Showing posts with label utilities. Show all posts
Showing posts with label utilities. Show all posts

Monday, September 05, 2016

Valca Windows KeyFinder Utilities

Last night I was culling my collection of Windows key-finding utilities.  There were some that had gone “404” and others that didn’t seem stable (or effectively work at all) on newer Windows 7/10 systems.

Many were collected back in the days of Windows XP so I decided to pick through them and dump the oldest ones and add some new ones.

This morning I saw that the TinyApps.org bloggist was hard at work on his own list!

Possibly we are being confronted with similar troublehsooting and service issues?

Here is my list and there are some similarities (as presented in semi-alphabetical order).

Some of these recover more than just the Windows OS key.

Some have not been updated in a while and may not work effectively on Win 7/8/8.1/10.

Then there is there is the manual method using CMD or PowerShell for most Win 10 / 8 / 8.1 systems.

I tend to prefer ProduKey, ShowKeyPlus, and Windows OEM Product Key Tool as my primary tools.

Cheers,

Claus Valca

Saturday, June 25, 2016

Windows Service Triggers

I was troubleshooting some issues with WSUS server updating firing off on some Surface Pro tablets the other week.

In doing so, it seemed the root cause was that the Windows Update Service was set to not run full time or Automatically but rather manually and based on service trigger starts.

Hmmm. Time to learn me some facts about Windows service triggers.

Now we know!

--Claus Valca

Telenet Clients

This week I was working with a network team-member to pilot some changes that will lock our network switches down more tightly.

I’m used to using PuTTY Portable or KiTTY Portable which are simply portable versions of PuTTY and KiTTY and seem hands-down better than Microsoft’s Hyperterminal that got left behind when Windows 7 came out (although it can run just fine on WIn 7 if you copied the snagged binaries over).

However, the network admin I was working with requested we use the terminal Poderosa.

Apparently Poderosa has been out for a very long time and I’m just now finding out about it.

What makes it very nice – aside from the beautiful GUI – is the “tabbed” nature of the application so you can have multiple sessions running and organized very similarly to browser tabs.

It felt very natural and easy to use and is pretty light and fully portable.

Like other telnet clients you can change the back color, text color, and font for improved legibility. The buffer size can be adjusted to allow capture of more of the session content, and copy/paste support feels more natural (IMHO).

GSD Bonus:

Don’t forget these great Cisco reference sites:

Cheers.

--Claus Valca

Unpacking Inno Installers

Some – but not all – applications that come packaged as “installers” can actually be run “portable” without needing to do the full install.

There are degrees of portability when attempting this. Some applications are truly portable in that they don’t write extra files to the Windows Registry or ProgramData locations but either use their own “local” ini/config files or helper portability wrappers to retain settings and option selections (if available).

Others will run after being unpacked, but may still write settings and changes into the Windows Registry and other system locations.

All that to say, that a common installation packer I encounter is Inno.

Normally, I just run Universal Extractor where I have updated the dated inno unpacker binary with the latest one from innounp to be sure that I can unpack those built with the latest versions.

Or you can try out the newer project UniExtract2 which the author is trying to create an updated and feature enhanced version of Universal Extractor. It’s very nice too though you still may end up having to manually update innounp when a new version comes out.

Anyway, if that is too much overhead, you might want to try one of these Inno-focused unpacker utilites.

  • InnoEx – GUI based extractor. see the Help/tips for more ideas.
  • InnoExtractor – HavySoft
  • innoextract – supports multiple platforms like Windows, Mac OS X, and multiple Linux flavors
  • - A tool to unpack installers created by Inno Setup

Of course if your CLI-fu is strong, you could just keep it old-school and use innounp directly from the command line and be done with it.

Cheers,

--Claus Valca

Supplemental Spell Checking in OLW with tinySpell

The biggest feature I am missing in Open Live Writer is the lack of “real-time” spell checking when running it on a Windows 7 system.

