Windows Vista Tweaks/Performance FAQ Thread *LONG*

[BunLengthHotDog]

It may not be a tweak per say, but I loved the taskbar grouping in XP, having gone to Vista its problematic at best. I cannot seem to get it to work correctly with any options I chose..beit thumb preview on/off. Any idea where the registry setting is (XP was, as you are aware I am sure) TaskbarGroupSize in current users > software > MS > windows > Explorer > advanced) for Vista? I have grouping enabled, but still nogo...any way to get this gui tweak working again?

 

[stash]

You mean where it will group a bunch of buttons from the same app under one button? It works for me, but it took like 11 instances of IE before it grouped them.

 

[BunLengthHotDog]

Originally posted by: stash
You mean where it will group a bunch of buttons from the same app under one button? It works for me, but it took like 11 instances of IE before it grouped them.

Yes that...I think I tried around 10 instances of Firefox, but it still didnt group after the entire Taskbar was filled up. It's odd, I have grouping checked, but cannot find (didnt look THAT long) where the registry key is in Vista to change how many instances it takes to start grouping.

Hrmm

 

[BD2003]

Originally posted by: mechBgon
Hey BD2003, could you add "fully enable your Data Execution Prevention" as a tip? From the Vista blog, it appears that even Vista doesn't come with DEP fully enabled out of the box.

Apparently due to some apps still having compatibility problems with it. As you can probably tell from my post I'm more concerned with performance than security. I'll mention the option and leave it up for people to decide if it's worth it.

Not with all the Doom 3 engine games out. Doom 3, Prey, Quake 4, etc. I haven't benchmarked OpenGL games on my 8800GTX, but from what I saw with Doom 3 is that performance was pretty good. The Ati drivers may have very poor OpenGL performance, but nVidia's driver is much better. There is no reason why they can't get similar OpenGL performance in Vista compared to XP. It's not an integral part of the OS like DirectX is.

I'm sure there's nothing in the OS absolutely preventing them from getting to it eventually, but with the vast number of games being DX, it's not their #1 priority right now.

Though I forget where I read it, but I am pretty sure any OpenGL is going to have to turn off glass and take over the 3d hardware exclusively, making the original question somewhat inapplicable.

 

[Frankie]

Got my vote for sticky status :thumbsup:

I'm going to have to re-read this again when I break down and get Vista

 

[ProviaFan]

That's a great "summary" of what to do (and what not to do) for best performance in Vista. You've got my vote for a sticky. :thumbsup:

 

[BunLengthHotDog]

oh yes...apologies..Sticky please

 

[archcommus]

Hey BD2003...

To make this a bit better for a sticky I would add some highlighting for the section titles and bulleted lists within them. This will be better as the sticky grows, as well.

 

[mechBgon]

Apparently due to some apps still having compatibility problems with it. As you can probably tell from my post I'm more concerned with performance than security. I'll mention the option and leave it up for people to decide if it's worth it.

There are apps that have issues with full-on DEP on WinXP, too, but an Admin can simply make exceptions for them as they make themselves apparent (a DEP prompt comes up to inform the user). So I would recommend fully enabling it, then making exceptions if/when they're needed. That's what I do with WinXP and so far I've only got one app that needs to be exempt (an older image-editing program).

 

[BD2003]

whoops - wrong button.

 

[mechBgon]

Here's another idea: if typing passwords for UAC prompts is too much hassle, consider a Microsoft USB fingerprint reader to deal with UAC prompts, instead of depriving your rig of a meaningful proactive security feature.

 

[BD2003]

Originally posted by: archcommus
Hey BD2003...

To make this a bit better for a sticky I would add some highlighting for the section titles and bulleted lists within them. This will be better as the sticky grows, as well.

Hows that?

 

[BD2003]

Originally posted by: mechBgon
Here's another idea: if typing passwords for UAC prompts is too much hassle, consider a Microsoft USB fingerprint reader to deal with UAC prompts, instead of depriving your rig of a meaningful proactive security feature.

Definitely a better option than a password, so I added it in.

