Some Notes on the Machines

Found by the profound Brigg Bush:

$writers = vssadmin list writers | 
    Select-String -Context 0,4 'Writer name:' | 
    ? {$_.Context.PostContext[2].Trim() -ne "Last error: No error"} | 
    Select Line | 
    % {$_.Line.tostring().Split("'")[1]}



 $ServiceNames = $writers | 
    ForEach-Object {
        switch ($_) {
            'ASR Writer' { $Result = 'VSS' }
            'Bits Writer' { $Result = 'BITS'}
             'Certificate Authority' { $Result = 'EventSystem'}
            'COM+ REGDB Writer' { $Result = 'VSS'}
            'DFS Replication service writer' { $Result = 'DFSR'}
            'Dhcp Jet Writer' { $Result = 'DHCPServer'}
            'FRS Writer' { $Result = 'NtFrs' }
            'IIS Config Writer' { $Result = 'AppHostSvc'}
            'IIS Metabase Writer' { $Result = 'IISADMIN'}
            'Microsoft Exchange Writer' { $Result = 'MSExchangeIS'}
            'Microsoft Hyper-V VSS Writer' { $Result = 'vmms'}
            'MS Search Service Writer' { $Result = 'EventSystem'}
            'NPS VSS Writer' { $Result = 'EventSystem'}
            'NTDS' { 'EventSystem'}
            'OSearch VSS Writer' { $Result = 'OSearch'}
            'OSearch14 VSS Writer' { $Result = 'OSearch14'}
            'Registry Writer' { $Result = 'VSS'}
            'Shadow Copy Optimization Writer' { $Result = 'VSS'}
            'Sharepoint Services Writer' { $Result = 'SPWriter'}
            'SPSearch VSS Writer' { $Result = 'SPSearch'}
            'SPSearch4 VSS Writer' { $Result = 'SPSearch4'}
            'SqlServerWriter' { $Result = 'SQLWriter'}
            'System Writer' { $Result = 'CryptSvc'}
            'WMI Writer' { $Result = 'Winmgmt'}
            'TermServLicensing' { $Result = 'TermServLicensing'}
        }
        $result
    }

If ($ServiceNames) { Restart-Service -Name ($ServiceNames | Select-Object -Unique) -WhatIf }

If ($Result) { Restart-Service -Name ($ServiceNames | Select-Object -Unique) -WhatIf }

This is a great way to get things removed where nothing else works.

learn.microsoft.com/en-us/sysinternals/downloads/pendmoves

Often, the QuickBooks desktop installer will not accept the serial number and/or product number, the fields are too short. QB support pages advise changing font scaling, but often this does not help. The best workaround so far, has been to copy the serial and product numbers to Notepad, then paste them in all at once, rather than trying to type them in directly.

The most reliable way I had for a long time, was using a scheduled task. But Powershell for this changes from Windows version to Windows version. Here’s a new method, it uses the time specification in the ‘shutdown’ command, to reboot the machine tomorrow at 3AM:

$tomorrow3AM = (Get-Date).AddHours(24)
$tomorrow3AM = $tomorrow3AM.AddHours( ($tomorrow3AM.Hour * -1) + 3 )
$tomorrow3AM = $tomorrow3AM.AddMinutes( $tomorrow3AM.Minute * -1 )
$tomorrow3AM = $tomorrow3AM.AddSeconds( $tomorrow3AM.Second * -1 )
$tomorrow3AM = $tomorrow3AM.AddMilliseconds( $tomorrow3AM.Millisecond * -1 )
$SecondsFromNow = ($tomorrow3AM - (Get-Date)).TotalSeconds
shutdown -f -r -t ([int] $SecondsFromNow)

Remember that huge text file with all of the DHCP reservations, load average, and everything else? Well, go to:

-Monitor -> Devices
-Choose a firewall
-Go to Live Status -> Diagnostic Tools
-Choose the Snapshot tab.
-Click to download a snapshot file.

Then, in that file:

Fireware_support.tgz\
Fireware_support.tar\
Fireware_XTM_Support.tgz\
Fireware_XTM_Support.tar\
support\system\system_status.txt

Sometimes, when one logs into https://portal.office.com, the link/button for downloading is not present at the upper-right corner. One thing to try is this, right after login:

https://portal.office.com/account/?ref=MeControl

If that doesn’t get you to downloads, try these steps:

Click on ID ball at the upper right to pull down menu
Click on View Account
Click on Subscriptions at lower left
Click on Apps & devices near lower left

Recently it was discovered that a Windows server was running very slow because the Security log’s maximum size was set to 40 gigabytes. Here is a Powershell bit which will look at all event logs, set their max size to 2.5M if set larger, and clear them. Seems to free up a nice healthy dollop of performance in general.

wevtutil el | Foreach-Object {
	$LogObject = Get-WinEvent -ListLog $_
	If ( $LogObject.MaximumSizeInBytes -gt 2500KB ) {
		"$_ has max set to larger than 2.5M.  Setting to 2.5M."
		$LogObject.MaximumSizeInBytes = 2500KB
		$LogObject.SaveChanges()
		}
	wevtutil cl $_
	"$_ cleared."
}

There are times when an operation, a software install or configure perhaps, will error with “Cannot open log for source ———-. You may not have write access.” The below will do the above, and also give read/write to every local admin.

wevtutil el | Foreach-Object {
	wevtutil sl $_ "/ca:O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)(A;;0x3;;;LA)"
	$LogObject = Get-WinEvent -ListLog $_
	If ( $LogObject.MaximumSizeInBytes -gt 2500KB ) {
		"$_ has max set to larger than 2.5M.  Setting to 2.5M."
		$LogObject.MaximumSizeInBytes = 2500KB
		$LogObject.SaveChanges()
		}
	wevtutil cl $_
	"$_ cleared."
}

The security string is written in something called SDDL. Some more info:

https://itconnect.uw.edu/wares/msinf/other-help/understanding-sddl-syntax/

There have been many live CDs out there which have utilities to reset passwords on Windows. Unfortunately, many of them are long out of date and won’t work (or will do odd things) on recent hardware, and recent operating systems. This one:

https://www.supergrubdisk.org/rescatux/

was proven on 2022-12-21 to do well with the latest build of Windows 10.

SpaceSniffer is free of charge (donations encouraged), highly recommended, very very fast, orders of magnitude faster than WinDirStat, and works on drives, folders, and UNC paths. Not fancy, but oh so fast & functional.

Look for an app called Sweech. Put your phone on the same network as your desktop. Run it. It brings up a screen, tap the middle (go/play) symbol. You get a URL on the LAN you’re on. If you put that URL in a browser, you can pull off anything you want. Don’t look for security in this one, but it sure is handy.