My “fix” at the time of this post - Open Live Writer – we will (eventually) get through this – was to compose my post, copy/paste it into a session of Notepad++ where a spell check plugin was configured, and then correct any spelling issues back in the original post.

It worked but felt very clumsy.

So a few weeks ago I found a more streamlined solution.

  1. Download the free version of tinySpell – a free (and portable) spell checker.
  2. Launch tinySpell.
  3. Launch Open Live Writer.
  4. Compose post and fix spelling errors on-the-fly while composing as notified by tinySpell.

Done.

tinySpell comes in both installed or portable versions and there is also a tinySpell+ version as well for $ if you need more of the advanced features it offers.

You can easily add additional words into a custom dictionary. Set the application to run at system startup if desired. Make an audible beep if a spelling error is detected, and change the font size and color of the spelling tip notification.

tinySpell has restored my blogging confidence in using Open Live Writer as it continues through the development process.

Cheers!

--Claus Valca

Monday, May 30, 2016

Windows “Service Pack”, Slipstreaming, ISO files, misc.

Wow.  Big thanks to Lavie for being patient with me while I hammered out all these blog posts.

I’ve still got quite a lot more, but it has been a very productive – non-productive day off.

Cheers!

Claus Valca

…since we are talking about encryption…

Here are some links about TrueCrypt, VeraCrypt, CipherShed, and Bitlocker…

FWIW – I’m still running the last release version of TrueCrypt…

Cheers,

Claus Valca

Move that Window!

It never fails that when I pull my laptop off my docking station and then start it up again in the field, I’ll have an “orphaned” application window launch on my “phantom” 2nd monitor.

Getting it repositioned back on the visible display is always a pain.

Here are some tips/tools to help.

How to move or resize windows with the keyboard – BetaNews

On Windows 7 and later, pressing Win+Left or Win+Right snaps the current window to the left or right half of the screen.

Using Win+Shift+Left moves the window across displays on a multimonitor setup.

Win+Up and Win+Down maximize and minimize your window.

If a window is positioned off the screen, then pressing Alt+Space+M is still an easy way to bring it back. Just press or hold down the arrow keys to move it wherever you need.

Window Seizer – freeware app from Alex Nolan. Click the window’s process, then click the “Move to 1,1” icon on the bar. It doesn’t always work properly, but does more times than not. Portable single exe file.

MultiMonitorTool – NirSoft – Has some options to move a/some/all windows to the primary monitor. Portable app in both x32 and x64 versions.

Cheers,

Claus Valca

Sysadmin Tools and Tips Linkfest: Part I

More goodies for the Sysadmin crowd!

Cheers,

Claus Valca

Suface Pro SysAdmin Linkage

This is one of the piles of collected linkage that I have been working hard to get to and post.

Supporting Surface Pro devices is a never-ending challenge. They operate differently than our other laptop/desktop platforms and require a different set of tools and utilities for troubleshooting core device issues.

So here are some critical tips and resoure links.

Surface Pro Device Firmware and Drivers

Surface Pro power cord issues

Surface Pro Diagnostic Toolkit

Note the Toolkit files that stand out to me are:

  • Surface_Data_Eraser_Installer_v3.1.9.msi
  • Surface_Diagnostic_Toolkit_v1.0.88.0.zip
  • Surface_Dock_Updater_v1.0.8.0.msi

Surface Pro Tips and Tricks

Surface Pro Data Eraser Utility

This is important as the Surface uses a SSD drive and “normal” secure wiping techniques may not be effective. Using the Microsoft Surface Data Eraser tool should ensure a secure wipe occurs before the device is repurposed or returned to Microsoft for service.

Surface Recover Image

Cheers,

Claus Valca

New Defrag Tool videos – does the fun never stop?!!!

Now that we are getting near the summer TV re-run doldrums, maybe now is a good time to start Chromecasting some technical videos.

