Performance Optimization Guidelines for

Windows 7 Desktop Virtualization

05 August 2012
Abstract

This guide describes important tuning parameters and settings that you can adjust
to improve the performance and energy efficiency of the Windows 7 operating
system. This guide describes each setting and its potential effect to help you make
an informed decision about its relevance to your system, workload, and
performance goals.
This paper is for information technology (IT) professionals and system
administrators who need to tune the performance of an environment that is running
Windows 7.
This information applies to the Windows 7 operating system.
References and resources discussed here are listed at the end of this guide.
The current version of this paper is maintained on the Web at:
TBD
Feedback: Please tell us whether this paper was useful to you. Submit comments at:
TBD

Page | 1

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the
date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment
on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR
STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of
this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means
(electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of
Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter
in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document
does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places
and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email
address, logo, person, place or event is intended or should be inferred.
2012 Microsoft Corporation. All rights reserved.
Microsoft, MSDN, SuperFetch, Windows, and Windows 7 are either registered trademarks or trademarks of Microsoft Corporation in
the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
2012 Microsoft Corporation. All rights reserved.

Document History
Version
Date

1.0

21 June 2012

1.1

02 July 2012

1.2

10 July 2012

1.3

27 July 2012

1.4

5 August 2012

1.5

6 August 2012

1.6

28 August 28,
2012

Change
Initial
version.
Event Log
section
completed
, adding
Internet
Explorer
section
Minor
version,
services
section
added
Turned
over to for
edit
review
Minor
Changes
Minor
Changes
and peer
review
Document
ing
Windows

Page | 2

1.7

14 September
2012

1.8

20 September
2012

1.9

3 December
2012

Presentati
on
Foundatio
n Font
Cache
3.0.0.0
issues and
possible
resolution
s.
Updated
guidance
on NLA
service.
Removed
an
inapplicabl
e group
policy
setting.
Added
note
about
security
settings.
Added
note
about 8.3
file
system
setting.
Minor
edits

Page | 3

Table of Contents
Introduction................................................................................................................ 4
Acknowledgements..................................................................................................... 5
Contributors................................................................................................................ 5
Implementing Changes............................................................................................... 5
VDI Optimization Checklist......................................................................................... 6
Optimization Categories............................................................................................. 7
1.Visual Effects Settings.......................................................................................... 7
2.Windows Services Optimization Recommendations.............................................9
3.Windows Features Possible Settings................................................................13
4.Windows Group Policy Settings...........................................................................14
5.Windows Event Log Optimization Recommendations.........................................17
6.Virtual Machine Disk Controller Configuration....................................................23
7.Clean up miscellaneous files from the base image before locking down as gold
.............................................................................................................................. 23
8.Apply applicable Microsoft updates and hotfixes................................................25
9.Memory Management Settings:..........................................................................26
10.Networking Recommendations.........................................................................27
11.Scheduled Tasks............................................................................................... 29
12.Increase Service Timeout.................................................................................30
13.Disable Boot Animation.................................................................................... 31
14.Change Hard Error Popup Behavior..................................................................31
15.File System Optimizations................................................................................31
16.Event Trace Sessions........................................................................................ 33
17.Crashdump Recovery Options..........................................................................34
18.Pagefile Settings............................................................................................... 35
19.Miscellaneous Startup Items.............................................................................36
Appendix.................................................................................................................. 36
Boot Startup Time with each group of recommendations......................................36
Works Cited.............................................................................................................. 38

Page | 4

Introduction
Microsoft Desktop Virtualization & Management solutions use key features and tools
found in Windows Server Hyper-V, System Center, MDOP, and other components to
help simplify management of IT operations onto a single infrastructure across
physical and virtual assets. It enables instant provisioning of corporate applications
and desktops, which get users up and running sooner, and equips IT to provide
access to legacy applications during migration to Windows 7. Working with System
Center management tools, Microsoft Desktop Virtualization automatically detects
device configurations and network conditions to deliver the most appropriate
services to each user.
The goal of this paper is to take the Windows 7 operating system, which is very
well tuned out of the box, and refine it further specifically for a corporate VDI
environment. Windows 7 was designed to tune itself as it runs over time, by
collecting telemetry about the applications and services run on the operating
system. In the VDI environment, many background services and tasks are disabled
from the beginning, so no further collection of telemetry is needed, nor is further
optimization necessary. The VDI images themselves run on enterprise class storage
that is sufficiently abstracted from the VDI images that background optimization
tasks for storage are not necessary, nor would they yield quantifiable results for the
overhead cost of optimization cycles.
Further, performance data can be taken at other levels, such as host-level, or
System Center agents, if so equipped, so that ongoing trace capturing is not
necessary on the default scale.
This paper should not be intended as a blueprint, but more of a guide or starting
point. There are some recommendations that may disable functionality that is
desirable to maintain. In most all cases there is no right or wrong decision, only a
cost-benefit analysis.

Page | 5

Acknowledgements
Portions of this paper were derived from information available from the following
sources:

Windows 7 Optimization Guide for Desktop Virtualization

Citrix Corporation

Windows 7 VM Optimization for VDI Deployment

Microsoft Premier Services

http://social.technet.microsoft.com/wiki/contents/articles/4495.list-ofresources-on-windows-7-optimization-for-vdi-en-us.aspx

Contributors
Thank you to the following folks for contributing to this paper:

Joe Fox, Microsoft

Aaron Margosis, Microsoft

Implementing Changes
Where possible, all changes will be implemented using available enterprise tools or
methods, including but not limited to:

Group Policy settings

User-Interface settings

PowerShell

Scripting

Direct registry modifications

The most preferable method to implement changes is through Group Policy or

scripting. The next best method is tools and the least preferable is modifying the
registry directly. Examples of commands or scripts are provided where applicable.

Page | 6

VDI Optimization Checklist

VDI Image Optimization Checklist

Visual effects settings

Customize Default-User profile
Disabling services
Features Settings
Group Policy Settings (local or domain-based Group Policy)
Event log optimizations
Virtual Machine Disk Controller Settings
Miscellaneous file cleanup
Applicable hotfixes and other updates
Memory management settings
Networking settings
Scheduled Tasks
Always On and Diagnostic Event Trace for Windows (ETW) Sessions
Increase service timeout setting
Disable boot animation
Change Hard Error Popup Behavior
File system settings
Kernel-Mode Bug-Check Memory Dump File Settings
Pagefile Settings
Miscellaneous Automatic Startup Items

Page | 7

Optimization Categories
1. VISUAL EFFECTS SETTINGS
Windows 7 visual effects settings affect the appearance of Windows 7 by smoothing
screen elements and so on. The visual effects settings are found in the userinterface by going to System Properties (sysdm.cpl), then clicking the Advanced tab,
then clicking the Settings button in the Performance section.
The changes need to be implemented for the default user profile, so that all users
logging on thereafter will receive these changes. The changes here reduce several
small animation effects, but leave the semi-translucent appearance.
The supported method for modifying the default user profile for all subsequent
users is documented in the following KB article:
Customize the default local user profile when preparing an image of Windows
http://support.microsoft.com/kb/973289
The easiest way to accomplish the visual effects changes are to log with the built-in
administrator account, modify the settings directly per the KB article, and then use
the unattended installation method of CopyProfile.
The procedure is to take the base image, run Sysprep against the base image with a
customized Unattend.xml (deployment answer file). The Unattend.xml should be
essentially as follows:
BEGIN UNATTEND.XML
====================
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup"
processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35"
language="neutral" versionScope="nonSxS"
xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<CopyProfile>true</CopyProfile>
<RegisteredOrganization></RegisteredOrganization>
<ComputerName></ComputerName>
<RegisteredOwner />
</component>
</settings>
<cpi:offlineImage cpi:source="wim:d:/win7entx64.wim#Drive C"
xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

====================
END UNATTEND.XML

Page | 8

After creating the Unattend.xml, copy it to the drive of the reference Windows 7
image and then run Sysprep with the answer file parameter pointing to the custom
answer file previously created. Then, create an account and verify that the account
has the desired options, such as display settings, etc.

