In my last column, I discussed how to test your environment for Windows 7 compatibility with a tool like Microsoft's (News - Alert) Upgrade Advisor.

 

Now I'd like to discuss a few of the benefits of Windows 7. What new and improved features does the OS potentially offer you and your users?

 

Microsoft introduced User Access Control (UAC) in Vista to safeguard your system by requesting permission anytime you try to make a change. But UAC got clobbered with complaints, and deservedly so. With Vista's UAC, it's all or nothing. Keep it turned on, and you get a never ending barrage of confirmation messages, even for basic tasks, such as changing the time. Keep it turned off, and you defeat the whole purpose of having greater security and protection.

 

The UAC in Windows 7 is more intelligent and flexible, so it's a better option for you and your users. You can set it to any of four different levels, from Always Notify to Never Notify. The two options in the middle notify you when programs try to make changes to your PC, but not when you change Windows settings. The second highest option dims your desktop when the confirmation message pops up; the third option does not.

 

I ran a fresh install of Windows 7 and various apps on a notebook using UAC's second and third options at different times. The process was much smoother than on a Vista machine, with considerably fewer prompts. I was asked to confirm tasks like installing a new application but was able to breeze through more common actions without UAC's nagging. I was even able to change the time without UAC shouting at me.

 

One stumbling block with any new OS is whether or not it can support your older legacy applications. My former organization had a lot of lab equipment connected to PCs that often ran older software and sometimes balked at the latest Windows OS.

 

For apps that can't run under Windows 7 natively, Microsoft offers a virtual Windows XP mode.

 

Those of you who already use virtual desktop tools, such as Microsoft's Virtual PC or VMware, know the concept. Windows XP runs as a guest in its own virtual box within Windows 7, with access to all the same peripherals and network resources as on the host OS. Your users can still keep that old legacy app that doesn't work under Windows 7 but plays well with XP.

 

The downside here is that Windows XP mode becomes another level of software for you to support. You'll have to protect it with its own anti-malware software and keep it updated with the latest patches. So this is an option you might want to deploy selectively to your users.

 

A new feature in Windows 7 Ultimate and Enterprise and in Windows Server 2008 R2, AppLocker lets you create group policies to restrict which apps your users can and can't run. An improvement over Software Restriction Policies, which were available in prior versions of Windows, AppLocker is more powerful and easier to maintain.

 

Unlike other software policies, AppLocker works under a simple premise: It allows the apps you specify and blocks the rest. The tool offers three different methods to determine which software your users are allowed to run—by location, by digital signature, or against a unique "fingerprint" generated for the program. In Group Policy, you create rules based on one of those three methods by adding the programs that your users are allowed to run.

 

A lot of organizations don't lock down their applications so strictly. But to lower support calls and costs, more and more companies have already been going this route.

 

There's much more to AppLocker than I can cover here. If you're interested, I'd recommend checking out Microsoft's AppLocker white paper and FAQ.

 

If you have a copy of Windows 7 Ultimate or Enterprise, you can also play with AppLocker through your local Group Policy Editor. Click on the Run command and type gpedit.msc to open the Policy Editor. You'll find detailed information and the settings for AppLocker under Computer Configuration | Windows Settings | Security Settings | Application Control Policies.

 

These are just a few of the new features in Windows 7. But I think they're among the most useful ones in the new OS to help you better support your organization.