Defrag Tools – Microsoft Channel 9

Media eXperience Analyzer – Microsoft Download Center

Cheers,

Claus Valca

Network Link Roundup

And yet another pile of URL web-linkage. This collection focuses on network techniques, tools, and software releases.

Grab a fork and dig in!

Cheers.

Claus Valca

Windows Task Manager Alternatives

Not sure what got me started on this collection of links.

The stock Task Manager application on Windows isn’t that bad in Windows 7 and gets even better in Windows 8/8.1/10.

However, sometimes you really need something with a bit more lifting power when you are working on Windows system to review and dive into the running processes.

I use Microsoft Sysinternals Process Explorer as my EDC utility. I’ve yet to find a product to beat the overall feaures it brings.

However, there are a number of other utilities I like to keep handy just in case I need a different view.

Cheers.

Claus Valca

Found Applications, Utilities, and Miscellany

Here is a bunch of stuff that I’ve collected over the past several months but never go around to posting.

Maybe you will discover something new or interesting in this mess.

Cheers!

Claus Valca

Windows Winsock Repair

A few weeks ago it was brought to my attention that the XP desktop system sitting in our church-house library hasn’t been able to get on the Internet for quite some time.

(Yes…I said “XP”…moving on…)

I tried to argue that this sounded like a security feature rather than a problem but it was explained to me that the librarian used software on that system to catalog new book arrivals. One feature of that software was to look up the ISBN to pre-populate the database record it creates.

Turns out the system had a number of issues.

I had to remove quite a lot of third-party junkware from the system; (at least) one of which it turns out messed up the network/WinSock settings of the OS.

The net result was basically that no web-browser could reach the Internet.

After the system was cleaned up of all the junkware and auto-start crud, I had to clean up the network settings and fix the WinSock settings.

In the end I just followed the steps in this Microsoft KB: How to determine and to recover from Winsock2 corruption in Windows Server 2003, in Windows XP, and in Windows Vista

Manual steps to recover from Winsock2 corruption
Windows XP with Service Pack 2 instructions

To repair Winsock if you have Windows XP Service Pack 2 (SP2) installed, type netsh winsock reset at the command prompt, and then press ENTER.

Note Restart the computer after you run this command. Additionally, for computers that are running Windows XP SP2, there is a new netsh command that can rebuild the Winsock key. For more information, visit the following Web site:

http://technet.microsoft.com/en-us/library/bb457156.aspx

Warning Programs that access or monitor the Internet such as antivirus, firewall, or proxy clients may be negatively affected when you run the netsh winsock reset command. If you have a program that no longer functions correctly after you use this resolution, reinstall the program to restore functionality.

Note If these steps do not resolve the problem, follow the steps in the next section.

Windows XP without Service Pack 2 instructions
To repair Winsock if you do not have Windows XP SP2 installed, delete the corrupted registry keys, and then reinstall the TCP/IP protocol.
Step 1: Delete the corrupted registry keys
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

For more information about how to back up the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows XP and Windows Vista

  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

  4. When you are prompted to confirm the deletion, click Yes.
Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.
Step 2: Install TCP/IP
  1. Right-click the network connection, and then click Properties.
  2. Click Install.
  3. Click Protocol, and then click Add.
  4. Click Have Disk.
  5. Type C:\Windows\inf, and then click OK.
  6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.
    If Internet Protocol (TCP/IP) does not appear, follow these steps:
    1. Click Start, and then click Search.
    2. In the Search Companion pane, click More advanced options.
    3. Click to select the following three check boxes:
      • Search system folders
      • Search hidden files and folders
      • Search subfolders
    4. In the All or part of the file name box, type nettcpip.inf, and then click Search.
    5. In the results pane, right-click Nettcpip.inf, and then click Install.
  7. Restart the computer.

The real “trick” for me was in Step 2.5 above.  You need to actually type “C:\Windows\inf” as it says. If you try to browse to the folder in the GUI you won’t “see” the folder present. Type it in and the protocols appear as documented above.

