Fix: Windows 8.1/10 Black Screen with Cursor at boot

After upgrading my home laptop systems to Win 10 I began to notice a trend; every couple of times I tried booting the system I would be presented with a black screen and a blinking cursor…but no Windows 10 load.

Fortunately, powering the system off and then back on would allow the Win 10 OS to load OK.

It was an annoyance and signal that something was wrong, but nothing that this workaround wouldn’t address.

Then we upgraded our laptops at work to Windows 10 and started noticing the same behavior.

And our Surface Pro 3 users also occasionally complained about similar behavior.

After careful troubleshooting and searching the Internet, I fixed this particular problem on all our platforms by disabling “Fast Startup” in the power settings.

I’m not 100% why it seems to impact mobile platforms rather than desktops, but I suspect the fact that it involves loading the system from a specially saved/crafted “Fast Startup” hibernation state, if some hardware gets removed or not-detected between power-states – for example USB devices or the dock-station - it might cause the wake-up process to hang.

To fix this particular problem first go into the “classic” Control Panel for Windows, and into the Power Options applet.

On the left-hand side, select “Choose what the power button does”

Near the top of the loaded page to the right, select the “Change settings that are currently unavailable”  (note you may have to confirm a UAC prompt and provide admin-level credentials).

Once you do that, more options will appear below.

Uncheck the “Turn on fast startup (recommended)” checkbox.

Select “Save changes”.

That fixed my laptop issues at home, and by pushing this out to our systems as a standard configuration setting, it fixed the issues at work too.

More technical resources:

• Windows 10 Black Screen with Cursor [SOLVED] - Driver Easy
• How to disable Windows 10 fast startup (and why you'd want to) - Windows Central
• The Pros and Cons of Windows 10’s “Fast Startup” Mode – The How To Geek
• How to Shut Down Windows 10 Properly: Fast Start-up Explained - Tech Advisor
• How to disable Fast startup in Windows 10 OS – Official Support | ASUS USA
• Distinguishing Fast Startup from Wake-from-Hibernation - Microsoft Docs
• What Is Windows 10 Fast Startup And How to Disable It – Petri
• Turn On or Off Fast Startup in Windows 10 | Tutorials – Windows Ten Forums
• Group Policy Preferences - 1. Deploying Registry Settings - The Sysadmins

Cheers!

--Claus V.

Win 10 Laptop Storage Space-Drain Solved!

A lifetime ago (back in July) I was struggling to understand why my Win 10 workplace laptop’s hard-drive was running out of storage space.

grand stream dreams: QuickPost: PowerShell Scripts and Win 10 Helps

Despite my best efforts the 500 GB HDD had gotten down to about 60 GB – 80 GB of free space despite some pretty severe Windows space-hog/temp-file cleaning work.

That post detailed a number of PowerShell scripts I was using to try to find out the source of the space usage.

Reminder – because this was a work-laptop, my use of the normal third-party storage analysis tools I would rely on was verboten.

After several weeks of running modified versions of many of these scripts I was nowhere closer to finding the issue. I had lots of data, but the results suggested that the file or folder where the space eating usage had happened was off-limits to typical admin-level scripting runs.

Just before giving up and planning for a system reimage, I had an epiphany; Windows 10 comes with a built-in Storage Sense platform to let you understand (at a very high-level) space usage of your local drives in a categorized manner!

How to manage Disk Space & Storage using Windows 10 Settings – The Windows Club

Go into Settings (the gear icon in Win 10), select “System”, on the left side-bar select “Storage”, then click on one of the local system drives at the top you want to explore under the “Storage” section.

Let it run for a moment and it will then give you a report of storage use.

In my case it was immediately apparent that the “System & reserved” section was where the maximum file-usage was occurring; way more than a baseline Win 10 laptop in our enterprise.

You can click on any section and dive deeper into that.

That revealed that I had over 250 GB of files related to “System Restore”.

This was an interesting find as our Group Policy turns off System Restore. A visual check of all the options and settings under “Manage system restore” confirmed these were all disabled…so what was there and how did it get there?

VSSAdmin to the rescue!

I opened an administrator-elevated CMD window and ran the following command:

vssadmin list shadows

That revealed one “orphaned” shadow copy file created quite some time before I actually noticed the space drain.  A check of our operations logs for that timeframe couldn’t find any obvious actions or infrastructure routines that should have created it. So how it was triggered remains a mystery.

With the shadow copy ID known now I next ran this, using the actual ID # I found for that argument variable:

vssadmin delete shadows /Shadow={shadow copy ID}

It ran for quite a while, but then returned back to the blinking prompt cursor.

Another “vssadmin list shadows” confirmed it was gone, and a look at the local drive properties showed my space usage was back to a normal level with lots of free space available again.

Mischief managed!

More resources:

• Windows 10 Storage and how to view disk space and how it is used (YouTube) – Learn Windows 10 and Computers
• Vssadmin - Microsoft Docs
• VSSADMIN - Windows CMD - SS64.com
• Shadow Copies – Delete - Windows 7 Help Forums
• How to Delete Individual System Restore Points in Windows? – WinHelp Online
• Diskshadow, VSSAdmin’s best friend - danblee.com
• SysAdmin Tools – EventSentry – This free collection of command-line and GUI tools is offered by EventSentry. Its got a big collection of specialized utilities that well-supplements the on-board tools. While I couldn’t have used them at work, the “datahog” cmd tool looked especially handy and cool.

Cheers!

Claus V.

QuickPost: Removing Trend Micro Worry-Free Business Security Agent without the password

Not too long ago one of the ministry departments of the church-house needed a computer set up in their room to help manage things.

We had an older Dell laptop that was a beater, but was a business class device that still retained more than adequate performance.

It took me the better part of a weekend to bring the Win 7 Pro OS back up to a fully patched and updated state and clean a lot of older/abandoned applications off.

One of my last tasks was to remove the long-expired Trend Micro Worry-Free Business Security Agent off the system.

Before the uninstaller can complete, you must provide an administrator-set password (as a security feature).  Unfortunately, the admin who set it had long-since left the congregation and no documentation was left as to what it could be.

Bother.

Luckily, PowerBiz Solutions “down-under” had a promising tip:

How to uninstall Trend Micro’s Worry Free Business Security client agent without the password - PowerBiz Solutions

Note: The referenced link back to Trend Micro’s solutions page is now “404” but PowerBiz’s post provided a good start: (Update: Archived Trend Mircro solutions page via Wayback Machine – hat-tip to TinyApps bloggist!)

