I have been keeping a close eye on what was the Standalone System Sweeper and found that the same tricks can be used with Microsoft WDO as the Microsoft SSS, as would be expected with the beta and final versions. While WDO cannot be used out of the box to create PXE images you can, with little effort, create bootable WIM files.

The steps are as follows:

1. Download Windows Defender Offline
2. Use the tool to create an ISO file and save it to your computer
3. Use a tool like 7-zip to extract the boot.wim from the sources folder within the ISO you created
4. Extract FilesList64.dll and mpam-fex64.exe or mpam-fe.exe and Fileslist32.dll depending on the bit-ness of the WDO CD you have as well
5. Using ImageX from the Windows AIK mount the boot.wim (Example: imagex.exe /mountrw “boot.wim” 1 c:mounted_images)
6. Add the two files from step 4 to the root of this WIM file
7. Unmount and commit the WIM file (Example: imagex /unmount /commit c:mounted_images)
8. Add your new WIM file as a boot image in WDS or SCCM

Once loaded in as a boot image you should be ready to go. Keep in mind that you might need to add drivers to the WIM as well but with most systems I use the wired network adapter is included.

Ok, so what started hosting on 443? Apache was able to bind before I started this, in fact on a reboot it worked great, and when I saved the changes and applied them 443 worked, I just can’t restart the service.

So I checked if Apache was possible still running somewhere using ps -aux |grep httpd 

That turned up noting so I tried fuser -k -n tcp 443 and again there wasn’t anything on 443, great I know know it is Apache stepping on itself, now just to find out why.

I checked the httpd.conf and verified I had Listen *:443 listed only once, which I did, so I decided to comment it out to see if Apache would start up and sure enough it did. Not only did it start up but it was listening on 443, that seems a little odd.

I started looking around and it sure wasn’t in https.conf, so I looked at ssl.conf and noticed a new section:

#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443

Ah ha, we found our culprit, simply commenting out one of the listens and we are back up and running on 443.

Now, I can’t be 100% positive if I uncommented this line myself or it was that way by default, I have been doing this move rather slowly, but I am under the impression I didn’t do this as the issue only arised after I put the Listen *:443 in to the httpd.conf and https was already working before I did this. Maybe I should have seen the issue coming but I didn’t.

I still am not sure how many OS’es are effected by this issue and what causes it but in all my cases I ran in to the issue on computers that had been hit by Malware but Malware that might not be the cause. Either way, the issue seems to be surrounding the Control Panel app nusrmgr.cpl and when I run into the issue it effects all users on the computer, admin or not. What you run into is when you try to manage accounts via the GUI you see an error message popup saying that “The current user account is not recognized. Restart the computer and then open User Accounts.” yet endless reboots do not help.

To resolve this on the computers have seen I had to use a fix that seems a little odd so I thought I would post it. I have been searching for days and couldn’t find anywhere online that had a fix for this other than doing a repair or reinstall on the OS which in my mind isn’t a fix at all. Anyways, on to the fix.

• First, log in to a user that does have administrative rights.
• Open up CMD in your prefered method.
• Create a new user account for temporary use with the following command.
  net user FixAccountIssueUser /add
• Next add the new user to the Administrators group using this.
  net localgroup administrators FixAccountIssueUser /add
• Now log off your current user and log in as the new user.
• Once logged in either run nusrmgr.cpl or use the Control Panel to edit your users. From my experience you will now have resolved the issue and all accounts can now be managed without the error and no reboots required.
• Log off your newly created user account and log back in to an account with admin rights.
• Delete the temporary account you created to fix this issue as you should no longer need it.

I don’t know if all these steps are needed as I have only had two chances to try this out but on both computers I tried this worked out great. If I see more computers with this issue I will see if you can shorten the process but for now this is what I suggest trying if you run into the issue.

If you have ever worked with Dynamic Disks you know about all the warnings that once converted there is no way to undo the conversion. These warnings are a little misleading as you can convert some Dynamic Disk back to Basic, without losing any data. Now for the little disclaimer, I have done this a few times on my own drives and never lost data but I was running with a single mirrored partition within the Dynamic Disk, this might not work on things like RAID 5 Dynamic Disks and other striping methods as you would expect. However, I can confirm that mirrored drives will convert back just fine and with very little effort.