Once the PC was restarted I manually set the network configuration to the proper static IP the system should use along with custom DNS server values.

If you don’t want to go through all that manual work, you could try the Microsoft FixIt (50203) download link and save/run that file.

There are also a lot of third-party utilities that can fix WinSock issues. I like to keep these along with the Microsoft FixIT file handy just in case:

Cheers,

Claus Valca

FIle & Folder Mirroring: top picks and other misc notes

I have two folders on my system: “Standalone Apps” and “Updaters”.

The first one pretty much speaks for its content. The second folder contains the most recent installation binaries for third-party browser plugins, security applications, etc.

I keep them updated weekly.  Then I synchronize (mirror) them to a few different USB drive devices.

I have been using FreeFileSync Portable for a long time as my primary tool to handle it.  It has a clear interface, runs pretty fast, and has been reliable. I can do a “preview” of the synchronization run to see just what will occur. Drawbacks? I’m stuck on the older v6.2 build as it is the last one that plays nicest with the portable launcher. It also is more complicated in that it uses a lot of dependencies to make it work.

I had been using Dimio's DSynchronize application before that. I still do use it once a month or so just in case it catches something that FreeFileSync misses. I like it is that it is very small and fast, regularly updated, and has a complex “simple” interface.

So TinyApps bloggist brought a new synchronization tool to my attention recently in the blog post Synchronize, backup, or copy files and folders.

It’s a very nice freeware tool called SyncFolders. As TinyApps points out, it can be combined with ShadowSpawn to leverage the VSS.

The only “problem” I had using it the first time was that I had selected the “copy” option in my rule build and not “back-up”. This meant that none of the removed files in my “source” set were getting deleted on target drives. Once I figured that detail out it was smooth mirroring.

In my post Call Me Burned but Recovered: Windows 10 Upgrade Failure I mentioned a backup tool called Drive Snapshot that seemed pretty darn cool.

TinyApps reached out to me after that post and kindly shared some content on his site related to this backup tool:

Somehow I also ended up finding Image for Windows via Terabyte. They offer their backup/restoration tool in DOS/Linux/Windows editions with a free 30-day trial version. Full product purchase is less than $50 at the time of this post.

As noted in my original post my whole-system backup solution involved using a boot version of OSFClone to capture my system partition to a USB drive IMG file. Restoration was booting with a WinPE stick, running DiskPart to recreate my partition structure, then booting a LiveCD ISO of Linux Mint (Cinnamon version). Then I used the Ubuntu Disk Image Writer already integrated in the Mint OS build shell to browse to my IMG file on the external USB drive and simply selected my system’s primary HDD to write the image back, after first confirming I was selecting the correct one with gParted.

For my standard system-wide key file and folder backups for disaster recovery I am still using the freeware application Back4Sure in the portable version. This backup routine focuses not on creating an entire system backup image but just the most critical folders on my system that would allow me to recover my user-data in the event of a malware/cryptoware attack.

Cheers.

Claus Valca

Monday, February 15, 2016

Win 7 Task Image Corruption Errors: In which A Quick Fix is found and Blame is to be Assigned

When we last left the story, I had resolved a thorny issue getting a Glassware update to go on “clean” and re-attach to its service.

But subsequently I found on my Windows 7 (x64) Ultimate system that when I went into “Task Scheduler” via the Control Panel, I was getting this error:

2016-02-13 22_21_32-Task Scheduler

In total there were 46 different “tasks” that had that error message:

