• EyesOnWindows

    EyesOnWindows

    @eyesonwindows

    Viewing 15 replies - 31 through 45 (of 207 total)
    Author
    Replies
    • That may not work since the command “bcdedit /enum ALL” shows that “Winre.wim” is specifically referenced as a ramdisk for loading the “Windows Recovery Environment”:

      Windows Boot Loader
      ——————-
      identifier {9f0a4da7-c4b9-11ee-890a-64315017406b}
      device ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{9f0a4da8-c4b9-11ee-890a-64315017406b}
      path \windows\system32\winload.exe
      description Windows Recovery Environment
      locale en-US
      inherit {bootloadersettings}
      displaymessage Recovery
      osdevice ramdisk=[\Device\HarddiskVolume3]\Recovery\WindowsRE\Winre.wim,{9f0a4da8-c4b9-11ee-890a-64315017406b}
      systemroot \windows
      nx OptIn
      bootmenupolicy Standard
      winpe Yes
      
      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Windows Upgrade to Atlas #2654936

      Atlas Playbook is a zipfile:
      AtlasPlaybook_v0.3.2.zip – ZIP archive, unpacked size 9,477,089 bytes

      It contains:
      2023-11-08 16:15 9,473,693 AtlasPlaybook_v0.3.2.apbx
      2023-11-07 14:22 2,399 Bypass Windows 11 Requirements.cmd
      2023-11-07 13:49 997 Disable Automatic Driver Installation.reg

      The *.apbx is just a zipfile:
      AtlasPlaybook_v0.3.2.apbx – ZIP archive, unpacked size 10,236,131 bytes

      It contains 430 files in 116 folders all of which are encrypted.
      The files have extensions .yml .reg .ico .ps1 .cmd .exe .png .lnk .conf .url
      The unencrypted versions are available from https://github.com/Atlas-OS/Atlas/tree/main/src/playbook
      See https://github.com/Atlas-OS/Atlas and https://discord.atlasos.net for more details.

      From what I see it is just a large automatic configuration implemented by the AME Wizard tool.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • in reply to: January Cumulative Update Successfully Installed #2636041

      Go to Control Panel\System and Security\Security and Maintenance > View reliability history

      Click on the date column of interest to see updates that failed or succeeded, here are a couple relevant ones I found:

      Problem: Failed Windows Update
      Date: 2/5/2024 1:47 PM
      Description: Installation Failure: Windows failed to install the following update with error 0x8024200B: 2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441).

      Problem: Successful Windows Update
      Date: 2/5/2024 9:24 PM
      Description: Installation Successful: Windows successfully installed the following update: 2024-01 Security Update for Windows 10 Version 22H2 for x64-based Systems (KB5034441)

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Cannot install KB503441 #2636040

      Look at C:\Windows\Logs\ReAgent\ReAgent.log file which has record of each time ReAgentC is run.

      Understand that when ReAgentC /enable is run it first scans for any Recovery partition on all disks large enough to hold the winre.wim file + 52 MiB. If no such partition is found it uses C:\Recovery\WindowsRE instead. Notice that when disabled winre.wim is stored under C:\Windows\system32\Recovery. The C:\Windows\Logs\ReAgent\ReAgent.log file documents all this thoroughly. When disabled all you will see in its place is Startup Settings on doing a shift restart.

      A reply to @Susan Bradley’s post KB5034441 fails to install with error code 0x80070643 by PRSGroupIT ‎Feb 04 2024 01:59 AM and KB5034441 — Windows Recovery Environment (WinRE) successful install #2635064 both document that temporarily changing the Recovery partition to a plain Primary partition after ReAgentC /disable is run followed by ReAgentC /enable allows for a successful install of KB5034441.

      I fully expect that just shrinking the Recovery partition to 100 MB after ReAgentC /disable is run followed by ReAgentC /enable would also allow for a successful install of KB5034441 because the winre.wim file would again appear under C:\Recovery\WindowsRE.

      After the update you can run ReAgentC /disable followed by running ReAgentC /enable and  then look near the end of the C:\Windows\Logs\ReAgent\ReAgent.log file to determine the minimum Recovery partition size needed and take it from there.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • Go to Susan’s post KB5034441 and KB5034440 and click on CVE-2024-20666 which says:
      As an alternative to updates provided above or if your version of Windows is not listed above, you can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog. It also tells you how to apply it to WinRE.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Millions of hacked toothbrushes used in Swiss cyber attack #2635283

      My choice is manual toothbrush + Oral-B Glide Floss + GUM® Proxabrush® + water flosser in that order after each meal.

      Faucet Tap Oral Irrigator Water Dental Flosser

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • CrashTestDummy

      A chain is only as strong as its weakest link. The lighter a bicycle is the heavier the chain must be to secure it. So it is a loosing proposition. Even a 440C stainless steel chain would be ineffective because the thief would simply cut through what the chain was anchored to. Better to get a dirty, rusty old bike that nobody would care to steal and would be cheap to replace. There is security in obscurity, don’t put all your eggs in one basket.

