Getting started with Windows 7 in March 2016

By: Frank Rysanek [ rysanek AT fccps DOT cz ]

Motivation and hardware choices

Inadvertenly, I've wrecked my venerable Extensa 5620, while trying to solve some mysterious glitch in its display backlight. The backlight had been glitching for two weeks, and it felt more like a cold joint somewhere, rather than the CCFL tubes giving up... it was sensitive to vibration and mechanical stress on the plastic rear cover of the display. So I removed the front cover off the display, the way I've done several times before on this and similar notebooks... and couldn't find a problem, suddenly the backlight was perfectly stable. I turned off the notebook and I went on to remove the inverter from its seat in the lid.
What I didn't know was, that the backlight inverter is in fact powered all the time, as long as the AC adaptor is plugged in or a battery is inserted in the notebook. And, the aluminum foil lining in the rear plastic cover was pretty close to some live components on the inverter board... maybe too close at one particular critical place, which was possibly also a source of the "glitching" problem... which I found out much too late :-(
After some fumbling in the open display around the inverter, suddenly I realized, that the notebook doesn't respond to its power button anymore. It was... dead.

As it turns out, I managed to short the inverter's power input, to GND - which was NOT a problem after all. The problem was, that I also managed to short +12V to the PWM signal used for backlight intensity control (dimming), and that signal is an output of the Embedded Controller on the motherboard, and is connected straight from the chip to the inverter... the EC had no chance of survival. I actully found this problem the other way around: I found a schematic to the motherboard at some Russian website, and I looked around for some "stand-by power" rails. There's a cascade of +5VSB (which was okay) and a linear stabilizer making +3.3VSB (actually called AUX) which was NOT okay. The 3.3V rail was at about 100 mV and my ohm-meter indicated a short to GND. After I removed the stabilizer, the short at 3.3V remained... go figure :-(

At that moment, the Extensa was 6.5 years old, in daily service. I've worn two carrying bags to smithereens. I've tripped on a slippery sloping sidewalk on two or three winter occasions, while carrying the notebook in a briefcase-like bag - each time the notebook landed hard on the sidewalk. Yet the notebook kept going, except for an early HDD replacement and a recent constructional fortification of some metal rails holding the display to the hinges... the mod of the hinges looked like steampunk but worked amazingly well. Electrically it kept working perfectly fine, but I had to admit that a repair wasn't worth the bother anymore - ready for the electronics waste bin. Except for the HDD, which conveniently survived, containing lots of useful data.

My dilemma obviously was, what OS to use next.
The Extensa was XP-based, and I never had to reinstall. Basic sanitation works marvels - don't be promiscuous in what you run on the box, clean up the mess on the hard drive now and then, and XP keeps going for 6 straight years... I work as an industrial PC / communications / plant control troubleshooter, and I depend on several gadgets (USB-attached JTAG probes, for instance) and old software that runs best in XP, and has probably been ported to Win7 or even 8.1, but won't work in Win 10. Besides, Windows 10... oh well.

I can't afford to be an early OS adopter.
Rather, once I manage to make a particular software tool work, which often costs time and effort, I need to be sure that when I come back to it 3 years later, the original install is still operational, the way it was 3 years ago. Hence my conservatism. If I was an office grunt / sysadmin or some such, I would be running Linux on the desktop for years now.

Times they are a changin'. You can't run XP on modern HW, as there are no drivers for graphics and several other things, and even ACPI is nowadays just a legacy compatibility appendix in the post-modern UEFI BIOSen... The one thing I like about walking away from XP is, that finally I'll be able to take advantage of message-signaled interrupts... bye bye shared IRQ lines, physical, virtual or 2nd-order virtual :-)

