WTF, MS?

Frankly, that could probably be the tagline to this blog, but hey. Having had a run-in with a couple of trojans last night, I left the computer on overnight running a full scan, and by this afternoon it was showing the antimalware software running at 25% CPU pretty much constantly. Time for a clean reboot. On checking task manager following boot, I saw an Edge process kick off automatically, with nothing running. A bit of Googling led to this post on Windows Central which shows the bad effect Chrome has on everyone else - it used to be that only Chrome pre-loaded trash into memory (which was why, when I installed it many moons ago to test, it doubled my laptop's boot time) but now everyone's doing it, presumably because everyone's using Chromium as a base. The fix is to use group policies to stop it - Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge and disable "Allow Microsoft Edge to pre-launch at Windows startup" and "Allow ME to start and load the Start and New Tab page at Windows startup". Also stops it when Windows is idle. (Nothing bugs me quite so much as the computer suddenly storming into life when it should be sitting there quietly, twiddling its silicon thumbs.)

New, yet old

 Left my machine running during tea, because I had a metric fucktonne* of work open - apps and various file explorer windows - and wanted to come back to it.

Came back, the machine was off. Nothing - repeat, nothing - in the event logs. No power cut either, everything else in the house running fine. Windows update (always a bastard) had not run.

Disturbed, I had a root around to find that the last file before it died was telemetry - specifically, Microsoft Office Click-to-run. Programs and Features is now showing Office with an install date of today.

A bit of Googling reveals the following:

https://social.technet.microsoft.com/Forums/en-US/cd971c47-bb24-49bc-9b53-6ec1cbdc9870/windows-update-no-office-2016-updates?forum=win10itprosecurity

i.e. if you have any Click-to-run version of Office installed, then updates are controlled within the applications, independent of Windows Update on the machine. 

I have no idea whether the update-and-shutdown-and-screw-your-workflow was by design, or if something failed, but updates are now disabled on this computer. I'll decide when to run them, thanks very much.

---

* 1.61x an imperial fuckton.

What a festering pile of SPP

 Ah, Microsoft devs. What on earth is the point of you? I'm always amazed when I do a Google search for an issue - any issue really - and find it's been a problem for years, through many iterations of the Windows OS and that dozens, if not hundreds, of fee-paying users continue to experience issues and Microsoft continues to do sweet FA, other than laugh all the way to the bank - while Bill Gates gets universal acclaim for saving humanity with the small change that one of his cleaning staff found down the back of just one of his many sofas.

I digress. This blog is pretty moribund, partly because I'm retraining to get the hell out of IT (because I looked at Linux, and at the online Linux communities, and decided I'd rather try my luck elsewhere). But it's here, so I may as well still use it for this one, which is peculiar. 

Software Protection Platform - this service handles licensing within Windows, for those apps and services which are registered with it. So it will be kicked off by Windows itself on login, plus Office, Windows Update, Windows Defender, and various remote access calls. I started poking it because, while it appears to be working on my system, it was making a lot of random calls and kept rescheduling itself for 2122. (There's no reason for this, other than bad coding - something about there being a 100-year default if an end-point isn't properly specified.) But a number of people are having major issues with it, and have been since at least Windows 8 - and the issues are still occurring in Windows 11. This can be the service failing to start, taking ages to start (during which time the system hangs) or the service randomly restarting and closing down apps, and sometimes computers, in the process. Tumbleweed from Microsoft, obvs.

SPP is a weird one because there are 3 tasks in the scheduler relating to it, and it will work fine if you disable 2 of them and leave the main SvcRestartTask running. The service itself is set to Automatic start and the only options are on or off - you can't set it to Manual even with PowerShell. If the service is running, any call to it will kick off reporting to Event Viewer, and the last thing it does is reconfigure the SvcRestartTask for 100 years in the future. If you disable the service, Windows will not be able to guarantee the licensing and things will break. If you leave the service enabled but disable SvcRestartTask - or even change its parameters - then licensing will work absolutely fine, but the SPP service will bitch every 30s to Event Log that the the task can't be rescheduled. So I can only assume there's something hardcoded into the service itself to do with that, as I can't find another task or service that would cause it. 

