Category Archives: Scripting

Java SE Embedded package for Synology NAS

There is a lot of good Java software, but it’s difficult to get Java running on a NAS. I decided to do something about that, mainly to pave the way for a Serviio package that didn’t require a huge guide to install. In compliance with the Oracle EULA the Java binaries cannot be redistributed, so this package looks for the downloaded .tar.gz archive in the public shared folder on the NAS. The end user is required to register with Oracle to get the file, as you can see from the description below. I also added locale support to the underlying Linux since Java requires this for UTF-8 support when reading from the filesystem (DSM 4.3 later included this). Timezone support is also configured.

This package installs Java SE Embedded which is purposefully designed to run on low specification headless hardware. It should be noted that Synology Java Manager (only available on Intel products) is the full Java Runtime Environment, and consequently uses more RAM. By default you should use Java 8, unless the application you want to run specifically requires Java 7.

Please note that Oracle ceased maintaining Java 6 in 2012, so it should be considered a serious security vulnerability. The Java 6 package has been withdrawn from the package repository for this reason. If you need it to run a particular piece of software you may download it here for manual installation. Please also note that Oracle retired support for PowerPC CPUs following Java 8 Update 6, so the PowerPC package remains at that version.

Java Package



  • In Synology DSM’s Package Center, click Settings and add my package repository:
    Add Package Repository
  • The repository will push its certificate automatically to the NAS, which is used to validate package integrity. Set the Trust Level to Synology Inc. and trusted publishers:
    Trust Level
  • Now browse the Community section in Package Center to install a Java SE Embedded package:
    The repository only displays packages which are compatible with your specific model of NAS. If you don’t see Java Embedded in the list, then either your NAS model or your DSM version are not supported at this time.
  • If you have a multi-bay NAS, use the Shared Folder control panel to create a shared folder called public (it must be all lower case). On single bay models this is created by default. Assign it with Read/Write privileges for everyone.
  • Register with Oracle and download the appropriate version of Java SE Embedded for your CPU architecture and save in the public shared folder on your NAS. Note that to get any version of Java older than the current one you will need to follow the Oracle Java SE Embedded Downloads Archive link on that page. If in doubt, attempt to install the package first, and the error message will tell you which specific download version is required.
  • If you have trouble getting the Java archive recognised, try downloading it with a different web browser. Some browsers try to help by uncompressing the file, or renaming it without warning. I have tried to code around most of these behaviours. Use Firefox if all else fails.

Package scripts

For information, here are the package scripts so you can see what it’s going to do. You can get more information about how packages work by reading the Synology 3rd Party Developer Guide.


#--------JAVA installer script
#--------package maintained at

COMMENT="# Synology Java Package"
SYNO_CPU_ARCH="`uname -m`"
[ "`echo ${SYNO_CPU_ARCH} | cut -c1-7`" == "armv5te" ] && SYNO_CPU_ARCH="armv5tel"
#--------Synology switched Armada 370 systems from SoftFP to HardFP EABI for DSM 6.0
[ "${SYNOPKG_DSM_ARCH}" == "armada370" ] && [ ${SYNOPKG_DSM_VERSION_MAJOR} -gt 5 ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "armada375" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "armada38x" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "comcerto2k" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "alpine" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "alpine4k" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "monaco" ] && SYNO_CPU_ARCH="armv7l-hflt"
[ "${SYNOPKG_DSM_ARCH}" == "x86_64" ] && [ "${WIZARD_JRE_EE}" == "true" ] && SYNO_CPU_ARCH="i686"
[ "${SYNOPKG_DSM_ARCH}" == "x86_64" ] && [ ${SYNOPKG_DSM_VERSION_MAJOR} -lt 6 ] && SYNO_CPU_ARCH="i686"

if [ "${SYNOPKG_PKGNAME}" == "java6" ]; then
  if [ "`echo ${SYNO_CPU_ARCH} | cut -c1-7`" == "armv5te" ]; then
    JAVA_BUILD="ARMv5 Linux - Headless EABI"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BUILD="ARMv6/7 Linux - Headless EABI, VFP, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BUILD="x86 Linux Small Footprint - Headless"
  elif [ "${SYNO_CPU_ARCH}" == "x86_64" ]; then
    JAVA_BUILD="x86 Linux Small Footprint - Headless"
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 core"

elif [ "${SYNOPKG_PKGNAME}" == "java7" ]; then
  if [ "${SYNO_CPU_ARCH}" == "armv5tel" ]; then
    JAVA_BUILD="ARMv5 Linux - Headless EABI, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BUILD="ARMv6/7 Linux - Headless - Client Compiler EABI, VFP, SoftFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l-hflt" ]; then
    JAVA_BUILD="ARMv6/7 Linux - Headless - Client Compiler EABI, VFP, HardFP ABI, Little Endian"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BUILD="x86 Linux Small Footprint - Headless"  
  elif [ "${SYNO_CPU_ARCH}" == "x86_64" ]; then
    JAVA_BUILD="x86 Linux Small Footprint - Headless"  
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 with double-precision SPE Floating Point Unit"

elif [ "${SYNOPKG_PKGNAME}" == "java8" ]; then
  if [ "${SYNO_CPU_ARCH}" == "armv5tel" ]; then
    JAVA_BUILD="ARMv5/ARMv6/ARMv7 Linux - SoftFP ABI, Little Endian 2"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l" ]; then
    JAVA_BUILD="ARMv5/ARMv6/ARMv7 Linux - SoftFP ABI, Little Endian 2"
  elif [ "${SYNO_CPU_ARCH}" == "armv7l-hflt" ]; then
    JAVA_BUILD="ARMv6/ARMv7 Linux - VFP, HardFP ABI, Little Endian 1"
  elif [ "${SYNO_CPU_ARCH}" == "aarch64" ]; then
    JAVA_BUILD="Linux ARM 64 Hard Float ABI"
  elif [ "${SYNO_CPU_ARCH}" == "i686" ]; then
    JAVA_BUILD="x86 Linux Small Footprint - Headless"
  elif [ "${SYNO_CPU_ARCH}" == "x86_64" ]; then
    JAVA_BUILD="Linux x64"
  elif [ "${SYNO_CPU_ARCH}" == "ppc" ]; then
    #Oracle have discontinued Java 8 for PowerPC after update 6
    JAVA_BUILD="Power Architecture Linux - Headless - e500v2 with double-precision SPE Floating Point Unit"

JAVA_BINARY=`echo ${JAVA_BINARY} | cut -f1 -d'.'`
PUBLIC_FOLDER="`synoshare --get public | sed -r "/Path/!d;s/^.*\[(.*)\].*$/\1/"`"
TEMP_FOLDER="`find / -maxdepth 2 -path '/volume?/@tmp' | head -n 1`"
NATIVE_BINS_FILE="`echo ${NATIVE_BINS_URL} | sed -r "s%^.*/(.*)%\1%"`"
#DSM versions older than 4.3 need locale support adding, don't download unless needed
[ ! -e /usr/bin/locale ] && INSTALL_FILES="${NATIVE_BINS_URL}"
source /etc/profile

preinst ()
  synoshare -get public > /dev/null || (
    echo "A shared folder called 'public' could not be found - note this name is case-sensitive. " >> $SYNOPKG_TEMP_LOGFILE
    echo "Please create this using the Shared Folder DSM Control Panel and try again." >> $SYNOPKG_TEMP_LOGFILE
    exit 1


  if [ -n "${JAVA_HOME}" ]; then
    echo "It seems from /etc/profile that a Java Runtime is already installed at ${JAVA_HOME}. Uninstall it and try again." >> $SYNOPKG_TEMP_LOGFILE
    exit 1
  [ -f ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar.tar ] && JAVA_BINARY_FOUND=true
  if [ -z ${JAVA_BINARY_FOUND} ]; then
    echo "Java binary bundle not found. " >> $SYNOPKG_TEMP_LOGFILE
    echo "I was expecting the file ${PUBLIC_FOLDER}/${JAVA_BINARY}.tar.gz. " >> $SYNOPKG_TEMP_LOGFILE
    echo "Please agree to the Oracle licence at ${DOWNLOAD_URL}, then download the '${JAVA_BUILD}' package" >> $SYNOPKG_TEMP_LOGFILE
    echo "and place it in the 'public' shared folder on your NAS. This download cannot be automated even if " >> $SYNOPKG_TEMP_LOGFILE
    echo "displaying a package EULA could potentially cover the legal aspect, because files hosted on Oracle's " >> $SYNOPKG_TEMP_LOGFILE
    echo "server are protected by a session cookie requiring a JavaScript enabled browser." >> $SYNOPKG_TEMP_LOGFILE
    exit 1

  if [ "${WIZARD_JCE_UL}" == "true" ]; then
    if [ ! -f ${PUBLIC_FOLDER}/${JCE_BINARY} ]; then
      echo "JCE Unlimited Strength binary bundle not found. " >> $SYNOPKG_TEMP_LOGFILE
      echo "I was expecting the file ${PUBLIC_FOLDER}/${JCE_BINARY} " >> $SYNOPKG_TEMP_LOGFILE
      echo "Please agree to the Oracle licence at ${JCE_URL}, then download the Unlimited Strength Jurisdiction Policy Files zip file " >> $SYNOPKG_TEMP_LOGFILE
      echo "and place it in the 'public' shared folder on your NAS. " >> $SYNOPKG_TEMP_LOGFILE
      exit 1