Finding The Solution

I ran across this just the other day when I was working on recycling some old drives I had laying around. I threw them in a computer to format them and noticed that the raw data on one of them had a valid MBR yet was not NTFS like I thought it should have been. I took a deeper look into the situation and found that the partition was of type 42, not 07 as I expected. I decided to changed the partition type back to NTFS (type 07) to see what might happen, then rebooted in to Windows, and there were all my old files.

How To Do This Yourself

This is rather easy to do and even if you are not sure if the drive was mirrored or striped you can test it without doing any damage.

1. Download a hex editor that can edit disk drives and not just files. I prefer Tiny Hexer fromhttp://www.mirkes.de While the support for this application isn’t there I have never had issues with it and for its size it is very powerful.

2. Connect your drive that you want to convert, via USB, SATA, IDE, doesn’t matter. Just make sure the system can detect a drive is present.

3. Open up your hex editor with admin rights. Once it is loaded, open up the disk you want to convert back to Basic in edit mode. Make sure you open the disk and not a partition, if you are opening a partition you are looking at the wrong disk.

With Tiny Hexer this is done by clicking on File -> Disk -> Open Drive

4. Find Sector 0 Position 1C2 and verify that it is currently 42. If it is not a 42 make sure you selected the right drive, if you did open the correct disk and it isn’t 42 you might not want to try this. You can always undo this change without causing damage so if you are brave give it a shot anyways.

5. Change Position 1C2 from a 42 to 07, make sure you are overwriting and not inserting or you will cause minor damage, though it can be undone.

6. If you are on SATA or USB or any other PNP device you might be able to disconnect the drive and reconnect again or if needed reboot the system.

7. Open up Computer and you should see your drive listed if your files. If not see if it just needs to be assigned a drive letter, but it should be ready to go.

What if it didn’t work

If this did not seem to work you might have a striped volume and you will need other recovery methods to get to the data on the whole volume. Don’t forget to change 1C2 back to type 42 if this didn’t work for you, otherwise you might create other issues when trying to recover the data.

I logged in to my Google Voice site and sure enough, there are the inbound calls from “Unknown” with the option to either report them as spam or to block them. Reporting them as spam isn’t really what I want to do as that still rings the phone and just doesn’t allow for voice-mails to be left, I wanted to block them altogether. I have some concerns about blocking the “unknown” as Google Voice seems to know who is actually calling as you can see when choosing to block them they ask “Are you sure you want to block Unknown.95f990ac7cec66623daab9a6f37dd5fdea948088?”. The GUID there implies to me that Google knows the originating phone and should be able to block this one number, and only the one number, but is this actually what happens?

I went looking through Google’s help site and various other online sites and I could not find a solid answer. I am also wondering what happens if this caller starts unblocking their phone number, will the block still apply or will they still be blocked? I also could not find if this truly will only block this one Unknown caller known to me by the GUID or if it will block one or more “Unknown” callers.

Does anyone actually know the answers to these questions? I sent off an email to the Google Support team using the form within the Google Support pages but I don’t expect to hear back any time soon.

Over the last few months I have been working this wiki of mine in order to record all those stupid and rarely used tasks I find myself doing. After I got it started I thought about it and noticed that some of its content was there because I couldn’t google it quickly so I needed my own spot. If I was having to document these things I thought someone else might like to have access to them as well so I made it public.

Introducing the Remy Services Wiki, complete with my just recently started recipe book. That’s right folks, where else can you get technical documents and find what you are going to have for diner?

With my home network I have things locked down tight for many reasons but one of the main reasons is that I run a business removing Malware and I often end up bringing these infected computers into my home network. I have a separate network that goes straight through my firewall designed just for these infected computers and I am always looking at the logs for hints as to what infections there might be. Anyways, today I had one of my first Vista laptops the user thought to be infected so I put it in the quarantined network, started monitoring logs and started noticing a weird site in the logs. http://www.msftncsi.com/ncsi.txt came up and it caught my eye quickly with a name like that, mostly because MSFT is a common abbreviation for Microsoft. Doing some quick snooping around I found this Microsoft article that talks about the site and what it is meant to do. Basically when a Vista computer gets on a network it tries to get DNS for dns.msftncsi.com and then it tries to access the http://www.msftncsi.com/ncsi.txt file and looks for “Microsoft NCSI” within that text file. When these two tasks complete successfully you get the little icon, it’s just that easy.

