From 982397e9461abe05a9b1c0314c085bdf5c1b20c6 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Tue, 17 Jan 2023 18:22:32 +0100 Subject: [PATCH 01/29] Create Windows documentation --- user/templates/windows/Windows qubes | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 user/templates/windows/Windows qubes diff --git a/user/templates/windows/Windows qubes b/user/templates/windows/Windows qubes new file mode 100644 index 00000000..30268261 --- /dev/null +++ b/user/templates/windows/Windows qubes @@ -0,0 +1,15 @@ +Windows qubes +============= + +Like any other unmodified OSes, Windows can be installed in Qubes as an [HVM](https://www.qubes-os.org/doc/standalone-and-hvm/) domain. + +Qubes Windows Tools are then usually installed to provide integration with the rest of the Qubes system; they also include Xen's paravirtualized (PV) drivers to increase performance compared to qemu emulated devices. Alternatively, only Xen's PV drivers can be installed if integration with Qubes isn't required or if the tools aren't supported on a given version of Windows. In the latter case, one would have to [enable inter-VM networking](/doc/firewall/#enabling-networking-between-two-qubes) to be able to exchange files with HVMs. + +For more information about Windows VMs in Qubes OS, please see the following external resources: + +* [Installing and Using Windows-based VMs in Qubes R4.0](/doc/templates/windows/windows-vm.md) +* [Installing and Using Qubes Windows Tools in Qubes R4.0](/doc/templates/windows/windows-tools.md) +* [Installing and Using Windows-based VMs in Qubes R4.1](/doc/templates/windows/windows-vm41.md) +* [Installing and Using Qubes Windows Tools in Qubes R4.1](/doc/templates/windows/windows-tools41.md) +* [Create a Gaming HVM in Qubes 4.1](/doc/templates/windows-gaming-hvm.md) +* [Migrate backups of Windows VMs created under Qubes R4.0 to R4.1](/doc/templates/windows/windows-migrate41.md) From 36de6eef57626f4c36b63795b81d1a67242a7ee7 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Tue, 17 Jan 2023 18:27:23 +0100 Subject: [PATCH 02/29] Create Windows qubes.md --- user/templates/windows/Windows qubes.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 user/templates/windows/Windows qubes.md diff --git a/user/templates/windows/Windows qubes.md b/user/templates/windows/Windows qubes.md new file mode 100644 index 00000000..30268261 --- /dev/null +++ b/user/templates/windows/Windows qubes.md @@ -0,0 +1,15 @@ +Windows qubes +============= + +Like any other unmodified OSes, Windows can be installed in Qubes as an [HVM](https://www.qubes-os.org/doc/standalone-and-hvm/) domain. + +Qubes Windows Tools are then usually installed to provide integration with the rest of the Qubes system; they also include Xen's paravirtualized (PV) drivers to increase performance compared to qemu emulated devices. Alternatively, only Xen's PV drivers can be installed if integration with Qubes isn't required or if the tools aren't supported on a given version of Windows. In the latter case, one would have to [enable inter-VM networking](/doc/firewall/#enabling-networking-between-two-qubes) to be able to exchange files with HVMs. + +For more information about Windows VMs in Qubes OS, please see the following external resources: + +* [Installing and Using Windows-based VMs in Qubes R4.0](/doc/templates/windows/windows-vm.md) +* [Installing and Using Qubes Windows Tools in Qubes R4.0](/doc/templates/windows/windows-tools.md) +* [Installing and Using Windows-based VMs in Qubes R4.1](/doc/templates/windows/windows-vm41.md) +* [Installing and Using Qubes Windows Tools in Qubes R4.1](/doc/templates/windows/windows-tools41.md) +* [Create a Gaming HVM in Qubes 4.1](/doc/templates/windows-gaming-hvm.md) +* [Migrate backups of Windows VMs created under Qubes R4.0 to R4.1](/doc/templates/windows/windows-migrate41.md) From 4110a19d8ae541882a74404c11c74a0ebe673432 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Tue, 17 Jan 2023 18:30:39 +0100 Subject: [PATCH 03/29] Create windows-migrate41.md --- user/templates/windows/windows-migrate41.md | 48 +++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 user/templates/windows/windows-migrate41.md diff --git a/user/templates/windows/windows-migrate41.md b/user/templates/windows/windows-migrate41.md new file mode 100644 index 00000000..932ba71d --- /dev/null +++ b/user/templates/windows/windows-migrate41.md @@ -0,0 +1,48 @@ +Migrating Windows VMs from Qubes R4.0 to R4.1 +============================================= + +For Windows 7, 10 and 11, there is a way to migrate backups created under Qubes R4.0 to R4.1. For this, the version of Qubes Windows Tools (QWT) 4.1-67, available from [tabit-pro/qubes-windows-tools-cross](https://github.com/tabit-pro/qubes-windows-tools-cross/releases), has to be installed under Qubes