For anyone for whom this is causing actual problems, the only fix seems to be to work out (with the help of, say, PSTools) what exactly is causing the SPP service to kick off; if you're sitting there minding your own business and suddenly the system hangs or your app closes due to this, then something is calling SPP to trigger it (on servers this often seems to be remote management programs, and on desktops Windows Update seems to be the culprit). WU certainly can be disabled without issue, and only enabled when it's convenient to actually have it hog your bandwidth and system resources downloading fixes for things which Microsoft couldn't be bothered to code correctly in the first place. 

Not actually a computer thing but...

...Apple really, really don't want you using two phones with the same Apple ID. Not sure why. Are there really that many people selling on iphones without wiping them first, that this is a security consideration?

TL;DW - you can do it, but expect Apple to lock the account, screw up iMessage and ask both phones if it's ok if the other can do something every time you change functionality. It might just be easier to create a new ID for the new phone.

DHCP and Powershell

Powershell. Like all coding, it kinda makes sense when you can work through a command, although the chances of ever remembering the correct syntax whilst in the fray of a system meltdown seems remote. Like any foreign language, I suppose it's fine so long as you're in a situation of total immersion. For the rest of us, it's a phrase book all the way.

This morning's fun: trying to extract MAC addresses from a DHCP database so they can be set as reservations. I've done this before with Netsh but the details escape me. And I have that nagging feeling that I ought to be using Powershell, so...

To export leases:

Get-DHCPServerv4Lease -Computer <name> -ScopeID x.x.x.0 | Export-Csv <filename>

For "name" it really is just the name, no \\ required.

Importing can either be done on an individual basis in the console window, or via a .csv file.

The interactive command is

Add-DHCPServerv4Reservation -ScopeID x.x.x.0 -IPAddress x.x.x.x -ClientID "<MAC address>" -Description "<description>"

Note, the MAC address is the hyphenated version.

To do this via .csv, you need the headings "ScopeID", "IPAdress", "Name", "ClientID" and "Description" (typically of Microsoft, these are different names, and in a different order, from those in the export file - this may not be essential, but who knows?)

When you enter the MAC addresses and descriptions, you need the hyphenated address but no quotes.

Powershell command to import from a file:

Import-CSV -Path "<path>" | Add-DHCPServerv4Reservation -ComputerName "<fqdn>"

No, don't ask me why you can export from the NetBIOS name but you need the FQDN to import. It may be moot unless you have an enterprise setup, but I don't feel like testing it on a live server.

Hat-tip to Expert in the Cloud and Microsoft's own docmentation.

Office

More fighting with Office on the new install, but I found something useful. I knew the default Ctrl-V paste had been set to "keep formatting" - this is also the first option if you right-click to paste from the menu - but I didn't realise you could change the default. File > Options > Advanced > Cut, Copy and Paste section. Options are Keep Source Formatting, Merge, or Keep Text. 

It's been a while - but Windows 10 is still pants

Remember what I said about Windows 10 oh, about 5 years ago now? Nothing has happened to changed my mind. On the contrary. Now I'm forced into both supporting it and running it on my own computers, my cordial dislike has hardened to outright loathing, accompanied by a strong desire to punch the relevant developers in the throat. Remember, kids - coding without due care and attention is bad for your health.

I've been having particular issues lately, for no obvious reason, with activating VLK versions of Windows. Put in the correct key during install, the build decides it has another key (where the hell did it get that from?) which it can't activate because "the organisation's activation server isn't available". Don't ask me how it's managed to install a KMS version of Windows when I downloaded the ISO for the VLK version and put the volume licence key in. And this is confirmed by the fact that it will activate to the VLK, but only programmatically:

 From an elevated command prompt:

slmgr.vbs -ipk <product key> [this changes the installed key]

slmgr.vbs -ato [this does the activation]

Hat-tip to Carey Frisch MVP.

Outlook vs Sharepoint

A little thing, but an annoying one.  Both Outlook and Sharepoint cache used e-mail addresses, even when you've entered the address incorrectly; these then appear as auto-complete options on new e-mails.  To delete incorrect or unwanted entries from the auto-complete list:

In Outlook:
Open a new e-mail.
Start typing an address.  An auto-complete list will appear.
Use keyboard arrows or mouse to highlight the offending entry.
Click the X at the right-hand side of the entry to delete.

In Sharepoint:
Similar procedure, except that you cannot use the mouse, or the process fails.
Open a new e-mail.
Start typing an address.  An auto-complete list will appear.
Use the keyboard arrows to highlight the offending entry.
Use the Delete key to delete the entry.