Note
Ensure that the user profile being customized is the built-in Administrator.
Also, ensure that any other accounts are fully deleted and properly cleaned
up from the Windows registry. The best way to delete a profile is to use the
WMIC command, as follows:
wmic path win32_UserProfile where LocalPath="c:\\users\\user1"
Delete
Where user1 is the name of the account you want to delete
More information can be found in this KB article:
CopyProfile fails with FindLatestProfile failed (0x80070003) error
during Windows 7 deployment
http://support.microsoft.com/kb/2530664
Once complete, logon, then create a new user. Verify that the new user properly
inherits the desired settings from the previous operations.
Visual Element
Animate controls and elements inside Windows
Animate windows when minimizing and maximizing
Animations in the taskbar and the Start Menu
Fade or slide menus into view
Fade or slide ToolTips into view
Fade out menu items after clicking
Show shadows under mouse pointer
Show shadows under windows
Show translucent selection rectangle
Show window contents while dragging
Slide open combo boxes

Page | 9

2. WINDOWS SERVICES OPTIMIZATION RECOMMENDATIONS

The following services can be evaluated for disabling in the VDI environment:

Service
Background Intelligent
Transfer Services

Desktop Window
Manager (DWM) Session
Manager

Description
Transfers files in the background using idle network
bandwidth.
Services that use BITS are disabled like Windows
Update, as the VDI image has other patching
mechanisms.
DWM enables visual effects on the desktop as well as
various features such as glass window frames, 3-D
window transition animations, Windows Flip and
Windows Flip3D, and high resolution support.
In the virtualization environment, sharing a Graphics
Processor. Unless the VDI solution supports DWM, the
recommendation is disable the service.
P a g e | 10

Service
Diagnostic Policy Service
Disk Defragmenter
Function Discovery
Resource Publication
HomeGroup listener
HomeGroup provider

Indexing Service
Microsoft iSCSI Initiator
Service

Description
Manages and orchestrates built-in Windows diagnostics,
such as networking, audio, Windows Update.
Provides disk defragmentation capabilities. VDI doesnt
interact with storage the same as a computer with a
physical disk, or even a SAN disk, therefore, disable
unless required.
Publishes this computer and resources attached to this
computer so they can be discovered over the network.
Unless this functionality is needed, disable this service.
Homegroups are a feature intended more for ad-hoc file
sharing and not needed for domain joined computers in
most cases.
Homegroups are a feature intended more for ad-hoc file
sharing and not needed for domain joined computers in
most cases.
Functionality is replaced by the Windows Search service
and not available unless the Windows Feature called
Indexing Service is installed, which it is not by default
in Windows 7 Enterprise.
Manages iSCSI sessions. Disable unless required.
Dependency of NLA, this service maintains information
about network such whether a particular network is
categorized within Windows as Public, Home, or
Work. Usually all networks are treated as Public with
VDI computers in a corporate environment, and the VDI
computers do not change from network to network
much, if any.

Network List Service

NOTE: Disabling this service will prevent Windows from

being able to auto-detect the correct Windows Firewall
profile.
This setting should be thoroughly tested before
implementing.
Disabling the Network List service will cause all current
and future network connections to utilize the Public
category of Windows Firewall rules.
Another possible side-effect of disabling this service is
that it could interfere with DirectAccess functionality.

P a g e | 11

Service

Description
NOTE: Disabling this service will prevent Windows from
being able to detect the correct network profile in multiNIC systems, and could cause Windows Firewall to apply
unexpected rules. This setting should be
thoroughly tested before implementing.

Network Location
Awareness

Program Compatibility
Assistant Service

Offline Files

Security Center

Shell Hardware Detection

SuperFetch

Collects and stores configuration information for the

network and notifies programs when that information is
modified. Since the VDI computer will very likely always
be on one network, the corporate network, this
information will not change, so the NLA service is not
needed.
This service assists with automatically applying
application compatibility options to users when
programs either have, or appear to have problems when
starting or running. In the corporate environment
application compatibility is usually managed by
enterprise so therefore this service to automatically set
AppCompat shims for applications is not needed.
http://msdn.microsoft.com/enus/library/windows/desktop/bb756937.aspx
Offline files would generally not be used in a VDI
environment, as it is intended more for mobile
computers or computers that connect to and disconnect
from some network.
Interfaces with security and stability elements with the
operating system. Security Center reports status to
users of things like anti-virus, backup, etc. Other
reporting mechanisms are generally utilized in the
enterprise and the aspects of security are controlled by
the IT groups.
Monitors and provides notification for AutoPlay hardware
events. AutoPlay is a feature that detects content such
as pictures, music, or video files on removable media
and removable devices. AutoPlay then automatically
starts applications to play or display that content.
SuperFetch improves on Prefetch by monitoring which

applications you use the most and preloading those into your
system memory so they will be ready when you need them. In
VDI the telemetry obtained by SuperFetch does not persist,
therefore it cannot add value.
NOTE: Disabling the SuperFetch service is one aspect of PreFetch.
See:

http://msdn.microsoft.com/enus/library/ff794658(v=winembedded.60).aspx

P a g e | 12

Service

Telephony

Windows Backup

Windows Defender
Windows Font Cache
Service
Windows Media Player
Sharing Service

Windows Presentation
Foundation Font Cache
3.0.0.0

Windows Search

Windows Update

Description
Telephony integrates computers with communications
devices and networks. Possible telephony applications
include Multicast multimedia IP conferencing, VoIP calls,
Automatic Call Distribution (ACD) Center client and
server applications, IVR, and real-time collaboration.
This service may be required by subsequent
conferencing software.
http://msdn.microsoft.com/enus/library/windows/desktop/ms733433(v=vs.85).aspx
Provides data backup services for Windows. User data is
protected by various methods in the enterprise, in most
cases users will not be manually running backups with
Windows Backup, so this service can be disabled.
Malware (et al) prevention service. Usually replaced
with specific solutions that replace the functionality
provided by Windows Defender service.
Optimizes performance of applications by caching
commonly used font data.
Disable this service unless the functionality of sharing
media is specifically needed.
Optimizes performance of Windows Presentation
Foundation (WPF) applications by caching commonly
used font data. WPF applications will start this service if
it is not already running. It can be disabled, though
doing so could slightly reduce the performance of WPF
applications.
NOTE: if this service needs to remain enabled, but
problems are experienced with excessive CPU utilization
from the PresentationFontCache.exe process, see this
article for possible resolution:
http://support.microsoft.com/kb/937135
(Delete Font*.dat files)
The Windows Search service provides a great benefit
and the decision to enable or disable is an organizational
one. The ability to search local drives and content is
very helpful to users, but does not come without a price
in CPU cycles and disk I/O, even if moderate and lowpriority.
One possible compromise might be to limit the scope of
Indexed data to a very small subset.
NOTE: If the Windows Search feature is not installed in
the base image, the Search box above the Start menu
is not available, and the Windows Search service is not
available.
Updates to VDI images are tightly controlled and applied
with mechanisms that dont utilize the traditional WU
services directly.