Task image corrupt: Dell SupportAssistAgent AutoUpdate
Task image corrupt: GoogleUpdateTaskMachineCore
Task image corrupt: GoogleUpdateTaskMachineUA
Task image corrupt: GoogleUpdateTaskUserS-1-5-21-1728537537-2011028439-759670610-1000Core
Task image corrupt: GoogleUpdateTaskUserS-1-5-21-1728537537-2011028439-759670610-1000UA
Task image corrupt: PCDEventLauncherTask
Task image corrupt: PCDoctorBackgroundMonitorTask
Task image corrupt: SamsungMagician
Task image corrupt: SystemToolsDailyTest
Task image corrupt: Microsoft\Office\Office Automatic Updates
Task image corrupt: Microsoft\Office\Office ClickToRun Service Monitor
Task image corrupt: Microsoft\Windows\Media Center\ActivateWindowsSearch
Task image corrupt: Microsoft\Windows\Media Center\ConfigureInternetTimeService
Task image corrupt: Microsoft\Windows\Media Center\DispatchRecoveryTasks
Task image corrupt: Microsoft\Windows\Media Center\ehDRMInit
Task image corrupt: Microsoft\Windows\Media Center\InstallPlayReady
Task image corrupt: Microsoft\Windows\Media Center\mcupdate
Task image corrupt: Microsoft\Windows\Media Center\mcupdate_scheduled
Task image corrupt: Microsoft\Windows\Media Center\MediaCenterRecoveryTask
Task image corrupt: Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
Task image corrupt: Microsoft\Windows\Media Center\OCURActivate
Task image corrupt: Microsoft\Windows\Media Center\OCURDiscovery
Task image corrupt: Microsoft\Windows\Media Center\PBDADiscovery
Task image corrupt: Microsoft\Windows\Media Center\PBDADiscoveryW1
Task image corrupt: Microsoft\Windows\Media Center\PBDADiscoveryW2
Task image corrupt: Microsoft\Windows\Media Center\PvrRecoveryTask
Task image corrupt: Microsoft\Windows\Media Center\PvrScheduleTask
Task image corrupt: Microsoft\Windows\Media Center\RecordingRestart
Task image corrupt: Microsoft\Windows\Media Center\RegisterSearch
Task image corrupt: Microsoft\Windows\Media Center\ReindexSearchRoot
Task image corrupt: Microsoft\Windows\Media Center\SqlLiteRecoveryTask
Task image corrupt: Microsoft\Windows\Media Center\UpdateRecordPath
Task image corrupt: Microsoft\Windows\MobilePC\HotStart
Task image corrupt: Microsoft\Windows\MUI\Lpksetup
Task image corrupt: Microsoft\Windows\MUI\Mcbuilder
Task image corrupt: Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor
Task image corrupt: Microsoft\Windows\RAC\RacTask
Task image corrupt: Microsoft\Windows\Shell\WindowsParentalControls
Task image corrupt: Microsoft\Windows\SideShow\AutoWake
Task image corrupt: Microsoft\Windows\SideShow\GadgetManager
Task image corrupt: Microsoft\Windows\SideShow\SessionAgent
Task image corrupt: Microsoft\Windows\SideShow\SystemDataProviders
Task image corrupt: Microsoft\Windows\Tcpip\IpAddressConflict1
Task image corrupt: Microsoft\Windows\Tcpip\IpAddressConflict2
Task image corrupt: Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task image corrupt: OfficeSoftwareProtectionPlatform\SvcRestartTask

Oh my!  Did my Glasswire “repair” bork my system?  Did taking down the security perimeter allow an attack to penetrate?

Doubtful.  Once I clicked “OK” 46 times Task Scheduler would load and otherwise seemed OK. And the system would boot and run just fine. These errors were encountered only when loading up Task Scheduler.

Some initial research found these links:

That first link from Microsoft describes the manual repair process which is pretty painful…especially when you have a LOT of borked entries.

  1. Find the corrupted sub-key in the registry,
  2. Make a temporary copy of the corrupted task file
  3. Clean it up
    1. delete the task file
    2. delete the registry sub-key(s)
  4. Re-create the task by using the backed up copy

Luckily that last link in the Windows 7 Forums site had a recommendation for a quiet and obscure utility to help with the repair process…and explain just how these tasks got borked.

Repair Tasks – CodePlex project by Dijji

The Blame Game – Microsoft and my failed Windows 10 Upgrade/Rollback

Dijji explains exactly what happened on the main page…and it’s no surprise: my failed Windows 10 upgrade and rollback caused the issue.

