Some Notes on the Machines

Here is a reset procedure.

net stop wuauserv
cd %systemroot%\SoftwareDistribution
ren Download Download.old
net start wuauserv
net stop bits
net start bits
net stop cryptsvc
cd %systemroot%\system32
ren catroot2 catroot2old
net start cryptsvc

The Beard (alias Hunsinger the Mike) reported just now:

I may have just found a heck of a trick. If you run across PC’s who are getting spotty GPO adherence, and possibly unreliable network connection, as well as their network explorer folder in windows only shows a handful of the actual PC’s on the lan. Try this powershell command:

PS U:\> set-service -Name fdPHost -startuptype Automatic
PS U:\> Start-service -name fdPHost

The above fixed a very longstanding unpleasantry we had been working on, where Network Neighborhood would not show up and other items just would not work normally over a VPN. Oddly, it turns out that fdPHost is some sort of omnibus networking control service, set to Manual by default, but which lords it over several different sets of protocols.

It’s probably not to be enabled generally or lightly, there could be potential for major addition of network traffic, and security questions too. But on the other hand, it’s there, it’s normally Manual not disabled, and it fixed!

Mike later found a companion service, FDResPub, which reportedly is responsible for broadcasting the presence of network resources, by a Windows machine serving them to its LAN. Although it too is by default set to Manual, a reference gives its description as “Publishes your computer and resources attached to your computer so they can be discovered over the network. If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network.” And it stops sometimes with no known reasons, even on domain controllers. So this one too, at least on real servers, is a help if kept set Automatic.

FSUTIL is a general-purpose NTFS tweak tool. Here is a set of changes which appears to be helpful in general towards performance:

fsutil 8dot3name set 1
fsutil behavior set memoryusage 2
fsutil behavior set disablelastaccess 1
fsutil resource setavailable C:\
fsutil resource setlog shrink 10 C:\

In order:

• Turns off 8dot3name creation. Does not invalidate existing 8dot3names.
• Increases RAM cache devoted to NTFS.
• Turns off “last access” timestamp storage for files. Disindicated for some older backup systems.
• Makes the filesystem more focussed on “availability” and less on “consistency”.

And here are some which increase reliability:

fsutil repair set C: 0x01
fsutil resource setautoreset true C:\
fsutil resource setconsistent C:\

In order again:

• Turns autorepair on for C: drive.
• Cleans transactional metadata on next mount
• Makes the filesystem more focussed on “consistency” and less on “availability”.

Do be aware that “resource setavailable” and “resource setconsistent” are opposites, both do not get set at the same time :-) Also neither of them appear to be valid on system volumes, errors are thrown.

Here is one set which seems to balance reliability and performance boost:

fsutil 8dot3name set 1
fsutil behavior set memoryusage 2
fsutil behavior set disablelastaccess 1
fsutil repair set C: 0x01
fsutil resource setautoreset true C:\
fsutil resource setconsistent C:\
fsutil resource setlog shrink 10 C:\

Another from Matt the Quick:

By default, WSUS does not have .NET 3.5 available to install. This creates issues when .NET 3.5 is needed after a machine has joined the domain. Below is the workaround steps to install .NET 3.5 using the operating system ISO and not Windows Update or WSUS.

• Mount the ISO of the operating system. The Server 2016 ISO is known to work for this.
• Open an Administrative Command Prompt and run the following command:
  
  dism /online /enable-feature /featurename:netfx3 /all /source:D:\sources\sxs /limitaccess
  
  NOTE: The Source flag will have to be changed to reflect the Sources\sxs folder on your installation media. This is likely going to be the D drive (as in the example above), but it’s possible your results may differ slightly.
• Reboot machine.

From the indefatigable Matt Quick:

Sometimes, trying to install .NET 3.5 either via Add/Remove Programs or via the standalone offline installer produces an error code. This is due to WSUS not having the files for .NET 3.5. Use the following workaround to avoid taking the machine off the domain, installing .NET 3.5, then putting it back on the domain:

This worked for me. Windows has to download the 3.5 installation files, but the server is configured not to use Windows Update (common for managed servers), but WSUS. The above article describes how to fix this. In a nutshell:

1. Start the Local Group Policy Editor or Group Policy Management Console.
2. Expand Computer Configuration, expand Administrative Templates, and then select System.
3. Open the Specify settings for optional component installation and component repairGroup Policy setting, and then select Enabled.
4. Select the Contact Windows Update directly to download repair content instead of Windows Server Update Services (WSUS) check box.

Make sure Windows Updates Service is set to Manual or Automatic to apply this fix.

When certain antivirus products go a bit haywire, or other unfortunate things happen, hundreds of thousands of small files can pile up in either the location in the title of this article, or here:

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

The location in the title seems to be more common in Windows 10, the other more for Windows 7, but check both, and if you have a pileup in either, run this CMD command inside:

forfiles /D -10 /C "cmd /C attrib -s @file & echo @file & del @file"

forfiles is a very nice command that iterates through the files in a folder according to its parameters. /D -10 iterates through all files more than 10 days old. attrib -s takes off the System attribute, which is needed for DEL (delete) to work. The echo is there so you can see that it is doing its job.

An elegant solution from here:

https://social.technet.microsoft.com/Forums/systemcenter/en-US/e266d1eb-81ca-4084-8b3b-70f7c6904047/problem-with-inetresadmx?forum=winserverGP

Just go here:

https://www.microsoft.com/en-us/download/details.aspx?id=6243

and download the current versions of all of the templates (the above is for 2008R2, here’s to hoping Microsoft makes them available for all server versions), and replace them.

Here’s the command:

wmic useraccount where name='olduser' rename newuser

“olduser” is the old username, “newuser” is the new.

Here’s a regedit to disable:

Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f

and here’s an msiexec remover, quiet; not sure if this still works:

msiexec /uninstall windowsdefender.msi /quiet /log uninstall.log

In Vista or Windows 7, there is a built-in command, “MKLINK”. Here’s a good reference, suggested by Matt Quick:

http://www.howtogeek.com/howto/windows-vista/using-symlinks-in-windows-vista/

For a long while they were called “junctions”. In Server 2000, Server 2003, or XP, you’ll need this:

http://technet.microsoft.com/en-us/sysinternals/bb896768

The syntax is a bit different for each. And Windows does not support these “junctions” to directories on remote shares. But this can help a lot, for instance, when moving something like a profile folder from local drive to local drive. They are set up at the NTFS filesystem level, just like Unix/Linux.

A great example of usage, is moving a profile folder. It works like this:

1. Create a new user, local if it’s not a DC.
2. Reboot the server/PC, to unlock profile files and folders.
3. Log in as the new user.
4. Create a new folder for the profile to be moved.
5. Robocopy the old profile folder’s contents to the new. Make sure you get everything hidden!
6. Rename the old folder as backup, and create a junction from the new folder to the old folder’s container.
7. Log in as the new user and test.