P a g e | 13

Service
WLANAutoConfig

WWAN AutoConfig

Description
Provides the logic required to configure, discover,
connect to, and disconnect from a wireless LAN (WLAN).
This service also has the ability to turn a computer into a
wireless access point.
Service manages mobile broadband (GSM & CDMA) data
card/embedded module adapters. As VMs will not use
WWAN, this service can be disabled.

P a g e | 14

3. WINDOWS FEATURES POSSIBLE SETTINGS

For Windows 7 Enterprise, there are no changes necessary in this category to
further optimize the baseline.
Windows Features are accessible through the Uninstall or Change a Program
interface. The following table is for informational purposes.
Feature
Games
Indexing Service
Internet Explorer 9
Internet Information Services
IIS Hostable Web Core
Media Features:
Media Center
DVD Maker
Media Player
Microsoft .NET Framework 3.5.1
MSMQ
Print and Document Services

Remote Differential Compression

RIP Listener
Services for NFS
SNMP
Simple TCP/IP Services
Subsystem for Unix-based
Applications
Tablet PC Components
Telnet Client
Telnet Server
TFTP Client
Windows Gadget Platform
Windows Process Activation Service
Windows Search
Windows TIFF Filter
XPS Services
XPS Viewer

Default State

Recommen
ded State

Off
Off
On
Off
Off
Media Center: Off
DVD Maker: Off
Media Player: On
Off
Off
Internet Printing Client:
On
LPD Print Service: Off
LPR Port Monitor: Off
Scan Management: Off
Windows Fax and Scan:
On
On
Off
Off
Off
Off
Off
Off
Off
Off
Off
Off
Off
Off
Off
On
On

P a g e | 15

4. WINDOWS GROUP POLICY SETTINGS

The following Group Policy settings can fine-tune many aspects of the Windows 7
behavior. Windows 7 Group Policy settings are divided into 2 sections; machine and
user. Machine settings are global to the operating system. The user settings are
applied on a per-user basis, for all users logging on to that machine. The group
policies can be preset using configuration of the gold image, or set through
domain-based group policy.

Note
Microsoft does NOT recommend any changes that would lower security
settings, or conflict with recommendations or requirements made by
standards bodies such as USGCB. Any setting recommendation in this paper
that is in conflict with standards recommendations should be ignored.
The following are a list of recommended settings for VDI workstations:
Machine Group Policy Setting

Recommen
ded
Setting

Allow BITS Peercaching

Configure Automatic Updates
Configure Scheduled Maintenance Behavior
Default behavior for AutoRun

Disabled
Disabled
Disabled
Enabled

Detect application failures caused by deprecated COM objects

Disable add-on performance notifications
Disable Browser Geolocation

Disabled
Enabled
Enabled

Disable machine account password changes

Disable Periodic Check for Internet Explorer software updates
Disable software update shell notifications on program launch
Disable Windows Error Reporting
Display mixed content
Do not allow Digital Locker to run
Do not allow Windows Media Center to run
Do not automatically start Windows Messenger initially
Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box
Do Not Show First Use Dialog Boxes
Enabling Windows Update Power Management to automatically wake up the system to
install scheduled updates
No auto-restart with logged on users for scheduled automatic updates installations
Notify blocked drivers
Prevent Automatic Updates
Prevent Media Sharing
Prevent participation in the Customer Experience Improvement Program
Prevent performance of First Run Customize settings

Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Disabled

Prevent Windows Anytime Upgrade from running.

Troubleshooting: Allow users to access and run Troubleshooting Wizards

Enabled
Disabled

Enabled
Disabled
Enabled
Enabled
Enabled
Enabled

Addition
al

Do not execute
any autorun
commands

Requires IE 9.0
or later

Intranet Zone

Go Directly to
home page

P a g e | 16

Machine Group Policy Setting

Troubleshooting: Allow users to access online troubleshooting content on Microsoft
servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting
Service - WOTS)
Turn off AutoPlay
Turn off Autoplay
Turn off Autoplay for non-volume devices
Turn off Configuration
Turn off desktop gadgets
Turn off downloading of game information
Turn off first-run Opt-In
Turn off game updates
Turn off location
Turn off Reopen Last Browsing Session
Turn off sensors
Turn off suggestions for all user-installed providers
Turn off System Restore
Turn off the communities features
Turn off the Security Settings Check feature
Turn off tracking of last play time of games in the Games folder
Turn off Windows Mail application
Turn off Windows Search AutoComplete
Turn off Windows SideShow
Turn off Windows Update device driver search prompt
Turn off Windows Update device driver searching
Turn on BranchCache
Turn on compatibility logging
Turn on Internet Explorer Standards Mode for local intranet
Turn on Software Notifications
Turn on Suggested Sites
User Account Control: Switch to the secure desktop when prompting for elevation

Recommen
ded
Setting

Addition
al

Disabled

Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Disabled
Disabled
Enabled
Disabled
Disabled
Enabled

Enabled

P a g e | 17

User Group Policy Setting

Clear the recent programs list for new users
Do not add shares of recently opened documents to Network Locations
Do not preserve zone information in file attachments
Do not track Shell shortcuts during roaming
Do not use the search-based method when resolving shell shortcuts
Do not use the tracking-based method when resolving shell shortcuts
Enable screen saver
Exclude directories in roaming profile
Force specific screen saver
Hide the notification area
Maximum allowed Recycle Bin size
Maximum size of Active Directory searches
No Computers Near Me in Network Locations
No Entire Network in Network Locations
Password protect the screen saver
Prevent CD and DVD Media Information Retrieval
Prevent changing screen saver
Prevent Music File Media Information Retrieval
Prevent Radio Station Preset Retrieval
Prohibit Access of the Windows Connect Now wizards
Remove Balloon Tips on Start Menu items
Remove CD Burning features
Remove the "Undock PC" button from the Start Menu
Remove the Action Center icon
Remove the battery meter
Remove the Search the Internet "Search again" link
Remove UI to change menu animation setting
Restrict Internet communication
Screen saver timeout
Turn off access to the OEM and Microsoft branding section
Turn off access to the solutions to performance center core section
Turn off access to the solutions to performance problems section
Turn off all balloon notifications
Turn off automatic update of ADM files
Turn off caching of thumbnail pictures
Turn off common control and window animations
Turn off display of recent search entries in the Windows Explorer search box
Turn off feature advertisement balloon notifications
Turn off notification area cleanup
Turn off notifications when a connection has only limited or no connectivity
Turn off the caching of thumbnails in hidden thumbs.db files
Turn off the display of thumbnails and only display icons on network folders
Turn off user tracking
Turn off Windows Libraries features that rely on indexed file data
Turn off Windows Mobility Center