Times they are a changin'. For several years, 95% of notebook PC's offered in shops and e-shops where I live, had Windows 8 preinstalled. The HW vendors apparently had huge stockpiles of them and couldn't get rid of them :-) Even when 8.1 had been out for a year or so, most of the notebook models in the shops had the original 8. Upgrading that to 8.1 was a marathon of 3 days of running Windows Update. You had to do some human multitasking: find yourself some other occupation, while keeping an eye on the PC running the lengthy upgrade, taking a few clicks now and then to let the process go further...
During those "Windows 8 everywhere" days, I didn't quite believe people in the know telling me, that 80% of PC's shipping from TW still have Windows 7 preinstalled :-)
Today, the situation in the shops is different, and pretty amazing at that: Unsurprisingly, most PC's in the shops come with Windows 10 preinstalled. Some have 8.1, none have the original 8 - but, a very strong minority, maybe 40%, come with Windows 7 preinstalled! The license sticker says Windows 10, and the Win7 preload is a legal downgrade from 10. The revival of Windows 7 in the shops looks pretty psychedelic, in our tiny post-commie land.

I prefer simple machines: Intel chipset, Intel on-chip graphics, entry-level CPU's. This time I didn't go for the cheapest Haswell+ Celeron, I got myself an i3. The reason is, that I noticed, that the i3 notebooks tend to be the lowest model that's not artificially crippled. The i3 machines come combined with 3 USB ports, two SODIMM slots, NumLock/CapsLock LED's etc. Unfortunately there's no way to get a classic keyboard on a notebook anymore, flat keys have conquered the market a few years ago... same thing with 1366x768 displays (coming after an era where 1280x800 was still available and made more sense on a work machine). I like notebooks that provide easy access to the guts, for RAM expansion, keyboard replacement and fan cleaning. Especially fan cleaning can be a pain - some vendors seem to try to force you to replace the whole fan assembly, by preventing you from cleaning it...

In that context, I've been watching entry-level Acers and Lenovo Ideapads for a while. I've been using Acers for years, but I was specifically surprised and pleased to see that recent Lenovo Ideapads are apparently even easier to maintain. That in a brand which used to be renowned for shitty bells and whistles, cheapskate guts and proprietary design cockups (deviations from Intel reference designs) in enterprise-level notebooks (IBM).

I ended up ordering a Lenovo B50-80 with a Broadwell i3, 4 GB of RAM (bought a cheaper Acer with Haswell Celeron two years ago, that has 8 GB!) and a 1TB non-hybrid = flashless HDD. Western Digital... will last a year and will get replaced by a Seagate at the first bad sector. Good!
Out of the box I suffered a bit of a heart attack - the top row of F-keys on the keyboard (F1 to F12) have an "inverted Fn" modifier logic. Fortunately, this can be reverted to normal function in the BIOS Setup, and the Windows even came with "normal" logic in their own driver (interesting... in Windows, the keys worked normal, they were only inverted in the BIOS.) The keyboard is ugly as hell, but not much worse than the one on modern Acers and perhaps more conventional than most other competition. Typing on it is a pain, so I'll have to keep an external keyboard around, at work and at home. This was only to be expected...

One of the reasons for this Lenovo was, that it came with a license for Win10 Pro, and Win7 Pro preloaded. Win7 is admittedly slower than 8.1 or 10, but will be more compatible with my conservative taste in software - in several deeply technical respects.

Win 7 preloaded by Lenovo - updates galore

Obviously the Win7 preload was full of bloatware. As I wanted to repartition anyway, my first step was a full backup using PXE-booted WinPE with GImagex. And then I kicked and chopped most of the Lenovo junk, leaving just something called a Lenovo Utility, which I suspect is responsible for some special function keys, along with CapsLock and NumLock notifications on the screen = Lenovo Utility is the bare minimum of proprietary code that makes the notebook any use.
I also left PowerDVD installed, just in case the kids wanted to watch some silver disks (Windows Media Player sucks) and just in case I didn't have VLC installed by that time. I specifically kicked all the password managers / security centers including the fingerprint reader driver and (with a special grin) the obligatory McAffee nagware. Security Essentils is not much better, but seems more integrated and less of a hog.