R4.0, selecting the option to install the Xen PV disk driver, which emulates SCSI disks. For template VMs, the option to move user profiles may be selected, too. Then, the backup may be created, and this backup can be restored under Qubes R4.1, resulting in a VM well integrated into Qubes R4.1. If `qvm-features audio-model ich6` is set, Windows even will have audio, although for Windows 10 and 11 somewhat scratchy. + +While this is somewhat straightforward, things get difficult if QWT 4.0.1.3 was installed in the VM. Prior to installing version 4.1-67, the old version has to be removed, which can be quite tricky for Windows 10 and 11. + +Preparation for Windows 7 +------------------------- + + - Uninstall QWT 4.0.1.3, using the standard procedure from the system control panel of Windows. This will most likely result in a crash. + - Restart Windows again, hitting the F8 key, select the restart menu, and there select a start in safe mode. + - The system will start gain, but in a rather useless way. Just shut it down, and reboot again. + - Now Windows will start normally. Check in the control panel, if there are any Xen drivers left. If so, uninstall them. + - In the Windows device manager, check if there is still a (probably non working) Xen PV disk device. If so, uninstall it. Otherwise, QWT 4.1-67 will not install. + - In the control panel, check again, if the Xen drivers are removed. A Xen Bus Package (version 8.2.1.8) may remain and cannot be removed, but does no harm. Any other Xen drivers should have disappeared. + - There probably will be a drive `D:` containing the private user data. For Qubes, R4.1, QWT will expect this drive to be called `Q:`, so it has to be renamed: + - Start the command prompt as administrator, i.e. right click on the Command Prompt icon (All Programs -> Accessories) and choose "Run as administrator" + - In the command prompt type `diskmgmt.msc` + - In the disk manager, select the volume `Private (D:)` + - Select the option `Change Drive Letter and Path` + - Select option `Change...` + - Select the letter `Q` + - Click `OK` in all still open windows of the disk manager and terminate it. + +Preparation for Windows 10 and 11 +--------------------------------- +If there is a drive `D:` from this earlier installation of Qubes Windows Tools, it will probably contain incomplete private data; especially the folder `AppData` containing program configuration data will be missing. In this situation, it may be better to perform a new Windows installation, because repair may be difficult and trouble-prone. +- First, be sure that the automatic repair function is disabled. In a command window, execute `bcdedit /set recoveryenabled NO`, and check that this worked by issuing the command `bcdedit`, without parameters, again. +- Now, uninstall QWT 4.0.1.3, using the Apps and Features function of Windows. This will most likely result in a crash. +- Restart Windows again, possibly two or three times, until repair options are offered. By hitting the F8 key, select the restart menu, and there select a start in safe mode (in German, it's option number 4). +- The system will start gain, but in a rather useless way. Just shut it down, and reboot again. +- Now Windows will start normally. Check in the Apps and Features display, if there are any Xen drivers left. If so, uninstall them. +- In the Windows device manager, check if there is still a (probably non working) Xen PV disk device. If so, uninstall it. Otherwise, QWT 4.1-67 will not install. +- In the Apps and Features display, check again, if the Xen drivers are removed. A Xen Bus Package (version 8.2.1.8) may remain and cannot be removed, but does no harm. Any other Xen drivers should have disappeared. + +Transferring the Windows Qube +----------------------------- + +- Now, finally, after one additional reboot, Qubes Windows Tools 4.1-67 can be installed. The option `Move user profiles` should be used **if and only if** there was **no** separate drive `D:` in the earlier Windows installation. +- After one more reboot, the backup for R4.1 may be created. +- This backup can be installed in Qubes R4.1 and will (probably) work. + +The PV disk drivers used for migration can be removed after successful installation of the VM under Qubes R4.1. For this, the QWT installation has to be started, the option Change has to be selected, and the PV disk driver must be unselected. After completion, the VM has to be rebooted. For Windows 10 and 11, the VM will crash with the error INACCESSIBLE BOOT DEVICE, which can be repaired as described above. + +After successful uninstallation of the PV disk drivers, the disks will appear as QEMU ATA disks. + +:warning: **Caution:** This change may lead Windows to declare that the hardware has changed and that in consequence, the activation is no longer