    WGET_FILENAME="`echo ${WGET_URL} | sed -r "s%^.*/(.*)%\1%"`"
    wget ${WGET_URL}
    if [[ $? != 0 ]]; then
      if [ -d ${PUBLIC_FOLDER} ] && [ -f ${PUBLIC_FOLDER}/${WGET_FILENAME} ]; then
        echo "There was a problem downloading ${WGET_FILENAME} from the official download link, " >> $SYNOPKG_TEMP_LOGFILE
        echo "which was \"${WGET_URL}\" " >> $SYNOPKG_TEMP_LOGFILE
        echo "Alternatively, you may download this file manually and place it in the 'public' shared folder. " >> $SYNOPKG_TEMP_LOGFILE
        exit 1
  exit 0

postinst ()
  #ldd tool is very useful but not included in DSM
  if [ ! -e /usr/local/bin/ldd ]; then
    mkdir -p /usr/local/bin
    cp ${SYNOPKG_PKGDEST}/tools/ldd-${SYNO_CPU_ARCH} /usr/local/bin/ldd

  #extract native binaries if needed
  if [ -e ${TEMP_FOLDER}/${NATIVE_BINS_FILE} ]; then
    #older DSM tar uses different command line switch for xz archives

  #extract Java (Web browsers love to interfere with .tar.gz files)
  if [ -f ${JAVA_BINARY}.tar.gz ]; then
    #Firefox seems to be the only browser that leaves it alone
    tar xzf ${JAVA_BINARY}.tar.gz
  elif [ -f ${JAVA_BINARY}.gz ]; then
    tar xzf ${JAVA_BINARY}.gz
  elif [ -f ${JAVA_BINARY}.tar ]; then
    tar xf ${JAVA_BINARY}.tar
  elif [ -f ${JAVA_BINARY}.tar.tar ]; then
    #Internet Explorer
    tar xzf ${JAVA_BINARY}.tar.tar

  #install Java
  if [ "${EXTRACTED_FOLDER}" != "${EXTRACTED_FOLDER/jdk/}" ]; then

  #install unlimited crypto policy files if requested
  if [ "${WIZARD_JCE_UL}" == "true" ]; then
    if [ -e /usr/bin/7z ]; then
      7z x ${JCE_BINARY} > /dev/null 2>&1
      unzip ${JCE_BINARY} 
    mv ${JCE_FOLDER}/* ${JRE_PATH}/lib/security
    rmdir ${JCE_FOLDER}

  #change owner of folder tree
  chown -R root:root ${SYNOPKG_PKGDEST}

  echo "NOTE - This package does *not* start and stop like other packages. " >> $SYNOPKG_TEMP_LOGFILE
  echo "Java is correctly installed if you can see the runtime and HotSpot version numbers, " >> $SYNOPKG_TEMP_LOGFILE
  echo "and locale information in the package Log tab." >> $SYNOPKG_TEMP_LOGFILE
  exit 0

preuninst ()
  exit 0

postuninst ()
  #clean up profile mods
  sed -i "/${COMMENT}/d" /etc/profile
  sed -i "/${COMMENT}/d" /root/.profile

  #leave locale support in place on older DSM versions - too risky to delete system binaries
  exit 0


JRE_PATH="`find /var/packages/${SYNOPKG_PKGNAME}/target/ -name jre`"
COMMENT="# Synology Java Package"
#set the current timezone for Java so that log timestamps are accurate, modern timezone names so DST works
SYNO_TZ=`cat /etc/synoinfo.conf | grep timezone | cut -f2 -d'"'`
#fix for DST time in DSM 5.2 thanks to MinimServer Syno package author
[ -e /usr/share/zoneinfo/Timezone/synotztable.json ] \
 && SYNO_TZ=`jq ".${SYNO_TZ} | .nameInTZDB" /usr/share/zoneinfo/Timezone/synotztable.json | sed -e "s/\"//g"` \
 || SYNO_TZ=`grep "^${SYNO_TZ}" /usr/share/zoneinfo/Timezone/tzname | sed -e "s/^.*= //"`

EnvCheck ()
#updates to DSM will reset these changes so check them each startup 
  #/etc/profile should contain 5 lines added by this package tagged with trailing comments
  COUNT=`grep -c "$COMMENT$" /etc/profile`
  if [ $COUNT != 5 ]; then

    #remove any existing mods
    sed -i "/${COMMENT}/d" /etc/profile

    #add required environment variables
    echo "PATH=\$PATH:${JRE_PATH}/bin ${COMMENT}" >> /etc/profile
    echo "JAVA_HOME=${JRE_PATH} ${COMMENT}" >> /etc/profile
    echo "CLASSPATH=.:${JRE_PATH}/lib ${COMMENT}" >> /etc/profile
    echo "LANG=en_US.utf8 ${COMMENT}" >> /etc/profile
    echo "export CLASSPATH JAVA_HOME LANG PATH ${COMMENT}" >> /etc/profile

  #/root/.profile should contain 3 lines added by this package tagged with trailing comments
  COUNT=`grep -c "$COMMENT$" /root/.profile`
  if [ $COUNT != 3 ]; then

    #remove any existing mods
    sed -i "/${COMMENT}/d" /root/.profile

    #add required environment variables
    echo "PATH=\$PATH:${JRE_PATH}/bin ${COMMENT}" >> /root/.profile
    echo "TZ='${SYNO_TZ}' ${COMMENT}" >> /root/.profile
    echo "export PATH TZ ${COMMENT}" >> /root/.profile

  #timezone needs setting each startup in case system value has changed
  sed -i "s%^TZ=.* ${COMMENT}%TZ='${SYNO_TZ}' ${COMMENT}%" /root/.profile

  #DSM versions older than 4.3 need locale support adding
  if [ ! -e /usr/bin/locale ]; then

    #build missing locale with UTF-8 support (don't think it matters which language)
    cp ${SYNOPKG_PKGDEST}/bin/* /usr/bin
    cp -R ${SYNOPKG_PKGDEST}/share/i18n /usr/share
    if [ ! -d /usr/lib/locale ]; then
      mkdir /usr/lib/locale
    localedef -c -f UTF-8 -i en_US en_US.utf8

  #DSM versions up to 5.1 are missing the zoneinfo timezone definitions which causes inaccurate log timestamps
  #thanks to CoolRaoul here:
  #to revert, just remove everything apart from 'Timezone' '' from /usr/share/zoneinfo
  if [ ! -e /usr/share/zoneinfo/Europe/London ]; then
    cp -R ${SYNOPKG_PKGDEST}/zoneinfo/* /usr/share/zoneinfo/


case $1 in
    source /etc/profile
    source /root/.profile

    #evidence of whether Java can start successfully is written to the package log
    java -version > ${SYNOPKG_PKGDEST}/output.log 2>&1
    echo >> ${SYNOPKG_PKGDEST}/output.log
    echo System installed locales: >> ${SYNOPKG_PKGDEST}/output.log
    locale -a >> ${SYNOPKG_PKGDEST}/output.log
    echo >> ${SYNOPKG_PKGDEST}/output.log
    echo JAVA_HOME=$JAVA_HOME >> ${SYNOPKG_PKGDEST}/output.log
    echo TZ=$TZ >> ${SYNOPKG_PKGDEST}/output.log

    exit 0

    exit 0

    source /etc/profile
    source /root/.profile
    if [ -e "${JAVA_HOME}/bin/java" ]; then
      exit 0
      exit 1

    echo "${SYNOPKG_PKGDEST}/output.log"
    exit 0



    "step_title": "Java Runtime Environment Selection",
    "items": [
        "type": "singleselect",
        "desc": "Please select the Java version to install:",
        "subitems": [
            "key": "WIZARD_JRE_EE",
            "desc": "Java SE Embedded 8 (smaller memory footprint, 32bit)",
            "defaultValue": true
            "key": "WIZARD_JRE_SE",
            "desc": "Java SE 8 (64bit)",
            "defaultValue": false
    "step_title": "Java Cryptography Strength Selection",
    "items": [
        "type": "singleselect",
        "desc": "Please select Java Cryptographic Extension policy:",
        "subitems": [
            "key": "WIZARD_JCE_STD",
            "desc": "Default Strong JCE policy - limited to AES-128 encryption",
            "defaultValue": true
            "key": "WIZARD_JCE_UL",
            "desc": "Unlimited Strength JCE policy - not permitted in some jurisdictions, see Oracle documentation",
            "defaultValue": false