A mighty shock came when I tried to uncork Windows Updates. They just didn't work: "searching for updates..." forever, eating 1 whole CPU core. I went through several stages, from casual fumbling and googling, through focused scrutiny and deep googling, to an attempt at "out of band" semi-manual update. I suspected that my Lenovo crapectomy was *not* the problem and I did not resort to a humiliating restore from my early backup (and I think I was right). Finally I managed to find a 3rd-party "out of band" update tool that tries to work with the dependency metadata provided by Microsoft update servers and was enough to unhook the native updates on my preloaded Windows setup.

I used to find myself in the same situation before, in XP. If you installed XP SP3 from a Microsoft original CD, the Windows Update wouldn't start, and it was that way even before the "end of XP support". You needed to manually update the Windows Installer, the Windows Update Agent and maybe one or two further smaller patches, and MSIE8, before the native update tool finally started to work. Also, for simpler cases of "built-in updates not working", you could always browse (in MSIE) to windowsupdate.microsoft.com and get the recent-most version of the web-based update tool, which often was enough to unhook the stuck local agent. And this is exactly the option that's missing in Windows 7 !

Nowadays in Windows 7 in early 2016, you can find several Microsoft technet and KB articles, 3rd-party forum posts and blog entries, containing advice on what to do to resuscitate the Windows Update agent in Windows 7 - ranging from random single-entry suggestions and half-assed advice that hardly ever works, to comprehensive bullet lists that seem to help many people. The trouble seems to be that the update process can fail for different internal reasons in different versions (and combinations of versions) of the Windows-internal components involved, in the flow of time and gradual updates.
A Win7 preload from "misc computer maker", sold as a retrofit / license downgrade from Windows 10, shipped after Win7 got practically retired by Microsoft, that's perhaps outright asking for trouble in the context of Microsoft Windows Update :-) Microsoft understandably won't rush to help us with that setup. Their tech support people have a hard time denying existence of specific bugs in Windows 10.

The early Windows 7 SP1 Update Agent seems to share a bug with the early Windows 8 update agent, which looks like this: you ask the Windows Update window to search for updates, and it keeps searching forever, while eating 100% of one CPU core, and trashing the hard drive, gradually less and less intensively... the Wikipedia article on Windows Update explains that the bug was tracked down to some "exponential algorithm" in the local agent... who would've guessed, right?
Microsoft isn't enough of a software company to find their way about managing a database of dependencies (graph data) in their in-house software update framework. Ahh well... perhaps they should've just ported APT and pay the authors a nice license fee (retirement package).

Mindful of the advice to "disconnect from the internet while doing the following steps, to prevent the Windows Update service from getting stuck in its loopy bug, which would prevent even manual updates",
I progressed through these particular steps:

Early in the process I noticed that even if I forcibly disconnect my notebook from a WiFi ESSID, I have yet to open the properties of that ESSID profile and disable auto-reconnect, as otherwise Windows will connect again after a reboot, thus making all my manual update install attempts fail... So even after I sorted that out, the items above have failed to revive Windows Update on my shiny new notebook.

In ultimate despair, I checked out several 3rd-party tools purporting to handle the offline download and installation of updates. In the end I found only one tool fit for the purpose: the WSUS Offline Update:
http://download.wsusoffline.net/
http://www.wsusoffline.net/docs/
Ignore all the talk about using a USB flash drive to carry the updates to another computer. Just download and unpack the software into a dedicated directory, in Program Files or elsewhere.
There are two steps:

  1. download the updates, using a tool called UpdateGenerator.exe You can instruct the generator to copy the data and installer into a dedicated directory (I did), but this is perhaps not even necessary. The updates are in .msu format.
  2. install the updates, using a tool called UpdateInstaller.exe. (I found it in the dedicated directory, along with the downloaded .MSU updates.)

Now... the install stage was still not exactly smooth.

Note that the UpdateInstaller.exe is not entirely standalone, it still has to ask the Windows Update service (a part of the local WSU agent) to carry out the install of even the manually spoonfed MSU files. Apparently there is some special sauce to the installation of updates, and there's the database management bit which only the Microsoft's own engine understands...

