Ghost Files

In  Windows a space is not allowed in the end of a file name. When such a file is somehow created, it cannot be removed by regular means. As a workaround, try to specify the file location with the following notation:

"\\?\D:\path\filename "

 

Bitlocker

A new Surface laptop came with the bitlocker is not activated, but the hard drive was yet encrypted. The owner asked to turn off the encryption completely.
The UI of Windows 10 does not provide such an ability, but that could be achieved using the command line utility:

 manage-bde -off C: 

Read more how bitlocker works here.

To remove a wrong driver in windows

Was unable to connect a neighbor's Nook Color as a mass storage drive to a windows computer. Turned out the ClockworkMod universal ADB drivers installed earlier have a priority and won't let the usbstor.sys (the mass storage) to be selected a the primary device driver. Uninstalling the driver for the device in the Device Manager did not help, it appeared again after the device was unpluged and then plugged again.
Knowing the vendor and product IDs (for the Nook Color they are VID_2080&PID_0002), I found the ClockWork's oem##.inf file in the %SystemRoot%\inf folder.
Where ## is a number of the .inf file where the device VID and PID were mentioned.
Tried to delete that oem##.inf and then reboot the PC, did not help.
But what did help, is Window's pnputil utility.
Execute the following command as administrator and then even no need to reboot:
pnputil -d oem##.inf

Also, there is an useful utility to maintain the currently and previously connected USB devices.

Windows backup command line

Windows 8.1 does not have an GUI tool to schedule a regular system image backup.
But there is a command line which could be placed to the task scheduler:

wbAdmin Start Backup -backupTarget:E: -include:C:,D: -allCritical -quiet

Get the description of the wbAdmin command options by typing:

wbAdmin Start Backup /?

To restore the backup, first boot to the recovery partition. To do so on a healthy system (if the system is corrupted it should boot the recovery automatically) hold the Shift key when you click the "Reboot" button.

Cure for IE's paranoia

After the update KB3025390 was installed for IE11, it's stopped to allow access to its internal objects from outside. As it was described in this article, this behaviour could be cured by the following registry changes:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER]
"iexplore.exe"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER]
"iexplore.exe"=dword:00000001

Update: MS has released an update KB 3021952. To be installed to solve the issue instead of hacking the registry.


See also: http://www.inflectra.com/Support/KnowledgeBase/KB105.aspx

PC hunter

Sometimes when you try to modify a registry key you are getting "access denied" and even changing the ownership does not help. In this case try a free utility called "PC Hunter". It lets you to delete a problem registry node and then you could just created it back with default permissions.
The link to download: http://www.xuetr.com/download/PCHunter_free.zip
Original article the utility was mentioned:
https://www.raymond.cc/blog/full-control-permission-to-delete-or-edit-restricted-windows-registry/2/

hyperswitch

On windows, you should choose, either you use the Hyper-V or a third party virtual machines (such as android emulator with virtualization support provided by Intel x86 Emulator Accelerator (HAZM)).

In the second case the system hypervisor should be turned off:

bcdedit /set hypervisorlaunchtype off

 To turn it back on execute:

bcdedit /set hypervisorlaunchtype auto start

Reboot.

runas.vbs

Very simple script to run a command line application with elevated privileges: 

if WScript.Arguments.Length > 0 Then
    Set objShell = CreateObject("Shell.Application")
    dim a : a = ""
    for i=1 to WScript.Arguments.Length-1
        a = a & WScript.Arguments(i) & " "
    next
    objShell.ShellExecute WScript.Arguments(0), a, "", "runas"
end if

Remotely connect to the windows 2008 console.

Windows server won't let you to connect to the physical console session remotely.
Bot that's still possible.

Connect to a new session, then execute the following command:

tscon.exe 1

replace "1" with the console session if it's differ. To know it, open the task manager's Users tab and look for the console session id number.

To change the network profile

If you wired two PC together using a crossover cable or a hub without an outbound connection, windows makes the network connection type (profile) "Public" and all the public firewall rules will be applied. It's possible to make it "Private" using the script as described in this blog.

Windows on SSD

Made a new computer for my work place. It's not an upgrade, because the old one was not touched and completely replaced. I've got an ASUS motherboard (P8H77V-LE), an IvyBridge i7 CPU, plenty of memory, an Intel 520 series SSD for the system boot and a WD Black HDD for active work data.

To reduce the number of writing operation to the SSD, I moved some folders including my user profile to the HDD, and also instructed the system to create all new profiles there.

The latter is the most easy part, just change the registry value
HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\ProfileList\ProfilesDirectory

To redirect all the other folders you need to create a junction between the expected location and the actual one. The full list of the folders which were moved to be located on the HDD:

C:\Users\%myname%\
C:\ProgramData\
C:\Windows\Logs\
C:\Windows\System32\winevt\
C:\Windows\ServiceProfiles\LocalService
C:\Windows\SoftwareDistribution\DataStore\

To move a folder I need to boot to the recovery console (reboot, F8, repair (if F8 does notwork, try F5))
In the repair console the drive letters are changed. The drive C: becomes E:

Important! If there more than two drives in the system, the target HDD could also change the letter. Make sure it's letter is the same in the recovery mode as in the normal operation mode! Unplug or disable (in the BIOS setup) all other drives.

