Windows 10/11 Hybrid Boot (Fast Boot) - Why rebooting is better then shutting down to fix an issue

When you choose to shut down your Windows 10 or 11 system, it actually goes into a hybrid boot mode. This means that your system saves some information in a special file on your hard drive and then turns off most of its components to conserve power. When you turn your system back on, it quickly reloads that information and wakes up from this hybrid mode. This process is faster, so makes the system feel quicker on start-up 

On the other hand, when you choose to reboot your Windows 10 or 11 system, it completely powers down and then starts back up again from scratch. This means that any temporary files or processes that were open before the reboot will be closed and the system will start fresh. Rebooting your system is a good way to refresh it and make sure any updates or changes are properly applied.

So, if you want to completely power down your Windows 10 or 11 system and start fresh, choose the "Restart" option.

Getting started with Windows AppLocker

AppLocker is a great way to limit the applications a user has access to within Windows 10 or Remote Desk Host systems.

Its quick and easy to get going and once its up and running you can add and change as needed.  Ideally you wan to start it in audit mode only as this way you will get to see what is happening on the Remote Desktop Hosts or the local workstation.

At first you are going to need to make a GPO and give it a name.  it runs at the computer level and not the user so you can disable the user part of the GPO if you do that sort of thing.

The settings are located in Computer Configuration > Polices > Windows Settings > Security Settings > Application Control Polices > AppLocker

Once you are there right click on the "AppLocker" and select "Properties" and mark the polices wish to enforce.

I would suggest at first you set it audit only, so you can monitor what would of happened if it was used.

Once you have set it to audit click "Ok" which will bring you back to the GPO and the AppLocker polices.

Right click on each policy you have enabled and select "Create Default Rules"

This will give a base line of how it just look.

From here you can adjust and add as needed,  just be carful with how many rules you make as each time an application runs the AppLocker will run the rule set until it finds a match and if not kept lean could appear to slow down applications and GPO processing.

Some system variables can be used in path rule condition and some can not,  I found that %USERPROFILE% was not accepted but you can replace it with a wildcard as such "C:\Users\*\APPDATA\LOCAL\MICROSOFT\TEAMS\" say if you wish Microsoft Teams to still work.

Once the policy is set up the only thing left is that you need is to start the Application Identity service other wise the AppLocker will not be enabled on the RDH / local workstation.  you can do this in the GPO under the "System Services" part not the "Services" part but I also like to stick a start for it in "Services" too.

Now its up and running you can check the devices event logs to see what is happening,  the AppLocker logs can be found in.

Applications and Services Log > Microsoft > Windows > AppLocker

Each policy has its own log and Event ID:8003 shows what would of been blocked if the policy was enforced.

Monitor this log for sometime and adjust the AppLocker rules until you are happy then switch to enforce on the GPO.

AppLocker (Windows 10) - Windows security | Microsoft Docs

Requirements to use AppLocker (Windows 10) - Windows security | Microsoft Docs

Optimize AppLocker performance (Windows 10) - Windows security | Microsoft Docs

Understanding the path rule condition in AppLocker (Windows 10) - Windows security | Microsoft Docs

Using Event Viewer with AppLocker (Windows 10) - Windows security | Microsoft Docs

Configure the Application Identity Service | Microsoft Docs

Interactive Logon: Machine inactivity limit not working right

This is a good setting to roll out across your network as it means that devices left unattended for long periods of time will lock them self's but there is a catch.

When you set this time out you must set the screen saver wait time too to be less or equal to the timeout.

If you don't it can default to 60 seconds and lock the desktop even before the machine inactivity limit is reached.  Does not matter if screen saver is enabled or not it still uses the screen saver wait setting.

You can not set the wait setting high then the inactivity limit.

Enable Windows Photo Viewer within Windows 10, 2016, and 2019

Here is the Reg keys to enabled the Windows Photo Viewer that is still part of Windows 10, 2016, and 2019.

This is works well for 2019 Remote Desktop Host

https://gist.github.com/AndyUK24601/cc26266e7af84df3297d7d63271c18fc

Before doing this I would make sure that the following below location still exists as Microsoft may remove it later down the line

"C:\Program Files (x86)\Windows Photo Viewer"

You will also need to run the following too in cmd as admin

regsvr32 "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"

Side note,  running the REG does make it the default straight away

Windows 10 Sleep unattended idle timeout (Hidden setting)

 This setting controls the timeout before a Windows 10 device returns back to sleep from a WoL or timed event.

Sleep unattended idle timeout | Microsoft Docs

It can be accessed by unhiding it with the following command ran as admin

powercfg -attributes SUB_SLEEP 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 -ATTRIB_HIDE

Or rehidden with this one

powercfg -attributes SUB_SLEEP 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 +ATTRIB_HIDE

Once its unhidden it will give you a new options within the advanced power settings profile.

Quick command line for making a local admin account

 Sometimes with remote tools you have remote screen access with software such as TeamViewer or ISL Light.

and at times you also have a remote command line interface too but no local admin account to get in to a desktop.

open the command line CMD or remote command line tool and type

net user admin-tmp <Password> /add
net localgroup administrators admin-tmp /add

If you need to view a list of local users type

net user

and to check a local accounts password

net user <Name> <Password>

To delete accounts

 net user <Name> /delete

Windows server 2019 Remote Desktop Host with Search installed

 The way Windows 2019 / Windows 10 works with search has changed.  the short of it is that now parts are stored in the user profile which can have issues with User Profile Disks.