valid, possibly complaining that the use of the software is no longer lawful. It should be possible to reactivate the software if a valid product key is provided. From 8a0f6bffe8f6da81c7376abf161718c4550ddf05 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Tue, 17 Jan 2023 18:32:30 +0100 Subject: [PATCH 04/29] Create windows-tols.md --- user/templates/windows/windows-tols.md | 335 +++++++++++++++++++++++++ 1 file changed, 335 insertions(+) create mode 100644 user/templates/windows/windows-tols.md diff --git a/user/templates/windows/windows-tols.md b/user/templates/windows/windows-tols.md new file mode 100644 index 00000000..4e2eddf2 --- /dev/null +++ b/user/templates/windows/windows-tols.md @@ -0,0 +1,335 @@ +:warning: *The content below describes Qubes Windows Tools installation in Qubes R4.0. The text has been updated to reflect the newer R4.1 release and QWT recent development. Please see [this updated document](https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md) for instructions for Qubes R4.1 and the updated version of Qubes Windows Tools.* + +Qubes Windows Tools +=================== + +Qubes Windows Tools are a set of programs and drivers that provide integration of Windows AppVMs with the rest of the Qubes system. Currently the following features are available for Windows VMs after installation of those tools: + +- **Qubes Video Driver** - provides for the Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop +- **File sender/receiver** - Support for [secure clipboard copy/paste](https://www.qubes-os.org/doc/copy-paste/) between the Windows VM and other AppVMs +- **File sender/receiver** - Support for [secure file exchange](https://www.qubes-os.org/doc/copying-files/) between the Windows VM and other AppVMs +- **Copy/Edit in Disposable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) +- **Xen PV drivers** for Windows that increase performance compared to qemu emulated devices + +Below is a breakdown of the feature availability depending on the windows version: + +| Feature | Windows 7 x64 | Windows 10 x64 | +| ------------------------------------ | :------------: | :------------: | +| Qubes Video Driver | + | - | +| Qubes Network Setup | + | + | +| Private Volume Setup (move profiles) | + | + | +| File sender/receiver | + | + | +| Clipboard Copy/Paste | + | + | +| Application shortcuts | + | + | +| Copy/Edit in Disposable VM | + | + | +| Block device | + | + | +| USB device | + | + | +| Audio | - | - | + +Qubes Windows Tools are open source and are distributed under a GPL license. + +NOTES: +- Qubes Windows Tools are currently unmaintained +- Currently only 64-bit versions of Windows 7 and Windows 10 are supported by Qubes Windows Tools. Only emulated SVGA GPU is supported (although [there has been reports](https://groups.google.com/forum/#!topic/qubes-users/cmPRMOkxkdA) on working GPU passthrough). +- __This page documents the process of installing Qubes Windows Tools on versions up to R3.2.__. Installation on Qubes R4.0 is possible but is a work in progress and there are limitations/bugs (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585)). + +Installing Windows OS in a Qubes VM +----------------------------------- + +Please refer to [this page](https://www.qubes-os.org/doc/windows-vm/) for instructions on how to install Windows in a Qubes VM. + +NOTE: It is strongly suggested to enable autologon for any Windows HVMs that will have Qubes Tools installed. To do so, run `netplwiz` command from the `Win+R`/Start menu and uncheck the *Users must enter a user name and password to use this computer* option. + +Installing Qubes guest tools in Windows 10 VMs +---------------------------------------------- + +This will allow you to install the Qubes Windows Tools on Windows 10 both as a StandaloneVM as well as a Template VM and a corresponding AppVM. But some features are not available: + +> **Note:** seamless mode is currently not available for windows. Please check the top of this document for the full feature availability breakdown. + + 1. In the Windows 10 VM, download from the [XEN website](https://xenproject.org/downloads/windows-pv-drivers/windows-pv-drivers-9-series/windows-pv-drivers-9-0-0/) the installation kits for Xen bus (`xenbus`) and storage drivers (`xenvbd`) Version 9.0.0 (two files`xenvbd.tar`and `xenbus.tar`). + + 2. Use an archive extractor like [7-zip](https://www.7-zip.org/) to extract the contents of the `.tar` files. + + 3. Install `xenvbd` and `xenbus` by starting the file `dpinst.exe` from the `x64` directories of the extracted tar-files. If during installation, the Xen driver requests a reboot, select "No" and let the installation continue. + + 4. After installation, reboot. + + 5. Download the Qubes Windows Tools (`qubes-tools-4.0.1.3.exe`) from [the qubes FTP