  • 0050 17/Apr/19 – Updated to Java 8u211, added support for DS119j
  • 0049 11/Apr/19 – Updated to Java 8u201, fixed issue where x86_64 CPUs would ignore user selection and always install 64bit Java SE
  • 0048 22/Aug/18 – Updated to Java 8u181, added option to select 64bit full Java SE for x86_64 CPUs
  • 0047 14/May/18 – Updated to Java 8u171
  • 0046 20/Feb/18 – Updated to Java 8u161, experimental aarch64 support
  • 0045 30/Oct/17 – Updated to Java 8u151, added support for new CPUs in x17 and x18 models
  • 0044 02/Aug/17 – Updated to Java 8u144
  • 0043 21/Jan/17 – Updated to Java 8u121
  • 0042 07/Jan/17 – Updated to Java 8u111, fixed Armada 370/XP systems running DSM 6.0 which had switched from soft to hard float ABI
  • 0041 25/Jul/16 – Added support for unlimited strength cryptography (default is strong)
  • 0040 20/Jul/16 – Updated to Java 8u101
  • 0039 26/Apr/16 – Updated to Java 8u91
  • 0038 24/Mar/16 – Updated to Java 8u77
  • 0037 07/Feb/16 – Updated to Java 8u73
  • 0036 26/Jan/16 – Updated to Java 8u71
  • 0035 14/Dec/15 – Updated to Java 8u65, added support for models DS716+ and DS216play
  • 0034 19/Aug/15 – Fixed timezone DST issue with DSM 5.2, added support for DS215+
  • 0033 07/Aug/15 – Updated to Java 8u51, PowerPC build remains at 8u6
  • 0032 13/Jul/15 – Fixed timezone issue with DSM 5.2, updated main blog post documentation
  • 0031 25/Jan/15 – Fixed issue with version 0030 for systems with more than one volume
  • 0030 21/Jan/15 – Improved temp folder detection, updated to Java 7u75 and Java 8u33 (Oracle did not publish a version for PowerPC)
  • 0029 25/Dec/14 – DSM timezone file is no longer overwritten, which had been prompting a malware alert in DSM 5.1 Security Advisor
  • 0028 20/Oct/14 – Updated to Java 7u71, added missing zoneinfo timezone definitions to fix inaccurate timestamps for non-GMT timezones (checked every startup), switched native binary archives from .tgz to .tar.xz format to reduce size
  • 0027 18/Oct/14 – Updated Java 8 to 8u6, added support for Mindspeed Comcerto 2000 CPU in DS414j for Java 7 and Java 8
  • 0026 24/Jun/14 – DSM updates will no longer break Java
  • 0025 31/May/14 – Updated to Java 7u60
  • 0024 31/May/14 – Updated to Java 7u55
  • 0023 27/May/14 – Added Java 8 support
  • 0022 30/Jan/14 – Updated to Java 7u51
  • 0021 15/Nov/13 – Locale support is no longer downloaded and added to DSM 4.3 or newer since it’s already present
  • 0020 30/Oct/13 – Added support for Intel Atom Evansport and Armada XP CPUs in new DSx14 products, removed Early Access JDK 8 support since it did not run on the Armada SoCs
  • 0019 17/Oct/13 – Updated to Java 7u45
  • 0018 11/Oct/13 – Updated to Java 7u40, and JDK8 Early Access b106
  • 0017 05/Jun/13 – For Armada370 CPU changed from ARMv7 Server JVM to Client JVM since the Server one turned out to be unstable. Added support for Early Access JDK 8 for Armada 370.
  • 0016 21/May/13 – Added Armada370 CPU support (DS213j)
  • 0015 18/Apr/13 – Updated to Java 7u21, Java 6 Embedded seems to be no longer maintained by Oracle
  • 0014 13/Feb/13 – Fixed metadata for DSM 4.2 Package Center
  • 013 13/Dec/12 – Updated to Java 6u38 and Java 7u10
  • 012 10/Dec/12 – Installer script fetches native binaries separately to reduce bandwidth on repo hosting
  • 011 Added support for Freescale QorIQ PowerPC CPUs used in some Synology x13 series products, PowerQUICC PowerPC processors in previous Synology generations with older glibc versions are not supported
  • 010 updated to Java 6u34 and Java 7u6
  • 009 corrected timezone bug for Atlantic and Pacific timezones which may have caused error messages when in fact the package had installed correctly
  • 008 unified the build scripts
  • 007 included the locale binaries to simplify installation, fixed environment variables for root user (inc. timezone with DST support), displayed Java version information and env vars in Log tab, incremented Java to latest versions 6u32 and 7u4, fixed detection of renamed .tar.gz archives downloaded by Google Chrome
  • 006 fixed path issue for root user on non-bootstrapped systems, updated info link to refer back to this page, and improved description text
  • 005 incremented JRE versions to match new releases from Oracle
  • 004 forced check for existence of ‘public’ shared folder
  • 003 fixed a stupid typo that stopped 002 from working :)
  • 002 rewrote scripts to be easier to maintain, and to allow for web browsers that untar or rename the Java and toolchain binary bundles as they’re saved
  • 001 23/Aug/11 – fixed package repo support, defined as a non-runnable service, prevented more than one JRE being installed, saved files into actual package folder rather than @appstore/java now that package names can be separate from Package Center display names
  • v3 initial spk release (I think!)

Batch script for recursive FFmpeg transcoding

I recently had to shrink around 50GB of MP3 audio recordings that were sitting in a nested folder structure on a web server. Having experimented to find more appropriate LAME encoder settings for spoken word content I needed to transcode the files whilst keeping the existing ID3 tags intact. FFmpeg can do this nicely using libmp3lame, whereas LAME by itself cannot. Armed with my own compile of FFmpeg, I created a drag & drop batch script to recursively work through a folder structure transcoding MP3 and WAV files and writing out the resulting MP3 files in the same folder structure with an amended top level folder name. It will accept multiple files or folders being dragged and dropped. You could adapt this script to whatever task you’re using FFmpeg for.

::MP3 transcoding to more sensible default quality settings for spoken word
::32kHz mono VBR @ approx. 64Kbps

@echo off
::parse multiple command lines (so multiple targets can be dragged and dropped at once)
if "%~1"=="" goto :continue
call :mainloop %1
goto :commandlineloop
goto :eof

::main loop we run for each command line arg of the script
set folderpath=
if "%~1"=="" (
  echo Drag and drop files or folders onto this script.
  goto :eof
set folderpath=%~1
echo "%1" | find /I ".mp3" && (
  goto :fileonly
echo "%1" | find /I ".wav" && (
  goto :fileonly

echo Processing folder %1
echo ________________________________________________________________________________

::we need to find the last folder level in the folderpath
::batch scripting is horrible so we need to use a hacky way to get the last token
set temp_string=%~1
set count=0

::iterate parsing the tokens and trimming the string until it's empty, while counting how many loops
for /F "tokens=1* delims=\" %%a in ( "%temp_string%" ) do (
  set /A count+=1
  set temp_string=%%b
  goto loopcounter
for /F "tokens=%count% delims=\" %%i in ( "%~1" ) do set folder=%%i

::append the top level folder name with "-optimized" so we create a new folder tree
for /R "%folderpath%" %%i in (*.mp3 *.wav) do (
  set sourcepath=%%~di%%~pi
  set destpath=!sourcepath:%folder%=%folder%-optimized!
  md "!destpath!"
  ffmpeg -i "%%~fi" -acodec libmp3lame -aq 8 -ar 32000 -ac 1 "!destpath!%%~ni.mp3"
goto :eof

::individual files
for %%i in ("%folderpath%") do (
  ffmpeg -i "%folderpath%" -acodec libmp3lame -aq 8 -ar 32000 -ac 1 "%%~di%%~pi%%~ni-optimized.mp3"

There are several neat little tricks here. Multiple folders can be dragged onto the script because it uses SHIFT to work through each command line argument. The next hurdle is to get the last part of the folder name(s) being dragged. Though this would be simple in any Unix-like shell, but to do this in batch without relying on any additional tools proved to be quite tricky. Though tokens can be parsed by FOR, finding the last one (which we need) requires us to count how many tokens there are. Only then can the last one be selected. The folder name string substitution is done by the SET command (also used in my file renaming script). Delayed variable expansion means that the variables between the the exclamation marks are evaluated once per loop rather than the default of once per script execution (more info here). I hadn’t realised until today that you can create a folder structure several layers deep with a single MD command. This avoids having to iterate through all subfolders – we can use FOR’s /R switch to handle the recursion in a single line. For more information on some of the variables containing tildes like %%~pi and %%~ni, try running FOR /?. The script also first runs the FFmpeg subroutine with ECHO in front of the commands so you can double-check the syntax before proceeding.

There are of course much more efficient ways of compressing spoken word content than MP3 these days – AAC-HEv2 for instance, but that will rule out all but the latest audio playback devices.
The source MP3 recordings were in 44.1kHz mono @ 128Kbps. This was definitely overkill for speech. Just by opting for 64Kbps I could halve that. However I couldn’t drop the sample rate below 32kHz, as this is the lowest legal limit of MPEG-1 layer III. This info is tricky to find but the LAME encoder reveals it in its extended help:

MPEG-1   layer III sample frequencies (kHz):  32  48  44.1
bitrates (kbps): 32 40 48 56 64 80 96 112 128 160 192 224 256 320
MPEG-2   layer III sample frequencies (kHz):  16  24  22.05
bitrates (kbps):  8 16 24 32 40 48 56 64 80 96 112 128 144 160
MPEG-2.5 layer III sample frequencies (kHz):   8  12  11.025
bitrates (kbps):  8 16 24 32 40 48 56 64


I think it’s safe to assume that most MP3 players can handle variable bit rate. As far as I can remember only the first generation ones couldnt from early last decade – the sort of ones which only had around 64MB of storage. I don’t think excluding players this old is much of a concern.