Basically, it involves setting the registry key “Allow Uninstall” to 1.
For WFBS versions 5.x and 6.x, this key is located here – HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
For WFBS versions 7.x, this key can be found here – HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\UniClient\1600\Misc

In my particular case, the version appeared to be 7.x.

A quick look in the Registry found the “AllowUninstall” key.

…which I then changed to the needed “1” value.

Once set, I was then able to go back and run the uninstaller without any password prompt.

Success and done!

I then followed it up with a Microsoft Security Essentials installation that went on without issue and will provide sufficient real-time protection and current signature updates for AV/AM protection.

Cheers!

--Claus V.

QuickPost: PowerShell Scripts and Win 10 Helps

Since having a system migrated to Windows 10, I’ve noticed a trend of the hard-drive getting significantly fuller now.  I’ve done all the standard post-migration cleanups. I cleared over 40 GB of old software packages off the system and was feeling pretty good.  The next day all my space-gains were lost and I was back at 100 GB of free space where I started.

I suspect there is some caching activity going on in the background and that it running off a quota that keeps me returning to the magical 100 GB free of a 500 GB drive.

Normally, I’d just run one of these tools to identify the space/file hogs and start cleaning up. I’ve ordered these in my general preference; though I like them all for slightly different things they bring to the table on a space-hunt.

• SpaceSniffer – freeware – Uderzo Software
• TreeSize Free – freeware – JAM Software
• WizTree – freeware – Antibody Software
• Folder Size – freeware – MindGems
• SequoiaView – freeware – Technische Universiteit Eindhoven
• WinDirStat - Windows Directory Statistics – open source
• Disk Usage - Windows Sysinternals

However in this case I cannot use any third-party tools and must stick with using Microsoft OS-based solutions only.

So that led me to find a script I could use in PowerShell.

I’ve divided them into file-size analyzers and folder-size analyzers.

I found it is relatively easy to hunt down singular files on your system in PowerShell that are the largest. However, what happens if you have a bunch-load of very small files? Individually they may never float to the top, however in aggregate, they could add up to a lot of space usage.

I’ve listed these as well in my order of preference.

Note: They all seemed to run fine on my Win 10 systems in PowerShell ISE – though tweaking was needed for each one to target specific folders and/or report outputs – depending on the script.

PowerShell File-Hog Hunters

• Find Largest (Or Smallest) Files In A Directory Or Drive With PowerShell - Daniel Schroeder's (aka deadlydog) Programming Blog
  
  Daniel’s script is totally brilliant. Not only is it a “one-liner” but it generates a beautiful table for output that can be sorted by column and filtered by criteria.  I did note that the calculated file-size value didn’t seem to be accurate but haven’t figured out why that was. Daniel also has some tips in the comments and a link to this page in case you want to modify the script from a file-size hunt to a folder-size hunt.
  
  
• How to make a report of largest files on a file share – Michael (Netwrix) on Spiceworks – This was nice because it generated a very sweet CSV file to be opened in Excel.
  
  
• Script to list files by type and size, export to Excel - Adam Dimech's Coding Blog – Another nice script that exports to a designated CSV file.
  
  
• Use PowerShell to Explore Disk Utilization on Your Computer – Hey, Scripting Guy! Blog – Not only is this a very handy script, the Scripting Guy walks you through what the script actually does.
  
  
• Find top 10 large files in a disk - VBScript and Powershell Scripts: Powershell bog. Simple.
  
  
• PowerShell Script: Find the 25 largest files and list folder sizes for any drive - RobWillis.info – This one is much more advanced and outputs a lot of information to the console for the report.  It can also generate output to a TXT file. Definitely cool stuff.
  
  
• Powershell Script List Top 50 Largest Files – This is another very simple script but does the job. The comments have a few tweaks you can add to output to a file or change size to MB.
  
  
• Script Get-LargestFiles - What's the biggest space hogs on my disk? – This one is also pretty helpful.

PowerShell Folder-Hog Hunters

• TechNet Disk Usage Analyser – simulates the Sysinternals Disk Usage tool.
  
  
• How to find biggest folders (by number of files) in Windows - Super User
  
  
• Getting Directory Sizes in PowerShell – Hey, Scripting Guy! Blog. Spend some time in the comments for additional tweaks to the script.

If you do export output to CSV and don’t “pre-format” the bytes output to MB, here is a tip on a custom formatting rule in Excel you can use to make it more readable.

formatting - How can I format bytes a cell in Excel as KB, MB, GB etc? - Stack Overflow

I’ve not loaded Ubuntu on Windows to have a Bash console, but in looking for tools, I came across this that looked pretty neat: ncdu: Identify Large Files on Windows 10 - Trevor Sullivan

Finally, on Win 7 I used a pretty small set of common keyboard shortcut to navigate my way around the system.  In Windows 10, I’m finding a desire to expand my quick-access key combo skills. Here are some good resources:

• Download Shortcut keys for Windows 10 - Official Microsoft Download Center
• Windows Shortcuts 101/ The Ultimate Keyboard Shortcut Guide – (direct PDF file link) – MakeUseOf blog
• Complete List of Windows 10 Keyboard Shortcuts and Run Commands – gPost
• Windows 10 end user readiness – Microsoft guides, tutorials, and other resources.
• New tools to help drive Windows 10 adoption – Microsoft guides, tutorials, and other resources. For readiness and user communications, technical references and documentation, and post-deployment support helps.
• Note: at the bottom of that page there is a tiny link to download the full suite of Windows 10 deployment resources. (ZIP)

If I’ve missed a useful script or you have any tips for hunting for space/file hogs using only “on-board” native Windows 10 OS tools, please drop a comment!

I expect I’ll be adding to the list of links in this post too as I uncover more PowerShell scripts that could be useful. As I post this, I think I am overlooking one or two others that I found useful

Cheers!

--Claus V.

Valca Windows KeyFinder Utilities

Last night I was culling my collection of Windows key-finding utilities.  There were some that had gone “404” and others that didn’t seem stable (or effectively work at all) on newer Windows 7/10 systems.

Many were collected back in the days of Windows XP so I decided to pick through them and dump the oldest ones and add some new ones.

This morning I saw that the TinyApps.org bloggist was hard at work on his own list!

• Recover Windows product key from BIOS / UEFI – TinyApps.org blog

Possibly we are being confronted with similar troublehsooting and service issues?

Here is my list and there are some similarities (as presented in semi-alphabetical order).

Some of these recover more than just the Windows OS key.

