Windows 7 and application compatibility options
by James Grayson
Now that Windows 7 has shipped, you may already be fielding questions from inside your org about whether or when you plan to roll it out to users. Anytime you're thinking about upgrading to a new version of an operating system, you have to consider whether the applications your organization uses will be compatible with the new OS. Luckily, you have a couple of options to keep those old apps happy and keep your users running with minimal issues.
What apps are you running?
It goes without saying that before you start upgrading, you need to figure out what applications you have out there on yourusers' desktops that have to work with the new version of the OS. When you've done that, then you need to test those apps to figure out the best way to keep them working. If your client management software doesn't already monitor the usage of apps on your corporate network, Microsoft offers a tool that can help: the Application Compatibility Toolkit. You can use the Application Compatibility Toolkit to get a list of the applications used on your desktops, and then you can ask users to prioritize the apps that they use. It's also a great opportunity for you to get rid of redundant or unused apps, or standardize on a single version of an app across all of your users. In the long run, this kind of clean-up will help your org run more smoothly with less calls to your helpdesk.
What kinds of problems will you hit?
Back in the good ol' days, loads of applications wrote to the registry, modified the kernel, or ran with administrative privileges. We now know that apps with those behaviors left systems open to a variety of malware attacks. With each successive version of the operating system, Microsoft has made strides forward toward closing those points of attack, and they've continued that trend in Windows 7.
While increased security may be great for your network as a whole, it can play havoc with applications written before security levels were raised. They may fail to install, start exhibiting unexpected behavior, or they may just stop working altogether. Either way, it's a problem you'd rather not have. If you've got no choice but to continue to run those old apps (and let's be honest; these days, who can convince their managers to spend money to rewrite code that appears to be working just fine?), you can start by trying some workarounds. Obviously, the favorite approach has got to be one that allows you to maintain the increased security in Windows 7, but sometimes you might have to work your way down to reducing security, the least favorite alternative.
Here's a quick look at some specific pain points you'll probably want to consider:
- Platform-specific drivers
If your app relys on a driver from a previous version, obviously it won't work on Windows 7. - Operating system version number
Apps that look for a specific OS version number and don't allow for the version number being higher than that will fail. - Hard-coded paths
If an app wants to store something in a protected area, Windows 7 tries to reroute it to a safer area. However, this isn't always successful, and if Windows 7 can't reroute the app, the app will fail. - Run as a normal user
The app should run as a normal user without admin privileges. If it doesn't, it will fail. - Authentication methods/devices
Windows 7 doesn't permit authentication methods other than those built into the OS. If you use things like fingerprint devices, retinal scanners, or alternate authentication protocols to control access, you'll need to migrate to versions of those supported by Windows 7.
Compatibility fixes
You have a couple of ways to get your older apps that otherwise refuse to cooperate working on Windows 7. First, you can install them using Windows 7's built-in compatibility mode. Here's how it's done:
- Copy the application installation file to your computer.
- Right-click the installation file, select Properties, and then click the Compatibility tab.
- Select the Run this program in compatibility mode for check box, and then select the version of the OS that the app was intended to install on, such as Windows XP.
- If you absolutely must select it to make the app work, check Run this program as an administrator.
The advantages of this approach are obvious: it's quick and easy to carry out, and it lets you take full advantage of the improvements in security Microsoft made in Windows 7 compared to earlier versions. The downside is that the built-in compatibility mode doesn't always work, because there are some compatibility issues it simply isn't equipped to overcome.
Second, you can create shims between the app and Windows 7. If you go this route, you'll need a database to keep track of the shims you create. You'll also have more headaches with app and operating system updates, but if you can't get a newer version of the app either because your budget won't allow it or because it's an in-house custom app that you don't have developer resources to rewrite, this may be your most cost-effective alternative.
Is virtualization for you?
Microsoft has been shipping virtualization for some time now. In Windows 7, they've made it easier and more approachable for end-users by integrating Windows Virtual PC into the shell. Windows 7 Professional and above skus come with a special Windows XP virtual hard disk pre-installed and available to the Windows 7 environment. You don't have to scramble around to create an image or dig up a new license.
This new version of Windows Virtual PC has two nice features: It supports stored credentials so that users don't have to remember a logon for the virtual machine, and it supports USB devices so that flash drives and other removable storage work in the virtual machine. However, you still can't run USB audio and video devices from the virtual machine.
Otherwise, the virtual machine is seamlessly integrated into the desktop. Application folders on the virtual machine appear on your Windows 7 desktop. When a user clicks to start one of these apps, the virtual machine starts in the background. Unfortunately, the virtual machine tends to be slow starting, so there's a wait of as much as 10-15 seconds or longer before the app opens. Once the VM has been started, it goes into hibernation when the app is closed. That means that it starts faster the next time if the user hasn't shut the computer off, but it can still be slower than you might like.
Once you're inside the virtual machine, you can still see everything on the host, including network drives. The host and the VM share a clipboard, so you can copy and paste between them. There's even printer redirection so you can print from the VM. Better still, if you want, you can set up the machine to dual boot so you can go straight to the VM instead of booting through the host.
Consider server virtualization
The downside of having a bunch of client computers running their own virtual images of Windows XP is that you suddenly have a whole bunch of unmanaged images out there on your network. If that worries you, you might consider using server virtualization instead to maintain some XP images centrally, with the Windows 7-incompatible apps on them. Users can log on to the virtual images when they need to access the app, and spend the remainder of their time working on their local Windows 7 desktop.
Creating your downlevel OS images on a central server gives you the advantage of being able to easily manage and update the images with patches and fixes as needed. While it can be slow starting up the images, once they're running, you'll normally find that performance across the network is pretty good. Of course, this all assumes that users don't need to connect and use the incompatible apps when they're disconnected from your corporate network. That's something you'll want to ask users about when you have them prioritize the apps they use.
We mentioned stripping security down to make apps work on Windows 7. In some cases, decreasing the default security settings in Windows 7 will be enough to get apps running. But the security improvements in Windows 7 are the primary reason for updating your desktops. If you turn off those improvements, you'll be opening yourself to a higher risk of malware getting loose on your network. Microsoft don't recommend this as a viable solution to app compatibility issues, and it's hard not to agree.
Migration is always a challenge for the network administrator or IT professional. We hope you find some of these methods useful as you begin to upgrade your corporate desktops.
Link to this post at http://granitepillar.com/en/Blogs/OS/OS_Win7Compt111609.aspx