In particular, it fixes problems where opening the Task Scheduler, or trying to configure Windows Backup, results in the message "The task image is corrupt or has been tampered with" (0x80041321).

Searching the web reveals that this message has been seen from time to time, and the (rather laborious) set of steps that can be taken to correct it are fairly well-documented (see here and script for it here).

However, it turns out that reverting to Windows 7 from Windows 10 generates this problem in spades. It can leave more than 40 scheduled tasks in a corrupt state (see this thread). This is because many task registry keys and the task definitions to which they refer are updated by a Windows 10 upgrade, but only the registry keys are restored on reversion, so Task Scheduler finds that, for these tasks, the task registry keys and task definitions are now inconsistent.

So basically, the Windows 10 upgrade adds a bunch of additional scheduled tasks to the system, but when you roll-back, they are not all removed. Then you get the errors.

Classy, Microsoft.

Dijji’s Repair Tasks Utility In Action

Fortunately, brilliant and clever community folks like Dijji are around to do the hard work and create solutions to mop up the mess left in isle 4.

After reading all of Dijji’s project documentation I went through the process and quickly had all my corrupted tasks restored, the ones I didn’t need removed, and Task Scheduler working normally again.

Repair Tasks is a brilliant kit of software.

First read this:  Repair Tasks – Documentation to get a deep dive into the problem and the steps the utility does in the repair process.

Then read this: Repair Tasks - Documentation - Windows 10 only tasks which gets into details on some task that are often found and not repaired on a first-run of the tool.

Then read this: Repair Tasks - Some Tasks Lost Apparently where “Norwood451” did a better job documenting the actual utility use in a walk-through better than I could.

Fixed in 14 steps. See below.

    1. Issue was Caused by reverting from Windows 10 back to Windows 7 (in my case windows 7 64 Bit)
    2. Download Repair Tasks by Dijji at https://repairtasks.codeplex.com/
    3. Download Windows7 Tasks.zip (DO NOT UNZIP) at https://repairtasks.codeplex.com/releases/view/617575?RateReview=true
    4. Create a Folder called AAAAATASK in your Documents (Which can be found START > Documents)
      C:\Users\David\Documents\AAAAATASK
    5. Open the downloaded RepairTasks.zip file From step 2 and copy both files (RepairTaskes.exe and RepairTasks.exe.config to the AAAAATASK folder in your documents folder.
    6. Copy the entire downloaded zip file Windows7 Tasks.zip to the AAAAATASK folder in your documents folder.
    7. Right click and Run as administrator RepairTaskes.exe
    8. Click the Scan Button to get list of corrupted files
    9. Click the repair Button. (most or all of the tasks should be repaired now. If not, go to step 10.
    10. Click the Radio button> Take tasks from backup
    11. Click Scan for a list of the remaining corrupted files.
    12. Click Repair again.
    13. You will get a pop-up window asking where the RepairTasks.zip is located-- the file you created AAAAATASK, which should be on the very top – of course, as reason for the name of the file.
    14. You can test by running Both Scans and if you do not get anymore lists of files. Boom! You are done.

Yep that is pretty much it.

After I did my first scan for issues I saved the results in a TXT file; that is where I got the list of 46 issues I opened up this post with. Super handy.

I then ran the “Repair” routine which almost instantly fixed 41 of them, leaving 5 remaining as seen below.

2016-02-14 13_07_53-Typical Windows 10 reversion errors

I then attempted a repair of those remaining five tasks from the offered “Windows7 Tasks.zip” file provided and did a second repair. That did the trick!

2016-02-14 13_08_35-Repair Tasks - Some Tasks Lost Apparently - Internet Explorer

When I was all done and subsequent reboots confirmed a normal Task Scheduler again, I ran a scan one last time and then chose a “Backup Tasks” routine to tuck these away in case this happens again. That way I can rely on my own system.

