I've been meaning to write down something on this for a couple weeks now but have been having a tough time formulating a nice message on this. The short version is be very carefull doing this. I believe that somehow AppDomain's rely on something out of the Windows User Profile, and over time in a Windows Service when you're loading and unloading AppDomain's stuff MAY get screwed up.

We had a scheduler app which basically used AppDomain's as an isolation mechanism for controlling when and how each scheduled component was called and then disposed. Code looked something like this...

for each s as ScheduledComponent in myList
Dim d as new AppDomain
try
dim i as IExecutableInstance = d.CreateInstance("LaunchPad")
i.Execute
finally
AppDomain.Unload(d)
end try
next

Over time we'd eventually get into a state where the entire scheduler service which just cause a windows segmentation fault and shut down. No nice dot net exception or anything. Like I said, our best guess is that something gets out of sync between the windows profile and whatever exists in a dot net AppDomain.

Anyway, our solution was to create a wrapper layer which basically called each scheduled component as a process instead. This seems to be working very reliably ever since.

We were having some problems on our development machines at work as soon as we upgraded to Windows 7 and IE8. The problem first manifested itself as a javascript "client out of memory" error while using Outlook Web Access (OWA) but it seemed like randomly we'd have javascript errors while navigating webpages.

Our workaround was to switch over to Google Chrome but then you start finding all the things that don't work with that so we just wanted to get this figured out.

We ended up working microsoft support on this one and long story short, it looks like one of our development tools is overwriting one of the IE classes. They had us re-register a couple classes and now it's working awesome. Here's the registery changes required...

[HKEY_CLASSES_ROOT\Interface\{79EAC9C5-BAF9-11CE-8C82-00AA004BA90B}]
@="IHlinkFrame"

[HKEY_CLASSES_ROOT\Interface\{79EAC9C5-BAF9-11CE-8C82-00AA004BA90B}\NumMethods]
@="8"

[HKEY_CLASSES_ROOT\Interface\{79EAC9C5-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32]
@="{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}"

We've had some problems with the Binding Source component in our Windows Forms development and I wanted to jot down a note on here in case anyone else comes across this.

The problem we were having was an IDE runtime error which looks like a NullReferenceException, the specific message says "Object reference not set to an instance of an object".

Apparently this has something to do with the .datasource files that are auto-generated by visual studio for holding "default" values. You can remove these from the My Project folder and then the error goes away. Not sure why these are even required since you can still build without them.

One area of concern that I come up against quite often is the issue of source code version control. At its most basic layer this is nothing more than being able to control what a version of your software consists of... version A versus version B, that sort of thing. This model works great and is well documented on smaller isolated applications but tends to blur a little when working with larger systems. Specifically we’ve had issues managing system dependencies, as well as change requirements on a larger application consisting of about roughly 50 assemblies. I’ll spend just a few minutes here putting pen to paper on how we’ve structured our development tree to accommodate this.

We’ll start at a pretty simple level; each major release is placed in a named folder based on the version name. Our first branch within that folder is named Major.Minor.Zero, Major and Minor are related to the version name while the Zero indicated this is the opening development branch. Here’s how that looks when we start a new major release... our friendly version name is Jupiler and the Major.Minor associated with this is 5.1.

Notice that within the 5.1.0 folder we have a number of sub-folders. These are what we call modules and basically relate to a VS.Net solution; each one consists of roughly 5-6 projects and can be thought of as a sub-system. These sub-systems collaborate to provide our applications functionality.

Now, when we release our major version, Jupiler, we’ll typically LOCK the 5.1.0 folder so that no further changes can be made. This code is set in stone and we want to force all new changes to be done in an isolated environment until they’re tested and ready to go. Invariable though, something critical comes up during rollout and we need to make code changes to address those concerns. When this situation arises we BRANCH into a new folder called Major.Minor.One. This code folder consists of all the new development changes required to add what we call a Service Pack to the release. Here’s how this looks.  

One interesting aspect of this layout is that we only branch the modules that require changes. These Service Pack’s generally don’t require a lot of wholesale change; they`re usually small isolated bugs/features which can be addressed in a single module. You can see in the above diagram that our 5.1.1 only has changes for Accounting, all the other modules are identical to how they were developed in 5.1.0. This gives us a few key benefits.

1.        It limits the amount of open source code.

2.        It makes it easier to identify what code is actively being changed for a service pack.

3.        It leaves the original branch open so that it can be reviewed/modified for OTHER unanticipated issues.

Final rollout of the new changes is done by releasing 5.1.1 of Accounting with all the previous versions of the other modules.

After logging in, be sure to visit all the options under Configuration in the Admin Menu Bar above. There are 26 themes to choose from, and you can also create your own.

Not that this is necessarily a good idea. But after way too much time googling this, I think I'll clear up the fact that it IS possible call the Microsoft RDP client with a username and password parameter.