Over the past few months I have been playing around with Aardvark and I must say it is an interesting idea and I have already found it to be most usful. The idea behind Aardvark is a search engien where you can find someone to ask about recommendations, research help, advice, second opinions, tips and more. It is a little hard to explain as this is one of the first such search engiens I have seen but if you check out their site you can get a feel for the technology and its uses.

If you happen to want to join my Aardvark network feel free to use the link I have in my links section.

My experience with this issue started just about three years ago around work, we had 90+ desktops shipped to us with some ATI cards in them, I don’t remember the exact model of card with it was a 32mb Radion Pro I think. Anyways, after about one year the all started giving us weird issues, it would start off with some messed up graphics that would follow the mouse but would over the next hour make the computer totally unusable due the the monitor being filled with colored lines everywhere. Well we started to catch on to the fact it was all the same model card pretty quickly, and you can’t tell me that 90+ video cards just “happened” to go bad at the same time. Just on a whim I decided to press print screen and see what happened, and to my amazement I was able to capture a screen shot of the issue due to how screen shots are taken. I wish I had that original screen shot and I will go looking for it but for now I guess we will live without it. Now, with a screen shot in hand, we started replacing the cards as there wasn’t much more we could do to fix bad memory.

Now, three years later I have run across this issue again and this time I’m not letting that screen shot slip away. I now present to you a screen shot, not camera picture, of the issue on a Dell computer with an ATI 9700 video card in it.

Ok, so many of you might have seen this and not think it is nearly as exciting, or frustrating as I do, but I still find it odd that this is so common. Like I said earlier this issue doesn’t seem limited to PC’s only and doesn’t only happen to ATI but they sure are talked about more often with this issue the say, nVidia.

If I ever see this again I will continue to upload more screen shots to this gallery. I would love to know if anyone else has seen this issue and if you have seen it I would love a screen shot if you wouldn’t mind to throw up here as well.

Here are a few other resources I found on the issue, most notable David Norelid‘s post back in Febuary2008 and Derik DeLong from March 2006.

http://diglloyd.com/diglloyd/2007-03-blog.html

http://www.citronix.net/blog/odd-video-artifacts-reveal-memory-corruption/

http://techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=208819&start=0

http://www.macuser.com/hardware/graphics_card_terminal_disease.php

I have know for some time that the computers around my work have been having this issue but there hasn’t been any time to fix the issue; having computers that are slow is better than not having any computers. This issue started however when a previous employee started mass editing policies without testing the changes. Now, being one employee short I decided that this issue had gone on long enough, great timing right? Anyways, I decided before I would tackle the issue I would do some research on various issues people have had with this issue and do some data gathering from the computers having the issue. Through my searching of forums, kb articles and various other sites I came up with a fair amount of understanding of what I needed to do so I started going through my 30,000+ line userenv.log file and other logs to see what I might find.

I am still working on getting the issue figured out and I do have a few programs and policies that I hope to change in order to help the issues out but I thought that the info I gathered might be useful to others experiencing the issue so here is a list of sites and tips that helped me get a better understanding of userenv.log, group policy and other logon issues.

Turning on verbose computer messagesso you can find out at what stage the computer is being slowed down. Making the userenv.bak read-only so you can get a log file larger then 300kb, just remember to disable this as the file will grow till your hard drive is full.

Also a good understanding of what the logs are trying to tell you is a must and the one thing that I think is the most important is knowing what application is trying to do what. This can be accomplished by simply taking the two numbers after USERENV and converting them back to decimal numbers. The first number is your process ID and the second is the thread ID so if you open up your task manager or Process Explorer and find that information you will be able to identify what program is taking the longest to start up.

These two posts by Mark Ramey from the Directory Services team over at Microsoft are a must read as the explain many of the ins and outs of userenv.log and how to interpret them both on the computer and user side. Understanding How to Read a Userenv Log – Part 1 and Part 2

Mark also links to a great article I found about userenv.log that can be found on the TechNet site here.

Another Microsoft site lists all the log files you can look at along with userenv.log to see if there might be other errors here.

Yet another resource that someone might be interested in to help simplify the userenv.log file is a tool from SysPro called Policy Reporter. Although the tool looks great I had better luck just looking at the log in Notepad++ but I am sure others might find this as a great tool and it’s worth a mention.

Edit:  I had this sitting in my draft folder for some time and ended up just publishing it before verifying all the content was here. I will post another article in the next few weeks to deal with Vista using the Windows Perormance Toolkit (WPT)