Added/Removed EXEs in Windows 8 “Developer Preview” vs Windows 7 SP1 Enterprise

Here I’ll just do a quick comparison of .EXE in the Windows 8 Developer Preview and Windows 7 Enterprise SP1. Keep in mind Windows 8 is currently a “preview” and is not feature complete, so this will explain some missing items. The 32-bit versions of both OS were used in this comparison. This is based on a default install of both OS. (note: Developer Tools were not installed in this instance of Windows 8)

What’s missing?

  • C:\boot\memtest.exe
  • C:\Program Files\Common Files\microsoft shared\ink\InkWatson.exe “Handwriting Recognition Error Reporting Wizard”
  • C:\Program Files\DVD Maker\DVDMaker.exe
  • C:\Program Files\Windows Media Player\wmpenc.exe “Windows Media Player Encoder Helper”
  • Some subfolders of C:\Windows\assembly\GAC_32, C:\Windows\assembly\GAC_MSIL, and
  • C:\Windows\assembly\NativeImages_v2.0.50727_32

  • C:\Windows\eHome directory is completely missing, which contains Windows Media Centre. Microsoft has announced this will be part of Windows 8, but not in this release.
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727 empty
  • C:\Windows\Microsoft.NET\Framework\v3.0 and C:\Windows\Microsoft.NET\Framework\v3.5 do not exist
  • C:\Windows\servicing\GC32\tzupd.exe “Time Zone Update Utility”
  • C:\Windows\System32\dinotify.exe “Windows Device Installation”
  • C:\Windows\System32\GettingStarted.exe – would expect this time of thing to be missing from developer preview
  • C:\Windows\System32\icardagt.exe “Windows CardSpace User Interface Agent”
  • C:\Windows\System32\lsm.exe “Local Session Manager Service” (Note: It still exists in Windows 8 but is implemented as DLL C:\windows\system32\lsm.dll)
  • C:\Windows\System32\mctadmin.exe
  • C:\Windows\System32\MpSigStub.exe “Microsoft Malware Protection Signature Update Stub”
  • C:\Windows\System32\Netproj.exe “Connect to a Network Projector” (Note: this is only missing in the 32-bit version I installed in VMWare. It exists on the 64-bit version with developer tools)
  • C:\Windows\System32\PushPrinterConnections.exe
  • C:\Windows\System32\RegisterIEPKEYs.exe “Registers custom PKEYs for IE”
  • C:\Windows\System32\SetIEInstalledDate.exe
  • C:\Windows\System32\setupSNK.exe “Launch Connect to a Wireless Network Wizard”
  • C:\Windows\System32\spinstall.exe
  • C:\Windows\System32\spreview.exe
  • C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
  • C:\Windows\System32\TsWpfWrp.exe “Windows Presentation Foundation Terminal Server Print Wrapper”
  • C:\Windows\System32\VaultSysUi.exe “KeyRing Credential UI”
  • C:\Windows\System32\vmicsvc.exe “Virtual Machine Integration Component Service”
  • C:\Windows\System32\wisptis.exe “Microsoft Pen and Touch Input Component”
  • Some IMEs and utilities are missing from C:\windows\system32\IME and subdirectories.  (Note: there are many additions/replacements as well)
  • A number of file changes under C:\Windows\WinSxs and subdirectories – some files no longer there, some added

What’s new?

  • C:\Program Files\Applications directory. This contains the new “metro” style sandboxed applications.
  • C:\Program Files\Internet Explorer\iediagcmd.exe. This seems to do a thorough scan of all Internet Explorer and Network configuration registry keys and DLLs and repair if anything is missing.

image

  • C:\Program Files\Windows Defender\MsMpEng.exe “Antimalware Service Executable” and C:\Program Files\Windows Defender\NisSrv.exe “Microsoft Network Inspection System” (MsMpEng.exe is currently part of Forefront Client Security or Security Essentials)
  • C:\Windows\splwow64.exe “Print driver host for applications”
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319 directory
  • C:\Windows\System32\aitstatic.exe “Application Impact Telemetry Static Analyzer”
  • C:\Windows\System32\AuthHost.exe “Microsoft AuthHost”
  • C:\Windows\System32\backgroundTaskHost.exe “Windows Background Broker Infrastructure Task Host”
  • C:\Windows\System32\BackgroundTransferHost.exe
  • C:\Windows\System32\bdechangepin.exe “BitLocker Drive Encryption: PIN Change Tool”
  • C:\Windows\System32\bdeunlock.exe “BitLocker Unlock”
  • C:\Windows\System32\bootim.exe “boot immersive menus”