Recommende
d Setting
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Defined by organization
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled
Enabled

Additional

scrnsave.scr

500

600

P a g e | 18

5. WINDOWS EVENT LOG OPTIMIZATION RECOMMENDATIONS

The Event Log service maintains a set of event logs that the system, system
components, and applications use to record events. It must also register event
providers and the configuration of the system that is required for events and event
traces to be delivered to their destination (event logs and trace files).
The service exposes functions that enable programs to maintain and manage the
event logs, configure event publishing, and perform operations on the logs, such as
archiving and clearing.
Administrators can maintain event logs and perform administrative tasks using the
Wevtutil command-line utility and the Event Viewer MMC plug-in. These operations
require administrator privileges. The same utilities allow viewing the contents of the
logs and viewing the current status of the service and the logs. These operations
may also require administrative privileges, depending on the security descriptor of
the log.
Managed Entities
The following is a list of the managed entities that are included in this managed
entity:
Name

Description

Event
Provider
s

Event Providers publish events to event logs. Providers are registered with
the event logging and tracing subsystem of the Windows operating
system. Their definition contains information required to interpret these
events and to display readable strings that are associated with them.

Event
Channel

A channel is a pathway that events take between an event publisher and

a log file. There is normally a single log file associated with a channel,
although there may not be a log file created for channels that have not
had any events published to them.

Primary
Channel
s

The System, Application, Setup, and Security channels are the primary
channels. Each of these channels correspond to an event log that can be
viewed in the Event Viewer. The System and Application channels are
used by publishers to log administrator-level events. Such events indicate
system or application-wide issues. When error or warning events are
published to these channels, the events should indicate that the
administrator should take an action to resolve the issue. The Setup
channel is used for events associated with setup and installations. The
Security channel is the repository of the system audit events.

(Microsoft Corporation, 2011)

P a g e | 19

A primary design goal of Windows 7 was supportability. Virtually all components

within Windows are event enabled. There are literally hundreds of event categories
with many of those enabled for receiving events. With the VDI environment, the
ability to capture events on hundreds or thousands of systems at once is less
important per machine, because all the machines are nearly identical.

Note
Each of the two following lists encompass Event Log channels that are enabled by
default, in a default installation of Windows 7. This is not the entire list of Event
Log channels available overall in a default Windows 7 installation.
Event Channels to Possibly Disable
HardwareEvents
Microsoft-Windows-BranchCache/Operational
Microsoft-Windows-BranchCacheSMB/Operational
Microsoft-Windows-CodeIntegrity/Operational
Microsoft-Windows-FMS/Operational
Microsoft-Windows-EapHost/Operational
Microsoft-Windows-Help/Operational
Microsoft-Windows-HomeGroup Provider Service/Operational
Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
Microsoft-Windows-Kernel-Power/Thermal-Operational
Microsoft-Windows-MCT/Operational
Microsoft-Windows-MUI/Operational
Microsoft-Windows-MemoryDiagnostics-Results/Debug
Microsoft-Windows-NCSI/Operational
Microsoft-Windows-NetworkLocationWizard/Operational
Microsoft-Windows-NetworkProfile/Operational
Microsoft-Windows-OfflineFiles/Operational
Microsoft-Windows-ParentalControls/Operational
Microsoft-Windows-HomeGroup Listener Service/Operational
Microsoft-Windows-ReadyBoost/Operational

P a g e | 20

Microsoft-Windows-ReadyBoostDriver/Operational
Microsoft-Windows-Recovery/Operational
Microsoft-Windows-ReliabilityAnalysisComponent/Operational
Microsoft-Windows-RemoteAssistance/Operational
Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
Microsoft-Windows-RestartManager/Operational
Microsoft-Windows-Security-Audit-Configuration-Client/Operational
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Microsoft-Windows-WER-Diag/Operational
Microsoft-Windows-WFP/Analytic
Microsoft-Windows-WPD-CompositeClassDriver/Operational
Microsoft-Windows-WPD-MTPClassDriver/Operational
Microsoft-Windows-Windows Defender/Operational
Microsoft-Windows-Windows Defender/WHC
Microsoft-Windows-WindowsBackup/ActionCenter
Microsoft-Windows-WindowsSystemAssessmentTool/Operational
Microsoft-Windows-WindowsUpdateClient/Operational
Setup
microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin

Event Channels to leave enabled but move to alternate location

Application
Security
System
Internet Explorer
Key Management Service
Microsoft-Windows-API-Tracing/Operational
Microsoft-Windows-AppID/Operational

P a g e | 21

Microsoft-Windows-AppLocker/EXE and DLL

Microsoft-Windows-AppLocker/MSI and Script
Microsoft-Windows-Application-Experience/Problem-Steps-Recorder
Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
Microsoft-Windows-Application-Experience/Program-Inventory
Microsoft-Windows-Authentication User Interface/Operational
Microsoft-Windows-Backup" /lfn:"F:\EventLogs\Microsoft-Windows-Backup.evtx
Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
Microsoft-Windows-Bits-Client/Operational
Microsoft-Windows-Bluetooth-MTPEnum/Operational
Microsoft-Windows-CodeIntegrity/Operational
Microsoft-Windows-CorruptedFileRecovery-Client/Operational
Microsoft-Windows-CorruptedFileRecovery-Server/Operational
Microsoft-Windows-DateTimeControlPanel/Operational
Microsoft-Windows-DeviceSync/Operational
Microsoft-Windows-Dhcp-Client/Admin
Microsoft-Windows-DhcpNap/Admin
Microsoft-Windows-Dhcpv6-Client/Admin
Microsoft-Windows-Diagnosis-DPS/Operational
Microsoft-Windows-Diagnosis-PCW/Operational
Microsoft-Windows-Diagnosis-PLA/Operational
Microsoft-Windows-Diagnosis-Scheduled/Operational
Microsoft-Windows-Diagnosis-Scripted/Admin
Microsoft-Windows-Diagnosis-Scripted/Operational
Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
Microsoft-Windows-Diagnostics-Networking/Operational
Microsoft-Windows-Diagnostics-Performance/Operational
Microsoft-Windows-DiskDiagnostic/Operational
Microsoft-Windows-DiskDiagnosticDataCollector/Operational
Microsoft-Windows-DiskDiagnosticResolver/Operational