Playing around with VBR quality settings in LAME we can see that with -V 9 we get a small file (12.9MB becomes 3.7MB) however it’s actually an MPEG-2 layer III file which as you can see above supports lower sample rates. I’m not certain of the wider compatibility of this sub-type of MP3 file, and besides it does sound considerably worse than the lowest MPEG-1 layer III settings which is –V 8 (12.9MB becomes 5.2MB). This proved to be the best compromise between size and quality.

Windows 7 new user profile – MSOE.DLL could not be loaded error

Since my Windows 7 deployment I get an error every time a new user logs in (or logs in following a profile reset).

Windows Mail could not be started because MSOE.DLL could not be loaded

Since you can click past it I wasn’t initially too concerned but I soon came to realize that there’s pretty much no information on the Web about this problem. Anything the search engines turn up is invariably about Outlook Express on Windows 98/Me.

It seems to be caused when some kind of IE First Run process opens Internet Explorer with an MSN page and presumably tries to register the default email client (which is not yet set to Outlook, despite it being installed). The strange thing is that Windows Mail is not even available on Windows 7. Microsoft discontinued it after Vista in favour of Windows Live Mail. WinMail.exe is present on the system but it’s hidden, and that MSOE.DLL has been purposely omitted. Apparently you can get it working again by supplying a copy from a Vista PC.

The problem is that this error looks important enough for a new user to contact the helpdesk about. The other issue is that it significantly delays that first logon, sometimes by several entire minutes. The error occurs immediately after you enter your credentials (you can hear the alert sound) but it happens while the desktop is still hidden from view by the Windows 7 splash screen. Eventually the Preparing your desktop splash screen times out and you can click OK:

Windows Mail could not be started because MSOE.DLL could not be loaded

Notice the label in that floating window – it’s setting up a component which is titled as Microsoft Windows.

Eventually I discovered a KB article relating to Internet Explorer 5 personalized settings, which was when Microsoft introduced this method of installation.

Having consulted that document I viewed HKLM\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents in Regedit and saw that there is indeed a component with the name “Microsoft Windows” which is invoking WinMail.exe, intending to register it as a mail and news (nntp) client:

WinMail.exe ActiveSetup parameters

I have no idea why it’s doing this since WinMail.exe is intentionally disabled in Windows 7. It would seem logical that deleting this whole key should fix the problem (I backed it up first of course). In testing this didn’t seem to work though.

However I did notice that sometimes I got the error on screen twice and other times only once. Exasperated I searched the registry for instances of WinMail.exe until I discovered the reason: the entire ActiveSetup branch of the registry also exists under HKLM\Software\WOW6432Node\Microsoft, for the 32bit version of Internet Explorer on 64bit systems. Once both keys had been deleted the error disappeared.

I was then able to refine this – instead of deleting the whole key you only need to set to the single DWORD value IsInstalled to zero. Do this to both instances and the problem is fixed! In my environment I used my existing VBScript startup script which worktations inherit by Group Policy. Excerpt below:

If InStr (strOS,"Microsoft Windows 7") Then
  'Prevent Windows from trying to invoke the non-existent Windows Mail for new user profile setup
  On Error Resume Next
  strKey = "SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}"
  objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKey,"IsInstalled",0
  strKey = "SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}"
  objReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKey,"IsInstalled",0
  On Error Goto 0

Enabling Network Level Authentication on Windows XP by script

Migrating to Windows 7 has thrown up another problem – users wanting to connect from home computers running XP cannot use the Remote Desktop Client to connect to their newly upgraded office PCs. The Network Level Authentication change to the Remote Desktop Client was made because the original RDP is susceptible to Man-in-the-middle attacks.

Rather than leaving the new systems vulnerable by allowing connections from all clients in Computer Propertes > Remote settings, I discovered that Windows XP SP3 does in fact offer NLA support however it’s disabled by default. Somewhat frustratingly, the steps outlined in Microsoft KB 951608 require Registry edits which I would not want to encourage non-IT-savvy people to try. Giving out a .reg file is not really a good idea here either since these are additions to existing values, so forced replacements could interfere with certain vendors’ VPN clients etc.

Here’s a VBScript for the task which will only install on XP SP3 and will detect if the modifications have already been made. You could easily target it at a whole group of PCs by iterating through an array of hostnames.

'Enables Network Level Authentication on XP SP3 (disabled by default)
'which allows you to use the Remote Desktop Client 6.1 to connect to
'Windows 7 and Windows Server 2008 R2 without degrading security

Option Explicit

Const HKEY_LOCAL_MACHINE = &H80000002

Dim strLsaKey, strLsaValue, strHostname, size, arrMultiRegSZ, objReg, objWMI, colItems, i, found, modified
Dim objItem, SPlevel, strOSVer, strSecProvKey, strSecProvValue, strValue

strLsaKey = "SYSTEM\CurrentControlSet\Control\Lsa"
strLsaValue = "Security Packages"
strSecProvKey = "SYSTEM\CurrentControlSet\Control\SecurityProviders"
strSecProvValue = "SecurityProviders"
strHostname = "."
modified = false
found = false

Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strHostname & "\root\cimv2")
Set colItems = objWMI.ExecQuery("SELECT * FROM Win32_OperatingSystem")
For Each objItem In colItems
  strOSVer = objItem.Version
  SPlevel = objItem.ServicePackMajorVersion
If Not Left(strOSVer,3) = "5.1" Then
  WScript.Echo "This script is only intended for Windows XP."
End If
If Not SPlevel >= 3 Then
  WScript.Echo "Please install the latest Windows XP Service Pack from Windows Update."
End If

Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strHostname & "\root\default:StdRegProv")
objReg.GetMultiStringValue HKEY_LOCAL_MACHINE, strLsaKey, strLsaValue, arrMultiRegSZ
size = Ubound(arrMultiRegSZ)
For i=0 to size
  If arrMultiRegSZ(i) = "tspkg" Then
    found = true
  End If
If found Then
  WScript.Echo "tspkg already added to HKLM\SYSTEM\CurrentControlSet\Control\Lsa"
  ReDim Preserve arrMultiRegSZ(size + 1)
  arrMultiRegSZ(size + 1) = "tspkg"
  objReg.SetMultiStringValue HKEY_LOCAL_MACHINE, strLsaKey, strLsaValue, arrMultiRegSZ
  modified = true
End If

objReg.GetStringValue HKEY_LOCAL_MACHINE, strSecProvKey, strSecProvValue, strValue

If Instr(strValue,"credssp.dll") Then
  WScript.Echo "credssp.dll already added to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders"
  strValue = strValue & ", credssp.dll"
  objReg.SetStringValue HKEY_LOCAL_MACHINE, strSecProvKey, strSecProvValue, strValue
  modified = true
End If
If modified Then
  WScript.Echo "Settings updated. You will need to restart for the changes to become active."
End If

Set objReg = nothing
Set objWMI = nothing

Migrating roaming profiles to Windows 7

Though a Microsoft user migration tool exists, I only want the bare minimum to be carried across from XP and I definitely want automation to ensure consistency. I made this script to be run by support technicians while logged in on newly installed Windows 7 as the user being migrated. The My Documents folder redirection is particularly important – the script mounts the old XP profile’s registry hive from the server, and checks whether My Documents was correctly redirected to the home drive. If not, the script will migrate the files from the old location. This tidies up any old inconsistent user profiles. Having My Documents on the home drive keeps profile size down for faster logins when roaming and helps to reduce the chance of a user losing data if their hard disk fails.

I spent a while wondering how to keep this as a single script despite the need to use RunAs for the Registry hive mount before hitting on the idea of recursion – see highlight below (%0 is the running script’s full name with path, %~nx0 is just the filename and extension). Despite the /env in the command which is supposed to make the invoked process share the main user environment, only some things are in fact shared. %TEMP% is for instance, though environment variables are not. So I pass the username as a command line, and recover the results of the Registry parse from a temporary file.

UPDATE – Since the file copying can take a long while I have made the My Documents path checking the first task, a failure of which will quit the script. There is now a five second delay between mounting the Registry hive and querying it) which should stop the script having to be run twice.