server](https://ftp.qubes-os.org/qubes-windows-tools/) and move it to `C:\`. + + 6. Check the integrity of the file `qubes-tools-4.0.1.3.exe`by comparing its hash checksum. This can be done using the Windows command `certutil` on the windows command prompt (`cmd.exe`) and specifying an appropriate hash algorithm like: + + certutil -hashfile C:\qubes-tools-4.0.1.3.exe SHA256 + + And compare it the value to `148A2A993F0C746B48FA6C5C9A5D1B504E09A7CFBA3FB931A4DCF86FDA4EC9B1` (**it has to exactly match for security reasons**). If it matches, feel free to continue the installation. If not, repeat the download to make sure it was not corrupted due to a network problem. If keeps on not matching it might be an attacker attempting to do something nasty to your system -- Ask for support. + + > **Note**: this is a workaround for installing the qubes windows tools on windows 10 since the standard way is broken. + + 7. Install Qubes Windows Tools 4.0.1.3 by starting `qubes-tools-4.0.1.3.exe`, not selecting the `Xen PV disk drivers` and the `Move user profiles` (which would probably lead to problems in Windows, anyhow). If during installation, the Xen driver requests a reboot, select "No" and let the installation continue - the system will be rebooted later. + + 8. Shut down Windows and wait until the VM is really stopped, i.e. Qubes shows no more activity. + + 9. On a `dom0` terminal write: *(where `` is the name of your Windows 10 VM)* + + qvm-features gui 1 + qvm-prefs qrexec_timeout 300 + + 10. Reboot Windows. If the VM starts, but does not show any window then shutdown Windows from the Qube manager, wait until it has really stopped, and reboot Windows once more. + + 11. Now the system should be up, with QWT running correctly. + + 12. Lastly to enable file copy operations to a Windows 10 VM the `default_user` property should be set the `` that you use to login to the Windows VM. This can be done via the following command on a `dom0` terminal: *(where `` is the name of your Windows 10 VM)* + + `qvm-prefs default_user ` + + > **Note:** If this property is not set or set to a wrong value, files copied to this VM are stored in the folder `C:\Windows\System32\config\systemprofile\Documents\QubesIncoming\`. + > If the target VM is an AppVM, this has the consequence that the files are stored in the corresponding TemplateVM and so are lost on AppVM shutdown. + + +Installing Qubes guest tools in Windows 7 VMs +--------------------------------------------- + +First, make sure that `qubes-windows-tools` is installed in your system: + +~~~ +sudo qubes-dom0-update qubes-windows-tools +~~~ + +(If the above command does not work, it could be that the Qubes Tools are not in the stable repo yet. Try installing from the testing repo instead.) + +You can also install the package from testing repositories, where we usually publish new versions first: + +~~~ +sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-windows-tools +~~~ + +This package brings the ISO with Qubes Windows Tools that is passed to the VM when `--install-windows-tools` is specified for the `qvm-start` command. Please note that none of this software ever runs in Dom0 or any other part of the system except for the Windows AppVM in which it is to be installed. + +Before proceeding with the installation we need to disable Windows mechanism that allows only signed drivers to be installed, because currently (beta releases) the drivers we provide as part of the Windows Tools are not digitally signed with a publicly recognizable certificate. To do that: + +- Start command prompt as Administrator, i.e. right click on the Command Prompt icon (All Programs -> Accessories) and choose "Run as administrator" +- In the command prompt type `bcdedit /set testsigning on` +- Reboot your Windows VM + +In the future this step will not be necessary anymore, because we will sign our drivers with a publicly verifiable certificate. However, it should be noted that even now, the fact that those drivers are not digitally signed, this doesn't affect security of the Windows VM in 'any' way. This is because the actual installation ISO (the `qubes-windows-tools-*.iso` file) is distributed as a signed RPM package and its signature is verified by the `qubes-dom0-update` utility once it's being installed in Dom0. The only downside of those drivers not being signed is the inconvenience to the user that he or she must disable the signature enforcement policy before installing the tools. + +To install the Qubes Windows Tools in a Windows VM one should start the VM passing the additional option `--install-windows-tools`: + +~~~ +qvm-start lab-win7 --install-windows-tools +~~~ + +Once the Windows VM boots, a CDROM should appear in the 'My Computer' menu (typically as `D:`) with a setup program in its main directory. + +After successful installation, the