P a g e | 22

Microsoft-Windows-DriverFrameworks-UserMode/Operational
Microsoft-Windows-EventCollector/Operational
Microsoft-Windows-Fault-Tolerant-Heap/Operational
Microsoft-Windows-Folder Redirection/Operational
Microsoft-Windows-Forwarding/Operational
Microsoft-Windows-GroupPolicy/Operational
Microsoft-Windows-IKE/Operational
Microsoft-Windows-International/Operational
Microsoft-Windows-Iphlpsvc/Operational
Microsoft-Windows-Kernel-EventTracing/Admin
Microsoft-Windows-Kernel-StoreMgr/Operational
Microsoft-Windows-Kernel-WDI/Operational
Microsoft-Windows-Kernel-WHEA/Errors
Microsoft-Windows-Kernel-WHEA/Operational
Microsoft-Windows-Known Folders API Service
Microsoft-Windows-LanguagePackSetup/Operational
Microsoft-Windows-MUI/Admin
Microsoft-Windows-NTLM/Operational
Microsoft-Windows-NetworkAccessProtection/Operational
Microsoft-Windows-NetworkAccessProtection/WHC
Microsoft-Windows-NlaSvc/Operational
Microsoft-Windows-PowerShell/Operational
Microsoft-Windows-PrintService/Admin
Microsoft-Windows-RemoteApp and Desktop Connections/Admin
Microsoft-Windows-RemoteAssistance/Admin
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Microsoft-Windows-Resource-Exhaustion-Detector/Operational
Microsoft-Windows-Resource-Leak-Diagnostic/Operational
Microsoft-Windows-TZUtil/Operational
Microsoft-Windows-TaskScheduler/Operational

P a g e | 23

Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
Microsoft-Windows-TerminalServices-PnPDevices/Admin
Microsoft-Windows-TerminalServices-PnPDevices/Operational
Microsoft-Windows-TerminalServices-RDPClient/Operational
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
Microsoft-Windows-UAC-FileVirtualization/Operational
Microsoft-Windows-UAC/Operational
Microsoft-Windows-User Profile Service/Operational
Microsoft-Windows-VDRVROOT/Operational
Microsoft-Windows-VHDMP/Operational
Microsoft-Windows-WFP/Operational
Microsoft-Windows-WLAN-AutoConfig/Operational
Microsoft-Windows-WPD-ClassInstaller/Operational
Microsoft-Windows-WinRM/Operational
Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Microsoft-Windows-Winlogon/Operational
Microsoft-Windows-Winsock-WS2HELP/Operational
Microsoft-Windows-Wired-AutoConfig/Operational
Windows PowerShell

You can move and resize the event log channels in one operation. The following is a
sample command that will relocate the event log output file to the F: drive, and
resize to the minimum, which is 1 MB:
wevtutil sl "Microsoft-Windows-API-Tracing/Operational"
/lfn:F:\EventLogs\Microsoft-Windows-API-Tracing%4Operational.evtx /ms:1052672

P a g e | 24

The following is a sample command that will disable an event log:

wevtutil sl "Microsoft-Windows-WPD-CompositeClassDriver/Operational" /e:false

Note
The event log maximum size can be reduced in overall size from the default
setting for each log. The smallest event log size possible in Windows 7 is 1 MB.
Even if a smaller size is specified, the size will remain at 1 MB.

6. VIRTUAL MACHINE DISK CONTROLLER CONFIGURATION

If using a secondary disk with the Windows 7 VDI image, use one of the ATA
controllers within the Hyper-V VM configuration. There is a known issue
where the VDS service generates spurious errors in the event log, per KB
article 979391.

7. CLEAN

UP MISCELLANEOUS FILES FROM THE BASE IMAGE BEFORE LOCKING

DOWN AS GOLD
The base image can be optimized by cleaning up unnecessary files. If the
base image is based on Windows 7 with SP1 embedded, there is little to
cleanup. Otherwise, you can go through and make sure there are no .tmp
files, unnecessary log files, etc. There are two ways to cleanup, first is the
console application, CMD.EXE, and the second is the Disk Cleanup wizard
built-in.
Disk Cleanup of .TMP files

1. Open a CMD prompt as administrator

2. Change directory to C:\
CD
3. To list current .tmp files in current folder and all subfolders, run the
command dir *.tmp /s.
4. To delete current .tmp files in current folder and all subfolders, run
the command del *.tmp /s.
5. To list current .tmp files, that include the hidden and/or system
attribute, in current folder and all subfolders, run the command dir
*.tmp /s.
6. To delete current .tmp files, that include the hidden and/or system
attribute, in current folder and all subfolders, run the command del
*.tmp /s.
Disk Cleanup Wizard

1. Run Cleanmgr to open Disk Cleanup

P a g e | 25

2. In the Drives list, click the hard disk drive that you want to clean up,
and then click OK.
3. In the Disk Cleanup dialog box, on the Disk Cleanup tab, select the
check boxes for the file types that you want to delete, and then click
OK.
4. In the message that appears, click Delete files.
To clean up all files on the computer

1. Run Cleanmgr to open Disk Cleanup.

2. In the Drives list, click the hard disk drive that you want to clean up,
and then click OK.
3. In the Disk Cleanup dialog box, click Clean up system files. If you are
prompted for an administrator password or confirmation, type the
password or provide confirmation.
4. In the Disk Cleanup: Drive Selection dialog box, select the hard disk
drive that you want to clean up, and then click OK.
5. In the Disk Cleanup dialog box, on the Disk Cleanup tab, select the
check boxes for the file types that you want to delete, and then click
OK.
6. In the message that appears, click Delete files.
The More Options tab is available when you choose to clean files from
all users on the computer. This tab includes two additional ways to free
even more disk space:

Programs and Features. This option opens Programs and

Features in Control Panel, where you can uninstall programs that
you no longer use. The Size column in Programs and Features
shows how much disk space each program uses.

System Restore and Shadow Copies. With this option, you can
delete all but the most recent restore point on the disk.

System Restore uses restore points to return your system files to

an earlier point in time. If your computer is running normally,
you can save disk space by deleting the earlier restore points.
P a g e | 26

In some editions of Windows 7, restore points can include

previous versions of files, known as shadow copies, and backup
images created with Windows Complete PC Backup. These files
and images will also be deleted.

