ThinApp - Another layer to the compatibility question

OK - I have been having loads of fun with Microsoft's App-V virtualization suitability challenges over the past few months, and I now have been tasked to look at the VMware ThinApp technology.

From the VMware website, the ThinApp technology is described as a technology that;

"With ThinApp, applications are packaged into single executables that run completely isolated from each other and the operating system for conflict-free execution on end point devices. Application packages can be deployed to different Windows platforms, eliminating costly recoding and regression testing so you can easily migrate existing applications to Windows 7."

Which is a little naughty as this messaging propagates one of the now unravelling myths about virtualization technology. Specifically, Virtualization technologies do not solve OS level compatibility issues. If an application does not work on a platform (such as Windows 7) in a native environment, then the chances of it working in a virtualization layer (or bubble) on that same target platform are actually reduced.

Now, ThinApp is a great product and this OS level compatibility issue applies to all virtualization products across the industry including Symantec's SWVS, Microsoft's App-V, Citrix's XenApp and VMware's ThinApp.

I need to do a quick posting today, so here are two scenarios to illustrate the compatibility "question" when investigating virtualization layers

Scenario 1: It works on Windows XP but will it work on Windows 7?
Due to the changes made in Windows 7, primarily to the underlying driver model, some applications may install, start and run correctly in an older environment (Windows XP) but may not run correctly due non-supported driver issues, security restrictions or incorrectly configured installation logic on a new platform like Windows 7. So, with specific references to non-supported drivers, if the application will not run on Windows 7, it will not run in a ThinApp layer on a Windows 7 build.

Scenario 2: It may work on Windows 7, but will it work in ThinApp?
The VMware ThinApp  virtualization technology imposes a few (but manageable) limitations on the installation and configuration of an application. One example of these limitations is Kernel mode drivers (low-level system drivers that generally relate to hardware such as drives and printers). ThinApp operates in the user context of the operating system - meaning ThinApp can not crash your workstation but it can not directly load (but it can reference)  any system level resources. If an application relies on a Kernel mode driver to run correctly, ThinApp will not be able to load this driver into the user -context and the application may fail to behave as expected.

There is some good news here. Many applications are now shipping with user mode drivers; which are supported on both Windows 7 and VMware ThinApp. So, you can have your driver and virtualize it too.



References:

VMware ThinApp Product Page
http://www.vmware.com/products/thinapp/

Microsft Public Sector Seminar - You are invited!

When it comes to an OS migration Public Sector organisations face the same challenges as any other type of business. If anything, the success or failure of such as project can is much more visible due to the nature of the audience they serve.

We all want our NHS, county council or fire service to be provide the very best service they can and for them to do this they need to embrace the very best technology available. BUT and here’s the BUT  when you’re dealing in tax payers money, it’s important that any public sector organisation delivers projects and services in the most cost effective way possible.

On Friday (21^st May) at 11.00am,  I’m hosting a Public Sector webinar with Microsoft  entitled Windows 7 Application Compatibility and Migration. The objective of the webinar is to walk through application compatibility and migration for Windows 7 – illustrating how easy and quick it can be to get your application estate working on the new OS.

So if you’re interested in hearing about the work ChangeBASE has been doing with other Public Sector organisations and are free between 11-12 on Friday, simply register here , use the invitation code of: 4ACF82 and join us!

Microsoft Patch Tuesday: May 2010

With this May Microsoft Patch Tuesday Security Update, we see a relatively light release with just two security updates this month. Both patches are rated as Critical with the potential for remote code execution on the target client. Unfortunately, all patches released this month will most likely require a reboot of the target system. In addition, the ChangeBASE AOK Patch Impact team has updated the sample application database to now more than 2000 unique application packages. All of the applications in this large sample application portfolio are analysed for application level conflicts with Microsoft Security Updates and potential dependencies, or down-level conflicts. Based on the results of our AOK Application Compatibility Lab only one patch will have a minor impact on a standard application portfolio; MS010-031 Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution. We have included a brief snap-shot of some of the results from our AOK Software that demonstrates some of the potential impacts on the OSP application package with the following snap-shot image. MS010-030 Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542). Testing Summary MS10-030 : "Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)" MS10-031 : "Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)" Patch Name Total Issues Matches Affected Reboot Rating RAG Microsoft Security Bulletin MS10-030 <1% <1% YES Moderate impact and negligible testing profile Microsoft Security Bulletin MS10-031 40% 2% YES Marginal impact and negligible testing profile Legend: No Issues Detected Potentially fixable application Impact Serious Compatibility Issue Security Update Detailed Summary MS10-030 MS010-030 Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542) Description This security update resolves a privately reported vulnerability in Outlook Express, Windows Mail, and Windows Live Mail. The vulnerability could allow remote code execution if a user visits a malicious e-mail server. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Payload Directdb.dll, Iecustom.dll, Inetcomm.dll, Inetres.dll, Msident.dll, Msimn.exe, Msoe.dll, Msoeacct.dll, Msoeres.dll, Msoert2.dll, Oeimport.dll, Oemig50.exe, Oemiglib.dll, Wab.exe, Wab32.dll, Wabfind.dll, Wabimp.dll, Wabmig.exe Impact Critical - Remote Code Execution MS10-031 MS010-031: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213) Description This security update resolves a privately reported vulnerability in Microsoft Visual Basic for Applications. The vulnerability could allow remote code execution if a host application opens and passes a specially crafted file to the Visual Basic for Applications runtime. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Payload Vbe6.dll Impact Critical – Remote Code Execution *All results are based on an AOK Application Compatibility Lab’s test portfolio of over 1,000 applications.