• EyesOnWindows

    EyesOnWindows

    @eyesonwindows

    Viewing 15 replies - 46 through 60 (of 213 total)
    Author
    Replies
    • in reply to: Windows RE — Curiouser and Curiouser #2635067

      Very important:
      When ReAgentC is run an entry is appended to C:\Windows\Logs\ReAgent\ReAgent.log
      That log will help you understand what is going on. It is very verbose.

      Portions of C:\Windows\Logs\ReAgent\ReAgent.log following a ReAgentC /enable:

      2024-02-06 16:14:50, Info [ReAgentc.exe] –Partition info–
      2024-02-06 16:14:50, Info [ReAgentc.exe] VolumeName: \\?\Volume{b26f97dc-0000-0000-0000-10d1ff010000}, PartitionName: \\?\GLOBALROOT\device\harddisk0\partition3
      2024-02-06 16:14:50, Info [ReAgentc.exe] Partition number: 3, offset: 2198235774976, free space: 769089536, total space: 786427904
      2024-02-06 16:14:50, Info [ReAgentc.exe] DiskNumber:0, DiskSignature:-1301309476, NTFS:1, Mbr:1, Active:0, Boot:0, BitlockerEnabled:0
      2024-02-06 16:14:50, Info [ReAgentc.exe] MBR partition id: 0x27
      2024-02-06 16:14:50, Info [ReAgentc.exe] DiskId: {00000000-0000-0000-0000-000000000000}
      …
      2024-02-06 16:14:50, Info [ReAgentc.exe] Checking partition at offset 2198235774976, partition number: 3
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements Partition details: {Offset: 2198235774976, Free space: 769089536, Total space: 786427904}
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements WinRE WIM size: 471185238
      2024-02-06 16:14:50, Info [ReAgentc.exe] MeetPartitionRequirements Required free space: 525711190
      2024-02-06 16:14:50, Info [ReAgentc.exe] partition meets requirements
      2024-02-06 16:14:50, Info [ReAgentc.exe] NOTE: select partition because it meets WinRE requirements
      …
      2024-02-06 16:14:50, Info [ReAgentc.exe] Copying WinRE from C:\Windows\system32\Recovery to staging location on \\?\GLOBALROOT\device\harddisk0\partition3
      

      Any recovery partition must be identified as Recovery(Type:27) not Primary(Type:7) and be large enough to be suitable.
      When not in use it should be empty. Use diskpart’s set id=27 command to change it.

      ReAgentC /disable moves everything from the recovery partition’s NTFS filesystem under \Recovery\WindowsRE to C:\Windows\system32\Recovery.

      ReAgentC /enable moves everything from C:\Windows\system32\Recovery to a suitable recovery partition under \Recovery\WindowsRE.
      If there is no suitable recovery partition, everything is moved into C:\Recovery\WindowsRE.

      You must use DIR /A to look at hidden and system files at an Administrator command prompt.

      DISKPART> select disk 0
      
      Disk 0 is now the selected disk.
      
      DISKPART> list partition
      
      Partition ### Type Size Offset
      ————- —————- ——- ——-
      Partition 1 Primary 50 MB 1024 KB
      Partition 2 Primary 2047 GB 51 MB
      Partition 3 Recovery 750 MB 2047 GB
      
      DISKPART> select part 3
      
      Partition 3 is now the selected partition.
      
      DISKPART> detail partition
      
      Partition 3
      Type : 27
      Hidden: No
      Active: No
      Offset in Bytes: 2198235774976
      
      Volume ### Ltr Label Fs Type Size Status Info
      ———- — ———– —– ———- ——- ——— ——–
      * Volume 3 Windows RE NTFS Partition 750 MB Healthy Hidden
      

      I ran sysinternals Process Monitor while KB5034441 was installing and took some notes:

      Command: C:\Windows\TEMP\IXP000.TMP\WinREUpdateInstaller.exe
      Read: C:\$WinREAgent\Scratch\update.wim
      Write: C:\$WinREAgent\Scratch\exported.wim
      Logging: C:\Windows\Logs\WinREAgent\setupact.log
      
