10 replies to this topic

[ToneSurfer]

So I work in a large enterprise and any request I make to get software media (i.e. Win 7 CD) is scrutinized by legal types. In explaining my intent to build Win7PE (actually WinFE flavor) using WAIK/WinBuilder this section of WAIK license is questioned:

 

"Windows Pre-Installation Environment. You may install and use the Windows Pre-Installation Environment for purposes of diagnosing and recovering Windows operating system software.  For the avoidance of doubt, you may not use the Windows Pre-Installation Environment for any other purpose, including without limitation as a general operating system, as a thin client or as a remote desktop client."

 

The conern is that I would be taking Win7PE and using it as a general OS to run my forensics tools, etc, perhaps even on computers that were never licensed for Windows OS in the first place (i.e. I may use it to acquire MAC or Linux hard drives).

 

I'm stumped how to respond to them as it seems to be true. Sureley someone has come across this before and have found a license statement that permits this - I am hoping. Otherwise I'm dead in the water, at least for use in my company.

 

[netlord]

Hi ToneSurfer

 

the legal team here is saying that spreading Win7-based PE is allowed, but with introduction of Win8 MS changed the rules....

 

We still use the old version

[Wonko the Sane]

Well, as always, yes and no.

 

First thing that license is the license coming with the WAIK/ADK, i.e. while it surely applies to a PE created through the WAIK/ADK  it may not apply to a PE created in another way from the files on your "normal" DVD.

 

And surely re-distribution of a pre-built PE is not allowed.

 

https://winfe.wordpr...-of-system-ram/

 

There may be issues if the source is a OEM DVD, because more generally in that case the use of the Operating System is "tied" to the specific hardware it is sold with.

 

If you take a "normal" Windows 7 in a non-OEM version, i.e. Retial or Enterprise you have a license to install and use it on a single computer.

 

For all that matters you can uninstall it from your old "yesterday's" PC and install it on your new "today's" PC (or non-PC) every morning.

 

But what you are licensed for is to use the OS on a single computer, there is no actual *need* to install it on an internal hard disk (and even if there was, aside the inconvenience there is no Law prohibiting you from removing an internal hard disk and moving it to another computer) and you can install it instead on a USB stick or hard disk.

 

A "Universal Windows 7 boot image", like - as an example - one that you can make with this:

http://www.911cd.net...showtopic=23553

http://reboot.pro/to...-and-windows-7/

represents an example of such a thing.

 

There is no reason why it would not be legal to use the above, as long as you use it only on a single computer concurrently, you have a license to use it on a computer, not on a given one.

 

So, if you use the SAME but in PE mode (which ultimately it is a non-persistent mode) it would suddenly become not legal?

 

Wonko

[Tripredacus]

The redistribution rights for WinPE has never existed, however there was a time (wonko aludes to) where you could get a license from MS to redist a WinPE product. One example of this was Norton Antivirus which you could boot the DVD into a WinPE. Since MS discontinued this program (it applies to any PE, 1.5-5.0), companies like Symantec have moved to using Linux.

It is a gray area if you are using a customized WinPE for internal or personal use. I think technically, still not allowed... similar to how you can't modify a Windows OS but people still do by changing the pictures in the boot up or install screens.

[Brito]

On this situation the text is clear that any software not used as pre-installation magically turns the whole thing into a general purpose OS. However, truth is that Microsoft hasn't been chasing people for adding programs that ease the offline administration of their operating system since about a decade to this part. I mentioned their because you are merely licensed to its usage and not entitled to ownership.

 

In practical terms, different legal departments have different tolerance to risks and different knowledge about the technical aspects required by administrators to do their work. Truth is that Microsoft wants to keep corporate customers happy and away from Linux, especially with Android taking the lead on user adoption. Historically, WinPE-based projects such as WinFE (Forensic Edition) are well know by people within Microsoft and no concerns about the situation were made.

 

Same thing for WinBuilder, in over ten years we were never called to attention by Microsoft.

 

From my perspective it is a pity that the Microsoft EULA is not updated to support end-users on valid scenarios such as forensics or at least ease the licensing of WinPE for specific projects.

 

Not related to Windows, but by the looks of the copyright evolution we might soon not even be entitled to own a vehicle. We will be licensed by the manufacturer to use one. This is starting to happen right now with tractors: http://www.wired.com...hip-john-deere/

 

[steve6375]

Running WinFE is NOT a 'general OS' - you are using it for diagnostic/repair purposes which is within the license terms. Presumably you are not intending to use it as a general purpose OS but only for forensic\repair purposes (WinPE reboots after 72 hours anyway).

As long as you boot it on licensed Windows systems you are OK as each one has it's own licence.

For linux systems you should use a linux OS - Windows cannot see linux ext volumes, so you will need a linux diagnostic OS that can access linux filesystems anyway.

[Wonko the Sane]

Well,

almost the WHOLE point a WinFE standard use (where the F stands for Forensics) is to prevent the Windows Mount Manager (or whatever) to mount and potentially modify not only the disk but also each and every volume on it.

 

So it is actually a good thing that there is not by default a filesystem driver for several filesystems (including Ext2/3/4) as you NEVER want to access/mount a filesystem on the evidence disk.

Once you have made an image, then you may want to access the image (Read Only) and the volumes/filesystems in it, and you can usually do that on a machine running a "normal" Windows.

 

I.e. strictly speaking the WinFE can well be a "recovery only" Operating System booted to the ONE and ONLY scope of running (say) FTK Imager (or WinHex/X-Ways or CloneDisk or any other imaging tool, including DMDE and/or any other dd-like program,  even dsfo - slowly - would do), see:

http://reboot.pro/to...st-and-results/

and make a forensic sound image (or clone) of the evidence disk.

 

Wonko

[lemon]

A lot of good info here!  Thanks to all who chimed in.  I've read the EULA crap and surmised my own interpretations of what what it is MS is trying to convey so the other perspectives are very handy!

[sbaeder]

Yes, a lot of good info here, and to me, the key phrase that SHOULD make legal happy enough is "for purposes of diagnosing and recovering Windows operating system software"

 

While it could be misused, if you make it clear to them that this is your intent (i.e. the whole FE aspect of it), and show them some of this as well as info from the following http://www.forensics....org/wiki/WinFE you should be OK.

[Wonko the Sane]

Yes, a lot of good info here, and to me, the key phrase that SHOULD make legal happy enough is "for purposes of diagnosing and recovering Windows operating system software"
 
While it could be misused, if you make it clear to them that this is your intent (i.e. the whole FE aspect of it), and show them some of this as well as info from the following http://www.forensics....org/wiki/WinFE you should be OK.

Not really-really.

The actual point IMHO is that that sentence refers ONLY to the WinPE release that is provided as part of the WAIK, and it does not apply to a self built PE or, if you prefer, to a Licensed Windows OS ("Full", not "OEM") used in PE mode.

Now, in stupid Windows 8/8.1 times most probably one could use to the same effect a Windows To Go device, however.


Wonko