If you are seeing the follow event in the event log

Event Log: Application

Event Level: Error

Event Source: Search-ProfileNotify

Event ID: 2

Event Data: Unable to remove Windows Search Service indexed data for user '<User Name>’ in response to user profile deletion.  Error code 0x80004002

This can be the start of issues with Search for all users.  The fix is to make a task that triggers on this event to restart the search service.

Program: powershell.exe
Arguments: restart-service WSearch

This was taken from jkindon.com site so that I have it at hand if it comes back up again, but they go in to more details of the thing.

Windows Search in Server 2019 and Multi-Session Windows 10 – James Kindon (jkindon.com)

Windows Assessment and Deployment Kit (Windows ADK)

Windows Assessment and Deployment Kit (Windows ADK) is a great tool for helping you see performance issues with signing in and booting up a system.

I have used it for Remote Desktop hosts to see where the processing is getting tied up.

Just need to download the right version from

https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install

When you are installing make sure you select the "Windows Performance Toolkit"

when its finished opened cmd as Administrator and type the following

xperf -on PROC_THREAD+LOADER+INTERRUPT+DPC+PROFILE+DISK_IO+HARD_FAULTS+DRIVERS+NETWORKTRACE+ALL_FAULTS -stackwalk profile -SetProfInt 1221

Then get the user to log in or log off depending on what your monitoring and once its finished switch back to the user that ran the above command and type

xperf -d <filename>.etl

This information was found on

https://forums.ivanti.com/s/article/HOWTO-Create-Detailed-User-Logon-Performance-Logging-with-Windows-Performance-Analyzer?language=en_US

Windows 10 Network Connection Status Indicator (NCSI)

 The Network Connection Status Indicator within Windows 10 makes a call to the following URL

http://www.msftncsi.com/ncsi.txt
http://www.msftconnecttest.com/connecttest.txt

Depending on the response it will tell you if you have internet, need to login to access the internet, or have no internet.

Sometimes firewalls can block or filter this request  leading to issue with workstations.  If your not using a login portal for users internet access and are getting issues with devices reporting no internet the first check would be to bypass the URL and allow it straight out.

Windows GPO WMI Filter for Client OS only

 WMI Filters can be used to target devices that GPO should apply to.  This one will only apply to Client OS and not Server.

select * from Win32_OperatingSystem where ProductType="1"

Install Windows Store if its been removed and had its provisioning removed as well from Windows 10

The steps I took to get the store back on are as follows.

1. Downloads Windows 10 Media Creation Tool and used this to download an ISO
   https://www.microsoft.com/en-gb/software-download/windows10
   
   
2. Mount the ISO and run an in place upgrade / repair, while keeping all the users files and applications
   
   
3. Once this has been done and the PC has rebooted back in to Windows 10 you will need to download the "Windows 10 Inbox App" iso form the Microsoft Volume Licensing portal.  Making sure to match the Feature build you upgraded / repaired installed too.
   
   
4. Once its downloaded mount this ISO and take a note of its drive letter (my Drive letter was F)
   
   
5. Run PowerShell Elevated and run the following:
   
   Add-AppxProvisionedPackage -Online -PackagePath "F:\amd64fre\Microsoft.WindowsStore_8wekyb3d8bbwe.appxbundle" –LicensePath "F:\amd64fre\Microsoft.WindowsStore_8wekyb3d8bbwe.xml"
   
   

This should now install the Windows Store,  once in the store go to "Downloads and Updates" and update the store to its latest version.

Windows Store Applications Crash as soon as they are opened with Exception code: 0xc000027b

Not 100 percent sure what fixed it but I did the following

1. Give the user local admin (This is needed so you can run PowerShell elevated but remain in the users context space)
2. Open Powershell Elevated
3. Type and run "$manifest = (Get-AppxPackage Microsoft.WindowsStore).InstallLocation + '\AppxManifest.xml' ; Add-AppxPackage -DisableDevelopmentMode -Register $manifest"
   
   Side note on this, you may get an error about the store is still being accessed, if so kill off the store and rerun it
4. Type and run wsreset.exe
5. Type and run "Get-AppxPackage | ForEach-Object { Add-AppxPackage -DisableDevelopmentMode -Register ($_.InstallLocation + '\AppxManifest.xml')}"
   
   Side note on this command too, you will get errors for the applications that are running,  should be ok not seen any issues is testing so far (23/07/2020)
6. Reboot
7. Test and confirm working
8. Remove Local admin if you had to give it.

Registry Path for Uninstall software that shows in Program and features

Device:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

User:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 

Windows 10 Wireless Troubleshooting by outputting WLAN Report

1. Run CMD as Administrator
2. Type "netsh wlan show wlanreport"
3. Once its finished it will give you a file location, open the file in a web browser

This will give you a break down on the issues this device has had with wireless, Microsoft have a quick over view on how to read it here.

If you get any errors like 0x02 when you run the command try running windows updates and then reboot.  or just reboot.