Some have not been updated in a while and may not work effectively on Win 7/8/8.1/10.

• Jalapeño License Keyfinder
• LicenseCrawler - Martin Klinzmann
• Magical Jelly Bean – Note I don’t use this one as often as it typically makes anti-virus software go nuts as a PUP.
• ProduKey – NirSoft
• Product Key Finder - Dave Hope
• recALL
• RockXP – Korben - Note I also don’t use this one as often as it typically makes anti-virus software go nuts as a PUP.
• RWEverything - Read & Write Everything
• ShowKeyPlus - GitHub
• SterJo Key Finder
• Win Keyfinder 2.0 / 1.75
• Windows Key Finder – Lazesoft
• Windows OEM Product Key Tool - NeoSmart Technologies
• Windows Product Key Viewer – RJL Software

Then there is there is the manual method using CMD or PowerShell for most Win 10 / 8 / 8.1 systems.

• Use Command Prompt or PowerShell to find Windows Product Key - Microsoft Windows Mini-Guides – BleepingComputer

I tend to prefer ProduKey, ShowKeyPlus, and Windows OEM Product Key Tool as my primary tools.

Cheers,

Claus Valca

Lenovo Y50 Hard Drive Replacement and Windows 10

About a month ago I was asked by a family at the church-house if I could give them some advice about their son’s two-year-old Lenovo Y50 laptop.

Apparently the hard-drive had failed and time was short before he headed off to college out of state.

They had purchased a new 1 TB Western Digital laptop drive similar to the one in it but despite good effort had been unable to get Windows 10 reloaded on the device. They suspected more was wrong with the system and wanted to confirm before picking up a new laptop before he shipped out.  Basically, they said the BIOS detected the HDD but they could not get Windows 10 reloaded on the laptop.

I asked them to let me look at the system along with the bits and pieces and then I would let them know.

So, armed with my various troubleshooting tool kits and USB sticks I sat down in our sound-booth with it and ran a quick assessment.

I’m more of a Dell-guy and hadn’t had much experience with the Lenovo line. As such, getting into the BIOS took a bit of research.

The trick was something called the “NOVO” button.

• How to Enter the Lenovo Y50 BIOS – Gearhack.com Forums
• Introduction to NOVO button - Idea laptops - Lenovo Support (US)assessment
• How to enter BIOS setup from Windows 10 System - Idea Notebooks/Desktops - Lenovo Support (US)
• Lenovo BIOS Key – InfraLib – nice list of all the ways (as of 2015) to get into BIOS on different Lenovo systems.

I booted into the BIOS (on the Y50 using the NOVO button to the immediate left of the power button) and checked a few things.

I was able to confirm the BIOS was picking up the new HDD. 

I look under the boot tab options and saw that it was set to EUFI.

I changed it temporarily to “Legacy” and saved. I needed it that way for the next step to work more smoothly in my troubleshooting assessment. 

I attached one of my custom USB sticks that I can use to boot a system and load/run an OS (Windows/Linux/Whatever) directly from the USB stick and not off the local HDD. 

I then hit the NOVO button again and selected to boot from my USB stick. That allowed me to load a WinPE build and run some commands to…

1. confirm that I could see the new HDD,
2. confirm that it was a 1 TB drive,
3. rebuild the drive partition configuration (MBR type) and make it bootable, and then
4. formatted it as NTFS using DiskPart from a command prompt window.

        1. Diskpart
        2. > select disk 0
        3. > clean
        4. > create partition primary
        5. > active
        6. > assign letter = C
        7. > exit

Followed up by a final

format C: /fs:ntfs /q /y

It worked perfectly. That confirmed the laptop recognized the drive while running under a Windows OS and it was working as expected. Now I needed to get the Win 10 OS loaded on the hard drive.

I shut it down and rebooted it again with the NOVO button. I went back in to the boot options tab and set it back to UEFI, saved the changes and rebooted. 

This time I had swapped USB sticks and now used a Windows 10 Installation Media USB that I had previously built when I was working on my own laptops a while back.

The Win 10 lnstaller loaded and the setup wizard started.

Only I had forgotten that the HDD was still configured as MBR with my pre-testing. 

Win 10 and UEFI BIOS support enabled didn’t like each other and the wizard refused to continue with the installation. So at that point in the installation options I had to just delete the MBR partition I had made so Win 10 could automagically create the partition again as a GPT type which it required. 

It did and then the rest was just watching Win 10 install, reboot a few times, creating a local user account, and dumping on the OS updates. 

Because it had Win 10 on before, it automatically loaded the license key from BIOS storage and activated Win 10 once fully installed and after I connected it to the Internet. 

Done. The Y50 was a sharp looking (and running) laptop and I was impressed during my short service time with it.

Note: I had planned on looking at the failed hard-drive to see if any data could be recovered and ported back over onto the new drive, but they said that wasn’t needed and would just go with a fresh-start. I left it to them to follow up with any remaining software application reinstalls as well.

I didn’t kick off the new Win 10 "Anniversary Edition" build update release since this was to be just a short “assessment” service but told them that it should eventually auto update in a week or so. I also let them know they could force it on early by heading over to this Microsoft site page and following the instructions. 

And I advised them to keep these link handy as well. 

• Windows 10 Anniversary Update common problems and how to fix them - Windows Central
• What’s New in Windows 10’s Anniversary Update – How-To Geek blogassessment

The family didn’t have to shell out for a new laptop and all was well.

Cheers.

Claus Valca

 

Additional reference notes:

• What You Need to Know About Using UEFI Instead of the BIOS – How-To Geek blog
• UEFI (Unified Extensible Firmware Interface) - Install Windows 7 with - Windows 7 Help Forums
• Secure Boot - Enable or Disable in UEFI – Windows 8 Forums
• UEFI/GPT-based hard drive partitions – Microsoft Hardware Dev Center
• What’s the Difference Between GPT and MBR When Partitioning a Drive? -  How-To Geek blog
• Sample: Configure UEFI/GPT-Based Hard Drive Partitions by Using Windows PE and DiskPart – Microsoft TechNet
• Change a Master Boot Record Disk into a GUID Partition Table Disk – Microsoft TechNet
• My laptop is not booting from a bootable USB drive [SOLVED] [Solved] – TomsGuide - Laptop Tech Support Forum
• Booting Dell Venue 10 Pro 5055 from USB device – TinyApps.org
• How To Create Windows 10 Installation Disk Or Bootable USB – Make Use Of blog
• Windows 10 Media Creation Tool – Microsoft Software Download
• UEFI Bootable USB Flash Drive - Create in Windows – WIndows 8 Forums

Windows Service Triggers

I was troubleshooting some issues with WSUS server updating firing off on some Surface Pro tablets the other week.

