Windows XP Service Pack 2 (SP2) is more than a simple roll-up of bug fixes. SP2 includes a series of security and maintenance enhancements--many of which have special significance to mobile users--that amount to a whole new OS release. When preloaded on new Tablet PCs, SP2 is called Windows XP Tablet PC Edition 2005.
The SP2 features that you're likely to hear most about--and the ones with the greatest impact on application compatibility--are related to security. SP2's security features include a built-in software firewall that's on by default. Built-in applications, including Microsoft Internet Explorer (IE), Outlook Express, and Windows Messenger have also undergone significant changes. For Tablet PC users, SP2 includes a set of enhancements, including handwriting recognition that's actually good enough to use.
The downside to SP2's many changes is compatibility problems. XP users who upgrade to SP2 (or users who start out with XP Tablet PC Edition 2005) are likely to experience problems when using network and Web applications. In enterprise environments, testing SP2 before rolling it out is crucial to determine what compatibility problems exist and how to work around them.
As I write this article, SP2 isn't yet available, but I've been testing SP2 Release Candidates 1 and 2 for some time now. Here's a rundown on the features of most interest to mobile users--and the administrators who support them.
Windows Firewall
When a user restarts after installing SP2, the computer boots with the firewall enabled. SP2 will probably prompt users with network applications to enable them to communicate through the firewall. Configuring such "exceptions" is simple but can be unnerving for a user who doesn't expect it. In an Active Directory (AD) environment, you can use Group Policy to specify exceptions to minimize user impact. SP2 also has a Don't Allow Exceptions mode that blocks all communications originating outside the firewall and an option to turn the firewall off--although Microsoft doesn't recommend the latter option. In my opinion, mobile users connecting to the Internet while away from the office should be encouraged (or required) to use the Don't Allow Exceptions mode to minimize the risk of infection by network worms when the user isn't protected by a corporate firewall.
By default, SP2's firewall blocks the ports required for file and printer sharing, so users who depend on files and printers shared from other workstations will find that these features don't work properly after SP2 is installed. To change the default setting, you use the Exceptions tab of the new Windows Firewall Control Panel applet, which Figure 1 shows. Select the File and Printer Sharing box, and sharing will work through the firewall. By default in SP2, only computers on the same subnet have access to shared files and printers, but you can change this behavior by using the Windows Firewall applet's Advanced tab. You can also use Group Policy to control these settings.
Browsing, Email, and Messaging
Users will likely experience some compatibility problems with SP2's version of IE. In a nutshell, IE now defaults to asking the user's permission before displaying pop-up or active content. To avoid annoying the user by repeatedly displaying a dialog box that asks the user whether to show the active content, SP2 IE provides a new UI element called the Information Bar, which pops up as an extra line below the Address bar, as Figure 2 shows. The Information Bar lets the user know that IE is blocking active content; the user can click the bar to see a context menu that lets him or her choose to show the content, or the user can ignore the bar, in which case the active content isn't displayed. Organizations that use active content and pop-ups in intranet applications can control this behavior on a per-zone basis through Group Policy.
Another security-related change in the browser--and in the SP2 versions of Outlook Express and Windows Messenger--can create unexpected results. A new feature called Attachment Execution Service (AES) checks all files that a user might want to download and attachments that he or she might want to save. If a file's content doesn't match its MIME type or file extension, SP2 will display the content in a safe format, typically text. This feature is designed to block the spread of virus and worm content that's masquerading as something else; but it also exposes bugs in some Web pages that work perfectly well with pre-SP2 versions of IE.
SP2 Outlook Express has a text-only option that prevents display of any graphical content. And SP2 Windows Messenger requires the user's sign-in name to be different from his or her email address.
Automatic Updates
Some of SP2's best features relate to maintenance: You can now fully automate the update process. A revised version of Windows Update includes application and device driver patches as well as OS updates, and the same update procedure now applies to security patches and will be used for future service packs. Multiple updates are prioritized--a small crucial update is installed before a large noncrucial update--and updates are transmitted via the Background Intelligent Transfer Service (BITS) 2.0 protocol, which transmits only compressed changes to components rather than complete components. Obviously, transmitting changes only is particularly good news for mobile users who are using slow connections. In enterprise environments, IT can set up BITS servers and users can download updates from the nearest server rather than from their home domain to help reduce unnecessary WAN traffic. You can even limit the bandwidth that the update servers use. By default, updates are installed automatically when the user logs off.
SP2 Administration
I've mentioned several times that you can use Group Policy to control SP2 security features. Microsoft also introduced a revised version of the netsh.exe command-line utility firewall helper in the Advanced Networking Pack for Windows XP. Netsh can be used to show and modify firewall settings on local or remote computers running SP2 and is scriptable. You'll need to use it to open TCP port 445 for the client administration tools included with XP--the SP2 firewall blocks the port by default. For a quick look at the options, after you install SP2, type
netsh firewall show
at a command prompt. You can find a discussion of the nine new Group Policy settings for the firewall and their corresponding Netsh commands in "Fine-Tuning Windows Firewall," June 2004, Instant Doc ID 42594.
Previous
Register