GSD Tip: If you do decide to do a Windows 7 to Windows 10 upgrade, be sure you take your own manual backups, set some system restore points, and also use this took to take a backup of your Tasks for good measure.

I think Dijji could be selling his project features just a bit short and recommend also highlighting it as a “regular” Task Scheduler backup tool, not just as a “repair” tool.

Yes…it was really THAT easy!

Repair Tasks – CodePlex project by Dijji – highly Valca recommended!

Cheers!

Saturday, February 13, 2016

PowerShell one liner to get USB Flash Drive Serial Number

First a confession, I bought the “Learn Windows PowerShell 3 in a Month of Lunches” book quite a while ago but still haven’t had the discipline to work my way through it.

Couple that with tons of PowerShell learning resources documented across the GSD blog and I am woefully behind the game.

However, I can read music so I guess that means I can puzzle out code with patience and Google searching.

One of my duties is to keep inventory of USB device issuances to the team. I record the serial numbers of the devices in a spreadsheet.

While some external USB HDD’s have the device serial number listed on the external case, USB flash drives aren’t so good wtih that practice.

There are some USB imaging tools such as the USB Image Tool or utilities such as USBDeview or Kanguru’s free Serial Number Display Tool that I could use to get that information directly.

However, I really like to stick with “in-box” tools and techniques so while that would be the “easy” way I’ve been collecting the information the “long-way-round” by the following process:

  1. Insert USB flash drive into system.
  2. Open Control Panel
  3. Open Device Manager
  4. Expand the “Universal Serial Bus controllers” item
  5. Look for the “USB Mass Storage Device” in the list (that’s my inserted flash drive)
  6. Right-click that item and select “Properties”
  7. Select the “Details” tab
  8. In the Properties list, pick “Device Instance Path”
  9. Read the serial number which is the trailing string after the last “\”

Eject and repeat.

What I wanted to do was just run a “WMIC” query directly from the command line to get that specific information via the Command Prompt.

But despite my best efforts (which isn’t saying much) I wasn’t able to locate the correct parameter.

Tonight I did find and tweak a similar command via PowerShell and it does the trick. So while it isn’t elegant, it does the job I need. Victory at last!

gwmi Win32_USBControllerDevice |%{[wmi]($_.Dependent)} | Where-Object {($_.Description -like '*mass*')} | Sort Description,DeviceID | ft Description,DeviceID –auto

(That’s one long string btw.)

So I can get a result like this:

Description             DeviceID
-----------             --------
USB Mass Storage Device USB\VID_0DD8&PID_3200\<serial number displayed here>

Your DeviceID details will vary depending on the make/model/etc. but the serial number is there easy to copy/paste.

Credits:

wmi - Getting a USB Device Instance Path in Powershell - Stack Overflow. This post got me finally on the right track but still didn’t work for me.

Displaying USB Devices using WMI - Windows PowerShell Blog.  Jeffrey Snover’s post did get me the output I was looking for, but I then needed to clean it up just a bit as I only wanted the “USB Mass Storage Device” information.

Filtering PowerShell Objects - PowerShell content from Windows IT Pro. This was the final bit in giving examples how I could filter for just the one line I needed.

If anyone can “refine” the code or filter it more to just pass on the Serial Number string itself, I would be grateful for any recommendations.

Using PowerShell’s gwmi or the Command WMIC call are powerful ways to get system information.

Here are some additional examples that I’ve collected trying to puzzle out my own particular USB Mass Storage device query technique that could be helpful to sysadmins:

Cheers!

--Claus Valca.

Bonus USB utility finds:

Universal Extractor and updated “builds”

One of the most important utilities that I use weekly is the Universal Extractor from LegRoom.net.

It has a very large version of supported formats for archive unpacking but hasn’t been updated in a very long time.