In doing so, it seemed the root cause was that the Windows Update Service was set to not run full time or Automatically but rather manually and based on service trigger starts.

Hmmm. Time to learn me some facts about Windows service triggers.

• Service Trigger Events (Windows) – Windows Dev Center
• “A service can register to be started or stopped when a trigger event occurs. This eliminates the need for services to start when the system starts, or for services to poll or actively wait for an event; a service can start when it is needed, instead of starting automatically whether or not there is work to do. “
• Windows service trigger start - difference manual vs automatic? - Server Fault
• Windows 7 Trigger Start Service – CodeProject – good article that goes into service triggers even if you don’t need the code tips that are also on the page.
• Using the registry editor to change the service state – Smallvoid.com
• Windows 7 Service Triggers – Anything about IT
• Windows: Remove a trigger from a service (Prevent the DNS Client (dnscache) from stopping) - Michls Tech Blog
• Using SC to manage Service Triggers on Windows 8/2012/7/2008 R2 – Core Technologies Consulting
• Service Trigger Editor - A free utility to manage Service Triggers – Core Technologies Consulting

Now we know!

--Claus Valca

Yep, it broke things…MS16-072 (that’s by design folks!)

 

Let it be said, let it be applied, so be it now broken, so be it now removed.

Thus sayeth the sysadmin.

• Microsoft Security Bulletin MS16-072 – Important – Microsoft Security TechCenter
• Updated - MS16-072 may break your User Group Policies "by-design" – Group Policy Central
• How to fix broken GPO because of MS16-072 – Group Policy Central
• MS16-072 may break Group Policy configurations - gHacks Tech News
• Official Microsoft Guidance for MS16-072 Breaking Security Patch – Group Policy Central
• Deploying Group Policy Security Update MS16-072 \ KB3163622 - Ask the Directory Services Team

Now let’s go fix it…well, you know…

Cheers,

--Claus Valca

Telenet Clients

This week I was working with a network team-member to pilot some changes that will lock our network switches down more tightly.

I’m used to using PuTTY Portable or KiTTY Portable which are simply portable versions of PuTTY and KiTTY and seem hands-down better than Microsoft’s Hyperterminal that got left behind when Windows 7 came out (although it can run just fine on WIn 7 if you copied the snagged binaries over).

However, the network admin I was working with requested we use the terminal Poderosa.

• poderosaproject (Poderosa Project) · GitHub
• Poderosa download - SourceForge.net

Apparently Poderosa has been out for a very long time and I’m just now finding out about it.

What makes it very nice – aside from the beautiful GUI – is the “tabbed” nature of the application so you can have multiple sessions running and organized very similarly to browser tabs.

It felt very natural and easy to use and is pretty light and fully portable.

Like other telnet clients you can change the back color, text color, and font for improved legibility. The buffer size can be adjusted to allow capture of more of the session content, and copy/paste support feels more natural (IMHO).

GSD Bonus:

Don’t forget these great Cisco reference sites:

• Cheat Sheets - PacketLife.net
• CiscoZine
• Basics of Cisco Switch Administration - Part 1 – TechRepublic
• Basics of Cisco Switch Administration - Part 2 – TechRepublic
• Basic Switch Configuration Guide with Examples – ComputerNetworkingNotes.com
• CCNA Study Guide – ComputerNetworkingNotes.com
• Cisco Networking Academy's Introduction to Basic Switching Concepts and Configuration – Cisco

Cheers.

--Claus Valca

Windows “Service Pack”, Slipstreaming, ISO files, misc.

Wow.  Big thanks to Lavie for being patient with me while I hammered out all these blog posts.

I’ve still got quite a lot more, but it has been a very productive – non-productive day off.

• Windows 7 now has a Service Pack 2 (but don’t call it that) - Ars Technica
• Microsoft brings Windows 7 fully up-to-date with new convenience rollup package, simplifies future updates for Win 7 and 8.1 – BetaNews
• Simplifying updates for Windows 7 and 8.1 - Windows for IT Pros
• Microsoft wants to make Windows 7 and 8.1 updating easier - gHacks Tech News
• The Last Windows 7 ISO You’ll Ever Need: How to Slipstream the Convenience Rollup – How-To Geek blog
• How to Update Windows 7 All at Once with Microsoft’s Convenience Rollup – How-To Geek blog
• Slipstream Windows 7 SP1 convenience rollup into a universal x86/x64 installer – Tinyapps.org blog
• Windows ISO Downloader review - gHacks Tech News
• Download Microsoft Security Updates in ISO Format - Next of Windows
• Security updates are available on ISO-9660 DVD5 image files - Microsoft Download Center
• How To Create Unattended Windows 10 USB or ISO – Into Windows
• How To Build A Windows 10-based WinPE USB Bootable Drive - Next of Windows

Cheers!

Claus Valca

Western Digital Encrypted Hard Drive “gotchas”

Good information to know if you use a Western Digital encrypted hard drive. Not breaking news but still good to be familiar with – especially if your organization uses them!

• Western Digital self-encrypting hard drives riddled with security flaws - Ars Technica
• Western Digital self-encrypting hard drives are completely insecure – HelpNet Security News
• Western Digital's hard drive encryption is useless. Totally useless - The Register
• got HW crypto? On the (in)security of a Self-Encrypting Drive series (PDF link - right-click and save file) – Paper by researchers Gunnar Alendal, Christian Kison, modg.
• Western Digital Security – a short story of a known password that doesn’t work – Hexacorn blog
• Windows Slowdown, Investigated and Identified - Random ASCII blog
• Windows Slowdown, Investigated, Identified, and Now Fixed - Random ASCII blog

Wow.

Claus Valca

Wrestling with Outlook Troubleshooting

I’ve found myself working on Outlook (Outlook client, Windows Live Mail, Office 365) issues much more often than usual.

Here is a collection of reference links.