8. APPLY

APPLICABLE

MICROSOFT

UPDATES AND HOTFIXES

Note
This is a list of POST-SP1 hotfixes for Windows 7. Each fix should be
individually evaluated for applicablility. Also, this list can change at any time.
Please check the Microsoft Knowledge Base for the latest list of recommended
hotfixes for Windows 7.
2524478
The network location profile changes from "Domain" to "Public" in
Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2524478/EN-US
982018
An update that improves the compatibility of Windows 7 and Windows
Server 2008 R2 with Advanced Format Disks is available
http://support.microsoft.com/kb/982018/EN-US
2705233
You cannot access offline files that were configured in a DFS
namespace on a Windows 7-based client computer
http://support.microsoft.com/kb/2705233/EN-US
2549311
You cannot access a DFS share by using a valid user account in
Windows Server 2008 R2, in Windows 7, in Windows Vista or in Windows Server
2008
http://support.microsoft.com/kb/2549311/EN-US
2614892
A computer stops responding because of a deadlock situation in the
Mountmgr.sys driver in running Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2614892/EN-US
2689311
SMB commands run serially when the SMB packet-signing feature is
enabled in Windows 7 SP1 or in Windows Server 2008 R2 SP1
http://support.microsoft.com/kb/2689311/EN-US
2646563
SMB2 directory cache is not updated correctly if a file is deleted in
Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2646563/EN-US
2708811
Data corruption occurs when a sparse file undergoes random write
stress in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2708811/EN-US
P a g e | 27

2680906
Robocopy.exe utility incorrectly skips some files during the file copy or
backup process in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2680906/EN-US
2591462
A boot LUN can be disabled if it is claimed for use with MPIO in
Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2591462/EN-US
2709630
Delay occurs when you log on to a domain from a computer that is
running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2709630/EN-US
2625434
"""ERROR_SHARING_VIOLATION"" error message in Windows XP or in
Windows Server 2003 when you try to open a file on an SMB share on a server that
is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2625434/EN-US
2654363
Computer crashes when you use Driver Verifier to monitor Storport.sys
if you disable the HBA in Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2654363/EN-US
2615327
You cannot cancel a shrink operation on a volume in Windows 7 or in
Windows Server 2008 R2
http://support.microsoft.com/kb/2615327/EN-US
2708549
"Stop error when you create a VSS snapshot backup in Windows 7 SP1
or in Windows Server 2008 R2 SP1: ""fvevol!FveFilterDeviceControl+1d0"""
http://support.microsoft.com/kb/2708549/EN-US

9. MEMORY MANAGEMENT SETTINGS:

Prefetch
Prefetch is a tool that is intended to improve application startup performance.
It does this by loading application data into memory before it is demanded.
For the VDI image, Prefetch should be disabled because some applications
may be virtualized. The following is the registry location that controls the
Prefetch behavior:
HKLM\SYSTEM\CCS\Control\Session Manager\Memory
Management\PrefetchParameters
DWORD=EnablePrefetcher
Decimal Value=0

Command to run to disable Prefetcher:

REG ADD "HKLM\System\CCS\Control\Session Manager\Memory
Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 0 /f

(Microsoft Corporation, 2012 )

P a g e | 28

Superfetch
SuperFetch is a tool that is intended to improve application startup
performance. It does this by loading application data into memory before it is
demanded. SuperFetch improves on Prefetch by monitoring which
applications you use the most and preloading those into your system memory
so they will be ready when you need them. For the VDI image, Superfetch
should be disabled because some applications may be virtualized. The
following is the registry location that controls the Superfetch behavior:
HKLM\SYSTEM\CCS\Control\Session Manager\Memory
Management\PrefetchParameters
DWORD=EnableSuperfetch
Decimal Value=0
REG ADD "HKLM\System\CCS\Control\Session Manager\Memory
Management\PrefetchParameters" /v EnableSuperfetch /t REG_DWORD /d 0 /f

(Microsoft Corporation, 2012)

10. NETWORKING RECOMMENDATIONS

Do not register network change events recursively.
This helps to reduce network traffic by reducing change notifications to
network clients.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
DWORD= NoRemoteRecursiveEvents
Decimal Value=1
(Microsoft Corporation, 2012)

DisableBandwidthThrottling
HKLM\system\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

The default is 0. By default, the SMB redirector throttles throughput across

high-latency network connections in some cases to avoid network-related
timeouts. Setting this registry value to 1 disables this throttling, enabling
higher file transfer throughput over high-latency network connections.

DisableLargeMtu

P a g e | 29

HKLM\system\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

The default is 1. By default, the SMB redirector does not transfer payloads
larger than approximately 64 KB per request. Setting this registry value to 0
enables larger request sizes, which can improve file transfer speed.

EnableWsd
HKLM\system\CurrentControlSet\Services\Tcpip\Parameters
\(REG_DWORD)

The default is 1 for client operating systems. By default, Windows Scaling

Diagnostics (WSD) automatically disables TCP receive window autotuning
when heuristics suspect a network switch component might not support the
required TCP option (scaling). Setting this registry setting to 0 disables this
heuristic and allows autotuning to stay enabled. When no faulty networking
devices are involved, applying the setting can enable more reliable highthroughput networking via TCP receive window autotuning.

RequireSecuritySignature
HKLM\system\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

The default is 0. Changing this value to 1 prevents SMB communication with

machines where SMB signing is disabled. In addition, a value of 1 causes SMB
signing to be used for all SMB communication. SMB signing can increase CPU
cost and network round trips. If SMB signing is not required, ensure that this
registry value is 0 on all clients and servers.

FileInfoCacheEntriesMax
HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

The default is 64 with a valid range of 1 to 65536. This value is used to

determine the amount of file metadata that can be cached by the client.
Increasing the value can reduce network traffic and increase performance
when a large number of files are accessed.

DirectoryCacheEntriesMax
HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

P a g e | 30

The default is 16 with a valid range of 1 to 4096. This value is used to

determine the amount of directory information that can be cached by the
client. Increasing the value can reduce network traffic and increase
performance when large directories are accessed.

FileNotFoundCacheEntriesMax
HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
\(REG_DWORD)

The default is 128 with a valid range of 1 to 65536. This value is used to
determine the amount of file name information that can be cached by the
client. Increasing the value can reduce network traffic and increase
performance when a large number of file names are accessed.
File Client Tuning Example

The following settings for parameters can optimize a machine for accessing
remote file shares in many cases, particularly over some high-latency
networks. The settings are not optimal or appropriate on all machines. You
should evaluate the impact of individual settings before applying them.
Parameter

Value

DisableBandwidthThrottling

EnableWsd

RequireSecuritySignature

FileInfoCacheEntriesMax

32768

DirectoryCacheEntriesMax

4096

FileNotFoundCacheEntriesMax

32768

MaxCmds

32768

(Microsoft Corporation, 2011)

11. SCHEDULED TASKS

There are several scheduled tasks that run in Windows 7 that can be
disabled. The Scheduled Tasks can be found in Control Panel ->
Administrative Tools. The particular Scheduled Tasks that could be disabled
can be found in the Task Scheduler Library, under the Microsoft category and
the Windows subcategory.
Folder