      C:\Windows\system32>DIR /A /S C:\$WinREAgent
      
      Directory of C:\$WinREAgent
      
      02/05/2024 09:24 PM <DIR> .
      02/05/2024 09:24 PM <DIR> ..
      02/05/2024 09:19 PM <DIR> Rollback
      02/05/2024 09:24 PM 81 Rollback.xml
      02/05/2024 09:24 PM 343 RollbackInfo.ini
      02/05/2024 09:23 PM 3,935 WinREServicingManager.xml
      3 File(s) 4,359 bytes
      
      Directory of C:\$WinREAgent\Rollback
      
      02/05/2024 09:19 PM <DIR> .
      02/05/2024 09:19 PM <DIR> ..
      0 File(s) 0 bytes
      
      Total Files Listed:
      3 File(s) 4,359 bytes
      
      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2634337

      If any of your UWP apps fail to start these packages will fix that.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2634322

      Easy solution! Just install these two packages from the online Microsoft Store:
      Microsoft Visual C++ 2015 UWP Desktop Runtime Package
      Microsoft Visual C++ 2015 UWP Runtime Package

      These all have DLLs with File version: 14.39.33519.0

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      2 users thanked author for this post.
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2633614

      I’ve followed this a bit further (I’m stopping for now):

      Complaints on reddit:
      Windows Photos app and Calculator stopped working. File System Error (-2147219196).

      On Feedback Hub:
      Windows 10 suddenly won’t open after updating: Photos, Calculator, Feedback Hub, etc. (Jan 23rd 2024)-(Most likely the cause could be the Intel 2 Core CPU and/or 64-Bit)

      Here Matthew Jones writes:
      If you input “Get-AppxPackage Microsoft.VCLibs.140.0* | Remove-AppxPackage” in PowerShell then you’ll see that VCLibs are dependencies for most of the apps that people say no longer work.

      He shows a newer version Microsoft.VCLibs.140.00_14.0.33321.0_* than what powershell on my system:

      Get-AppxPackage Microsoft.VCLibs.140.0*|select InstallLocation
      
      InstallLocation
      —————
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.30704.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.32530.0_x86__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x86__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.32530.0_x64__8wekyb3d8bbwe
      C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.32530.0_x64__8wekyb3d8bbwe

      google[sse4.2 instruction set] says:
      SSE4. 2 is an updated version of the Streaming SIMD Extensions 4 (SSE) CPU instruction set. Nowadays, all modern CPUs fully support this instruction set since it was already introduced in 2008 (Intel) / 2011 (AMD).

      I came across these using google[sse4.2 instruction set download]:

      [Arnold] [MtoA] How to check if your processor supports SSE4.2
      Use sysinternals coreinfo -f

      SSE4.2 fix (help for old CPU without this instruction)

      Which uses Intel® Software Development Emulator:

      Intel® SDE Current Version 9.33 Released on January 07, 2024 DOWNLOAD

      The documentation from the download sde-external-9.33.0-2024-01-07-win.tar.xz\sde-external-9.33.0-2024-01-07-win\doc\getting_started.html says:

      Intel® SDE is application level binary instrumentation based emulator.
      Running Intel® SDE on applications is of the following pattern:
      % <path-to-kit>/sde [sde args] — user-application [app args]

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • I updated one of my test systems running Windows 10 Pro 19045 a week ago and Windows Update did not install the update for the Recovery Partition. The C: drive is not GPT and has an unused 100+ MB third partition after the 2047 GB C: partition followed by a 500+ MB fourth partition which is the working Recovery Partition.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: MS-DEFCON 3: A bumpy start to 2024 #2633508

      Before you go updating any UWP apps using Microsoft Store (I haven’t yet, it may affect my PCs) you should have a look at this:

      Windows 10 users report app gremlins after Microsoft update
      When Redmond says unsupported, it really means it. Windows 11 fans beware

      Old Windows 10 hardware is struggling to open some recently updated Microsoft applications, giving anyone running Windows 11 on unsupported hardware a glimpse of their potential future.