Outlook/Office 365 Troubleshooting Tools

• Office Configuration Analyzer Tool (OffCAT) information – Microsoft Support
  The Microsoft Office Configuration Analyzer Tool (OffCAT) provides a detailed report of your installed Office programs. This report includes many parameters about your Office program configuration. It also highlights known problems that are found when OffCAT scans your computer. For any problems that are listed in the report, you are provided a link to a public-facing article (usually a Microsoft Knowledge Base article) about each problem so that you can read about possible fixes. If you are a Helpdesk professional, you can also save the report to a file so that it can be viewed in the Office Configuration Analyzer Tool on another client on which the tool is installed.
• Download Microsoft Office Configuration Analyzer Tool 2.1 - Microsoft Download Center
• Fix Outlook and Office 365 problems with the Microsoft Support and Recovery Assistant for Office 365 – Microsoft Office
  Support and Recovery Assistant for Office 365 can help you automatically diagnose and fix a range of Outlook problems. You will need to download the application to your local computer, sign in with your work or school account and select the issue you want help with. The application will run a series of diagnostic tests and help you set up a new profile. If any of the tests fails, it will provide suggested solutions to get your problem solved.
• New tool for helping resolve Office 365 issues - Office Blogs
• Fix Outlook account problems in Office 365 - Office 365 Support

Outlook Management Tips

• HOWTO: Find & reenable/reactivate dismissed reminders in Outlook - Kurt Shintaku's Blog
• INFO: Getting rid of Outlook .PSTs on workstations & in your network - Kurt Shintaku's Blog
• Free and easy email migration from Thunderbird to Outlook – Tinyapps.org

WIndows Live Mail

• Windows Live Mail 2012 end of Outlook support - gHacks Tech News
• Windows Live Mail 2012 requires an update to keep using it – Newowin news
• Update required to keep using Windows Live Mail 2012 with Microsoft accounts - Windows Central
• Solved Update for Windows Live Essentials Mail 2012 (KB3093594) kills WLM - Windows 10 Forums
• Windows Live Mail woes continue with re-re-released KB 3093594 – InfoWorld
• [Fix] KB3093594 Update Causing Email Sync Problems to Windows Live Mail 2012 Users - AskVG
• Using Windows Live Mail 2012 with Outlook.com? Time to update your email application! - Office Blogs

Outlook.com/Hotmail.com and Outlook Client

• Outlook 2016 Not Responding–Solved – ThirdTier.net
• Add Outlook.com to Office Outlook - Outlook.com Help
• Use an Outlook.com account in Outlook - Outlook
• Download Outlook Hotmail Connector 32-bit - Microsoft Download Center
• Download Outlook Hotmail Connector 64-bit - Microsoft Download Center
• How to Setup Hotmail in Outlook 2007 using Outlook Connector - KhimHoe.Net
• Using the Outlook Hotmail Connector - PocketPrimer
• Configure Outlook with an Outlook.com (Hotmail), Gmail, Office 365, Yahoo, AOL or iCloud account - HowTo-Outlook
• Setting up an Outlook.com IMAP account – SlipStick
• I am receiving email fine, but I cannot send messages - GreenNet
• Solved Update for Windows Live Essentials Mail 2012 (KB3093594) kills WLM - Page 15 - Windows 10 Forums
• Change Outlook Startup Folder – How-To Geek

Cheers,

Claus Valca

Sysadmin Tools and Tips Linkfest: Part II

Mores…

Windows Updating and Patching – Tips and Tricks

• Windows Update Delivery Optimization (WUDO) in Windows 10 - 4sysops
• Get Your Patching Information Here – ThirdTier
  • Susan Bradley, resident patchaholic, keeps track of these things for you in a handy spreadsheet. Across the bottom of the spreadsheet you’ll find patching recommendations for previous months with updated information. They get updated too with the latest in known issues and solutions. Revisit our blog each month to get your updated version.
• Windows 10: the case of SFC in Windows PE – Borns IT and Windows Blog (GTranslated)
• Case of the Win10 Windows Performance Recorder Trace That Wouldn’t Stop - chentiangemalc
• Case of the Domain Join Failure Part III - chentiangemalc
• Script Reset Windows Update Agent – TechNet Tool “ResetWUEng.zip”
• Fix Windows Update issues with Reset Windows Update Agent - gHacks Tech News
• INFO: Fixing Windows Updates by clearing the cache folder - Kurt Shintaku's Blog
• Windows Update stuck "Checking for updates..." / Error 0x80070005 – TinyApps.org blog
• What you need to know about KB3148812 – Group Policy Central
• Microsoft limits direct update downloads - gHacks Tech News
• Changes to Security Update Links - MSRC

Windows Troubleshooting and Tips

• Fixed: Microsoft Edge can't see or open VirtualBox-hosted local web sites - Scott Hanselman
• Detecting file changes on Microsoft systems with FCIV (“File Checksum Integrity Verifier”) InfoSec Handlers Diary Blog
• INFO: Scan/Repair System Files on Windows 10 – Kurt Shintaku's Blog
• PowerTip: Use PowerShell to Mount ISO Image - Hey, Scripting Guy! Blogs
• The Easiest and Fastest Way to Delete A Large Folder in Windows - Next of Windows
• Removing a corrupted Canon print driver - 4sysops
• Case of the Slow Downloads Folder - chentiangemalc
• How-To Disable Windows Script Host - News from the Lab
• Office 2016 installation – 4sysops
• How to rename the local administrator with Group Policy - 4sysops
• Using reg query to determine the last registry key accessed - MoonPoint Support Weblog
• 9 Cool Useful Command Prompt Tips You May Not Know - Next of Windows
• Well-known security identifiers in Windows operating systems – Microsoft KB243330
• Enable Automatic Silent Adobe Flash Updates – 4sysops
• How To Use Windows Explorer To Get A Fold Structure in Tree View - Next of Windows
• How to Choose Whether Your Function Keys are F1-F12 Keys or Special Keys – How-To Geek
• Windows Backup Privilege: CMD.EXE - Didier Stevens
• Is There a Fast Way to Open a Program as Administrator with UAC Enabled? – How-To Geek
• Process Monitor: Tips for Running Long-term Captures in the Enterprise (by Paul Offord) – LoveMyTool blog
• Robocopy replacement – TinyApps.org
• Obtaining the model number and serial number for a HDD from the command line - MoonPoint Support Weblog
• PowerTip: Back up Drivers with PowerShell - Hey, Scripting Guy! Blog
• How To Export and Back Up Your Windows Drivers For Future Use - Next of Windows
• Fixing "the application was unable to start correctly (0xc0000018)" in Windows - gHacks Tech News
• Set Up Windows Smart Folders by Saving Your Searches – MakeUseOf blog

Windows Tools

• DOWNLOAD: Windows 10 Deployment & Management Lab Kit - Kurt Shintaku's Blog
• Windows Update for Business Group Policy Setting – Group Policy Central
• Microsoft Security Baseline for Windows 10 Download - Next of Windows
• Free RDP Client – Remote Desktop Manager 11 - 4sysops