@echo off
set FServer=YourServerHere
echo .:: User profile migration script for user %USERNAME%

if not "%1" == "" goto checkxpreg

echo .:: We need admin rights to mount and check the user's XP profile registry hive
runas /env /noprofile /user:%USERDOMAIN%\Administrator "%~nx0 %USERNAME%"

if exist %TEMP%\XPMyDocsPath.txt type %TEMP%\XPMyDocsPath.txt
if not exist %TEMP%\XPMyDocsPath.txt (
  echo .:: ERROR the XP profile registry hive has not mounted - run the script again!
  goto :eof

if exist %TEMP%\DocsNeedMoving.txt (
  echo .:: Migrating content to H:\ ready for Windows 7
  xcopy /y /e /c "\\%FSERVER%\profiles$\%USERNAME%\My Documents\*.*" "H:\"
if not exist %TEMP%\DocsNeedMoving.txt (
  echo .:: No documents need moving

echo .:: My Documents redirection to root of H: drive
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal /t REG_SZ /d "H:" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Personal /t REG_EXPAND_SZ /d %%HOMEDRIVE%% /f

echo .:: IE Favorites
xcopy /y /e /c \\%FSERVER%\profiles$\%USERNAME%\Favorites\*.* %USERPROFILE%\Favorites\

echo .:: Outlook signatures
xcopy /y /e /c "\\%FSERVER%\profiles$\%USERNAME%\Application Data\Microsoft\Signatures\*.*" %USERPROFILE%\AppData\Roaming\Microsoft\Signatures\

echo .:: Outlook nicknames file
if not exist %USERPROFILE%\AppData\Roaming\Microsoft\Outlook\*.* md %USERPROFILE%\AppData\Roaming\Microsoft\Outlook
copy /y "\\%FSERVER%\profiles$\%USERNAME%\Application Data\Microsoft\Outlook\*.nk2" %USERPROFILE%\AppData\Roaming\Microsoft\Outlook\

echo .:: Word user templates
xcopy /y /e /c "\\%FSERVER%\profiles$\%USERNAME%\Application Data\Microsoft\Templates\*.*" %USERPROFILE%\AppData\Roaming\Microsoft\Templates\

echo .:: Desktop files and shortcuts
xcopy /y /e /c \\%FSERVER%\profiles$\%USERNAME%\Desktop\*.* %USERPROFILE%\Desktop\

:: Stop the shell from changing the display name of the folder to My Documents on the fileserver
if exist H:\Desktop.ini (
  attrib -r -s -h H:\Desktop.ini
  del H:\Desktop.ini
:: Cleanup
if exist %TEMP%\DocsNeedMoving.txt del %TEMP%\DocsNeedMoving.txt
del %TEMP%\XPMyDocsPath.txt

goto :eof

if exist del %%TEMP%\DocsNeedMoving.txt
reg load "HKEY_USERS\TempXPRegHive" "\\%FSERVER%\profiles$\%1\NTUSER.DAT"
echo .:: Waiting 5 seconds - Registry hive mount seems unreliable if queried immediately
ping -n 1 -w 5000 > nul
for /f "tokens=2* delims= " %%a in ('reg query "HKEY_USERS\TempXPRegHive\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal') do set TempMyDocs=%%b
echo XP profile My Documents=%TEMPMYDOCS%> %TEMP%\XPMyDocsPath.txt
echo %TEMPMYDOCS% | find /I "%1" && date /t> %TEMP%\DocsNeedMoving.txt
reg unload "HKEY_USERS\TempXPRegHive"
set TempMyDocs=

Customizing Windows 7 unattend.xml

Windows 7, like Vista, uses an XML answer file to configure the OS install. What’s neat about this is that even though you use the WAIK‘s WSIM tool to edit and validate it, you can customize it and add your own sections for software packages etc. as you can see from the example below, though these custom sections will need to be inserted after the sections that WSIM validates. This answer file can easily be parsed with VBScript using MSXML DOM, allowing for variables like passwords, driver sets, product keys and so on to be inserted at build time.

Why use an unattended install?

If you’ve always used an unattended install to build your workstations, you’ll know that they can be extremely versatile. If you already have a scripted build for XP with applications then chances are you’ll want to tweak those scripts to work with Windows 7. Sure, Sysprep images are handy too, but unless all your machines are the same, or all your packaged app requirements are identical, then you’ll need to add a load of scripted customization to them anyway. Which begs the question: why not just use an unattended install? That way you eliminate application problems that sometimes surface after image-based deployment. In a previous job I remember Roxio deployment in particular was a nightmare for this reason.

Microsoft have certainly made things considerably easier with the release of the Microsoft Deployment Toolkit 2010 but, though it offers a great introduction into the process of automated system building, it lacks the flexibility of rolling your own build process – in particular if you already have a host database. When I decide to rebuild a machine, it boots Windows PE from WDS, looks up its MAC address in the host database and reads the model type from WMI and will offer default choices in my build script menus based on that. It also works out which is the nearest site file server to use for the install.

The problem with Sysprep deployment if you have a very mixed hardware environment is that you either have to:

  • Create a WIM image for each different hardware type (lots of boring maintenance when changes are required)
  • Add a huge bulk of drivers to a single WIM image with DISM
  • Use the AuditSystem phase to connect to a driver share and re-detect all the hardware

Since Windows Vista and later versions effectively just install a WIM and run a hardware detection phase during their normal install process, Sysprep no longer offers much of a speed improvement over an unattended build.

Device drivers

Additional mass storage and networking drivers that will be essential during setup are detected in the Windows PE instance (which we booted from WDS) Driver Store and ‘reflected’ into the installed OS. As you build your custom Windows PE boot image, add these using DSIM as described in my post on the subject.

Since we can read the PC model name from the BIOS via WMI, we can add a tailored device path to the offlineServicing phase of setup. This allows for easy maintenance of driver bundles, since we can arrange them by model type (which certainly beats having dozens of SoundMAX audio drivers lumped together), and we can limit which drivers are offered to each model – particularly useful when a driver causes problems for some models, as with the GMA950 driver and Adobe Flash on Intel 945G motherboards.

I noticed that this is in fact considerably neater that the method used in MDT2010’s ZTIDrivers.wsf script, which copies drivers to the local system then invokes the AuditSystem phase, running the PnP detection routines a second time, slowing down the install. Useful for an OEM like Dell I suppose, whose PCs are often started from their factory image with no connectivity, but not ideal for corporate LANs.

Sample autounattend.xml with custom sections at the end

Note 1 – I couldn’t find any examples of this online, but I discovered that the values for pre-populating the Internet Explorer 8 Search Providers can be obtained by configuring a workstation, then harvesting the registry settings from HKCU\Software\Microsoft\Internet Explorer\SearchScopes. I have highlighted the relevant lines in the XML below.

Note 2 – Somewhat confusingly, in the offlineServicing phase Microsoft-Windows-PnpCustomizationsNonWinPE will fail to connect to your file server for drivers unless you connect to its FQDN (assuming the unattended launched the OS build from a share referencing just the NetBIOS name). Fail to do this and %systemroot%\panther\setupact.log will reveal that it fails to connect with error 0x4C3 (multiple credentials on connection to the same server). What’s bizarre is that there certainly aren’t multiple credentials in use – I use the same ones throughout. I wrote up this problem and solution in this thread on the MSFN Forums. I suspect this might be caused because I launch setup.exe from a network drive rather than mounting the OS WIM image from a WDS server (I wanted to maintain consistency with my other legacy OS builds). I have highlighted this on line 57.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
                        <MetaData wcm:action="add">
                            <Value>Windows 7 PROFESSIONAL</Value>
                <Organization>My company</Organization>
    <settings pass="offlineServicing">
        <component name="Microsoft-Windows-PnpCustomizationsNonWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
                <PathAndCredentials wcm:action="add" wcm:keyValue="common">
                <PathAndCredentials wcm:action="add" wcm:keyValue="build">
                        <Domain>*value to be set by install.vbs*</Domain>
                        <Password>*value to be set by install.vbs*</Password>
                        <Username>*value to be set by install.vbs*</Username>
                    <Path>*value to be set by install.vbs*</Path>
    <settings pass="generalize">
        <component name="Microsoft-Windows-PnpSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
    <settings pass="specialize">
        <component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
            <CompanyName>My Company</CompanyName>
                <Scope wcm:action="add">
                <Scope wcm:action="add">
        <component name="Microsoft-Windows-RemoteAssistance-Exe" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-Security-SPP-UX" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
            <RegisteredOrganization>My Company</RegisteredOrganization>
        <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
                    <Domain>*value to be set by install.vbs*</Domain>
                    <Password>*value to be set by install.vbs*</Password>
                    <Username>*value to be set by install.vbs*</Username>
                <MachineObjectOU>OU=Windows 7,OU=Workstations,DC=domain,DC=com</MachineObjectOU>
        <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
            <RegisteredOrganization>My Company</RegisteredOrganization>
            <TimeZone>GMT Standard Time</TimeZone>
                    <LocalAccount wcm:action="add">
                        <Description>Dummy user required for unattended - delete later</Description>
                <SynchronousCommand wcm:action="add">
                    <Description>Connect to unattended share</Description>
                    <CommandLine>net use *value to be set by install.vbs*</CommandLine>
                <SynchronousCommand wcm:action="add">
                    <Description>Launch package installer</Description>
                    <CommandLine>cscript *value to be set by install.vbs*</CommandLine>
    <cpi:offlineImage cpi:source="wim://myserver/unattended/os/7-x64/sources/install.wim#Windows 7 PROFESSIONAL" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
    <mycompany:custom xmlns:mycompany="urn:schemas-domain-com:mycompany">
        <!-- build description -->
        <cust_description>standard workstation</cust_description>
        <!-- list of packages to install in order. Descriptions are read from U:\scripts\packages.csv -->
        <!-- start of the model name string, as reported by WMI, comma separated - allows auto-selection of build. -->
        <cust_models>OptiPlex 745,OptiPlex GX620,VMware Virtual Platform</cust_models>
        <!-- do we want packages.vbs to activate Windows? -->
        <!-- do we want a hibernation file wasting disk space? If set to false packages.vbs will disable hibernation support -->

Sample VBScript code for parsing the XML using MSXML DOM

This is not a complete script – it’s intended purely to illustrate the concept.