      However the most important concern with information theft is knowing if something has actually been stolen. What if someone has broken in and cut small circular holes in the bottom of all your company’s laptops in just the right places? You don’t know what data has been stolen do you? Yeah the possibilities are endless…

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • See Moving Windows Recovery Partition Correctly which also works for resizing it.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Windows RE — Curiouser and Curiouser #2635237

      Yes! See #2635064 at the end:

      To just change the primary partition back into a recovery partition use set id=27 (or for GPT set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac)
      See PARTITION_INFORMATION_GPT structure (winioctl.h)

      PARTITION_BASIC_DATA_GUID ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
      The data partition type that is created and recognized by Windows.
      Only partitions of this type can be assigned drive letters, receive volume GUID paths, host mounted folders (also called volume mount points)
      
      PARTITION_MSFT_RECOVERY_GUID de94bba4-06d1-4d40-a16a-bfd50179d6ac
      The partition is a Microsoft recovery partition.
      This value can be set for basic and dynamic disks.
      

      See also UEFI/GPT-based hard drive partitions and Overview of Disk Management.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Windows RE — Curiouser and Curiouser #2635067

      Very important:
      When ReAgentC is run an entry is appended to C:\Windows\Logs\ReAgent\ReAgent.log
      That log will help you understand what is going on. It is very verbose.

      Portions of C:\Windows\Logs\ReAgent\ReAgent.log following a ReAgentC /enable:

      2024-02-06 16:14:50, Info [ReAgentc.exe] –Partition info–
      2024-02-06 16:14:50, Info [ReAgentc.exe] VolumeName: \\?\Volume{b26f97dc-0000-0000-0000-10d1ff010000}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition3
      2024-02-06 16:14:50, Info [ReAgentc.exe] Partition number: 3, offset: 2198235774976, free space: 769089536, total space: 786427904
      2024-02-06 16:14:50, Info [ReAgentc.exe] DiskNumber:0, DiskSignature:-1301309476, NTFS:1, Mbr:1, Active:0, Boot:0, BitlockerEnabled:0
      2024-02-06 16:14:50, Info [ReAgentc.exe] MBR partition id: 0x27
      2024-02-06 16:14:50, Info [ReAgentc.exe] DiskId: {00000000-0000-0000-0000-000000000000}
      …
      2024-02-06 16:14:50, Info [ReAgentc.exe] Checking partition at offset 2198235774976, partition number: 3
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements Partition details: {Offset: 2198235774976, Free space: 769089536, Total space: 786427904}
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements WinRE WIM size: 471185238
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements Required free space: 525711190
      2024-02-06 16:14:50, Info [ReAgentc.exe] partition meets requirements
      2024-02-06 16:14:50, Info [ReAgentc.exe] NOTE: select partition because it meets WinRE requirements
      …
      2024-02-06 16:14:50, Info [ReAgentc.exe] Copying WinRE from C:\Windows\system32\Recovery to staging location on \\?\GLOBALROOT\device\harddisk0\partition3
      

      Any recovery partition must be identified as Recovery(Type:27) not Primary(Type:7) and be large enough to be suitable.
      When not in use it should be empty. Use diskpart’s set id=27 command to change it.

      ReAgentC /disable moves everything from the recovery partition’s NTFS filesystem under \Recovery\WindowsRE to C:\Windows\system32\Recovery.

      ReAgentC /enable moves everything from C:\Windows\system32\Recovery to a suitable recovery partition under \Recovery\WindowsRE.
      If there is no suitable recovery partition, everything is moved into C:\Recovery\WindowsRE.

      You must use DIR /A to look at hidden and system files at an Administrator command prompt.

      DISKPART> select disk 0
      
      Disk 0 is now the selected disk.
      
      DISKPART> list partition
      
      Partition ### Type Size Offset
      ————- —————- ——- ——-
      Partition 1 Primary 50 MB 1024 KB
      Partition 2 Primary 2047 GB 51 MB
      Partition 3 Recovery 750 MB 2047 GB
      
      DISKPART> select part 3
      
      Partition 3 is now the selected partition.
      
      DISKPART> detail partition
      
      Partition 3
      Type : 27
      Hidden: No
      Active: No
      Offset in Bytes: 2198235774976
      
      Volume ### Ltr Label Fs Type Size Status Info
      ———- — ———– —– ———- ——- ——— ——–
      * Volume 3 Windows RE NTFS Partition 750 MB Healthy Hidden
      

      I ran sysinternals Process Monitor while KB5034441 was installing and took some notes:

      Command: C:\Windows\TEMP\IXP000.TMP\WinREUpdateInstaller.exe
      Read: C:\$WinREAgent\Scratch\update.wim
      Write: C:\$WinREAgent\Scratch\exported.wim
      Logging: C:\Windows\Logs\WinREAgent\setupact.log
      