Windows PowerShell

• Introducing the Windows PowerShell ISE Preview - Windows PowerShell Blog
• Introducing the Windows PowerShell ISE Preview - just another windows noob ?
• Introducing the Windows PowerShell ISE Preview - Windows PowerShell Blog
• Playing with PowerShell ISE Preview - Hey, Scripting Guy! Blog
• A first look at Windows PowerShell ISE Preview - Hey, Scripting Guy! Blog
• Install the PowerShell ISE Preview from the PowerShell Gallery - Hey, Scripting Guy! Blog
• Windows Management Framework (WMF) 4.0 Update now available for Windows Server 2012, Windows Server 2008 R2 SP1, and Windows 7 SP1 - Windows PowerShell Blog
• Windows Management Framework (WMF) 5.0 RTM is now available - Windows PowerShell Blog
• PowerShell Equivalent Cmdlets for IPConfig, PING, and NSLookup - Next of Windows
• How to find a logged-in user remotely using PowerShell – 4sysops
• Run PowerShell from File Explorer - 4sysops
• ScriptAnalyzer v1.2.0 Released - Windows PowerShell Blog
• Use PowerShell to parse event log for shutdown events - Hey, Scripting Guy! Blog
• PowerShell Command to List the Event Logs on a Remote computer - MoonPoint Support Weblog
• The Easiest and Fastest Way to Delete A Large Folder in Windows - Next of Windows
• Removing a corrupted Canon print driver - 4sysops
• Case of the Slow Downloads Folder - chentiangemalc
• How-To Disable Windows Script Host - News from the Lab

Microsoft News Bits

• Microsoft prevents Windows 10 Pro admins from blocking access to the Windows Store – BetaNews
• Remote Desktop for Windows 10 exiting preview - Remote Desktop Services Blog

Cheers,

Claus Valca

Sysadmin Tools and Tips Linkfest: Part I

More goodies for the Sysadmin crowd!

• Visio Stencils / PNGs for all things Microsoft Cloud - Ben Armstrong
• Download Windows Server 2016 Technical Preview 3 - 4sysops
• Windows 10 tools: MDT 2013 Update 1, Windows ADK for Windows 10, MDOP 2015, and RSAT – 4sysops
• Windows 10 virtual machines now available on Microsoft Edge Dev - Microsoft Edge Dev Blog
• Microsoft releases free Windows 10 virtual machines – BetaNews
• April 2016 evaluation Windows developer virtual machines - Building Apps for Windows
• DOWNLOAD: Group Policy Settings Reference for Windows and Windows Server (including Windows 10 & Windows Server 2016 TP5) - Kurt Shintaku's Blog
• Windows 10 privacy – All Group Policy settings - 4sysops
• Deploy the Windows 10 Start menu layout with Group Policy - 4sysops
• Group Policy Settings in Windows 10 Build 10.0.10074 - Anything about IT
• Group Policy Template file for Windows 10 Wi-FI Sense - Anything about IT
• Windows 10 Enterprise vs. Windows 10 Pro - 4sysops
• How to install Nano Server, step by step - 4sysops
• New tool: Policy Analyzer - Microsoft Security Guidance

Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet.

Policy Analyzer lets you treat a set of GPOs as a single unit.  This makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values.  It also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.


• ToolTip: Policy Analyzer – Anything about IT
• DOWNLOAD: “Policy Analyzer” – Comparison tool for groups of GPOs - Kurt Shintaku's Blog
• Get-ADComputer – Display computers in OU or AD group with PowerShell - 4sysops
• Microsoft Windows DirectAccess Client Troubleshooting Tool - Microsoft Download CenterThe
• DirectAccess Client Troubleshooting Tool is a graphical application, based on the .NET Framework, which checks the health of a DirectAccess client by running various tests. Built-in health tests: The following tests are currently implemented: Network interfaces Network location (NLS and NRPT DNS) IP connectivity (6to4, Teredo, IPHTTPS, entry point in a multisite setup, DNS) Windows Firewall (applied profile, Firewall outbound rules) Certificates (EKU Client Authentication, trust chain for AIA and CRL) IPsec infrastructure tunnel (Domain SysVol share) IPsec intranet tunnel (PING and HTTP probes) Additional features Run post-check script (PowerShell, VBScript, BAT or CMD file)
• DirectAccess Client Troubleshooting Guide - The DirectAccess Guide
• DirectAccess Client Troubleshooting tool! - The DirectAccess Guide
• Download Windows 7 and 8.1 ISO Images from Microsoft - gHacks Tech News
• How to Download Official Windows ISO Files Free from Microsoft – makeuseof blog
• FREE: AdRem Software NetCrunch WMI Tool – 4sysops
• TechNet Diskspd Utility: A Robust Storage Testing Tool (superseding SQLIO) - TechNet
• A Robust Disk Performance Benchmark Command Line for Windows - Next of Windows
• DiskSpd, PowerShell and storage performance: measuring IOPs, throughput and latency for both local disks and SMB file shares - Jose Barreto's Blog

Cheers,

Claus Valca

Suface Pro SysAdmin Linkage

This is one of the piles of collected linkage that I have been working hard to get to and post.

Supporting Surface Pro devices is a never-ending challenge. They operate differently than our other laptop/desktop platforms and require a different set of tools and utilities for troubleshooting core device issues.

So here are some critical tips and resoure links.

Surface Pro Device Firmware and Drivers

• Surface Pro 3 Drivers and Firmware – Microsoft Download Center
• Surface Pro 4 Drivers and Firmware – Microsoft Download Center
• Microsoft Surface update history - Surface firmware updates
• Microsoft Surface Pro 3 update history - Surface firmware updates
• Install Microsoft Surface and Windows updates – Microsoft
• Surface Pro - Technical Guidance, Help, Support - TechNet
• Where can I find the official drivers for the new Surface Pro 4 and Surface Book products ? -  just another windows noob ?
• Stealthy Microsoft Surface Pro 3 firmware update brings BSODs, mayhem - InfoWorld
• INFO: Notes on Surface Pro Drivers from April 2016 - Kurt Shintaku's Blog
• HOWTO: Get Support for Surface devices - Kurt Shintaku's Blog

Surface Pro power cord issues

• Surface Pro, Pro 2, and Pro 3 power cords recalled amid overheating fears - Ars Technica
• How to get a replacement AC power cord for your Surface Pro - Microsoft Devices Blog
• Exclusive: Microsoft to recall huge number of Surface power cords on overheating fears - Channelnomics.eu
• Microsoft to manage Surface cord recall directly - Channelnomics.eu