      The answer appears to be the use of old hardware. Intel Core 2 Duo and Quad processors have featured in some of the reports, as well as some AMD Athlon chips. The Core 2 line first turned up in 2006 and, while not on the list of officially supported processors for Windows 10, the processor had more than enough oomph for many productivity tasks, until now.
      A Register reader got in touch to highlight the situation: “A common theory is that the faulting component uses some instruction extension that Core 2 doesn’t support, such as SSE 4.2.”

      The article references Microsoft Photos: File system error (-2147219196) where on page 2 Salvatore Besso writes:

      But I have to add more information. This morning I have tried all the Store apps that I have installed on this computer and there are many more with the same defect: It opens and then suddenly crashes. Following is the complete list of all apps that are crashing exactly like Photos:

      1. Calculator
      2. Movies and TV
      3. Photos
      4. Feedback Hub
      5. Paint 3D
      6. 3D Viewer

      The error code -2147219196 is 80040904 in hex, which apparently means “Operation not supported”.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      3 users thanked author for this post.
    • COBOL in 100 seconds

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • in reply to: Goodbye 2023, fly high #2616405

      On lighter note, this all triggered the memory of a now nearly 100 year old song for me:
      Annette Hanshaw “Happy Days Are Here Again” (1929) LYRICS history lesson Depression Years

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: MS-DEFCON 4: Is Windows 11 really a disaster? #2590352

      I allowed Windows Update to install 2023-09 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5030211) today and got Microsoft Windows 10 Pro Version 22H2 (OS Build 19045.3448) as a result.

      I did notice brief episodes of online Outlook and Chrome browser network use crawling along but didn’t chase it down. I thought it was just the install slowing things down on my gigabit connection.

      After the install rebooted I was presented with this unwelcome surprise:
      SearchBoxAddedToYourTaskbar
      Yeah, I clicked UNDO. What, you think I don’t know how to search from within a browser Microsoft? I have removed all the “Indexing Options” folders and yet it still indexes 10 items locally. What a waste. And I can manage to turn that “Search Box” on and off if I want with out your meddling Microsoft! Just by right-clicking on the taskbar and moving the pointer to Search:
      SearchBoxAddedToYourTaskbar-X
      The “Cloud” Windows Backup also appeared in the Start Menu apps list:
      SearchBoxAddedToYourTaskbar-New
      No option to uninstall it in right-click More > … . Right-clicking More > App settings brings up settings for “Windows Feature Experience Pack”. What??? Weird…

      Also Microsoft Store > Library  showed updates for Microsoft Store, Microsoft Photos, App Installer, and Windows Clock:
      SearchBoxAddedToYourTaskbar-Store

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      3 users thanked author for this post.
    • And then there is this from Disable S mode without a Microsoft account, page 2:

      “There IS a procedure to remove SMode without using the windows store however it involves several advanced techniques Recovery Mode, Admin Command Prompt, and Regedit. Only attempt this if you have backed up your data and are familiar with these tools. I can kinda understand why David would not mention this either because he did not know or was not comfortable explaining how to modify an offline registry hive in a preboot environment.”

      1. Boot into recovery mode Settings > Recovery > Advanced Startup > Reboot now
      2. Click advanced troubleshooting open an admin command prompt in recovery mode and run regedit
      3. Click on HKEY Local Machine and than select Load Hive from the file menu.
      4. Go to C:\windows\system32\config and select the file named SYSTEM
      5. Name the loaded hive offline System it will now show up under HKEY Local Machine.
      6. Navigate to offlineSystem\ControlSet001\Control\CI\Policy
      7. Change SkuPolicyRequired from 1 to 0 unload the hive and reboot the computer.

      “There is a good tutorial demonstrating the process here glad to know there are still some people in the IT world that actually take the time to do this kind of research for the rest of us”

      See this youtube video How To Turn Off Windows S Mode Without Microsoft Account

      Note: It is really a hoot to watch! BTW, you can also turn SMode back on if you want to…

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      2 users thanked author for this post.
    • See #2486181 for How to Clean Install Windows 11 Using DISM on Any HDD/SSD.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
      1 user thanked author for this post.
    • in reply to: I honestly can’t tell if this is a scam or not #2564575

      So I googled 206-429-9176.