Now, everyone out there will say, yeah - we know that. You key in the username and password and if you check off the "remember credentials" checkbox it will store that data.

Well the trick is that this data is stored in a place that's not easily accessed -Windows Stored UserNames and Passwords. This area is basically a secured area of windows where passwords are stored for remote connections. You can access this by going Control Panel\User Accounts\Manager your network passwords. Here's a screen snap.

Our management infrastructure tracks this username and password in a seperate secured database, and then when we call MSTSC.exe from our software we want to pass this information. Now, a little more information on how you can pass parameters to MSTSC is in order. When you call MSTSC you can pass as a parameter a .RDP file which contains information about how you want to connect to the remote computer. Same idea as every other document type in Windows, a .RDP file is associated with MSTSC and is used to contain information for that application. Fortunately the .RDP files are basically key value pairs. Check it out...

screen mode id:i:1
desktopwidth:i:1024
desktopheight:i:768
session bpp:i:16
winposstr:s:0,1,526,61,1566,865
full address:s:SomeIpAddress
compression:i:1
keyboardhook:i:2
audiomode:i:0
redirectdrives:i:0
redirectprinters:i:1
redirectcomports:i:0
redirectsmartcards:i:1
displayconnectionbar:i:0
autoreconnection enabled:i:1
alternate shell:s:
shell working directory:s:
disable wallpaper:i:0
disable full window drag:i:1
disable menu anims:i:1
disable themes:i:0
disable cursor setting:i:0
bitmapcachepersistenable:i:1
allow desktop composition:i:1
allow font smoothing:i:0
redirectclipboard:i:1
redirectposdevices:i:0
authentication level:i:2
prompt for credentials:i:0
negotiate security layer:i:1
remoteapplicationmode:i:0
gatewayhostname:s:
gatewayusagemethod:i:4
gatewaycredentialssource:i:4
gatewayprofileusagemethod:i:0
promptcredentialonce:i:1
drivestoredirect:s:

The imporant pieces here is the "full address" line... this points to the server we're connecting to.

Well... it turns out you can also pass parameters for domain, username, and password. You just need to add them to the bottom of your .rdp file like this

domain:s:MyDomain
username:s:MyUserName
password 51:b:MyPassword

But wait a second, saving a password in plain text in a .rdp file sounds like just about the worst security hole you could use! And you're right - you can't actually pass the password parameter as straight text. It needs to be encrypted binary.

(As an aside, that's what the second part of these key/value pairs is... the s, or b, or i character. That indicates whether the data is String, Binary or Integer).

Well it turns out that taking a straight text password and encrypting it ain't too bad. I'm not going to take credit for this code but the following vb dot net code uses the windows api to do just that.

Imports System
Imports System.Text
Imports System.Runtime.InteropServices
Imports System.ComponentModel
Imports Microsoft.VisualBasic

PublicClass DPAPI
<DllImport("Crypt32.dll", SetLastError:=True, CharSet:=System.Runtime.InteropServices.CharSet.Auto)> PrivateSharedFunction CryptProtectData( _
ByRef pPlainText As DATA_BLOB, _
ByVal szDescription AsString, _
ByRef pEntropy As DATA_BLOB, _
ByVal pReserved As IntPtr, _
ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _
ByVal dwFlags AsInteger, _
ByRef pCipherText As DATA_BLOB _
) AsBoolean
EndFunction

<DllImport("Crypt32.dll", SetLastError:=True, CharSet:=System.Runtime.InteropServices.CharSet.Auto)> _
PrivateSharedFunction CryptUnprotectData( _
ByRef pCipherText As DATA_BLOB, _
ByRef pszDescription AsString, _
ByRef pEntropy As DATA_BLOB, _
ByVal pReserved As IntPtr, _
ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _
ByVal dwFlags AsInteger, _
ByRef pPlainText As DATA_BLOB _
) AsBoolean
EndFunction

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)> _
FriendStructure DATA_BLOB
Public cbData AsInteger
Public pbData As IntPtr
EndStructure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)> _
FriendStructure CRYPTPROTECT_PROMPTSTRUCT
Public cbSize AsInteger
Public dwPromptFlags AsInteger
Public hwndApp As IntPtr
Public szPrompt AsString
EndStructure

PrivateConst CRYPTPROTECT_UI_FORBIDDEN AsInteger= 1
PrivateConst CRYPTPROTECT_LOCAL_MACHINE AsInteger= 4

PrivateSharedSub InitPrompt _
( _
ByRef ps As CRYPTPROTECT_PROMPTSTRUCT _
)
ps.cbSize = Marshal.SizeOf(GetType(CRYPTPROTECT_PROMPTSTRUCT))
ps.dwPromptFlags = 0
ps.hwndApp = IntPtr.Zero
ps.szPrompt =Nothing
EndSub