'New OS - 7/Vista/2008/2008R2

'read the answer file
Set objXML = CreateObject("Microsoft.XMLDOM")
objXML.Async = "False"
objXML.Load(strMedia & "\sifs\" & strOS & "\" & strBuild & ".xml")

'Additional mass storage and Networking drivers that will be essential for the rest of the build are detected in the
'running Windows PE instance's Driver Store and reflected into the installed OS

'insert the non-WinPE PnP driver discovery paths and credentials for the offlineServicing pass
strXPath = "/unattend/settings[@pass='offlineServicing']/component[@name='Microsoft-Windows-PnpCustomizationsNonWinPE']/DriverPaths/PathAndCredentials/Credentials"
'we need to iterate since there may be several sets of credentials (one for each driver path)
Set colNodes=objXML.selectNodes(strXPath & "/Domain")
For Each objNode In colNodes
  objNode.Text = strDomainName
Set colNodes=objXML.selectNodes(strXPath & "/Password")
For Each objNode In colNodes
  objNode.Text = strPass
Set colNodes=objXML.selectNodes(strXPath & "/Username")
For Each objNode In colNodes
  objNode.Text = strUser  

'Insert hostname
strXPath = "/unattend/settings[@pass='specialize']/component[@name='Microsoft-Windows-Shell-Setup']/ComputerName"
Set objNode=objXML.selectSingleNode(strXPath)
objNode.Text = strComputerName

'insert credentials for Domain join
On Error Resume Next
strXPath = "/unattend/settings[@pass='specialize']/component[@name='Microsoft-Windows-UnattendedJoin']/Identification/Credentials"
Set objNode=objXML.selectSingleNode(strXPath & "/Domain")
If Err.Number = 0 Then
  'Microsoft-Windows-UnattendedJoin exists - carry on modifying (workgroup builds won't have this section in the XML)
  objNode.Text = strDomainName
  Set objNode=objXML.selectSingleNode(strXPath & "/Password")
  objNode.Text = strPass
  Set objNode=objXML.selectSingleNode(strXPath & "/Username") 
  objNode.Text = strUser
End If
On Error Goto 0

'insert manufacturer and model into OEMinfo
strXPath = "/unattend/settings[@pass='oobeSystem']/component[@name='Microsoft-Windows-Shell-Setup']/OEMInformation/Manufacturer"
Set objNode=objXML.selectSingleNode(strXPath)
objNode.Text = strManufacturer
strXPath = "/unattend/settings[@pass='oobeSystem']/component[@name='Microsoft-Windows-Shell-Setup']/OEMInformation/Model"
Set objNode=objXML.selectSingleNode(strXPath)
objNode.Text = strModel & " - Your Company"

strXPath = "/unattend/settings[@pass='oobeSystem']/component[@name='Microsoft-Windows-Shell-Setup']/FirstLogonCommands/SynchronousCommand/CommandLine"
Set colNodes=objXML.selectNodes(strXPath)
For Each objNode In ColNodes
  'Insert the unattended share info and credentials
  If InStr (objNode.Text,"net use *value to be set by install.vbs*") Then
    objNode.Text = "net use " & strMedia & " \\" & strInstallServer & "\" & strShare & " /user:" & strUser & "@" & strDomainName & " " & strPass & " /persistent:no"
  End If
  'Record our build file selection for the package installer later
  If InStr (objNode.Text,"cscript *value to be set by install.vbs*") Then
    objNode.Text = "cscript //nologo " & strMedia & "\scripts\packages.vbs " & strMedia & " " & strOS & " " & strBuild & ".xml"
  End If

Set objNode = Nothing
'write out the answer file
objXML.Save "x:\autounattend.xml" 
Set objXML = Nothing

Simple batch script for file renaming

Ever ended up with 100 files you need to rename? Like removing  ” copy” from each filename after a batch Photoshop action? Or removing ” (small)” after resizing a big folder of images using the Image Resizer Powertoy? When you start looking online for a tool to do this most of them are commercial software, even for something so outwardly simple.

Here’s something I wrote a while ago for a colleague who runs Photoshop actions. It seemed like an easy challenge but the script actually took a while to figure out, mainly because I was determined that it should call no additional programs. I managed in the end using a couple of neat tricks: delayed variable expansion, and the little-known string replace function of the Set command. I also allowed drag & drop for the target folder containing the files you want renaming.

The script below targets .jpg files but I’ve highlighted the lines you would need to edit to change its behaviour:

::simple batch file renamer
::EXPLANATION - delayed variable expansion must be enabled since we want to
::expand the vars on each pass, not just once as the whole FOR loop is parsed.
::The SET command includes some simple string substitution methods (see SET /?)
::Below, I am setting newname=oldname with " (small)" substituted to ""
::The script displays what it's about to do before it does it and also supports
::dragging and dropping of the target folder.
@echo off
set folderpath=
if "%~1"=="" (
  echo No target folder was dragged ^& dropped - using local directory.
) else (
  echo Opening folder %1
  set folderpath=%1\
call :rename echo
echo Proceed with rename? (CTRL-C to cancel).
call :rename
goto :eof

for %%i in (%folderpath%*.jpg) do (
  set oldname=%%~ni%%~xi
  ::to replace " (Small)" with ""
  set newname=!oldname: ^(Small^)=!
  %1 ren "%%~fi" "!newname!"

Changing IP settings fast

When I need to keep changing TCP/IP settings to test networking configs it’s a real pain to have to keep opening up the adapter properties (especially on Windows 7) and usually I’m in too much of a hurry to lookup up the netsh command syntax. For that reason I’m posting this small script. Save it as ipset.cmd.

Note: using netsh to revert to DHCP seems to be intermittent if no DHCP server is available – e.g. if the adapter has no link.

Windows 7

@echo off
If "%1" == "" (
  echo Configures Local Area Connection
  echo   ipset address/maskbits gateway (dns)
  echo   ipset
  echo   ipset
  echo   ipset dhcp
  goto :eof
If "%1" == "dhcp" (
  netsh interface ip set dnsservers name="Local Area Connection" source=%1
  netsh interface ip set address name="Local Area Connection" source=%1
  goto :eof
netsh interface ip set address name="Local Area Connection" source=static address=%1 gateway=%2
If "%3" == "" (
  :: OpenDNS public DNS servers
  netsh interface ip set dnsservers name="Local Area Connection" source=static address=
  netsh interface ip add dnsservers name="Local Area Connection" address=
) else (
  netsh interface ip set dnsservers name="Local Area Connection" source=static address=%3

Windows XP

@echo off
If "%1" == "" (
  echo Configures Local Area Connection
  echo   ipset address mask gateway
  echo   ipset
  echo   ipset dhcp
  goto :eof
If "%1" == "dhcp" (
  netsh int ip set address local source=%1
  netsh int ip set dns local source=%1
  goto :eof
) else (
  netsh int ip set address local static %1 %2 %3 1
  :: OpenDNS public DNS servers
  netsh int ip add dns local index=1
  netsh int ip add dns local index=2

Moving your SQL 2005 databases ready for VSS off-host backups

Many storage vendors now offer hardware Volume ShadowCopy Service providers for their storage arrays which allow the SAN itself to carry out the snapshot, rather than the underlying OS. These providers are Exchange- and SQL-aware so they will quiesce the transaction logs just before the snapshot.

The big win here is off-host backup – the target server asks the SAN to snap the data volume then carries on as normal. The backup media server meanwhile will mount this SAN snapshot and back it up directly from the SAN. In this way you can backup SQL and Exchange environments in the middle of the day without any performance degradation (assuming of course that you have the IOPS headroom on the SAN). Symantec Backup Exec 12.5 and later supports this technology but it must be purchased as an option – Advanced Disk-based Backup Option or ADBO.

However, to off-host backup Exchange or SQL you will need to have both the databases/mail stores and the transaction logs on the same SAN LUN. This flies in the face of the old wisdom of segregating logs onto RAID1 spindles, but it’s important to realise that a modern SAN makes this perfectly viable. The EqualLogic PS4000XV in my environment for instance has a write latency of <1.0ms in RAID50. Microsoft used to recommend keeping SQL logs on disk with a write latency sub 10ms (now they say 1-5ms).

Moving all of the transaction logs on a crowded SQL server is tricky for several reasons:

  • the Transact-SQL database alter command requires you to know the database’s logical filenames. On an SQL 2005 server, these are largely predictable but it gets complicated when some of the DBs have migrated from SQL 2000 and if some of them were restored from backups of databases with different names (dev or test versions which then went into production for example).
  • the system databases are likely to be on C: and if you want to grab all DBs in one backup job these will need moving too (TempDB is usually ignored by most backup software and can stay where it is).
  • though some guides on the Web suggest detaching and re-attaching the DBs – this is a surefire way to end up with a total disaster since the re-attached DBs will have new GUIDs which will wreck SharePoint amongst others.

Backing up then restoring your databases specifying new file paths is one method but the danger is that you would need to isolate them so that no changes occurred during that time window (which could be a long time).