Windows VM must be shut down and started again, possibly a couple of times. + +Qubes will automatically detect the tools has been installed in the VM and will set appropriate properties for the VM, such as `qrexec_installed`, `guiagent_installed`, and `default_user`. This can be verified (but is not required) using qvm-prefs command: + +~~~ +qvm-prefs +~~~ + +NOTE: it is recommended to increase the default value of Windows VM's `qrexec_timeout` property from 60 (seconds) to, for example, 300. During one of the first reboots after Windows Tools installation Windows user profiles are moved onto the private VM's virtual disk (private.img) and this operation can take some time. Moving profiles is performed in an early boot phase when qrexec is not yet running, so timeout may occur with the default value. To change the property use this command in dom0: + +~~~ +qvm-prefs qrexec_timeout 300 +~~~ + +Xen PV drivers and Qubes Windows Tools +-------------------------------------- + +Installing Xen's PV drivers in the VM will lower its resources usage when using network and/or I/O intensive applications, but *may* come at the price of system stability (although Xen's PV drivers on a Win7 VM are usually very stable). There are two ways of installing the drivers: + +1. installing the drivers independently, from Xen's [official site](https://www.xenproject.org/developers/teams/windows-pv-drivers.html) +2. installing Qubes Windows Tools (QWT), which bundles Xen's PV drivers. + +Notes about using Xen's VBD (storage) PV driver: +- **Windows 7:** installing the driver requires a fully updated VM or else you'll likely get a BSOD and a VM in a difficult to fix state. Updating Windows takes *hours* and for casual usage there isn't much of a performance between the disk PV driver and the default one; so there is likely no need to go through the lengthy Windows Update process if your VM doesn't have access to untrusted networks and if you don't use I/O intensive apps. If you plan to update your newly installed Windows VM it is recommended that you do so *before* installing Qubes Windows Tools (QWT). If QWT are installed, you should temporarily re-enable the standard VGA adapter in Windows and disable Qubes' (see the section above). +- the option to install the storage PV driver is disabled by default in Qubes Windows Tools +- in case you already had QWT installed without the storage PV driver and you then updated the VM, you may then install the driver from Xen's site (xenvbd.tar). + +**Caution:** Installing the version 9.0.0 Xen drivers on Windows 7 (a system without QWT - QWT uninstalled) leads to an unbootable system. The drivers install without error, but after reboot, the system aborts the reboot saying `Missing driver xenbus.sys`. + +- **Windows 10:** The version 9.0.0 Xen drivers have to be installed before installing Qubes Windows Tools. Installing them on a system with QWT installed is likely to produce a system which crashes or has the tools in a non-functional state. Even if the tools were installed and then removed before installing the Xen drivers, they probably will not work as expected. + + +With Qubes Windows Tools installed the early graphical console provided in debugging mode isn't needed anymore since Qubes' display driver will be used instead of the default VGA driver: + +~~~ +qvm-prefs -s win7new debug false +~~~ + + +Using Windows AppVMs in seamless mode +------------------------------------- + +> **Note:** This feature is only available for Windows 7 + +Once you start a Windows-based AppVM with Qubes Tools installed, you can easily start individual applications from the VM (note the `-a` switch used here, which will auto-start the VM if it is not running): + +~~~ +qvm-run -a my-win7-appvm explorer.exe +~~~ + +![windows-seamless-4.png](/attachment/wiki/WindowsAppVms/windows-seamless-4.png) ![windows-seamless-1.png](/attachment/wiki/WindowsAppVms/windows-seamless-1.png) + +Also, the inter-VM services work as usual -- e.g. to request opening a document or URL in the Windows AppVM from another VM: + +~~~ +[user@work ~]$ qvm-open-in-vm work-win7 roadmap.pptx +~~~ + +~~~ +[user@work ~]$ qvm-open-in-vm work-win7 https://invisiblethingslab.com +~~~ + +... just like in the case of Linux AppVMs. Of course all those operations are governed by central policy engine running in Dom0 -- if the policy doesn't contain explicit rules for the source and/or target AppVM, the user will be asked whether to allow or deny the operation. + +Inter-VM file copy and clipboard works for Windows AppVMs the same way as for Linux AppVM (except that we don't provide a command line wrapper, `qvm-copy-to-vm` in Windows VMs) -- to copy files from Windows AppVMs just right-click on the file in Explorer, and choose: Send To-\> Other AppVM. + +To simulate CTRL-ALT-DELETE