Blogger tweaks

This is an interesting one.  By default, Google wants you to use posts on a single blog page, with the option for extra static pages for reference information.

You can use the Page widget in the Layout to create a page using the link of a label search.  This will give what appears to be a page of blog posts on a related topic, but is actually an archive.  Those posts will also show up on the home page.  (Going to the page will give a status message of "you are viewing all the posts with label X" but there's a way to get rid of that.)

To get themed posts to show on a "static" page without showing on the home page as well is more tricky.  There are several ways to do it if you don't want anything on your homepage at all, or want the homepage to be a single, static post (including using custom 404s or page redirects).  To show both - i.e. to have a "normal" blog on the homepage, with "extra" themed posts on their own pages - is non-standard, not how Google wants it to work, and thus requires changes to the HTML of the template, plus JavaScript. I found a nice little tutorial on how to do this, plus how to hide the identifying label from the label widget.  One thing that isn't mentioned in the tutorial is that it doesn't just hide the labelled post: it also hides anything posted the same day (I don't know enough about JavaScript or Blogger to be able to say why).  For the lack of hassle, I'm prepared to just put a different date on a post when using the specific label.

Outlook revisited

It never improves.

Today, I foolishly decided to correct my Outlook configuration.  You can have any number of .pst files associated with an account, but Outlook will keep its main outlook.ost file for holding the calendar, notes, tasks, journal, contacts and the rest of it.  When you set it up for the first time, it will gleefully pounce on the first e-mail address (and associated .pst file) that you add as the default, and that cannot be easily changed.

Not too much of a problem if you only have one account and it's an Exchange account; more of a problem if you have a bunch of accounts, of varying types, on more than one server.

Oh, and Outlook won't let you use the .pst file associated with an IMAP account as your default Outlook delivery location (I think because an IMAP account is e-mail only, and doesn't have all the other bits).  If you have a secondary Exchange e-mail account it will grab that, which is no good if it's not your primary account (or if, as in my case, it's in someone else's organisation - I need to be able to see it and send from it, but I don't want to be sending from it by default, and I certainly don't want my own org Outlook details mixing with those of the client org.)

If you get caught like this, first things first - go into Accounts and remove everything.  E-mail addresses need to go before their respective data files.  IMAP data files will be recreated, so there's actually no real point keeping them, unless you want to check that everything has synchronised correctly.  The default e-mail has to be removed last, and you may have to close Outlook and go into Control Panel > Mail > Profiles and do it there.

[Aside: if you have moved your Windows profile, say to another drive, you will have Outlook files in both places.  The default outlook.ost file will go in <new drive>\<profile>\Documents\Outlook Files, but all the mail .pst files will go in <old drive>\<profile>\AppData\Local\Microsoft\Outlook]

Go into the above locations and delete (or move to a subfolder if you're feeling fragile) all the .pst and .ost files, with the exception of the outlook.ost.  NB: if you have POP3 data files, back them up first, unless you know you've a copy of emails on the server!

If you have no non-Exchange main org e-mail, create a new base account - I used an admin account.  Open Outlook and configure this account for POP3.  Outlook will then configure this as the default, meaning all the contacts, calendar etc will be within your organisation, associated with an e-mail address you control.

Add back the IMAP accounts.  Outlook will create new data files for them and synchronise - there seems to be no way of changing the location to pick up the old versions.  (Sort of makes sense given that the local versions of these are more of a cache than an actual mailbox - the live mailbox lives on your mail server.)  When they're all in place, you can pick up the saved data files from the subfolder one at a time, and make sure synchronisation has run OK and that you have all the mail.  (If they're POP3 data files, this may be the only copy of these mails you have, depending on the server.)  Once done, the old files can be deleted or (certainly in the case of POP3) kept as a backup.

Lastly, add in any non-organisation IMAP accounts.  Name them such that they group.  Add in any non-org calendars.  (Will need a separate post on that because I can't remember how I did it!)

Twitter defaults

Needed to make a note of this again for a client as I'd forgotten since the last account I set up.

Twitter icon (replaces egg) - needs to be square and ideally 400 x 400 (can crop it when you add it)
Header (only seen on your own page) - ideally 1500 x 500 with no gradient colour, as – ignoring any pre-processing you've already done – Twitter will compress the snot out of it anyway when you upload it.

Interestingly, for pictures you want to include in the twit-stream, they need to be no more than 440 x 220 with a ratio 2:1 (info from this Postcron piece).