Use the robust copy command which carefully copies all the directory structure:
robocopy /copyall /mir /xj E:\ProgramData\ D:\ProgramData\

after the command above successfully creates a directory mirror, rename the source directory (delete it if you are brave enough) and then make a junction (a link), using the following command:

mklink /J E:\ProgramData\ D:\ProgramData\

make sure, the ACL remains the same for the original and the junction, use the icacls command as follows (assume the current dir is E:\):


icacls E:\ProgramData\ /save ProgramData.acl
- before you put the original away

icacls . /restore ProgramData.acl
- after you have created the junction

Directories like the following can't be safely moved, windows does not even boot:

C:\Windows\System32\config
C:\Windows\security

 Also do the following:

1. Direct the %TEMP% and %TMP% environment variable to a HDD folder.
2. Make the page file on the HDD as well. Even if you have a lot of RAM, the page file is still required.

Use windows' Resource Monitor to check, that most of writes now go to the D: drive (HDD). Use the Sysinternals' ProcMon to collect a statistic about file operations and make decision what could be also moved to the HDD.

Depricate an IP address

Say, a server has a number of IP addresses, but we don't want some addresses to be used as outbound.

ipconfig /all   gives us which address is preferred:

 Autoconfiguration Enabled . . . . : Yes
 IPv4 Address. . . . . . . . . . . : 2.68.18.2(Preferred)
 Subnet Mask . . . . . . . . . . . : 255.255.255.248
 IPv4 Address. . . . . . . . . . . : 2.68.18.3(Preferred)
 Subnet Mask . . . . . . . . . . . : 255.255.255.248

To make an address not preferred, remove it from the interface and recreate it again using the netsh:
 
interface ipv4 add address LAN 2.68.18.2 mask=255.255.255.248 preferredlifetime=0

keyboard switching utility

Updated the language switching utility
This utility assigns mostly unused the right "windows" key to switch between the system's languages.

Dynamic DNS

To prevent windows' DNS server from creating A records on all other interfaces the server might have (such as OpenVPN) to the dynamic DNS list, go to the DNS server's properties and exclude all the interfaces you don't need.

Association of file extensions in the registry

HKCR\.ext  def. value refers to a HKCR\Appl.DocType
which could have key  CurVer which refers to Appl.DocType.version

In this case look for HKCR\Appl.DocType.version

To let the ShellExecute() system call find the associated executable when called with the document name, the following key should exist and be valid:
HKEY_CLASSES_ROOT\Appl.DocType[.version]\Shell\Open

PlayBook <-> PC

Wanted to copy a big amount of music to the PB... Easy task? Duh!
First thing, after I plugged it to the PC, it was found as a mass storage device. But it contained only drivers. Hm.. Fine, let's install them. The driver sees the device, but how to open it to transfer files? The USB file sharing is on... What's could be possible wrong? The message on the playbook suggest go and download the "BB Desktop manager". The size? 110Mb. OMG! But let's give it a try. I can always uninstall it, right? Now a huge crapware is installed and actually does nothing except showing me the error "Cannot connect to PlayBook...". Great!.. Ok, long story short, it turned out, I just can treat the PlayBook as a network device. Just go to the "My Network Places" and search the device there. If it fails, look for the USB IP address and type in it in the explorer address bar as a UNC name (i.e. \\169.256.224.209). Tune your windows firewall if it prevent the CIFS(SMB) from working. So, it seems the mass storage mode is not an option at all. Why???

Sharing

Some collected facts about windows sharing.

1. There are two modes: when the "Simple file sharing" (SFS) is ON or OFF.
2. XP Home has only "simple" mode.
3. On every else (including Windows 6.x Home ?) can be changed that in the Explorer's Tools->Folder Options->View->"Use simple file sharing".
4. Also, the "Guest" account has to be enabled.
5. When it's on all connected users are considered as "Guests" (It's not a name but status).
6. To check the current mode, open the Computer Management->Shared folders->Sessions, or just by the command "net sessions"
7. There is policy "Limit local account use of blank passwords to console logon only", when enabled (by default) an account with blank password is not allowed to access the window shared folders.
8. jCIFS browses the network when the NtlmPasswordAuthentication is ANONYMOUS
9. It accesses a "simple" share when no credentials specified as GUEST.
10. So, the shared folders should have rights to the Guest account and/or for Everyone

windows passwords

to manage users and autologons in windows:
control userpasswords2

cmd variables tricks

Get the variable value with replaced part to some new string:
%variable:wildcard_string=new_string%
Get only part of the variable:

%variable:~num_chars_to_skip%
%variable:~num_chars_to_skip,num_chars_to_keep%
%variable:~num_chars_to_skip_from_start, -num_chars_to_skip_from_end%
%variable:~-num_chars_to_skip_from_end,num_chars_to_keep%
%variable:~-num_chars_to_skip_from_end,-num_chars_to_skip_from_end%  

other variable substitutions can be found in the command-line reference

Browser pas

Desperate one behaves vilely. Opera installer v11.11 made that browser default without asking me (I can swear, no questions were asked). To return the IE as default browser (not that I like or use IE for browsing, but to make it start first for test purposes) I had to modify the registry.
As it turned out, the HKCR hive is not a link but a cascade union of the HKEY_LOCAL_MACHINE\SOFTWARE\Classes and then HKEY_CURRENT_USER\Software\Classes. So, modifying one branch, make sure there is no the same in the second place which will override the values.