in the HVM (SAS, Secure Attention Sequence), press Ctrl-Alt-Home while having any window of this VM in the foreground. + +![windows-seamless-7.png](/attachment/wiki/WindowsAppVms/windows-seamless-7.png) + +Changing between seamless and full desktop mode +----------------------------------------------- + +You can switch between seamless and "full desktop" mode for Windows HVMs in their settings in Qubes Manager. The latter is the default. + +Using template-based Windows AppVMs +----------------------------------- + +Qubes allows HVM VMs to share a common root filesystem from a select Template VM, just as for Linux AppVMs. This mode is not limited to Windows AppVMs, and can be used for any HVM (e.g. FreeBSD running in a HVM). + +In order to create a HVM TemplateVM one can use the following command, suitably adapted: + +~~~ +qvm-create --class TemplateVM win-template --property virt_mode=HVM --property kernel='' -l green +~~~ + +... , set memory as appropriate, and install Windows OS (or other OS) into this template the same way as you would install it into a normal HVM -- please see instructions on [this page](https://www.qubes-os.org/doc/hvm-create/). + +If you use this Template as it is, then any HVMs that use it will effectively be DisposableVMs - the User directory will be wiped when the HVN is closed down. + +If you want to retain the User directory between reboots, then it would make sense to store the `C:\Users` directory on the 2nd disk which is automatically exposed by Qubes to all HVMs. +This 2nd disk is backed by the `private.img` file in the AppVMs' and is not reset upon AppVMs reboot, so the user's directories and profiles would survive the AppVMs reboot, unlike the "root" filesystem which will be reverted to the "golden image" from the Template VM automatically. +To facilitate such separation of user profiles, Qubes Windows Tools provide an option to automatically move `C:\Users` directory to the 2nd disk backed by `private.img`. +It's a selectable feature of the installer, enabled by default, but working only for Windows 7. +If that feature is selected during installation, completion of the process requires two reboots: + +- The private disk is initialized and formatted on the first reboot after tools installation. It can't be done **during** the installation because Xen mass storage drivers are not yet active. +- User profiles are moved to the private disk on the next reboot after the private disk is initialized. +Reboot is required because the "mover utility" runs very early in the boot process so OS can't yet lock any files in there. +This can take some time depending on the profiles' size and because the GUI agent is not yet active dom0/Qubes Manager may complain that the AppVM failed to boot. +That's a false alarm (you can increase AppVM's default boot timeout using `qvm-prefs`), the VM should appear "green" in Qubes Manager shortly after. + +For Windows 10, the user directories have to be moved manually, because the automatic transfer during QWT installation is bound to crash due to undocumented new features of NTFS, and a system having the directory `users`on another disk than `C:` will break on Windows update. So the following steps should be taken: + +- The Windows disk manager may be used to add the private volume as disk `D:`, and you may, using the documented Windows operations, move the user directories `C:\users\\Documents` to this new disk, allowing depending AppVMs to have their own private volumes. Moving the hidden application directories `AppData`, however, is likely to invite trouble - the same trouble that occurs if, during QWT installation, the option `Move user profiles` is selected. + +- Configuration data like those stored in directories like `AppData` still remain in the TemplateVM, such that their changes are lost each time the AppVM shuts down. In order to make permanent changes to these configuration data, they have to be changed in the TemplateVM, meaning that applications have to be started there, which violates and perhaps even endangers the security of the TemplateVM. Such changes should be done only if absolutely necessary and with great care. It is a good idea to test them first in a cloned TemplateVM before applying them in the production VM. + +It also makes sense to disable Automatic Updates for all the template-based AppVMs -- of course this should be done in the Template VM, not in individual AppVMs, because the system-wide settings are stored in the root filesystem (which holds the system-wide registry hives). Then, periodically check for updates in the Template VM and the changes will be carried over to any child AppVMs. + +Once the template has been created and installed it is easy to create AppVMs based on it: + +~~~ +qvm-create --property virt_mode=hvm --template --label