      First, from answers.microsoft.com there is this:

      I got a call twice from 1(206) 429-9176, they claim to be microsoft 365 support. They ask for ticket number and name. Is this number even legit from microsoft?

      with an answer from Stefan Blom which says:

      Phone numbers for Office business support are listed in the article at https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2.

      The number (206) 429-9176 does not appear in the North America portion; in fact the area code does not either. Very strange!

      Second from https://www.callercenter.com/206-429-9176.html there are 23 User Complaints and 14 Complaints to the FTC.

      Those complaints seem to be indicative of a scam to me…

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Microsoft will force push 22H2 on 21H2 PCs #2561657

      Just saw this today May 24, 2023 on MSN:
      Why Microsoft Is Forcing All Windows 10 Users to Upgrade to 22H2
      Which says:

      Why has Microsoft chosen Windows 10 22H2, you ask? This is because 22H2 is the last version of Windows 10. Microsoft will automatically upgrade all versions of Windows 10 to Windows 10 22H2 because older versions of the OS, including Windows 10 21H2, will reach the end of support on June 13, 2023.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Windows 11 erases Windows 10 digital-signature fix #2552879

      Still can’t seem to find where the Digital Signatures are stored!

      SignTool is a command-line tool that digitally signs files, verifies the signatures in files, and time stamps files and is available as part of the Windows SDK, which you can download from Windows SDK.
      Verify command option /a:
      Specifies that all methods can be used to verify the file. First, SignTool searches the catalog databases to determine whether the file is signed in a catalog. If the file isn’t signed in any catalog, SignTool attempts to verify the file’s embedded signature. We recommend this option when verifying files that might or might not be signed in a catalog. Examples of files that might or might not be signed include Windows files or drivers.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    • in reply to: Microsoft… I’m not in the mood for this #2552538

      Gosh such vehemence! Speaking for myself, I’ve had a Microsoft Account for over 25 years now. It has been my primary email account for all that time but I use Outlook Online to access my mail nowadays. I don’t sign into my computer using the account. Just today when I signed in to check my email, the following popped up (the ************ you see is my doing):
      Privacy setting popup
      Clicking the “Learn more” link here will show you what all the privacy settings are for a Microsoft Account. You don’t have to sign-in to see all the places a Microsoft Account comes into play. For myself, probably much to Microsoft’s chagrin, I have everything turned off. As a result I don’t get that “personalized experience” Microsoft is so desperate to foist on me. I have had a fine “experience” without ever purchasing any Microsoft products what-so-ever over those 25 years.

      After I did a fresh install recently on a test system, the settings app displayed
      Get even more out of Windows
      With a few quick selections, you’ll be on your way to enjoying the full Microsoft experience.”
      as is shown here:
      Settings app sign-in
      Just for kicks I clicked on “Let’s go!” and followed through clicking yes on everything. Naturally it wanted a Microsoft Account sign-in right off the bat which I obliged it with. The rest of it was just the standard privacy settings followed by how will you use this system culminating in trying to sell me on Microsoft Office 365 and more space on One drive. Sadly for Microsoft, I of course declined, and later switched back to the local account and scrubbed out any vestiges of the Microsoft Account related settings. So far the setting app hasn’t displayed that message again.

      Note: See Don’t activate the “Let’s Go” button in the Windows 10 Settings application for a nicely detailed write-up of this by Martin Brinkmann.

      My point is that Microsoft has been pushing this for a very long time now and I will make use of a free Microsoft Account as I see fit in ways which benefit me and not Microsoft. I have never had to pay for it or give away any secret information to keep it. Just like over-the-air free TV, there will always be commercials which I have had a lifetime’s experience in tuning-out and ignoring.

      Note: I posted this without seeing @Rick Corbett’s post first. By “vehemence” I was referring to all the posts I saw here.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB

      HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
      Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB
    Viewing 15 replies - 46 through 60 (of 213 total)