Surface Pro Diagnostic Toolkit

• Download Surface Tools for IT -  Microsoft Download Center
• This download location stores all the right tools you need as a IT Professional when you want to deploy, manage and secure a Surface device in your organization.
• Microsoft Surface Diagnostic Toolkit - gHacks Tech News
• Surface Diagnostic Toolkit - Love My Surface blog
• Microsoft Surface Diagnostic Toolkit helps you test hardware – The Windows Club
• Download Surface Tools for IT Professionals from Microsoft – The Windows Club
• Surface (Surface) –TechNet
• Microsoft Surface Dock Updater (Surface)
• Manage Surface Dock firmware updates
• Surface Diagnostic Toolkit
• Manage Surface UEFI settings
• Manage Surface driver and firmware updates

Note the Toolkit files that stand out to me are:

• Surface_Data_Eraser_Installer_v3.1.9.msi
• Surface_Diagnostic_Toolkit_v1.0.88.0.zip
• Surface_Dock_Updater_v1.0.8.0.msi

Surface Pro Tips and Tricks

• How to repair broken UEFI Bootloader in Windows 10 on Surface Pro -  Microsoft Surface tablet blog
• INFO: “Surface turns on, but Windows won’t start” - Kurt Shintaku's Blog
• Surface 3 Is Plugged In But Not Charging - Love My Surface blog
• Fix Windows did not detect any networking hardware in Windows 10 - Microsoft Surface tablet blog

Surface Pro Data Eraser Utility

• Microsoft Surface Data Eraser (Surface) - TechNet
• Download Microsoft Surface Data Eraser Tool – Into Windows
• A guide for Surface Data Eraser – Solaat.no blog

This is important as the Surface uses a SSD drive and “normal” secure wiping techniques may not be effective. Using the Microsoft Surface Data Eraser tool should ensure a secure wipe occurs before the device is repurposed or returned to Microsoft for service.

Surface Recover Image

• Download a recovery image for Microsoft Surface - TechNet

Cheers,

Claus Valca

Ongoing consumer product security issues

Note: most of this is “old news” now. Posted for posterity.

• Bring Your Own Dilemma: OEM Laptops and Windows 10 - Blog: Duo Security
• Zombie Crapware: How the Windows Platform Binary Table Works – How To Geek blog
• Lenovo issues BIOS updates to fix security vulnerability – BetaNews
• Microsoft Removes Trust for eDellroot Certificates – ThreatPost blog
• Microsoft moves to blacklist Dell's root certificates in its Untrusted CTL – HA blog (via Internet Archive)
• FreeSmartSoft products still hiding an uninstallable 'back door' – BetaNews
• Security Paper suggests to remove McAfee from PCs, finds issues in OEM devices - gHacks Tech News
• Mousejacking: What you need to know – Naked Security
• Mousejack Attacks Abuse Vulnerable Wireless Keyboard, Mouse Dongles – Threatpost
• Logitech Response to Unifying Receiver Research Findings - Logitech Forums

If you do use a Logitech wirless mouse/keyboard with a Unifying receiver, follow that last link above to install the new Unifying Software package, then do a firmware update on the device. Now would be a good time to check and upgrade your SetPoint software as well. GSD tip here.

…moving on…

Claus Valca

Network Link Roundup

And yet another pile of URL web-linkage. This collection focuses on network techniques, tools, and software releases.

Grab a fork and dig in!

• Let me tell you about Wireshark 2.0 - Sniff free or die
• Wireshark 2.0 - Top 10 Filters (by Chris Greer) – LoveMyTool
• Wireshark 2.0 Statistics Endpoint Report (by Tony Fortunato) – LoveMyTool
• Wireshark Use Case: Slow Response Times - Part 2 (by Paul Offord) – LoveMyTool
• Wireshark Use Case: Slow Response Times - Part 3 (by Paul Offord) – LoveMyTool
• How to Detect a Worm with a Network Anayzer (by Nancy Liu) – LoveMyTool
• Announcing Microsoft Message Analyzer 1.4 - Microsoft Message Analyzer
• Selection Tool Window – Microsoft Message Analyzer
• Message Analyzer Videos – Two More - Microsoft Message Analyzer
• YouTube Message Analyzer channel
• Message Analyzer Blog
• Packet Sniffing with PowerShell: Looking at Messages - Hey, Scripting Guy! Blog
• Packet Sniffing with PowerShell: Getting Started - Hey, Scripting Guy! Blog
• Use PowerShell to Parse Network Trace Logs—The Video - Hey, Scripting Guy! Blog
• EMCO Ping Monitor – A sophisticated uptime monitoring tool - 4sysops
• BPF is your Friend - NETRESEC Blog
• NetworkMiner 2.0 Released - NETRESEC Blog
• Detecting Periodic Flows with CapLoader 1.4 - NETRESEC Blog
• Analyzing Web Browsing Activity - NETRESEC Blog
• clumsy 0.2 – utility for simulating broken network for Windows Vista / Windows 7 and above
• Clumsy makes your Windows network conditions worse, on purpose - gHacks Tech News
• NetSpot - free WiFi Site Survey Software for MAC OS X & Windows
• NetSpot 1.0 Wi-Fi analyzer and troubleshooting tool launches on Windows – BetaNews
• Create detailed Wi-Fi Surveys with NetSpot for Windows - gHacks Tech News
• Download NetSpot for Windows – NetSpot
• HeatMapper - Free Wi-Fi coverage mapping software for homes and small offices.
• NetSurveyor - 802.11 Network Discovery Tool
• Xirrus Wi-Fi Inspector
• inSSIDer 3.1.2.1 - Download - FileCroco.com – link to one of the last “free” versions of inSSIDer
• Mostly Wi-Fi and Network Security: Linkfest – GSD blog post
• toolsmith #114: WireEdit and Deep Packet Modification – HolisticInfoSec
• WireEdit - A Full Stack WYSIWYG Packet Editor for Pcap.
• TraceWrangler – Jasper’s awesome tool that can also do sanitization and anonymization of PCAP and PCAPng files
• Sanitized IEEE OUI Data (oui.txt) – linuxnet.ca – when you need a cleaned up version of oui.txt
• What SSL or TLS level are you using? – Soussan DAS Computer Consultants post
• Colasoft – collection of their freeware network utilities.
• HostedNetworkStarter – NirSoft – ad-hoc Wifi Hotspot Creator for Windows 10/8/7
• HostedNetworkStarter: turn your PC into a WiFi Hotspot - gHacks Tech News
• New utility to easily start a wifi hotspot on Windows 10/8/7 – NirBlog
• The Ars guide to building a Linux router from scratch - Ars Technica
• A Bettercap Primer – Daniel Miessler
• Performing network forensics with Dshell. Part 1: Basic usage - InfoSec Handlers Diary Blog
• Tcproute - MoonPoint Support Weblog
• How to identify and prevent programs from phoning home - gHacks Tech News
• Use Fiddler to determine which connections Windows 10 establishes automatically - gHacks Tech News
• Sniffing encrypted traffic – Tinyapps.org
• NetRipper
• Pi-Hole: Standalone Raspberry Pi Ad-blocker – I smell a new Raspberry Pi project coming on!