Personally, its not the idea of UAC that bothers me, it's the level at which is it integrated.

It'd be genuinely useful if I was prompted about modifying system files etc, but I really don't need to be nagged about changing font size or resolution.

It has potential to be a useful feature for admins and parents to keep kids and noobs from screwing up PCs, but without customization, it's fairly useless IMO.

 

[mechBgon]

Originally posted by: BD2003

Originally posted by: archcommus
Hey BD2003...

To make this a bit better for a sticky I would add some highlighting for the section titles and bulleted lists within them. This will be better as the sticky grows, as well.

Hows that?

I think he means like this (below). BTW I am not too enthusiastic about your security mindset of "turn stuff off so it behaves like olden-days Windows back from when it was safe to go around like that." The times, they are a-changin'...

 

[mechBgon]

BTW the way bullets work, is you start with a {BULLET} (except use square brackets, not curly) and then put a {LI} (with square brackets) in front of each item, and the {LI} makes a bullet. When you get to the end of the list, put a {/BULLET} to shut'er down. For a numbered list, use NUM instead of BULLET. You can nest them too.

 

[capeconsultant]

Yes, first helpful post on tweaking the VISTA, Sticky vote here! Thank you!

 

[BD2003]

Originally posted by: mechBgon

Originally posted by: BD2003

Originally posted by: archcommus
Hey BD2003...

To make this a bit better for a sticky I would add some highlighting for the section titles and bulleted lists within them. This will be better as the sticky grows, as well.

Hows that?

I think he means like this (below).

Looks much better, nice job. I lack UBB skills. You can edit out the huge block quote now that I copied it over.

BTW I am not too enthusiastic about your security mindset of "turn stuff off so it behaves like olden-days Windows back from when it was safe to go around like that." The times, they are a-changin'...

Which I am sure is an opinion many people agree with, but I personally consider security my own responsibility, and am willing to deal with the risks. Since it's merely a home PC, worst case scenario is that Id have to reload the OS in the off chance I actually caught a bug vscan couldnt deal with. I'd *never* recommend such settings to be used on a corporate machine where security is more of a serious issue. The thread is directed towards ideal performance, not security, and I did certainly add a due disclaimer towards actually doing what I say.

That being said, if it does get stickied and others have the same issues, I'll change it to be even more neutral and such, but as it stands, I'd like to believe most users in this section of the forum don't need a security primer, and understand the risks involved.

 

[mechBgon]

Originally posted by: BD2003

Originally posted by: mechBgon

Originally posted by: BD2003

Originally posted by: archcommus
Hey BD2003...

To make this a bit better for a sticky I would add some highlighting for the section titles and bulleted lists within them. This will be better as the sticky grows, as well.

Hows that?

I think he means like this (below).

Looks much better, nice job. I lack UBB skills. You can edit out the huge block quote now that I copied it over.

Righto

BTW I am not too enthusiastic about your security mindset of "turn stuff off so it behaves like olden-days Windows back from when it was safe to go around like that." The times, they are a-changin'...

Which I am sure is an opinion many people agree with, but I personally consider security my own responsibility, and am willing to deal with the risks. Since it's merely a home PC, worst case scenario is that Id have to reload the OS in the off chance I actually caught a bug vscan couldnt deal with. I'd *never* recommend such settings to be used on a corporate machine where security is more of a serious issue. The thread is directed towards ideal performance, not security, and I did certainly add a due disclaimer towards actually doing what I say.

If you reload your OS due to an infection, does that:

• get your logged keystrokes back from the bad guys in Russia, including
  • your CC number
  • your WoW login that they used to steal & sell your gold, items, characters, etc
  • your bank, PayPal and eBay login credentials
  • your AnandTech Forums login credentials!!! OMG! :Q
• snatch back your files that got FTP'ed off to some other country, and the bad guys now have copies?
• retract the virus-bearing emails that your infected system might've sent to everyone in your address book?
• retract the 50000000000 v1AgRa spams your infected system might've sent to me?
• undo the infections on any systems out on the Internet that your system infected with worms?