Moving user databases

The best solution for these is 99% careful preparation work – to build a long list of T-SQL database alter commands to change the SQL file references, and a batch script to move the actual files to the database drive. You can also use this as an opportunity to clean up any badly named files, and move ones that are in the wrong place.

It is highly recommended that if you haven’t already done so, you should set the following registry values on the SQL server which will guard against future inconsistencies. If they already exist, check they’re still valid:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\DefaultData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\DefaultLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\BackupDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\FullTextDefaultPath

For each database you need to run the following Transact-SQL:

Use [DBname]
Select * from sys.database_files

This will return all the files in the filegroup including full text catalogs (if they exist) together with their logical names (name column):
Database logical filenames

In this example the transaction log is already in the desired location, but it if was in say C:\TRANSACTIONS LOGS we would need to write:

alter database [SUSDB] modify file (name = SUSDB_log, filename = 'G:\DATABASES\SUSDB_log.ldf')

You would then add this to your file move batch script:


My method was to run a full SQL backup to commit the transaction logs (less data to move), run the alter database commands all at once (which don’t take effect until the SQL Server service next starts), stop the SQL Server service, run the file move batch script, check for any errors, then start the SQL Server service again. Once it’s up, you can try to expand each database in SQL Management Studio. Any databases with damaged file paths will not expand. Refer back to your command prompt window to try and figure out what went wrong (usually a typo).

In this way you should be able to move all of the logs with a bare minimum of downtime – several minutes in my case.

Moving system databases

Moving system databases is fairly straightforward, but it will require a little more downtime. Again, I’d probably leave TempDB where it is to separate its I/O from the rest as it can be high and we don’t need to back it up. If you do want to move it, the procedure is the same as any non-system database. The rest though are special cases.

Run the following and note the current file locations which will probably be in C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA

use model
select * from sys.database_files
use msdb
select * from sys.database_files
use master
select * from sys.database_files

Now close SQL Management Studio and run the following from a Command Prompt (the parameters are case sensitive!):

net stop mssqlserver
net start mssqlserver /c /m /T3608

Open SQL Management Studio again but read this carefully. With these startup parameters, SQL Server will only allow a single connection. The default behaviour of the GUI is to open the Object Explorer window once you connect, which counts as a connection. You need to click on the Disconnect button, and close the Object Explorer child window. You should then be able to open a New Query.
If you closed the Object Explorer without disconnecting you’ll get the error “Server is in single user mode. Only one administrator can connect at this time.” and you’ll need to stop and start the service again, as above, and repeat. Next:

sp_detach_db 'model'
sp_detach_db 'msdb'

Move the files to the new location (logs and databases remember), then run the following taking care to substitute in your new file paths:

sp_attach_db 'model','G:\DATABASES\model.mdf','G:\DATABASES\modellog.ldf'
sp_attach_db 'msdb','G:\DATABASES\msdbdata.mdf','G:\DATABASES\msdblog.ldf'

Stop the SQL Server service. Start it again normally (no parameters) and check you can expand model and msdb in Management Studio.

We just have the master database left to move. Stop the SQL Server service again. Move master’s log and database files to the new location. On the SQL server machine’s console, open Start Menu > Programs > Microsoft SQL Server 2005 > Configuration Tools > SQL Server Configuration Manager.
In the category SQL 2005 Services, select SQL Server (MSSQLSERVER) and look at the Properties. Select the Advanced tab. Select Startup Parameters and pull down the dropdown next to it.
Change the value from the defaults of:

-dC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\master.mdf;-eC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG;-lC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\mastlog.ldf

to your new file paths (don’t change the error log path by accident):

-dG:\DATABASES\master.mdf;-eC:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG;-lG:\DATABASES\mastlog.ldf

SQL Server Configuration Manager
Finally, start the SQL Server Service. Done!

The trouble with full-text catalogs

If you rely on the EqualLogic Auto-Snaphot Manager to tell you whether your databases now support SAN snapshots you could be in for a surprise when you backup using ADBO in Backup Exec:

V-79-57344-34086 – ADBO: Offhost backup initialization failure on: “”.
Snapshot provider error (0xE0008526): Backup Exec could not locate a Microsoft Volume Shadow Copy Services (VSS) software or hardware snapshot provider for this job. Select a valid VSS snapshot provider for the target computer.
Check the Windows Event Viewer for details.

This is an awful error message because it doesn’t really describe the problem (and you won’t find anything meaningful in the Event Viewer). It almost looks like a registration failure of the Hardware VSS Provider, which is misleading, and caused me about 2 hours of out-of-hours work reinstalling it, taking the server offline, etc. to satisfy Symantec Support. However, run a job with the same selection list but using normal AOFO (Advanced Open File Backup) and you get:

AOFO: Initialization failure on: “”. Advanced Open File Option used: Microsoft Volume Shadow Copy Service (VSS).
V-79-10000-11219 – VSS Snapshot error. The volume or snapped volume may not be available or may not exist. Check the configuration of the snapshot provider, and then run the job again.
The following volumes are dependent on resource: “C:” “D:” “G:”.

Much clearer – there’s a dependency on the D: drive being detected, the drive I migrated from. By chance I changed the backup selection list realised that some databases backed up while others didn’t. The cause turned out to be a full text catalog.

The EqualLogic ASM only checks the database and log files, not full-text catalogs. Moving these seems to be pretty difficult. Microsoft have an MSDN document describing database moves (see section on catalogs further down the page). I have tried following this process to the letter, and when that didn’t work I tried various permutations of stopping the SQL Server service, the SQL FullText Search service (which seems to autorestart), the SQL Server Agent service, copying the files, not copying the files (expecting SQL to move them) etc. No combination seemed to work for me. What I found was that, while it is easy enough to move the catalog path like so:

alter database [ExampleDB] modify file (name = [sysft_ExampleDB], filename = 'G:\DATABASES\FTData\ExampleDB')

there is some meta data that does not get updated and the ADBO backup will still fail when the VSS provider checks all the file dependencies.
sys.database_files shows the correct paths. Eventually I discovered that

Select * from sys.fulltext_catalogs

still showed the old location for the catalogs. The only way I could find to get this to update was to rebuild the full-text catalog in SQL Management Studio – expand the database > Storage > Full Text Catalogs > right-click > Rebuild.

For me this was acceptable and quick, but I imagine some infrastructures might not be so tolerant of a rebuild.

Outlook stationery – scripting default font and HTML signature

Many organizations decide to use a house style for email, and being able to force a default font is the only reliable way to get this consistent. I do this with the login script.

What’s difficult about it is that it’s not just a minor registry edit – the font styles are actually written in HTML and then stored in binary in the registry. The best way to get them modified is to use an Outlook client to make the changes, then grab them from the registry. They’re stored at:


In Outlook you need to edit the stationery in Tools > Options > Mail Format tab > Stationery and Fonts, making sure to change the font for both new messages and replies.

The registry values which are modified are:

  • ComposeFontComplex
  • ComposeFontSimple
  • ReplyFontComplex
  • ReplyFontSimple

Here’s what my ComposeFontComplex looks like converted back to text:



 /* Style Definitions */
	{mso-style-name:"Personal Compose Style";
	mso-bidi-font-family:"Times New Roman";


The cleanest way to script this is to export the values from regedit (they will be in hex) and insert them into the script unmodified with the line breaks intact. Then you just quote and line-wrap them, split them into an array on the ”,” character and use a hex-to-binary function before inserting them into the user registry. Here is my example OutlookStationery subroutine for reference  (note that it’s not a working script – some objects are defined elsewhere, e.g. objReg, the Active Directory job title, name, surname etc.):

Sub OutlookStationery
  'Standardized Outlook signature based on AD data
  WScript.Echo "Updating Outlook signature and default font"
  Dim objWord, objDoc, objSelection, objEmailOptions, objSignatureObject, objSignatureEntries, objLink
  Set objWord = CreateObject("Word.Application")
  Set objDoc = objWord.Documents.Add()
  Set objSelection = objWord.Selection
  Set objEmailOptions = objWord.EmailOptions
  Set objSignatureObject = objEmailOptions.EmailSignature
  Set objSignatureEntries = objSignatureObject.EmailSignatureEntries
  objSelection.TypeText strFirstName & " " & strSurname
  objSelection.TypeText strTitle
  objSelection.TypeText "Tel +xx xxx xxxx " & strExtension
  objSelection.TypeText "Fax +xx xxx xxxx xxxx"
  objSelection.TypeText "Web "
  Set objLink = objSelection.Hyperlinks.Add(objSelection.Range,"",,"My Company Website","")
  objSelection.TypeText "The Company Name"
  objSelection.TypeText "Address Line 1"
  objSelection.TypeText "Address City"
  objselection.Font.Bold = True
  objSelection.TypeText "Company"
  objselection.Font.Bold = False
  objSelection.TypeText " strapline goes here"
  Set objSelection = objDoc.Range()
  objSelection.Font.Name = "Verdana"
  objSelection.Font.Size = "10"
  objSignatureEntries.Add "Standard Signature", objSelection
  objSignatureObject.NewMessageSignature = "Standard Signature"
  objSignatureObject.ReplyMessageSignature = ""
  objDoc.Saved = True