TaskName

Application Experience

AitAgent

ApplicationExperience

ProgramDataUpdater
P a g e | 31

Autochk

Proxy

Bluetooth

UninstallDeviceTask

Customer Experience
Improvement Program

Consolidator
KernelCeipTask
UsbCeip

Defrag

ScheduledDefrag

Diagnosis

Scheduled

DiskDiagnostic

Microsoft-WindowsDiskDiagnosticDataCollector

Location

Notifications

MobilePC

HotStart

MUI

LPRemove

MultiMedia

SystemSoundsService

NetTrace

GatherNetworkInfo

PowerEfficiencyDiagnostics

AnalyzeSystem

Rac

RacTask

Ras

MobilityManager

Registry

RegIdleBackupTask

RemoteAssistance

RemoteAssistanceTask

SideShow

GadgetManager

SideShow

SessionAgent

SystemRestore

SR

TextServicesFramework

MsCtfMonitor

WDI

ResolutionHost

WindowsErrorReporting

QueueReporting

WindowsMediaSharing

UpdateLibrary

WindowsBackup

AutomaticBackup

WindowsBackup

WindowsBackupMonitor
P a g e | 32

12. INCREASE SERVICE TIMEOUT

When rebooting a large number of virtual machines within a short period of
time, it may be necessary to increase the Service Control Manager timeout
value to allow enough time for the services to start. This timeout can be
increased by modifying the following registry key:
HKLM\SYSTEM\CurrentControlSet\Control
DWORD=ServicesPipeTimeout
Decimal Value=180000 (3 Minutes)
(Microsoft Corporation, 2006)

13. DISABLE BOOT ANIMATION

Disabling the computer startup animation, which no user will see.
bcdedit /set bootux disabled
(Microsoft Corporation, 2012)

14. CHANGE HARD ERROR POPUP BEHAVIOR

Windows allows the user to change the handling of hard error popups that
result from application and system errors. Such errors include no disk in the
drive and general protection (GP) faults. Normally, these events cause a hard
error popup to be displayed, which requires user intervention to dispatch.
HKLM\SYSTEM\CurrentControlSet\Control\Windows
DWORD=ErrorMode
Decimal Value=2
(Microsoft Corporation, 2010)

15. FILE SYSTEM OPTIMIZATIONS

Disable Background disk defragmentation

Disable Background auto-layout

Disable 8.3 file name creation

Disable Last Access time stamp (default)

Disable Background disk defragmentation:

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction\
Value Name: Enable

P a g e | 33

Type: REG_SZ
Value: N

reg add HKLM\SOFTWARE\Microsoft\Windows\ Dfrg\BootOptimizeFunction /v

Enable /t REG_SZ /d N

Disable Background auto-layout:

Key Name:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout
Value Name: EnableAutoLayout
Type: REG_DWORD
Value: 0

reg add HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout /v

EnableAutoLayout /t REG_DWORD /d 0

(Microsoft Corporation, 2006)

NtfsDisable8dot3NameCreation
Note
Disabling 8.3 file name creation can have a negative effect in the
following circumstances:

16-bit programs that cant access long paths

o
E.g., old installation programs extracted to %TEMP%

Batch files that expect short-name support

o
E.g., use of %~s1 expanded path contains short names
only
o
Avoids having to quote paths that may contain spaces

Apps that expect short-name support

o
SCCM (!), McAfee, Symantec, others
HKLM\System\CurrentControlSet\Control\FileSystem\REG_DWORD)
The default is 0. This parameter determines whether NTFS generates a short
name in the 8.3 (MS DOS) naming convention for long file names and for
file names that contain characters from the extended character set. If the
value of this entry is 0, files can have two names: the name that the user
specifies and the short name that NTFS generates. If the user-specified name
follows the 8.3 naming convention, NTFS does not generate a short name.
Changing this value does not change the contents of a file, but it avoids the
short-name attribute creation for the file, which also changes how NTFS
displays and manages the file. For most SMB file servers, the recommended
setting is 1.

P a g e | 34

With Windows 7, you can disable 8.3 name creation on a per-volume basis
without using the global NtfsDisable8dot3NameCreation setting. You can do
this with the built-in fsutil tool. For example, to disable 8.3 name creation on
the d: volume, run fsutil 8dot3name set d: 1 from a command prompt
window. You can view help text by using the command fsutil 8dot3name.
Sample commands:
"fsutil 8dot3name set 1"
"fsutil 8dot3name set C: 1"

- disable 8dot3 name creation on all volumes

- disable 8dot3 name creation on c:

NtfsDisableLastAccessUpdate
HKLM\System\CurrentControlSet\Control\FileSystem\(REG_DWORD)
The default is 1. In versions of Windows prior to Windows Vista and Windows
Server 2008, the default is 0 (do not disable last access). A value of 0 can
reduce performance because the system performs additional storage I/O
when files and directories are accessed to update date and time information.

16. EVENT TRACE SESSIONS

Windows 7 makes extensive use of Event Tracing for Windows (ETW). ETW
provides the means for Windows components to output messages that can be
used for information and diagnostic purposes. Virtually every component in
Windows is trace enabled, meaning that with little overhead and little to no
configuration changes, most components can be configured to output
diagnostic messages to output files for later analysis.
The built-in ETW sessions can be found by going to Computer Management,
then Performance category, and then the Data Collector Sets category. In
Windows 7 there are 4 sub-categories of Data Collector sets:
1. User Defined
2. System

System Diagnostics

System Performance

3. Event Trace Sessions

4. Startup Event Traces Sessions
With the VDI image, not all of these traces are necessary. Each trace
consumes a small amount of memory, and uses a small number of processor
cycles. To disable a particular trace, go to Startup Event Traces Sessions,
double-click on the trace, click the trace session tab, and then uncheck the
P a g e | 35

option box next to enabled. The following traces are candidates to be

disabled:
Startup Event Trace Sessions
Audio
DiagLog
ReadyBoost
WdiContextLog

17. CRASHDUMP RECOVERY OPTIONS

This set of options determine the behavior of the VDI computer in the event
of a Windows stop-error, also known as a kernel bug-check. This determines
the level of debug diagnostic data saved to disk and whether the VDI
machine logs the error in the local event log.
Theoretically if one machine has the problem they all should have the
problem. Therefore the enterprise-wide settings do not have to be the same
as they would be for physical machines. At a minimum the event should still
be recorded in the event log, even if no dump file of any kind is saved.
Also the restart behavior should be left to default, which is to restart the
machine in the event of a failure. On the enterprise level, if one machine has
a stop-error, most or all the other machines should have the same error as
they are all based on one gold image, or a series of copies of the gold
image. If troubleshooting, look at the scope of the problem to help narrow
down whether this is enterprise-wide, single-host, machines scoped to one
copy of an image, or just one machine. If it is just one machine, look at the
local data for the machine, or the server hosting that machine, or some
component in the path.
Key Name: HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\
Value Name: CrashDumpEnabled
Type: REG_DWORD
Value: 0
Commands to change options:
wmic recoveros set DebugInfoType = 3
wmic recoveros set MiniDumpDirectory = D:\Minidump
These 2 commands would first set dump type to small, and second, redirect
the output to a non-default location, in this case D:\Minidump.
P a g e | 36

NOTE: By turning off normal memory dump file creation for VDI machine,
but changing nothing else, the behavior will be that in the event of a stop
error the VDI machine will still log an event and still capture a small memory
dump which is 64 KB for 32-bit OS and 128 KB for 64-bit OS. This small bit of
information can be extremely useful in the event the VDI machines do
experience stop errors. A determination may be made that a larger memory
dump is needed for diagnostic purposes and that change could be
implemented on a subset of VDI machines via group policy for a short period
of time, which would limit the overall I/O demand on the infrastructure as a
whole.
Reference:
How to configure system failure and recovery options in Windows
http://support.microsoft.com/kb/307973
Overview of memory dump file options in Windows 2000, Windows XP,
Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and
Windows Server 2008 R2
http://support.microsoft.com/kb/254649

