Geeks in Phoenix

Geek Blog


Harden / Mitigate the security of your Windows programs with Microsoft EMET

Updated January 31, 2021. Microsoft's Enhanced Mitigation Experience Toolkit reached the end of its life on July 31, 2018, and is no longer available for download.

Enhanced Mitigation Experience Toolkit 5.5

Let's face it, some of the software we use on a daily basis has become subject to security vulnerabilities and exploits. Software manufacturers do their best to develop and test fixes / patches as fast as possible, but this can take time. A lot of users just cannot keep up with all of the updates and hotfixes. A few years ago Microsoft released the Enhanced Mitigation Experience Toolkit (EMET) to deal with just this issue.

View of the main screen inside EMET 5.5
View of the main screen inside EMET 5.5

So what is EMET? EMET monitors selected programs (Internet Explorer, Microsoft Office, etc.) for known attack actions and techniques. When one of the several pseudo mitigation technologies is triggered, EMET will either block the programs' access to the resource it is trying to reach or just terminate it. EMET expands on the technologies that Microsoft implemented with Data Execution Prevention (DEP), which has been included in the Windows operating system since Windows XP SP2. It will also validate digitally signed SSL certificates inside of Internet Explorer.

View of the application configuration screen inside EMET 5.5
View of the application configuration screen inside EMET 5.5

So how does EMET work? EMET acts as a shim between the program being monitored and the operating system. The monitored program thinks it's talking directly to the operating system, but it's actually talking to it through EMET. EMET comes with predefined profiles for some of the more common programs like Microsoft Office, Internet Explorer, Adobe Acrobat and Java. You can also add to the predefined profiles or create your own. I recommend that you monitor any program that can open files on or from the Internet.

What security exploits are currently covered

Here's is the current list of mitigations EMET 5.5 currently looks for.

  • Attack Surface Reduction (ASR) Mitigation
  • Export Address Table Filtering (EAF+) Security Mitigation
  • Data Execution Prevention (DEP) Security Mitigation
  • Structured Execution Handling Overwrite Protection (SEHOP) Security Mitigation
  • NullPage Security Mitigation
  • Heapspray Allocation Security Mitigation
  • Export Address Table Filtering (EAF) Security Mitigation
  • Mandatory Address Space Layout Randomization (ASLR) Security Mitigation
  • Load Library Check - Return Oriented Programming (ROP) Security Mitigation
  • Memory Protection Check - Return Oriented Programming (ROP) Security Mitigation
  • Caller Checks - Return Oriented Programming (ROP) Security Mitigation
  • Simulate Execution Flow - Return Oriented Programming (ROP) Security Mitigation
  • Stack Pivot - Return Oriented Programming (ROP) Security Mitigation
  • Windows 10 untrusted fonts

What programs should you harden / mitigate

You only want to harden / mitigate certain programs that are targeted on a regular basis. Web browsers like Chrome, Firefox and Internet Explorer, production / office programs like Microsoft Word, Excel and PowerPoint, e-mail clients like Outlook and Windows Live Mail are some of the few. I recommend that you harden any program that can open files on or from the Internet.

What programs should you not harden / mitigate

You should never configure EMET to monitor anti-virus, anti-malware, intrusion prevention / detection software, debuggers, software that handles Digital Rights Management (DRM) technologies or software that uses anti-debugging, obfuscation, or hooking technologies.

Installation notes

New installation: Just download EMET and install

Upgrade install: Since the registry keys for EMET changed with this version, you can either export your existing EMET settings using the method in the 'What's new' section below, download the converter or reconfigure all of the program settings. With the drastic change with the EMET data format inside of the registry, I think that it would be just easier to reconfigure EMET then try the export / import method. Either way, remember to uninstall any older version of EMET and restart your computer before you install this version.

What's new in EMET 5.5?

  • Full-featured GPO management, compatible with reporting and compliance requirements
  • Command line: new syntax and options
  • Implementation of certificate pinning now based on root CA thumbprints. Exceptions logic removed.
  • Export and Import now memorize path
  • EMET registry has been refactored. To convert settings from previous versions of EMET (including EMET 5.5 Beta), registry values must be saved in a file then imported back with the use of the converter PowerShell script after EMET 5.5 is installed. Here are the steps to follow:
  1. Export settings. With elevated PowerShell, run the following command:
    .\Migrate-EmetSettings.ps1 -RegFile .\NewEmetSettings.reg -MissingCertCsv .\MissingCerts.csv PowerShell script Migrate-EmetSettings.ps1 is provided with EMET 5.5 RTM. It includes documentation about its usage.
  2. Uninstall former version of EMET.
  3. Install EMET 5.5 RTM. When asked to choose between Use recommended settings and Configure manually later, chose option Configure manually later.
  4. Import settings. With elevated PowerShell, run the following command:
    reg.exe import .\NewEmetSettings.reg

Supported Operating Systems

Windows 10 , Windows 7, Windows 8.1, Windows Server 2008, Windows Server 2012, Windows Server 2012 R2, Windows Vista

  • EMET 5.5 requires .NET Framework 4.5.
  • For Internet Explorer 10 on Windows 8 you need to install KB2790907 - a mandatory Application Compatibility update that has been released on March 12th, 2013 or any other Application Compatibility updates for Windows 8 after that

My five favorite Windows tips for maintaining your computer

Updated October 14, 2020

In this article, I am going to share my five favorite tips for maintaining Microsoft Windows.