The Assembly folder

This is a weird one.  In a search for something else entirely (which might become the subject of another post), I clicked on the c:\windows\assembly folder, and the result was a bit weird:

Specifically, the weirdness was in the icon for the filetype.  I wasn't sure if I'd been able to see the contents of this folder in the past, but a bit of research shows this is .NET's answer to the system32 folder's .dll mashup.  The folder on my computer is 1.7GB, which seems excessive, but the real problem with it is you can't make sense of what it's showing you - because it's pulling that info from a variety of subfolders, which it hides.

This, in itself, is interesting - and this is info from Geeks With Blogs about how that kind of shell namespace works.

The subfolders can be viewed from a standard command prompt.  Easiest way to accomplish this in windows seems to be to use the subst command to map a drive letter to one of the subfolders, e.g.

subst z: %windir%\assembly\GAC 
(you can then use subst z: /d to remove it when you've finished).

Alternatively, as the display of the namespace is controlled by desktop.ini, unhiding that and renaming it will cause the file structure to display in Explorer.

Outlook

Many years of using Outlook, never seen this one before.  Thanks for the minor heart attack, Microsoft...

E-mails "disappear" due to advanced filter setting on imap folder items

Windows 10 "upgrade"

Windows 10. Where do I start? What a mess.

Microsoft have decided that They Know Best and don't want everyone using Windows 7 for the next decade (because it actually works) in the same way that they used XP for a decade (because it actually worked).  There's a big push to get everyone on Windows 10 whether they want to use it or not.  That's a big problem as 1) there are serious security considerations with the new OS and 2) Microsoft will try to download many gigabytes of data in the background in the hope that you won't notice - whether you want to upgrade or not.

Microsoft has released a knowledgebase article about managing the install process, including preventing install of the updates.  Typically (and usurprisingly) it's not exactly a walk in the park for non-technical users.

First things first: Microsoft are offering a free upgrade until next July.  Even if you want it, there is no rush.

Generally good idea: turn off "recommended updates" in Windows Update.  All you need to have for safety are the security updates, and you can still review the recommended updates and install them if you want to.

If the little Windows 10 square window has appeared in your system tray, at least one of the updates has already installed.  To avoid a huge download (and potentially slow connection/extra bills if you're on a restricted connection) do the following:

1) Uninstall the relevant updates.  These are KB3021917, KB2952664 and KB3035583 in Windows 7, or KB2976978 and KB3035583 in Windows 8.

2) Check the system drive for hidden folders $Windows.~BT and $Windows.~WS.  These can both be deleted if you need the space, but use the command line - they won't all be deleted through Disk Cleanup, despite claims to the contrary.  You can leave them if you think you may want to upgrade at some point in the future and the download damage has already been done. (In that case you can right-click on the system tray icon and hide it to stop it bugging you.)

3) Look for the updates listed above, then hide them in Windows updates (or they'll be offered again).

If the icon hasn't appeared yet, go into Windows update, look for the relevant updates and hide them, so they aren't scheduled for download. Setting Windows Update to "notify me but don't download" is an option (and the one I go for personally) but it really only works if you've got the discipline to check through updates as they come in and install the relevant ones, rather than just ignoring the "updates waiting" icon in your system tray.  You don't need useless crap, but you do need security patches.

Setting up a NAT network on VirtualBox

VirtualBox is available as a free download from Oracle.

It can be set up in various ways.  New in the latest version is something called "NAT network" - essentially allowing you to run several virtual machines that share a virtual network, and NAT through the host machine's network card.

Set-up comprises:
1. Create virtual machines
2. Create virtual network - this affectively sets up the router (which was the bit I didn't realise)
3. Add the virtual machines to the network

Create the virtual network by going to File - Preferences - Network - NAT networks
Add a new one, call it whatever you like, then go into the settings for it and set the network CIDR - by default this is a class A network with a single subnet.  If you're going to run a DC on this network with DHCP, untick the "Supports DHCP" option on the NAT network.  Essentially, this page is setting up the (virtual) gateway router that sits between the guest VMs (either client or server) and the host (which, to the VMs, is equivalent to the internet).  Port forwarding is not required for standard applications.

Having set up the NAT network, all the VMs have to be configured to use it - this is the virtual equivalent of plugging the cable in.  Right-click on a VM and choose "Settings", then Network.  Click the "Attached to:" drop down and choose "NAT Network".  If there is only one NAT network configured, it will be chosen by default.  Repeat for all VMs on the same network.