Cheers.

Claus Valca

Found Applications, Utilities, and Miscellany

Here is a bunch of stuff that I’ve collected over the past several months but never go around to posting.

Maybe you will discover something new or interesting in this mess.

• Update: Autoruns v13.5, Sigcheck v2.3, RAMMap v1.4, BgInfo v4.21, Sysmon v3.11, ADInsight v1.2 - Sysinternals Site Discussion
• Update: Sigcheck v2.4, Sysmon v3.2, Process Explorer v16.1, Autoruns v13.51, AccessChk v6.01 - Sysinternals Site Discussion
• Update: Sigcheck v2.5, Process Explorer v16.11, Whois v1.13, RAMMap v1.5 - Sysinternals Site Discussion
• Update: Sysmon v4, Procdump v8, Sigcheck v2.51 - Sysinternals Site Discussion
• Download EasyBCD 2.3 For Windows 10 – Into Windows blog
• MicEnum enumerates the integrity level of Windows files and folders - gHacks Tech News
• MMCSnapInsView – NirSoft - Displays the details of MMC snap-ins installed on your system
• MMCSnapInsView lists all Windows MMC Snap Ins - gHacks Tech News
• NirSoft releases MMCSnapInsView 1.0 – BetaNews
• VenusSoft Corporation: TheFolderSpy version 2 – VenusSoft Corporation - The ultimate, yet free, hard disk monitoring utility
• TheFolderSpy lets you track all activities in any folder – The Windows Club
• fGet.exe – Foolish IT - new utility for batch/scripting file downloads – Foolish IT
• O&O RegEditor - freeware
• BootSafe v4.1 Released! – Foolish IT
• NetworkOpenedFiles – NirSoft - View opened files by other computers on your network
• Display open network files with NetworkOpenedFiles - gHacks Tech News
• Download elementary OS – Linux distro Windows/OS X user friendly
• elementary OS Freya 0.3.2 – BetaNews
• Error Lookup - Henry++ – freeware tool to help translate wide range of error codes into more digestible messages; regular Windows errors, DirectX, NTSTATUS errors, Windows Internet errors, STOP codes.
• OpenShot Video Editor - Simple, powerful, and free video editor for Linux!
• Micorsoft Diskspd Utility
• Microsoft DiskSpd Storage Performance Tool - gHacks Tech News
• TechNet Diskspd Utility: A Robust Storage Testing Tool (superseding SQLIO) – Microsoft TechNet
• A better Problem Steps Recorder – TinyApps.org
• Wink - Homepage
• How To Burn An ISO Image to Disc from Command Prompt in Windows - Next of Windows
• SoftPerfect File Access Monitor – SoftPerfect freeware - file access audit and operations history
• UIforETW is No Longer a CPU Hog – Random ASCII blog
• Etcher - resin.io – freeware USB image writer tool.
• Meet Etcher, A Stylish Open-Source USB Image Writer – OMG Ubuntu!
• Classic Shell beta with taskbar skinning - gHacks Tech News

Cheers!

Claus Valca

Quickpost: that whole Bash on Windows thing

Old news; just a collection of links for future reference.

• Developers can run Bash Shell and user-mode Ubuntu Linux binaries on Windows 10 - Scott Hanselman
• Run Bash on Ubuntu on Windows - Building Apps for Windows
• Ubuntu on Windows - Ben Armstrong’s Virtualization Blog
• BETA: Bash on Windows - Kurt Shintaku's Blog
• Bash for Windows: Why it’s awesome and what it means for PowerShell - Windows PowerShell Blog
• Bash on Windows - MoonPoint Support Weblog
• Some notes on Ubuntu Bash on Windows 10 – Errata Security
• Installing Fish Shell on Ubuntu on Windows 10 - Scott Hanselman
• First thoughts and a quick setup guide on Bash for Windows — Medium
• Install Bash on Windows 10 - 4sysops
• Microsoft reveals all about Windows 10's Linux subsystem – BetaNews

Moving on…

Claus Valca

TRAINING: Windows Security & Forensics

“New” Microsoft Virtual Academy training course spotted.

• TRAINING: Windows Security & Forensics - Kurt Shintaku's Blog

Topics:

1. Windows Security and Forensics
   Take a look at the current state of the security landscape, Windows Security, and what "computer forensics" are.
2. Windows Memory Attacks and Forensics
   Learn how and why hackers attack a system’s memory, and see how Memory Forensics can help address the problem.
3. Windows Authentication Attacks and Forensics
   See demonstrations of how attackers use credential dependencies to gain elevated access to systems and to perform lateral movement. Plus, learn how to detect and prevent many of these attacks.
4. Windows Forensics
   Explore Digital Forensics, and find out what to do as a first responder to preserve evidence for legal actions.
5. Network Forensics
   Explore network forensics, along with case studies, best practices, and online analysis techniques.
6. Malware Incident Response
   Learn about malware incident response, including identifying, locating, and removing malware.
7. Windows 10 Forensics
   Take a look at Windows 10 forensics, and hear about new security features and innovations that can help forensic experts with their work.

Learn the following through this course:

• Examine how and why hackers attack a system’s memory.
• Identify how attackers use credential dependencies to gain elevated access.
• Review what to do as a first responder to an attack; learn to preserve evidence for legal actions.
• Explore network forensics.
• Learn about innovations of Windows 10 that can help forensic experts do their jobs.
• Learn the basics of computer forensics.
• See how to respond to malware incidents.

This won’t instantly make you a professional forensicator it looks to give sysadmins a well-rounded introduction into key topic and foundational approaches when deciding where to begin – if there isn’t already a formal support structure in your organization for these items.

• Windows Security & Forensics - Microsoft Virtual Academy

Claus Valca