  1. Checkdisk. This is the first thing I do when I get a system here in the shop. Errors do occur, and files do get damaged. Best to take care of this first thing. And yes, this can take a while, so I always recommend leaving your system on and let Checkdisk run overnight. That way, your computer is ready to go first thing in the morning.

    For more information on how to perform a Checkdisk, select your operating system below:

    Windows 10 Checkdisk

    Windows 8.1 Checkdisk

    Windows 7 / Windows Vista Checkdisk

    Windows XP Checkdisk

  2. Delete Temporary files. This is the first place to look when you need to free up some hard disk space. These files served their purpose at one time, but the program that used them did not delete them for some unknown reason. When deleting temporary files, some may still be in use. I recommend deleting all files/folders that are over a week old. See below for the location of the temporary files folder on your version of Windows:

    Windows Vista / 7 / 8.1 / 10 - C:\Users\username\AppData\Local\Temp
    Windows XP - C:\Documents and Settings\username\Local Settings\Temp

  3. Delete the Internet Explorer cache. This is the second place to look when you need to free up some hard disk space. I have seen systems with over 9 Gb of temporary files. Open Internet Explorer and go to Tools > Internet Options and change the following settings:

    Internet Explorer Temporary Files
    Internet Explorer Temporary Files

  4. Pagefile optimization. This one often gets overlooked. There is a formula for calculating the correct pagefile size. Minimum pagefile size is one and a half (1.5) x amount of memory. Maximum pagefile size is three (3) x minimum pagefile size. Say you have 4 Gb (4,096 Mb) of memory. 1.5 x 4,096 = 6,144 Mb would be the min. pagefile size and 3 x 6,144 = 18,432 Mb would be the max. pagefile size.

    Windows Pagefile Settings

    To change the pagefile size, you need to access the System Properties dialog box. Press Windows logo key + Pause (Windows Vista / 7 / 8.1 / 10 users select 'Advanced' system settings). Then select the 'Advanced' tab and under 'Performance' click on Settings. Then select the 'Advanced' tab and under 'Virtual memory' click on Change.

    For more information on how to change the pagefile size, select your operating system below:

    Windows 10 Pagefile Settings

    Windows 8.1 Pagefile Settings

    Windows 7 Pagefile Settings

    Windows Vista Pagefile Settings

    Windows XP Pagefile Settings

  5. Disk Defragmenter. Probably the best single thing you can do to speed up your computer. Imagine a filing cabinet where all of the folders were out of order, and files were misplaced throughout the cabinet. How could you find anything? Same thing with your hard drive. Disk Defragmenter takes care of that for you. And you can run it as a scheduled task too.

    For more information on how to use Disk Defragmenter, select your operating system below:

    Windows 10 Disk Defragmenter

    Windows 8.1 Disk Defragmenter

    Windows 7 Disk Defragmenter

    Windows Vista Disk Defragmenter

    Windows XP Disk Defragmenter

Use DejaOffice to sync Outlook with your Android

In my recent change to the Google Android from a Palm, I required two main functions. The second one was to be able to synchronize my Android to Microsoft Outlook. I have been using Outlook as a PIM (Personal Information Manager) for years now, as it's the 'de facto' standard in the corporate world. I was pleasantly surprised to find DejaOffice by CompanionLink.

Being on the Palm platform for years, I became kind of pampered when synchronizing data with Outlook. This really was one of Palm Pilot's strong points. So when I found DejaOffice, it was just the perfect replacement for the conduits from Palm. With the ability to sync Contacts, Tasks, Calendar, and Notes, this is a 'must-have' if you use Outlook. Here's a quote from their site:

Data from the PC sync to DejaOffice, a mobile office application suite for Android. DejaOffice features robust contacts, calendar, tasks, and notes apps that provide enhanced functionality over the native Android applications. Contacts and calendar automatically sync with the native Android databases to allow for full functionality with other apps.

I highly recommend you give this program a try. It's available from the Android page at CompanionLink.

Synchronize files & folders between devices with SyncToy 2.1

Updated January 31, 2021

Note: SyncToy is no longer available for download from Microsoft's servers. The links at the bottom of this article have been revised to third party downloads. For an alternative file synchronization software, take a look at Allway Sync.