All that remains is to fire up the server VM and set up a static IP address in the same range, and a DHCP scope.  Any client VMs can be set up to use DHCP.

Office registration

For Office 2010 Pro - only had this problem with trying to activate with a VLK.

If it gives peculiar errors on activation, or appears to activate but keeps asking to activate again on reboot, then activate via vbs:

a. Open an administrative command-prompt
b. Run one of the following command-lines based on your Operating System:

x86
cscript "C:\Program Files\Microsoft Office\Office14\ospp.vbs" /act
x64
cscript "C:\Program Files (x86)\Microsoft Office\Office14\ospp.vbs" /act


Slightly (sort of) related: Office performs a licence check whenever you start up an Office product, causing the Office Software Protection Platform service to start.  This then doesn't shut down automatically.  However, you can set this in the registry (need to create a new value):

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform

ValueName: InactivityShutdownDelay

ValueType: DWORD

ValueData: The number in seconds, that the Office Software Protection Platform will stay running for, after the most recent activity. The windows default for this is 300 seconds.

Details taken from the MS Technet forums.

AV rescue

Starting point for AV tools for a USB stick.
(All downloads available from BleepingComputer)

Create a bootable USB flash drive (requires WinPE from Windows ADK)
Will need to amend .cmd file by changing xcopy path.


Anti-rootkit
Malwarebyes Anti-Rootkit
TDSSKiller (only removes the TDSS rootkit)
Vba32 AntiRootkit
McAfee Labs rootkitremover
Panda antirootkit
TrendMicro RootkitBuster
MS Rootkit Revealer
GMER
aswMBR - specifically for MBR rootkits (needs reboot in safe mode)

Anti-malware
AdwCleaner
Malwarebytes AntiMalware


Anti-virus
EmiSoft Emergency kit (portable)
AVG remover
Avast remover
Sophos AV removal (standalone)


Specialist software
RogueKiller - stops running processes
rkill.exe - as above
ComboFix 15 - NB useful to have, USE WITH CAUTION. Win8 or below.
TreeSize Free - identifies storage use
CCleaner - Piriform crap cleaner.  Old files.
Recuva - Piriform file recovery
Hijack This - identifies startup hijacks.
Revo uninstaller - (30-day trial)
Process Explorer - task manager on steroids

Desktop utils
HashTab - adds an extra entry to file property page showing checksum. (free/$10)
SpeedFan

Outlook tweaks

With reference to Office 2010 Pro. Outlook - always defaults on install to minimum usability!

Navigation pane can be turned off from View tab. All folders apart from Sent are in the "Messages" view.

Generally, to change nav pane for all folders, change the default message view.

Specifically here, change the page to suit, then apply current view elsewhere: View tab > Change View > Apply current views to other mail folders...

Select folders from the list which appears. This will not change hidden folders (ones with their own views) or any folders where the view has been manually changed. For the latter, reset all views first: start up Outlook from a command line with switches:

 outlook.exe /cleanviews

Windows 7 tweaking

Decluttering explorer's navigation pane:

Homegroups: link to How-to Geek
Disable homegroup services.  That's it (assuming it wasn't added at install.)

Libraries.
I liken these to having a lady's maid or valet.  You say what clothes you want, and those clothes appear as if by magic.  If you want a shirt in the middle of the night, you're stuffed - you might know you have it, but good luck with finding it.  There's also the danger that the location of some of your clothes is "in the pawn shop," which isn't immediately obvious.

Full tutorial at sevenforums
Removing requires regedit:
HKEY_CLASSES_ROOT\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder
Change permissions on shell folder to give admins full control.
Modify attributes: b090010d removes, b080010d adds.


For Windows 7 x64, the above also needs doing at
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder

Changed pinned Explorer task location (independent of libraries!):
Under properties>shortcut change %windir%\explorer.exe (libraries) to (for example)
Computer: %windir%\explorer.exe shell:MyComputerFolder
My Docs:  %windir%\explorer.exe /n,::{450D8FBA-AD25-11D0-98A8-0800361B1103}
User profile: %windir%\explorer.exe shell:Profile
C: drive:  %windir%\explorer.exe /e,c:

Change start menu start locations away from libraries: use .reg files at sevenforums as it requires changing the values of entries from one string of gibberish to another.  .reg files also provided for changing back.  Needs a reload of the hive to work!