If I were posting a potentially-stickied "How to set up Vista" thread, I would feel a pretty heavy weight of responsibility on the security side. There's botnets out there with more than 1 million infected home PCs. Per botnet. Time to start taking home-computer security more seriously than "lol I will just reimage", IMHO. But I'm just crazy like that

 

[mechBgon]

BTW I think I misinterpreted Indexing and Start Menu as subheaders under User Folders. If you take out the {BULLET} ahead of Indexing, and the {/BULLET} before Sidebar, and drop in {HR}'s to put horizontal lines, that should fix it, and then fix the CONTENTS with two more {LI} items for Indexing and Start Menu Sorry for the error!

 

[BD2003]

Originally posted by: mechBgon

If you reload your OS due to an infection, does that:

• get your logged keystrokes back from the bad guys in Russia, including
  • your CC number
  • your WoW login that they used to steal & sell your gold, items, characters, etc
  • your bank, PayPal and eBay login credentials
  • your AnandTech Forums login credentials!!! OMG! :Q
• snatch back your files that got FTP'ed off to some other country, and the bad guys now have copies?
• retract the virus-bearing emails that your infected system might've sent to everyone in your address book?
• retract the 50000000000 v1AgRa spams your infected system might've sent to me?
• undo the infections on any systems out on the Internet that your system infected with worms?

But the thing is, I'm not being lax about security. I'm serious about it, but I'm also trying to be smart and efficient about it at the same time.

First, is not to engage in risky activity, which is actually quite easy. Don't use IE, don't download from just anywhere, etc

Secondly, I'm not really turning anything off entirely. I am only limiting real time security to the potential points of attack - hardware router firewall, and real-time scanning of incoming files and email.

At that point, UAC, software firewalls and the like are superfluous, since it's already difficult enough for malicious code to get through the first two barriers.

And on top of that, I still scan every file on my PC nightly with TWO security clients, just to be sure nothing slipped by, which others have said is obsessive.

The only thing that hackers might find useful on my system is my AT login, since thats all thats actually saved. And even that would require them actually caring enough to pick me to sniff through, out of the 1 million random people they infected.

If I were posting a potentially-stickied "How to set up Vista" thread, I would feel a pretty heavy weight of responsibility on the security side. There's botnets out there with more than 1 million infected home PCs. Per botnet. Time to start taking home-computer security more seriously than "lol I will just reimage", IMHO. But I'm just crazy like that

Being that this is a technical subforum, I'm giving the more savvy than average people here the benefit of the doubt.

Believe me, I've had friends that must hold world records on the amount of malware on their system, so I know what you're getting at, and I'll edit it a bit later to more strongly get across the risks, but I think that an advanced user who knows what he's doing, and is willing to accept the risks, can get by just fine without some of the extra baggage.

 

[mechBgon]

First, is not to engage in risky activity, which is actually quite easy.

Where I used to work, the Internet hosting company that hosted my employer's own public website got subverted. Our own site began trying to feed malware to our PCs, which used our site as the homepage. So much for it being "easy" to avoid risk, huh?

Another example from this week: normally-safe ticket sales site turns malignant. And another: Asus's site gets subverted, as well as Neowin and others in times past. Ever visit CircuitCity's site? Or HP's?

Remember, it is no longer enough to say "I never go to p0rn or warez sites, and I never download freeware, therefore I am safe". You are no longer safe if you stick to "safe" sites. We all believed Neowin is a safe site, yes? We all believed sites owned by Circuit City, and HP, and Asus, and spreadfirefox, and msblog, and debian, and sites owned by Capital City Bank, Wakulla Bank and Premier Bank were safe, and that the Google Video email group and myspace were safe (well maybe not myspace). All of them have put visitors at risk, whether it be from hacked pages with hostile code injected, or downloads that are infected with viruses.

And on top of that, I still scan every file on my PC nightly with TWO security clients, just to be sure nothing slipped by, which others have said is obsessive.