      C:\Windows\system32>DIR /A /S C:\$WinREAgent
      
      Directory of C:\$WinREAgent
      
      02/05/2024 09:24 PM <DIR> .
      02/05/2024 09:24 PM <DIR> ..
      02/05/2024 09:19 PM <DIR> Rollback
      02/05/2024 09:24 PM 81 Rollback.xml
      02/05/2024 09:24 PM 343 RollbackInfo.ini
      02/05/2024 09:23 PM 3,935 WinREServicingManager.xml
      3 File(s) 4,359 bytes
      
      Directory of C:\$WinREAgent\Rollback
      
      02/05/2024 09:19 PM <DIR> .
      02/05/2024 09:19 PM <DIR> ..
      0 File(s) 0 bytes
      
      Total Files Listed:
      3 File(s) 4,359 bytes
      
      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2634337

      If any of your UWP apps fail to start these packages will fix that.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2634322

      Easy solution! Just install these two packages from the online Microsoft Store:
      Microsoft Visual C++ 2015 UWP Desktop Runtime Package
      Microsoft Visual C++ 2015 UWP Runtime Package

      These all have DLLs with File version: 14.39.33519.0

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      2 users thanked author for this post.
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2633614

      I’ve followed this a bit further (I’m stopping for now):

      Complaints on reddit:
      Windows Photos app and Calculator stopped working. File System Error (-2147219196).

      On Feedback Hub:
      Windows 10 suddenly won’t open after updating: Photos, Calculator, Feedback Hub, etc. (Jan 23rd 2024)-(Most likely the cause could be the Intel 2 Core CPU and/or 64-Bit)

      Here Matthew Jones writes:
      If you input “Get-AppxPackage Microsoft.VCLibs.140.0* | Remove-AppxPackage” in PowerShell then you’ll see that VCLibs are dependencies for most of the apps that people say no longer work.

      He shows a newer version Microsoft.VCLibs.140.00_14.0.33321.0_* than what powershell on my system:

      Get-AppxPackage Microsoft.VCLibs.140.0*|select InstallLocation
      
      InstallLocation
      —————
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.30704.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x86__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.32530.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x64__8wekyb3d8bbwe

      google[sse4.2 instruction set] says:
      SSE4. 2 is an updated version of the Streaming SIMD Extensions 4 (SSE) CPU instruction set. Nowadays, all modern CPUs fully support this instruction set since it was already introduced in 2008 (Intel) / 2011 (AMD).

      I came across these using google[sse4.2 instruction set download]:

      [Arnold] [MtoA] How to check if your processor supports SSE4.2
      Use sysinternals coreinfo -f

      SSE4.2 fix (help for old CPU without this instruction)

      Which uses Intel® Software Development Emulator:

      Intel® SDE Current Version 9.33 Released on January 07, 2024 DOWNLOAD

      The documentation from the download sde-external-9.33.0-2024-01-07-win.tar.xz\sde-external-9.33.0-2024-01-07-win\doc\getting_started.html says:

      Intel® SDE is application level binary instrumentation based emulator.
      Running Intel® SDE on applications is of the following pattern:
      % <path-to-kit>/sde [sde args] — user-application [app args]

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • I updated one of my test systems running Windows 10 Pro 19045 a week ago and Windows Update did not install the update for the Recovery Partition. The C: drive is not GPT and has an unused 100+ MB third partition after the 2047 GB C: partition followed by a 500+ MB fourth partition which is the working Recovery Partition.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2633508

      Before you go updating any UWP apps using Microsoft Store (I haven’t yet, it may affect my PCs) you should have a look at this:

      Windows 10 users report app gremlins after Microsoft update
      When Redmond says unsupported, it really means it. Windows 11 fans beware

      Old Windows 10 hardware is struggling to open some recently updated Microsoft applications, giving anyone running Windows 11 on unsupported hardware a glimpse of their potential future.

      The answer appears to be the use of old hardware. Intel Core 2 Duo and Quad processors have featured in some of the reports, as well as some AMD Athlon chips. The Core 2 line first turned up in 2006 and, while not on the list of officially supported processors for Windows 10, the processor had more than enough oomph for many productivity tasks, until now.
      A Register reader got in touch to highlight the situation: “A common theory is that the faulting component uses some instruction extension that Core 2 doesn’t support, such as SSE 4.2.”

      The article references Microsoft Photos: File system error (-2147219196) where on page 2 Salvatore Besso writes:

      But I have to add more information. This morning I have tried all the Store apps that I have installed on this computer and there are many more with the same defect: It opens and then suddenly crashes. Following is the complete list of all apps that are crashing exactly like Photos:

      1. Calculator
      2. Movies and TV
      3. Photos
      4. Feedback Hub
      5. Paint 3D
      6. 3D Viewer

      The error code -2147219196 is 80040904 in hex, which apparently means “Operation not supported”.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      3 users thanked author for this post.
    Viewing 15 replies - 31 through 45 (of 207 total)