  'Force the default font for Outlook messages. The hex arrays are captures from a Regedit export, line breaks intact for easy later amendment
  Dim arrComposeFontComplexHex, arrComposeFontComplex, arrReplyFontComplexHex, arrReplyFontComplex
  Dim arrComposeFontSimpleHex, arrComposeFontSimple, arrReplyFontSimpleHex, arrReplyFontSimple

  arrComposeFontComplexHex = Split ("3c,68,74,6d,6c,3e,0d,0a,0d,0a,3c,68,65,61,64,3e,0d,0a," &_
   "3c,73,74,79,6c,65,3e,0d,0a,0d,0a,20,2f,2a,20,53,74,79,6c,65,20,44,65,66,69," &_
   "6e,69,74,69,6f,6e,73,20,2a,2f,0d,0a,20,73,70,61,6e,2e,50,65,72,73,6f,6e,61," &_
   "6c,43,6f,6d,70,6f,73,65,53,74,79,6c,65,0d,0a,09,7b,6d,73,6f,2d,73,74,79,6c," &_
   "65,2d,6e,61,6d,65,3a,22,50,65,72,73,6f,6e,61,6c,20,43,6f,6d,70,6f,73,65,20," &_
   "53,74,79,6c,65,22,3b,0d,0a,09,6d,73,6f,2d,73,74,79,6c,65,2d,74,79,70,65,3a," &_
   "70,65,72,73,6f,6e,61,6c,2d,63,6f,6d,70,6f,73,65,3b,0d,0a,09,6d,73,6f,2d,73," &_
   "74,79,6c,65,2d,6e,6f,73,68,6f,77,3a,79,65,73,3b,0d,0a,09,6d,73,6f,2d,73,74," &_
   "79,6c,65,2d,75,6e,68,69,64,65,3a,6e,6f,3b,0d,0a,09,6d,73,6f,2d,61,6e,73,69," &_
   "2d,66,6f,6e,74,2d,73,69,7a,65,3a,31,30,2e,30,70,74,3b,0d,0a,09,6d,73,6f,2d," &_
   "62,69,64,69,2d,66,6f,6e,74,2d,73,69,7a,65,3a,31,31,2e,30,70,74,3b,0d,0a,09," &_
   "66,6f,6e,74,2d,66,61,6d,69,6c,79,3a,22,56,65,72,64,61,6e,61,22,2c,22,73,61," &_
   "6e,73,2d,73,65,72,69,66,22,3b,0d,0a,09,6d,73,6f,2d,61,73,63,69,69,2d,66,6f," &_
   "6e,74,2d,66,61,6d,69,6c,79,3a,56,65,72,64,61,6e,61,3b,0d,0a,09,6d,73,6f,2d," &_
   "68,61,6e,73,69,2d,66,6f,6e,74,2d,66,61,6d,69,6c,79,3a,56,65,72,64,61,6e,61," &_
   "3b,0d,0a,09,6d,73,6f,2d,62,69,64,69,2d,66,6f,6e,74,2d,66,61,6d,69,6c,79,3a," &_
   "22,54,69,6d,65,73,20,4e,65,77,20,52,6f,6d,61,6e,22,3b,0d,0a,09,6d,73,6f,2d," &_
   "62,69,64,69,2d,74,68,65,6d,65,2d,66,6f,6e,74,3a,6d,69,6e,6f,72,2d,62,69,64," &_
   "69,3b,0d,0a,09,63,6f,6c,6f,72,3a,77,69,6e,64,6f,77,74,65,78,74,3b,7d,0d,0a," &_
   "2d,2d,3e,0d,0a,3c,2f,73,74,79,6c,65,3e,0d,0a,3c,2f,68,65,61,64,3e,0d,0a,0d," &_
   "0a,3c,2f,68,74,6d,6c,3e,0d,0a", ",")

  arrReplyFontComplexHex = Split ("3c,68,74,6d,6c,3e,0d,0a,0d,0a,3c,68,65,61,64,3e,0d,0a," &_
   "3c,73,74,79,6c,65,3e,0d,0a,0d,0a,20,2f,2a,20,53,74,79,6c,65,20,44,65,66,69," &_
   "6e,69,74,69,6f,6e,73,20,2a,2f,0d,0a,20,73,70,61,6e,2e,50,65,72,73,6f,6e,61," &_
   "6c,52,65,70,6c,79,53,74,79,6c,65,0d,0a,09,7b,6d,73,6f,2d,73,74,79,6c,65,2d," &_
   "6e,61,6d,65,3a,22,50,65,72,73,6f,6e,61,6c,20,52,65,70,6c,79,20,53,74,79,6c," &_
   "65,22,3b,0d,0a,09,6d,73,6f,2d,73,74,79,6c,65,2d,74,79,70,65,3a,70,65,72,73," &_
   "6f,6e,61,6c,2d,72,65,70,6c,79,3b,0d,0a,09,6d,73,6f,2d,73,74,79,6c,65,2d,6e," &_
   "6f,73,68,6f,77,3a,79,65,73,3b,0d,0a,09,6d,73,6f,2d,73,74,79,6c,65,2d,75,6e," &_
   "68,69,64,65,3a,6e,6f,3b,0d,0a,09,6d,73,6f,2d,61,6e,73,69,2d,66,6f,6e,74,2d," &_
   "73,69,7a,65,3a,31,30,2e,30,70,74,3b,0d,0a,09,6d,73,6f,2d,62,69,64,69,2d,66," &_
   "6f,6e,74,2d,73,69,7a,65,3a,31,31,2e,30,70,74,3b,0d,0a,09,66,6f,6e,74,2d,66," &_
   "61,6d,69,6c,79,3a,22,56,65,72,64,61,6e,61,22,2c,22,73,61,6e,73,2d,73,65,72," &_
   "69,66,22,3b,0d,0a,09,6d,73,6f,2d,61,73,63,69,69,2d,66,6f,6e,74,2d,66,61,6d," &_
   "69,6c,79,3a,56,65,72,64,61,6e,61,3b,0d,0a,09,6d,73,6f,2d,68,61,6e,73,69,2d," &_
   "66,6f,6e,74,2d,66,61,6d,69,6c,79,3a,56,65,72,64,61,6e,61,3b,0d,0a,09,6d,73," &_
   "6f,2d,62,69,64,69,2d,66,6f,6e,74,2d,66,61,6d,69,6c,79,3a,22,54,69,6d,65,73," &_
   "20,4e,65,77,20,52,6f,6d,61,6e,22,3b,0d,0a,09,6d,73,6f,2d,62,69,64,69,2d,74," &_
   "68,65,6d,65,2d,66,6f,6e,74,3a,6d,69,6e,6f,72,2d,62,69,64,69,3b,0d,0a,09,63," &_
   "6f,6c,6f,72,3a,23,31,46,34,39,37,44,3b,0d,0a,09,6d,73,6f,2d,74,68,65,6d,65," &_
   "63,6f,6c,6f,72,3a,64,61,72,6b,32,3b,7d,0d,0a,2d,2d,3e,0d,0a,3c,2f,73,74,79," &_
   "6c,65,3e,0d,0a,3c,2f,68,65,61,64,3e,0d,0a,0d,0a,3c,2f,68,74,6d,6c,3e,0d,0a", ",")

  arrComposeFontSimpleHex = Split ("3c,00,00,00,1f,00,00,f8,00,00,00,40,c8,00,00,00,00,00," &_
   "00,00,00,00,00,ff,00,22,56,65,72,64,61,6e,61,00,00,00,00,00,00,00,00,00,00," &_
   "00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00", ",")

  arrReplyFontSimpleHex = Split ("3c,00,00,00,1f,00,00,f8,00,00,00,00,c8,00,00,00,00,00,00," &_
   "00,1f,49,7d,00,00,22,56,65,72,64,61,6e,61,00,00,00,00,00,00,00,00,00,00,00," &_
   "00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00", ",")

  arrComposeFontComplex = ArrayHexToDec(arrComposeFontComplexHex)
  arrReplyFontComplex = ArrayHexToDec(arrReplyFontComplexHex)
  arrComposeFontSimple = ArrayHexToDec(arrComposeFontSimpleHex)
  arrReplyFontSimple = ArrayHexToDec(arrReplyFontSimpleHex)

  objReg.SetBinaryValue HKEY_CURRENT_USER,"Software\Microsoft\Office\12.0\Common\MailSettings", "ComposeFontComplex", arrComposeFontComplex
  objReg.SetBinaryValue HKEY_CURRENT_USER,"Software\Microsoft\Office\12.0\Common\MailSettings", "ReplyFontComplex", arrReplyFontComplex
  objReg.SetBinaryValue HKEY_CURRENT_USER,"Software\Microsoft\Office\12.0\Common\MailSettings", "ComposeFontSimple", arrComposeFontSimple
  objReg.SetBinaryValue HKEY_CURRENT_USER,"Software\Microsoft\Office\12.0\Common\MailSettings", "ReplyFontSimple", arrReplyFontSimple
End Sub

Function ArrayHexToDec(arrHex)
  Dim i, arrDec
  ReDim arrDec(UBound(arrHex))
  For i = 0 to UBound(arrHex)
    If arrHex(i) = "00" Then
      arrDec(i) = 0
      arrDec(i) = CByte("&H" & arrHex(i))
    End If
  ArrayHexToDec = arrDec
End Function