The is a really nice and welcome addition to Windows. Screenshots of this tool:

image

image

image

  • C:\Windows\System32\bootsect.exe “Boot Sector Manipulation Tool” This has been available since Vista, but is included on the Vista and Windows 7 DVD. This time it’s installed on the system. (Thank you Microsoft!)
  • C:\Windows\System32\CallButtons.exe “Windows Runtime CallButtonsServer EXE”
  • C:\Windows\System32\CameraSettingsUIHost.exe
  • C:\Windows\System32\CheckNetIsolation.exe “AppContainer Network Isolation Diagnostic Tool”

This is a command line tool with the following options:

Usage:
   CheckNetIsolation [Module]
      List Of Modules:
          LoopbackExempt – controls the loopback exemption of appcontainers
                           to ease application development
          Debug          – Starts a network traffic troubleshooting session
                           of an appcontainer. Generates a report of network
                           capabilities that are used, not used or missing,
                           together with the network traffic generated by the
                           application.

  • C:\Windows\System32\clrhost.exe “Out of proc server for managed services in the Windows Runtime” (Windows Runtime a.k.a. WinRT is new the metro app isolated app model)
  • C:\Windows\System32\CredentialUIBroker.exe “Credential Manager UI Host”
  • C:\Windows\System32\DsmUserTask.exe “Device Setup Manager User Task Handler”
  • C:\Windows\System32\DXPTaskDLNA.exe “DeviceStage DLNA tasks”
  • C:\Windows\System32\fbappinv.exe “Application Inventory Module for Win8 Feedback tool”
  • C:\Windows\System32\fhmanagew.exe “File History Management Tool”
  • C:\Windows\System32\FileHistory.exe

Launches the following utility:

image

File History also found in control panel under System and Security

image

  • C:\Windows\System32\Fondue.exe “Windows Features on Demand UX”
  • C:\Windows\System32\fsavailux.exe This file has no description, but from the function names within seems to be related to Anti-Virus

image

  • C:\Windows\System32\integrity.exe “File Integrity Utility”

This is a command line utility which outputs the following:

image

It has no documented command line options at the moment, but from looking inside seems options are

  • /enable
  • /disable
  • /scrub
  • /enforcement
  • /scrubberpolicy
  • /scrubber
  • /enforcement:*
  • /scrubberpolicy:*
  • /scrubber:*
  • /s

You can also specify integrity by itself to list current integrity settings of all files in current folder. Or integrity [path] to look at a specific path.

  • C:\Windows\System32\lpkinstall.exe “Language Pack Installer”
  • C:\Windows\System32\MbaeParserTask.exe “Mobile Broadband Account Experience Parser Task”
  • C:\Windows\System32\MDEServer.exe “PlayTo Server”
  • C:\Windows\System32\MSchedExe.exe “Automatic Maintenance”
  • C:\Windows\System32\MsSpellCheckingFacility.exe Provides ability for system-wide spell check functionality
  • C:\Windows\System32\MsSpellCheckingHost.exe Same as above
  • C:\Windows\System32\OpenWith.exe This provides the new “Open with Dialogcan be triggered by running OpenWith [filename]

image

If you click See All you also get two more options

image

Look for an app on this PC will bring up a standard file open dialog browser to find .exe files / etc.

Look for an app on the web will redirect you to a URL like http://shell.windows.com/fileassoc/0409/xml/redir.asp?EXT=txt

  • C:\Windows\System32\PickerHost.exe “File Picker UI Host”
  • C:\Windows\System32\PrintDialogHost.exe
  • C:\Windows\System32\ProximityUxHost.exe
  • C:\Windows\System32\PurchaseWindowsLicense.exe At the moment this is obviously not functional but brings a screen like this:

image

  • C:\Windows\System32\rdpinput.exe “RDP Session Input Handler” RDP will now support multi-touch.
  • C:\Windows\System32\RDSPnf.exe “Windows All User Installer Profile Processing Module”
  • C:\Windows\System32\recimg.exe Command line tool to capture WIM.