PrivateSharedSub InitBLOB _
( _
ByVal data AsByte(), _
ByRef blob As DATA_BLOB _
)
' Use empty array for null parameter.
If data IsNothingThen
data =NewByte(0) {}
EndIf

' Allocate memory for the BLOB data.
blob.pbData = Marshal.AllocHGlobal(data.Length)

' Make sure that memory allocation was successful.
If blob.pbData.Equals(IntPtr.Zero) Then
ThrowNew Exception( _
"Unable to allocate data buffer for BLOB structure.")
EndIf

' Specify number of bytes in the BLOB.
blob.cbData = data.Length
Marshal.Copy(data, 0, blob.pbData, data.Length)
EndSub

PublicEnum KeyType
UserKey = 1
MachineKey
EndEnum

PrivateShared defaultKeyType As KeyType = KeyType.UserKey

PublicSharedFunction Encrypt _
( _
ByVal keyType As KeyType, _
ByVal plainText AsString, _
ByVal entropy AsString, _
ByValdescriptionAsString _
) AsString
If plainText IsNothingThen
plainText =String.Empty
EndIf
If entropy IsNothingThen
entropy =String.Empty
EndIf

Dim result AsByte()
Dim encrypted AsString=""
Dim i AsInteger
result = Encrypt(keyType, _
Encoding.Unicode.GetBytes(plainText), _
Encoding.Unicode.GetBytes(entropy), _
description)
For i = 0 To result.Length - 1
encrypted = encrypted & Convert.ToString(result(i), 16).PadLeft(2, "0").ToUpper()
Next
Return encrypted.ToString()
EndFunction

PublicSharedFunction Encrypt _
( _
ByVal keyType As KeyType, _
ByVal plainTextBytes AsByte(), _
ByVal entropyBytes AsByte(), _
ByValdescriptionAsString _
) AsByte()
If plainTextBytes IsNothingThen
plainTextBytes =NewByte(0) {}
EndIf

If entropyBytes IsNothingThen
entropyBytes =NewByte(0) {}
EndIf

IfdescriptionIsNothingThen
description=String.Empty
EndIf

Dim plainTextBlob As DATA_BLOB =New DATA_BLOB
Dim cipherTextBlob As DATA_BLOB =New DATA_BLOB
Dim entropyBlob As DATA_BLOB =New DATA_BLOB

Dim prompt As _
CRYPTPROTECT_PROMPTSTRUCT =New CRYPTPROTECT_PROMPTSTRUCT
InitPrompt(prompt)

Try
Try
InitBLOB(plainTextBytes, plainTextBlob)
Catch ex As Exception
ThrowNew Exception("Cannot initialize plaintext BLOB.", ex)
EndTry

Try
InitBLOB(entropyBytes, entropyBlob)
Catch ex As Exception
ThrowNew Exception("Cannot initialize entropy BLOB.", ex)
EndTry

Dim flags AsInteger= CRYPTPROTECT_UI_FORBIDDEN

If keyType = keyType.MachineKey Then
flags = flags Or (CRYPTPROTECT_LOCAL_MACHINE)
EndIf

Dim success AsBoolean= CryptProtectData( _
plainTextBlob, _
description, _
entropyBlob, _
IntPtr.Zero, _
prompt, _
flags, _
cipherTextBlob)

IfNot success Then
Dim errCode AsInteger= Marshal.GetLastWin32Error()

ThrowNew Exception("CryptProtectData failed.", _
New Win32Exception(errCode))
EndIf

Dim cipherTextBytes(cipherTextBlob.cbData) AsByte

Marshal.Copy(cipherTextBlob.pbData, cipherTextBytes, 0, _
cipherTextBlob.cbData)

Return cipherTextBytes
Catch ex As Exception
ThrowNew Exception("DPAPI was unable to encrypt data.", ex)
Finally
IfNot (plainTextBlob.pbData.Equals(IntPtr.Zero)) Then
Marshal.FreeHGlobal(plainTextBlob.pbData)
EndIf

IfNot (cipherTextBlob.pbData.Equals(IntPtr.Zero)) Then
Marshal.FreeHGlobal(cipherTextBlob.pbData)
EndIf

IfNot (entropyBlob.pbData.Equals(IntPtr.Zero)) Then
Marshal.FreeHGlobal(entropyBlob.pbData)
EndIf
EndTry
EndFunction

EndClass

Then in our .RDP file generator we just call out to our dot net encryptor like this.

DPAPI.Encrypt(DPAPI.KeyType.MachineKey, "MyPassword", Nothing, "psw")

Now, this is worth stressing again that exposing passwords for RDP clients can be a very dangerous idea. Someone can grab ahold of those and cause all sorts of havoc so your management of these security tools needs to be very well understood. Storage, access, and management of this data is one of the most critical components of your security strategy and anytime your exposing this information you need to be aware of the ramifications of that action.