Do you know about rootkits? Their purpose is to make sure that if you do an after-the-fact scan, you find nothing that they are supposed to hide. Real-time protection, combined with checks & stops such as low-rights user accounts and other due cautions are all warranted to keep them from ever getting onboard.

How would the rootkit get onto your system? I don't know. But the bad guys are quite motivated to find ways. Subverted computers make them lots of money by sending Spam, performing extortion DDoS attacks, stock pump-&-dump and other stuff. Reading up on malware like Gromozon and Rustock.B, with anti-anti-rootkit capabilities and some of their other advanced tricks, it's evident the bad guys mean business and will keep raising the bar.

If I were going to run Vista without real-time virus protection (or even if I weren't, actually), I'd be on a non-Admin user account with a disallowed-by-default Software Restriction Policy and full DEP, using IE7+ and keeping all my other stuff up-to-date. Certainly not as an Admin with UAC disabled and no SRP.

Ok, I will stop hassling you now Nice effort with your thread, that obviously took time to prepare

 

[archcommus]

Originally posted by: BD2003
First, is not to engage in risky activity, which is actually quite easy. Don't use IE, don't download from just anywhere, etc

Hey, don't hate on IE, man, IE7, especially under Vista, is perfectly fine, and isn't even integrated with the OS anymore.

mechBgon, I understand your security viewpoint of things, but I have to agree with BD2003 that with the very limited number of websites I visit and files I download, I simply don't need things like full DEP, UAC, or a "limited" account. My daily activities on my computer consist of AT, DailyTech, Facebook, my university's website, AIM, music, TV, and the occasional game.

I guess full DEP couldn't hurt, as long as my programs were cool with it. But UAC - eh, it'd get annoying I'm sure. I'm really tempted to not run any real-time virus protection at all once I move to Vista, but I suppose that is a bit too risky, especially with the risks of things like keyloggers and rootkits.

 

[BD2003]

Well, for someone to get through my real-time defenses, they'd have to be pretty damn determined. I've never actually advocated running without real-time virus scan...I'll never feel safe doing that.

Honestly, if someone wanted to hack me that bad, I'd feel kinda special.

My work PC on the other hand, is like fort knox. They'd have to break through either two firewalls and two virus scanners, or alternatively, two door locks, a locked case, and break the encryption on any data of worth on the hard drive, only to find out that there is actually nothing of worth on it in the first place.

 

[mechBgon]

Originally posted by: archcommus

Originally posted by: BD2003
First, is not to engage in risky activity, which is actually quite easy. Don't use IE, don't download from just anywhere, etc

Hey, don't hate on IE, man, IE7, especially under Vista, is perfectly fine, and isn't even integrated with the OS anymore.

mechBgon, I understand your security viewpoint of things, but I have to agree with BD2003 that with the very limited number of websites I visit and files I download, I simply don't need things like full DEP, UAC, or a "limited" account. My daily activities on my computer consist of AT, DailyTech, Facebook, my university's website, AIM, music, TV, and the occasional game.

Guess what: AnandTech.com was causing DEP aborts :camera: on my system some time ago, a time that coincided with them having a really odd, non-AT-like advertising-banner company. Never say never...

I guess full DEP couldn't hurt, as long as my programs were cool with it. But UAC - eh, it'd get annoying I'm sure.

Consider one of those fingerprint readers, maybe.

My work PC on the other hand, is like fort knox. They'd have to break through either two firewalls and two virus scanners,

If you aren't using a non-Admin account and a SRP, consider adding those too. My analogy is that a Limited account is like them swiping your handgun and trying to shoot you with it, only to find out it's not loaded. And Limited+SRP is a handgun that can't even accept normal ammunition in the first place, even if they brought their own. This, and full DEP, will help protect you where your virus scanners and your firewalls will fail, such as true zero-day exploits delivering an as-yet-unknown payload.

I'm not claiming it's absolutely invincible, but it adds a completely arbitrary level of protection that doesn't need signature updates, and it safeguards your other security measures too (antivirus, firewall, HOSTS file, Windows directory, security logs, etc).

 

[MmmSkyscraper]

This thread needs sticky love.