18. PAGEFILE SETTINGS

Set pagefile initial and maximum sizes to 1000 MB (1 GB)

Move the pagefile to a different drive location, if so desired

It is possible to run Windows 7 with no paging file. Consideration must be

given to the ramifications of running with no paging file. The balance is that
the pagefile should be large enough to accommodate unexpected demands
on physical RAM, yet not be so large as to use up excessive disk space on the
infrastructure. Setting an upper limit on a pagefile caps the maximum
amount of memory potentially available to Windows 7. With System
Managed, the pagefile grows if needed to accommodate memory demand.
With a maximum size set once the limit of physical and virtual memory is
reached, either the OS must trim memory, meaning to reclaim pages, or
the operating system could return an out of memory error to the
application, or the user.
The VDI image could be set so the Windows virtual memory paging file initial
and maximum values are the same. The pagefile size, along with physical
RAM allocated to the VDI machine will determine the Commit Limit value, or
maximum value of memory possibly available to that instance of operating
system. For example, if the VDI machine is allocated 2 GB of RAM, and the
pagefile initial and maximum values are 1.5 GB, the effects are:
a) Commit Limit for the VDI machine is 3.5 GB
P a g e | 37

b) A complete memory dump is not an option as the pagefile size is less

than the size of physical RAM.
Consider that the first time the VDI computer is started up part of the time
spent in building the machine is the creation of the pagefile itself. The larger
the size, the more time spent per machine, and this factor must be weighed
along with the number of machines in use and the frequency of machine
creation. The other factor is that with unique machines, the pagefile, along
with unique applications and settings for that machine are all streamed each
time the machine is started up.
References:
PerfGuide: Out of System Committed Memory
http://social.technet.microsoft.com/wiki/contents/articles/2248.perfguide-outof-system-committed-memory.aspx
http://blogs.technet.com/b/markrussinovich/archive/2008/11/17/3155406.asp
x
(Refer to section, How Big Should I Make the Paging File?)

19. MISCELLANEOUS STARTUP ITEMS

In order to further streamline the entire startup process check for and remove
and unnecessary startup processes. The best tool to use for managing
startup items is Sysinternals Autoruns, available for free download from
Sysinternals.com, a Microsoft web site.
Here are some example items that may be found with Autoruns, the starting
of which can be disabled or removed from the system altogether:
Autorun Item

Windows Mail
Windows Mail (x86)
Sidebar
Task

There are other possible items that can be removed as a startup item.

Task Scheduler:
GatherNetworkInfo. This is a VBScript under Nettrace. This item
can be disabled, or the entry to automatically run this item can be
deleted through Autoruns. You may find that if you try to delete the
P a g e | 38

item there is an error that this item does not exist. However the
automatic running entry will be removed.

Task Scheduler:
Update Library configuration item. Unless the VDI image will be
using the functionality of the Windows Media Player Library, this item
can be deleted through Autoruns.

Miscellaneous items that are highlighted in yellow with a status of not

found. Delete out drivers or other items found in Autoruns with a
status of not found.

Appendix
BOOT STARTUP TIME

WITH EACH GROUP OF RECOMMENDATIONS

The following are the results of startup times with each group of recommendations,
and finally with all recommendations. This information is not intended to be
definitive on Windows 7 startup times, only to show a comparison of startup times
in a test environment. These times can be extrapolated to overall load placed on
the host servers and infrastructure.
Each group of tests was run with the Windows Performance Toolkit, boot tracing
analysis. The base image tested was Windows 7 Enterprise, with Service Pack 1,
pre-activated, and all other options set to factory defaults. The only additional
software installed on the test system was System Center 2012 Endpoint Protection,
a security suite from Microsoft.
1. Default Install, all Windows Updates:
Timing bootDoneViaExplorer=19993

P a g e | 39

2. Service Optimizations:
Timing bootDoneViaExplorer=18879
UI Change: No change, all elements look the same visually:

Figure 1: UI Appearance with services optimizations

3. Windows Machine Group Policy Optimizations:

Timing bootDoneViaExplorer=19040
UI Change: No change, all elements look the same visually (identical to
Figure 1 above)
4. Windows User Group Policy Optimizations:
Timing bootDoneViaExplorer=19465
UI Change: No change, all elements look the same visually (identical to
Figure 1 above)
5. Disabled Boot Animations
Timing bootDoneViaExplorer=19604
UI Change: No change, all elements look the same visually (identical to
Figure 1 above)
P a g e | 40

Works Cited
Microsoft Corporation. (2006, October 18). Disabling Disk Defragmentation.
Retrieved July 19, 2012, from MSDN: http://msdn.microsoft.com/enus/library/ms932871(WinEmbedded.5).aspx
Microsoft Corporation. (2006, September 22). The Windows Trace Session Manager
service does not start and Event ID 7000 occurs. Retrieved July 19, 2012,
from Microsoft Support: http://support.microsoft.com/kb/839803
Microsoft Corporation. (2009, June 1). Download: Understanding Networking with
Hyper-V. Retrieved July 16, 2012, from Microsoft Download Center:
http://www.microsoft.com/en-us/download/details.aspx?
displaylang=en&id=9843
Microsoft Corporation. (2010, November 17). HOWTO: How To Change Hard Error
Popup Handling in Windows NT. Retrieved July 19, 2012, from Microsoft
Support: 2012
Microsoft Corporation. (2011, May 13). Performance Tuning Guidelines for Windows
Server 2008 R2. Retrieved July 25, 2012, from Dev Center:
http://msdn.microsoft.com/en-US/windows/hardware/gg463392.aspx
Microsoft Corporation. (2011, August 5). Windows Event Log Service. Retrieved July
13, 2012, from TechNet: http://technet.microsoft.com/enus/library/dd315601(v=WS.10).aspx
Microsoft Corporation. (2012 , June 13). Disable Prefetch. Retrieved July 16, 2012,
from TechNet: http://msdn.microsoft.com/enus/library/ff794503(WinEmbedded.60).aspx
Microsoft Corporation. (2012, June 13). Disable SuperFetch. Retrieved July 26, 2012,
from TechNet: http://msdn.microsoft.com/enUS/library/ff794658(v=winembedded.60)
Microsoft Corporation. (2012, June 8). Overview of memory dump file options for
Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows
Server 2008, Windows 7, and Windows Server 2008 R2. Retrieved July 19,
2012, from Microsoft Support: http://support.microsoft.com/kb/254649
Microsoft Corporation. (2012, June 13). Remove Boot Screens. Retrieved July 19,
2012, from MSDN: http://msdn.microsoft.com/enus/library/ff794272(v=winembedded.60).aspx

P a g e | 41

Microsoft Corporation. (2012, June 6). RESTRICTIONS enumeration (Windows).

Retrieved July 19, 2012, from MSDN: http://technet.microsoft.com/enus/query/bb762534

P a g e | 42