG
Causes the kernel debugger to be loaded when the system boots, but to remain inactive unless a crash occurs. This allows the serial port that the kernel debugger would use to be available for use by the system until the system crashes (vs. /DEBUG, which causes the kernel debugger to use the serial port for the life of the system session).

/DEBUG
Enables kernel-mode debugging.

/DEBUGPORT=
Enables kernel-mode debugging and specifies an override for the default serial (usually COM2 on systems with at least two serial ports) to which a remote kernel-debugger host is connected. Windows XP and Windows Server 2003 also support debugging through accept IEEE 1394 ports. Examples: /DEBUGPORT=COM2, /DEBUGPORT=1394.

/EXECUTE
This optionIt disables no-execute protection. See the /NOEXECUTE switch for more information.

/FASTDETECT
Default boot option for Windows. Replaces the Windows NT 4 switch /NOSERIALMICE. The reason the qualifier exists (vs. just having NTDETECT perform this operation by default) is so that NTDETECT can support booting Windows NT 4. Windows Plug and Play device drivers perform detection of parallel and serial devices, but Windows NT 4 expects NTDETECT to perform the detection. Thus, specifying /FASTDETECT causes NTDETECT to skip parallel and serial device enumeration (actions that are not required when booting Windows), whereas omitting the switch causes NTDETECT to perform this enumeration (which is required for booting Windows NT 4).

/INTAFFINITY
Directs the standard x86 multiprocessor HAL (Halmps.dll) to set interrupt affinities such that only the highest numbered processor will receive interrupts. Without the switch, the HAL defaults to its normal behavior of letting all processors receive interrupts.

/KERNEL=
/HAL=
Enable you to override Ntldr's default filename for the kernel image (Ntoskrnl.exe) and/or the HAL (Hal.dll). These options are useful for alternating between a checked kernel environment and a free (retail) kernel environment or even to manually select a different HAL. If you want to boot a checked environment that consists solely of the checked kernel and HAL, which is typically all that is needed to test drivers, follow these steps on a system installed with the free build:

• Copy the checked versions of the kernel images from the checked build CD to your \Windows\System32 directory, giving the images different names than the default. For example, if you're on a uniprocessor, copy Ntoskrnl.exe to Ntoschk.exe and Ntkrnlpa.exe to Ntoschkpa.exe. If you're on a multiprocessor, copy Ntkrnlmp.exe to Ntoschk.exe and Ntkrpamp.exe to Ntoschkpa.exe. The kernel filename must be an 8.3-style short name.

• Copy the checked version of the appropriate HAL needed for your system from \I386\Driver.cab on the checked build CD to your \Windows\System32 directory, naming it Halchk.dll. To determine which HAL to copy, open \Windows\Repair\Setup.log and search for Hal.dll; you'll find a line like \WINDOWS\system32\ hal.dll="halacpi.dll","1d8a1". The name immediately to the right of the equals sign is the name of the HAL you should copy. The HAL filename must be an 8.3-style short name.

• Make a copy of the default line in the system's Boot.ini file.

• In the string description of the boot selection, add something that indicates that the new selection will be for a checked build environment (for example, “Windows XP Professional Checked”).

• Add the following to the end of the new selection's line: /KERNEL=NTOSCHK.EXE /HAL= HALCHK.DLL

Now when the selection menu appears during the boot process you can select the new entry to boot a checked environment or select the entry you were using to boot the free build.

/LASTKNOWNGOOD
Causes the system to boot as if the LastKnownGood boot option was selected.

/MAXMEM=
Limits Windows to ignore (not use) physical memory beyond the amount indicated. The number is interpreted in megabytes. Example: /MAXMEM=32 would limit the system to using the first 32 MB of physical memory even if more were present.

/MAXPROCSPERCLUSTER=
For the standard x86 multiprocessor HAL (Halmps.dll), forces cluster-mode Advanced Programmable Interrupt Controller (APIC) addressing (not supported on systems with an 82489DX external APIC interrupt controller).

/MININT
This option is used by Windows PE (Preinstallation Environment) and causes the Configuration Manager to load the Registry SYSTEM hive as a volatile hive such that changes made to it in memory are not saved back to the hive image.

/NODEBUG
Prevents kernel-mode debugging from being initialized. Overrides the specification of any of the three debug-related switches, /DEBUG, /DEBUGPORT, and /BAUDRATE.

/NOEXECUTE
This option is only available on 32-bit versions of Windows when running on AMD64 processors and only when PAE (see the /PAE switch) is also enabled. It enables no-execute protection, which results in the Memory Manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on AMD64 processors.

/NOGUIBOOT
Instructs Windows not to initialize the VGA video driver responsible for presenting bitmapped graphics during the boot process. The driver is used to display boot progress information, so disabling it will disable the ability of Windows to show this information.

/NOLOWMEM
Requires that the /PAE switch be present and that the system have more than 4 GB of physical memory. If these conditions are met, the PAE-enabled version of the Windows kernel, Ntkrnlpa.exe, won't use the first 4 GB of physical memory. Instead, it will load all applications and device drivers, and allocate all memory pools, from above that boundary. This switch is useful only to test device driver compatibility with large memory systems.

