Defeating SMS


Introduction Version History Download

OK, so it's not strictly a Clarion article but I do have a C5 app for download which you can use to "reconfigure" SMS .....

Introduction

SMS is a Microsoft product, Systems Management Server. SMS is mainly used by sysadmins for software and hardware inventory, product licensing and remote diagnostics. It's a client-server big brother, with a client on every PC sending back information about the machine to the SMS server. Amongst other things the sysadmin has the abilty to scan the entire hard drive and catalog every .EXE on your machine, as well as forcing you to take downloads he thinks is necessary for your PC to run correctly.

The SMS client software is typically installed on the client PC by a WinNT login script. The login script installs some base software, including a new control panel, to the client PC. The base software then runs in the background, and installs some more control panels and software, known as agents, to the PC. These agents are typically the hardware and software agents, which run periodically in the background and collect information about the PC before sending the information back to the SMS server.

The SMS client is supposed to be transparent - the user should not notice it is running, and it should not affect any other programs. I say "should" because that's not always the case. For most users (secretary's, financial, HR etc) it runs as designed, but for power-users, especially developers, it's a real PITA. Is this problem a bug in your code, a bug in you development environment, or is SMS generally fucking things up?

Installation

When SMS installs, it creates a lot of new registry entries. The base path for most registry keys is HKLM\Software\Microsoft\SMS. The base install path on your hard drive is \Windows\MS\SMS (or \WinNT\MS\SMS for NT users). In our installation the average client software uses about 10mb of disk space.

There are a few steps you can take to stop SMS from installing, but nothing that won't get you in trouble.

The most obvious under Win9x are to write-protect your AUTOEXEC.BAT, or to encrypt it completely. The WinNT login script (in our installation) adds 1 line to the beginning of the AUTOEXEC.BAT to set the new environment variable SMS_LOCAL_DIR. It’s interesting to note that this normally contains the path to \Windows, not \Windows\MS\SMS as you might expect

Under WinNT (which obviously doesn't have an AUTOEXEC.BAT) I don’t know of anything you can do stop SMS from being installed.

Un-Install

SMS doesn’t appear in the "Add/Remove Programs" control panel, nor does it write uninstall information to the normal place in the registry (HKLM\Software\Microsoft\Windows\CurrentVersion\UnInstall). Because of this, some lesser person may be tempted to think you are unable to remove SMS. Wrong!

To remove SMS completely, go to the SMS bin directory at \Windows\MS\SMS\Core\Bin\xxxx, where "xxxx" is the codepage number for your country (IE English is 00000409). Run SMSMAN.EXE and simply select the "Remove systems management components" option.

The other option is simply to edit the AUTOEXEC.BAT and remove any lines SMS added, delete the \Windows\MS directory and use RegEdit to remove the SMS and WBEM keys from HKLM\Software\Microsoft

Running SMS at startup

The SMS install creates registry keys that runs the SMS client software automatically at startup. The registry keys differ between Win9x and WinNT, because under NT SMS is installed as a service that starts automatically when the PC is booted up. Under Win9x, which has no concept of services, it's run in the background as a regular application, although the only indication that it's running is a listing in the task manager - there's no application window, or icon in the system tray.

Stopping SMS from running at startup

You have 2 choices when it comes to getting rid of SMS. Uninstall it, which will mean it'll probably get re-installed the next time you log on to the network, or leave it installed and cripple it to the point where it doesn't work. The second choice is obviously more discreet, and less likely to get in trouble with the sysadmin.

When it comes to stopping the SMS client under WinNT, it's remarkably easy. Go to the "Services" control panel, and change the SMS client service from automatic to manual startup. Even if you disable the service, the next time you logon the service will be re-enabled again.  To get around this, go to the user manager and disable (or remove) the SMS user accounts (when the SMS service starts, it can optionally be started under a different account than the one you used to log on to NT). You'll probably get a warning that a service failed to start, but you can ignore it - you know which service it is!

Under Win9x, it's a little more complex. Using your favourite registry editor, go to the following registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices) and remove any SMS entries you find. Under Win9x there should be 1 in each key - in WinNT there should be 1 entry in the first key. Once you've rebooted the SMS client will no longer run.

SMS Log Files

SMS has a number of different log files that it writes it's information to. Log files are written to \Windows\MS\SMS\Logs, and each log file has it’s own value stored under the base key HKLM\Software\Microsoft\SMS\Client\Configuration\Client\Client Components\Available Programs Manager Win32\Logs

SMS Agents

As I mentioned previously, the base SMS client (can) install a number of different agents on to your PC, based on what your sysadmin is intending to use SMS for. Each SMS agent is installed in it’s own sub-directory underneath \Windows\MS\SMS\Clicomp, and each agent has it's own registry key, under the base key HKLM\Software\Microsoft\SMS\Client\Configuration\Client Application Launchers\xxxx

Under each registry key is a value named "Executable path" that contains the path and name of the executable file containing the agent. Clearing this value means that attempting to run the agent from the new "System Administrator" control panel has no effect, because the control panel is unable to execute the agent.

Version History

22Dec99 1.03 Added ability to view / terminate running processes.
16Nov99 1.02 Initial upload

Download

Thor is an application which will do all of the above for you, without the need to dirty your hands using RegEdit.

THOR.ZIP (752K)


Back to my home page, Clarion page or send me mail at paula@attglobal.net

1