RecImg Tool v1.0 – Captures WIM Image

USAGE: RecImg [<options>]

OPTIONS –

      -CreateImage – path to the directory where the image (install.wim) will be
captured

  • C:\Windows\System32\Register-CimProvider.exe Command line tool to register CIM (Common Information Model) providers into system. Options are:
  • Usage:  Register-CimProvider.exe -Namespace <NamespaceName>
                    -ProviderName <ProviderName>
                    -Path <ProviderDllPath>
                    [-Impersonation <True or False>]
                    [-Decoupled <SDDL>]
                    [-HostingModel <HostingModel>]
                    [-ThreadingModel <Both/Free/Apartment>]
                    [-Localize <locale>]
                    [-NoAutorecover]
                    [-SupportWQL]
                    [-GenerateUnregistration]
                    [-ForceUpdate]
                    [-Verbose]

      -Namespace       Specifies the target namespace of the provider.
      -ProviderName    Specifies the provider name.
      -Path            Specifies the provider binary path.
      -Impersonation   Specifies foldidentity of decoupled provider, which is true by default.
      -Decoupled       Registers provider as decoupled and specifies the security descriptor that determines the set of users that can successfully register the provider.
      -HostingModel    Specifies the HostingModel of coupled provider.
      -ThreadingModel  Specifies the ThreadingModel of coupled provider.
      -Localize        Localizes the provider with resource of specified locale.
      -NoAutorecover   Doesn’t autorecover the provider.
      -SupportWQL      Passes the query expression to the filter.
      -GenerateUnregistration  Generate the uninstall mof for the registration, which is disabled by default.
      -ForceUpdate     Force update the class if it exists in the system.
      -Verbose         Outputs registration log.

  • C:\Windows\System32\RuntimeBroker.exe
  • C:\Windows\System32\SettingSyncHost.exe “Host Process for Setting Synchronization”
  • C:\Windows\System32\SmartScreenSettings.exe Configures new feature “Smart Screen”

image

  • C:\Windows\System32\SppExtComObj.Exe
  • C:\Windows\System32\SrTasks.exe “Microsoft Windows System Protection background tasks.”
  • C:\Windows\System32\sysreset.exe “Microsoft Windows Reset”
  • C:\Windows\System32\SysResetErr.exe
  • C:\Windows\System32\systemreset.exe displays the following screen

image

  • C:\Windows\System32\SystemSettingsRemoveDevice.exe
  • C:\Windows\System32\ThumbnailExtractionHost.exe
  • C:\Windows\System32\TM.exe

The new look task manager. Note the old Windows 7 style task manager still exists as TaskMgr.exe and will revert to this if you enable classic start menu mode.

Some examples of what the new TM offers. Defaults to a simple view:

image

In the processes view we see grouping by

  • Applications
  • Background Processes
  • Windows Processes

Note “Metro Apps” are suspended when not in use. Note the “Metro IE” below

image

Same processes are grouped together, making it easier to end all instances of that particular process. Also in the Windows Processes section we see where in the past we would have just seen svchost.exe we see much clearer explanation of what services contained within

image

The performance tab is really nicely included, and includes Bluetooth connection performance information.

image

App History so useful…

image

Again Startup section, life saver!

image

By user…

image

Details…

image

Services…

image

  • C:\Windows\System32\tpmvscmgr.exe Is a console application “TPM Virtual Smartcard Setup Utility” with the following options
  •  

    TpmVscMgr.exe

            [create /name <Name> [/AdminKey <admin key>|’@’] [/PUK <puk>|’@’|’.’|’!’] [/PIN <pin>|’@’] [/generate]]
            |
            [destroy /instance <device instance ID>]

            Legend:
                     ‘@’ => prompt for parameter
                     ‘.’ => default value for parameter
                     ‘!’ => explicitly omit value for parameter(the parameter is unspecified)

  • C:\Windows\System32\WallpaperHost.exe
  • C:\Windows\System32\WindowsAnytimeUpgradeResults.exe Displays a UI like this

image

  • C:\Windows\System32\wkspbroker.exe “RemoteApp and Desktop Connection Runtime Broker”
  • C:\Windows\System32\WWAHost.exe “Windows Web Application Host”
  • A collection of new utilities/IMEs in C:\Windows\System32\IME and subdirectories.
  • C:\Windows\System32\ImmersiveControlPanel\SystemSettings.exe
  • C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe
  • A number of additions under C:\Windows\WinSxs and subdirectories

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Windows 8 and tagged . Bookmark the permalink.

2 Responses to Added/Removed EXEs in Windows 8 “Developer Preview” vs Windows 7 SP1 Enterprise

  1. Quote: “C:\Windows\System32\Fondue.exe “Windows Features on Demand UX”
    C:\Windows\System32\fsavailux.exe This file has no description, but from the function names within seems to be related to Anti-Virus”

    More likely “F… On Demand User Experience” and “F… S… Avail User eXperience”.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s