I’ve manually updated some of the included binaries from time to time, but the Inno Setup Unpacker file is the one I need updated regularly. I get it from innounp and overwrite the older version in my bin folder. Current version as of the time of this release is 0.45 and supports Inno Setup versions 2.0.7 through 5.5.7 for all your unpacking needs.

I was excited to learn about a project to try to update not just the various unpacker binaries but the application itself.

Universal Extractor 2 – Bioruebe.com (changelog here)

From the project page:

As a short overview here is a list of the core improvements:

  • Batch mode
  • Silent mode, not showing any prompts
  • Scan only mode to determine file types without extracting
  • Integrated updater
  • 100+ new supported file types
  • Audio and video extraction for multimedia files
  • Cascading context menu
  • Support for password list for common archives
  • Improved optional status box with progress indicator
  • New detection methods + more detailed output and error messages
  • Support for some extractors not shipping with UniExtract as plugins
  • Resource usage/speed improvements, lots of fixes
  • First start assistant instead of installer
  • Full functionality available in no-install version
  • Auto-using 64 bit versions of extractors if supported by OS

Martin Brinkmann at ghacks.net has a good review of the differences; First look at Universal Extractor 2

I’ve not tossed out the original UE app that I’ve been using all these years but I’m keeping this one close by for comparisons.

Cheers.

--Claus Valca

Saturday, November 28, 2015

GSD Superpost: Windows Performance Troubleshooting

It has been a long time since my Case of the Unexplained Donut of Death post where I dip into the deeper waters of Windows Performance troubleshooting.

I might use…

But eventually I hit upon the Windows Performance Analysis Toolkit in Windows 8 (SDK 8) and newer (Win 8.1 & 10).  See this GSD post for linkages to more tool tips for the above items.

Later I would find an additional tool PerfView that helps with trace file collection and analysis.

Now Windows 10 is out and while I really need to invest in a deep dive of a resource like the Windows Performance Analysis Field Guide (amazon link) by Clint Huffman, there are still a lot of tools and resources still to be discovered.

I’m still trying to understand the new feature set and capability of Windows Performance Toolkit for Windows 10.

The latest tool that has inspired me is Bruce Dawson’s “UIforETW” tool.

This is a tool that records ETW traces, works around ETW performance bugs, allows configuration of trace recording options, works as a trace management UI, and more.

Basically you download it, run it, allow it to install the required WPT packages, and then pretty much start tracing. It records to a circular buffer so if you experience something interesting, save the trace and rename/note it, and the trace keeps on going while you go exploring the captured trace file. Read Bruce’s post for a full walk-through.

Bruce also has some good posts on performance troubleshooting.

This is an awesomely helpful tool to keep on your USB drive!

I had also just discovered Clint Huffman’s PAL (Performance Analysis of Logs) Tool

Both the ETW tool and the PerfView tool in particular should make it easy for me to leave a shortcut on a user’s desk so they can run the tool if I need them to capture a recurring performance issue, then let me collect the (large) trace file at a later time for deeper analysis.

However it would be nice to make a scripted “click-to-run” or “circular capture at startup” routine for ongoing troubleshooting; assuming resources (disk space and system performance) are up to the task.

I’m looking at these posts for inspiration and refinement.

Of course, just being able to collect ETL trace files and look at them with the Windows Performance Analyzer tool isn’t remotely close to fixing the issue. Generally there aren’t any singing angels present pointing the way to the problem process or issue.

You have to deep dive into the trace file to isolate the issue and drill down into the root cause; then come up with a solution.

So here are a BUNCH of video resources (and a few blog posts) to help with the learning process and to illustrate the tools mentioned and techniques used in Windows performance troubleshooting.  I’m collecting them here so I can find them quickly when I need some inspiration or deeper learning.

Defrag Tools - Windows Performance Toolkit (WPT) Videos

Defrag Tools - PerfView Videos

Defrag Tools - General Troubleshooting Videos

Advanced, Deep, and Challenging Performance Troubleshooting Videos

That should keep us busy for a while!

Cheers!

Claus Valca