/NOPAE
Forces Ntldr to load the non-Physical Address Extension (PAE) version of the Windows kernel, even if the system is detected as supporting x86 PAEs and has more than 4 GB of physical memory.

/NOSERIALMICE=[COMx | COMx,y,z...]
Obsolete Windows NT 4 qualifier—replaced by the absence of the /FASTDETECT switch. Disables serial mouse detection of the specified COM ports. This switch was used if you had a device other than a mouse attached to a serial port during the startup sequence. Using /NOSERIALMICE without specifying a COM port disables serial mouse detection on all COM ports. See Microsoft Knowledge Base article Q131976 for more information.

/NUMPROC=
Specifies the number of CPUs that can be used on a multiprocessor system. Example: /NUMPROC=2 on a four-way system will prevent Windows from using two of the four processors.

/ONECPU
Causes Windows to use only one CPU on a multiprocessor system.

/PAE
Causes Ntldr to load Ntkrnlpa.exe, which is the version of the x86 kernel that is able to take advantage of x86 PAEs. The PAE version of the kernel presents 64-bit physical addresses to device drivers, so this switch is helpful for testing device driver support for large memory systems.

/PCILOCK
Stops Windows from dynamically assigning IO/IRQ resources to PCI devices and leaves the devices configured by the BIOS. See Microsoft Knowledge Base article Q148501 for more information.

/RDPATH=
Specifies the path to a System Disk Image (SDI) file, which can be on the network, that the system will use to boot from. Often used in conjunction with the /RDIMAGEOFFSET= flag to indicate to NTLDR where in the file the system image starts.

/REDIRECT
Introduced with Windows XP. Used to cause Windows to enable Emergency Management Services (EMS) that reports boot information and accepts system management commands through a serial port. Specify serial port and baudrate used in conjunction with EMS with redirect= and redirectbaudrate= lines in the [boot loader] section of the Boot.ini file.

/SAFEBOOT:
Specifies options for a safe boot. You should never have to specify this option manually, since Ntldr specifies it for you when you use the F8 menu to perform a safe boot. (A safe boot is a boot in which Windows only loads drivers and services that are specified by name or group under the Minimal or Network registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot.) Following the colon in the option you must specify one of three additional switches: MINIMAL, NETWORK, or DSREPAIR. The MINIMAL and NETWORK flags correspond to safe boot with no network and safe boot with network support, respectively. The DSREPAIR (Directory Services Repair) switch causes Windows to boot into a mode in which it restores the Active Directory directory service from a backup medium you present. An additional option you can append is (ALTERNATESHELL), which tells Windows to use the program specified by the HKLM\SYSTEM\CurrentControlSet\ SafeBoot\AlternateShell value as the graphical shell rather than to use the default, which is Windows Explorer.

/SCSIORDINAL:
Directs Windows to the SCSI ID of the controller. (Adding a new SCSI device to a system with an on-board SCSI controller can cause the controller's SCSI ID to change.) See Microsoft Knowledge Base article Q103625 for more information.

/SDIBOOT=
Used in Windows XP Embedded systems to have Windows boot from a RAM disk image stored in the specified System Disk Image (SDI) file.

/SOS
Causes Windows to list the device drivers marked to load at boot time and then to display the system version number (including the build number), amount of physical memory, and number of processors.

/TIMERES=
Sets the resolution of the system timer on the standard x86 multiprocessor HAL (Halmps.dll). The argument is a number interpreted in hundreds of nanoseconds, but the rate is set to the closest resolution the HAL supports that isn't larger than the one requested. The HAL supports the following resolutions:

Hundreds of nanoseconds Milliseconds (ms)
9766 0.98
19532 2.00
39063 3.90
78125 7.80

The default resolution is 7.8 ms. The system timer resolution affects the resolution of waitable timers. Example: /TIMERES=21000 would set the timer to a resolution of 2.0 ms.

/USERVA=
This switch is only supported on Windows XP and Windows Server 2003. Like the /3GB switch, this switch gives applications a larger address space. Specify the amount in MB between 2048 and 3072. This switch has the same application requirements as the /3GB switch and requires that the /3GB switch be present.

/WIN95
Directs Ntldr to boot the Consumer Windows boot sector stored in Bootsect.w40. This switch is pertinent only on a triple-boot system that has MS-DOS, Consumer Windows, and Windows installed. See Microsoft Knowledge Base article Q157992 for more information.

/WIN95DOS
Directs Ntldr to boot the MS-DOS boot sector stored in Bootsect.dos. This switch is pertinent only on a triple-boot system that has MS-DOS, Consumer Windows, and Windows installed. See Microsoft Knowledge Base article Q157992 for more information.

/YEAR=
Instructs the Windows core time function to ignore the year that the computer's real-time clock reports and instead use the one indicated. Thus, the year used in the switch affects every piece of software on the system, including the Windows kernel. Example: /YEAR=2001. (This switch was created to assist in Y2K testing.)

Thanks to Jonas Fischer for pointing out the PCILOCK and NOSERIALMICE switches. Thanks to Rob Green for information on the FASTDETECT switch.