I first ran the UpdateInstaller.exe from a normal user, albeit a member of the "Administrators" group, and ran "as an Administrator" just in case.

This way, the installer hung at the second update.

I did a few more things:

(UAC was completely off by that time anyway)

I ran the UpdateInstaller.exe again. This time, it installed some 6 updates, and rebooted. After that, if memory serves, it didn't want to work in safe mode ever again.

I tried the UpdateInstaller.exe again, this time in normal mode, still disconnected from the internet (including WiFi). Again a few updates went through.

I rebooted between normal and safe mode in this way about twice or three times. On one occasion, the UpdateInstaller installed about 85 updates. I noticed that on shutdowns and startups, Windows started to do some "finalization work" (post-update / deferred scripts, probably) on the updates on its own, without the supervision of the 3rd-party UpdateInstaller.exe. The installer did complain about some updates "missing", but overall things were starting to look optimistic.

Then I reached a point where the UpdateInstaller kept saying that no further updates were due, regardless of me rebooting into normal or safe mode.

At that point, I tried connecting to the internet and asking the native Windows Update wizard to search for updates. Lo and behold, after some trashing of the HDD, the wizard was back with a list of further updates :-)

In other words, the WSUS Offline tool is probably not perfect, and relies on the Windows Update engine (service) running in the system for keeping track of the installed updates, but was capable enough to resuscitate Microsoft's own Windows Update engine.

From then on, the native Windows Update agent has been working. I took care to ban some known updates that bring GWX nagware and backported "telemetry" stuff.

I downloaded and installed the GWX Control Panel - and I noticed that I could not fiddle with the Windows Update settings any more - the choice of whether to inform only, or download and then inform, etc was greyed out. The GWX Control Panel probably banned this user choice in the Group Policies. I've learned that this choice hapens at two levels: 1) can be hardcoded via Group Policies 2) only if the relevant Group Policy leaves the choice to a "local admin", you're allowed to make your choice in the clickety Windows Update options dialog.

You can change the Group Policies either via gpedit.msc, or by editing a few registry keys - you just need to know what values and value names to enter.

I have disabled Autoplay for all drives, just for a good measure.

Pretty much irrelevant to the Windows Update galore, I have discovered one other interesting pitfall :-) You probably know that it's quite easy to change the background wallpaper on your desktop, per user. It's also possible to change the background at Winlogon. Not so simple anymore, but possible (easier than in 8.1) and pretty much no pitfalls so far.

In addition to that, it is technically possible to change the "starting Windows" splash animation. There's a tool for that, called the "Windows 7 Boot Updater", which allows you to import your own animation.¨ Its own data file, used for sharing of the themes over the Internet, is called .bs7 (Boot Skin for Win7) and there are quite a number of ready skins available for download. Cool stuff, regardless of your personal definition of "cool".

But, caveat emptor: The principle of operation of the Boot Updater is, that it modifies the winload.exe (second or third stage bootloader binary, it would seem) and some accompanying data files: some resource DLL (perhaps holding the animation) and the boot loader's MUI file = a file containing text strings for the binary, in the context of internationalization.

You need to read the docs really in depth to catch wind of upcoming trouble. And the trouble is that: by modding the bootloader binary, the Boot Updater voids the signature for that binary. And, unless you have the signature checking disabled in the BCD (default is enabled), you end up with a system that's stuck at boot, with a simple message that the signature on the bootloader binary doesn't match.

And, you need some offline environment to restore at least winload.exe from a backup (that you have certainly created in advance, right? RIGHT?). I.e., another PC where you can plug the disk drive from your bricked machine, or a Windows PE environment, booted from a USB flash drive, or via PXE or some such. Maybe even a Linux distro with NTFS support would do the trick.

And that's about all, folks. Sheesh... and I thought this would be easier than moving preloaded Win8 to the latest 8.1 level :-)