I recently migrated to a Google Android and needed a program to sync files between it and my workstation. I had used SyncToy 2.0 from Microsoft on Windows XP (32-bit), so I decided to give SyncToy 2.1 a try on Windows 7 (64-bit).

SyncToy 2.1

Once the installation was complete, I created a new folder on my computer to synchronize with the Android. I then opened up SyncToy and made a Folder Pair between the memory card on the Android (via USB cable) and the new folder on my computer.

SyncToy 2.1

Clicking on the Preview button will show what files and folders are synchronized, type of operation, last modified, etc. Here's a quote from the SyncToy page:

There are files from all kinds of sources that we want to store and manage. Files are created by our digital cameras, e-mail, cell phones, portable media players, camcorders, PDAs, and laptops. Increasingly, computer users are using different folders, drives, and even different computers (such as a laptop and a desktop) to store, manage, retrieve and view files. Yet managing hundreds or thousands of files is still largely a manual operation. In some cases it is necessary to regularly get copies of files from another location to add to primary location; in other cases there is a need to keep two storage locations exactly in sync. Some users manage files manually, dragging and dropping from one place to another and keeping track of whether the locations are synchronized in their heads. Other users may use two or more applications to provide this functionality.

Now there is an easier way. SyncToy, a free PowerToy for Microsoft Windows, is an easy to use, highly customizable program that helps users to do the heavy lifting involved with the copying, moving, and synchronization of different directories. Most common operations can be performed with just a few clicks of the mouse, and additional customization is available without additional complexity. SyncToy can manage multiple sets of folders at the same time; it can combine files from two folders in one case, and mimic renames and deletes in another case. Unlike other applications, SyncToy actually keeps track of renames to files and will make sure those changes get carried over to the synchronized folder.

I have used SyncToy over the years without any issues and recommend it to anyone who needs to synchronize files between devices. SyncToy runs on Windows XP, Windows Vista, Windows 7, Windows 8.1, Windows 10 and comes in 32-bit and 64-bit versions. For more information on SyncToy, follow the links below.

SyncToy - 32-bit version

SyncToy - 64-bit version

RAW Image Viewers for Windows

When I migrated from Windows XP to Windows 7, one of the things I have missed is the Microsoft Powertoys. A couple of the functions have been integrated into Windows 7 (Open Command Window Here and Power Calculator). However, there are a few I am still looking for applications to replace them with.

One of them is the RAW Image Viewer. I am into digital photography and like to organize and work with digital RAW image files in Windows Explorer (much as you can with JPEG images). But Windows does not have support for this format built-in. Well, I am glad to say I have found a replacement for it.

FastPictureViewer is a free collection of 32 and 64-bit RAW Image Decoders for Windows XP, Windows Vista, Windows 7, Windows 8.1, and Windows 10.

Once installed, you have the same features for RAW image formats in Windows as you do with JPEG, BMP, PNG, GIF, and TIFF, complete with thumbnails in Explorer, preview, slide show support in Photo Gallery / Photo Viewer, and metadata search integration.

For more information and to download FastPictureViewer, please visit their web site.

Free computer diagnostics

Repairing a PC can sometimes be expensive, and that is why we offer free basic in-shop diagnostics. Give one of our professional and experienced technicians a call at (602) 795-1111, and let's see what we can do for you.

Check out our reviews

Geeks In Phoenix LLC, BBB Business Review

Customer service is #1

Here at Geeks in Phoenix, we take pride in providing excellent customer service. We aim to give the highest quality of service  from computer repair, virus removal, and data recovery.

Bring your computer to us and save

Repairing a computer can be time-consuming. That is why we base our in-shop service on the time we work on your computer, not the time it takes for your computer to work! From running memory checking software to scanning for viruses, these are processes that can take some time.

Contact us

If you have any questions, please feel free to give us a call at (602) 795-1111  and talk with one of our Geeks. Or you can send us a message from our contact page contact page , and one of our Geeks will get back to you as soon as possible. Or you can stop by and see us. Here are our hours and location.

Like Geeks in Phoenix on Facebook

Follow Geeks in Phoenix on Twitter

Watch Geeks in Phoenix on YouTube

Geeks in Phoenix is an IT consulting company specializing in servicing laptop and desktop computers. Since 2008, our expert and knowledgeable technicians have provided excellent computer repair, virus removal, data recovery, photo manipulation, and website support to the greater Phoenix metro area.

At Geeks in Phoenix, we have the most outstanding computer consultants that provide the highest exceptional service in Phoenix, Paradise Valley, Scottsdale, and Tempe, Arizona. We offer in-shop, on-site, and remote (with stable Internet connection) computer support and services.

Geeks in Phoenix
Expert service at affordable prices!
4722 East Monte Vista Road
Phoenix, Arizona 85008
(602) 795-1111

Copyright © 2022 Geeks in Phoenix LLC