From time to time you might get into this situation. You either have an old laptop with a hard disk drive (HDD) or you have a newer model with a small solid state drive (SSD) like 120GB and want to perform an upgrade. Basically you can replace the hard drive of every device. But first I would recommend you to look up which drive is built-in into your device, there are in the meantime several building types like 2,5”, M.2, PCIe, NVMe. So I definitely suggest you to read into this topic, so you get an overview and buy the right hardware for your device. Another recommendation from my side is to check out iFixit. Probably you will find some useful information regarding the disassembly of your device and the hardware replacement/upgrade.
Clone HDD Macrium Reflect

Prerequisites

You will need the following things in order to clone the hard drive:

Depending on the type of hard drive, you will need one of these adapters (if it is a laptop, for a workstation you maybe have a second port to connect both simultaneously):

• 2,5” SATA to USB
• M.2 SATA to USB
• M.2 NVMe to USB

And an application for the cloning process. From my experience, the best one is Macrium Reflect Free, which is free for home use.

Cloning Process

When you installed Macrium Reflect successfully, please connect the new hard drive via your adapter to your laptop and start the application. Your screen should look like this. In my case there are now two SSDs available. The existing one with 120GB and the three partitions, and the completely empty new one with 450GB on the bottom.

Firstly, you need to click on Clone this Disk. Now another window will pop up where you need to select the partitions you want to copy. Probably you want to copy all of them.
Important: Please select them by dragging and dropping them. After dragging the main partition which you want to increase, click on Cloned Partition Properties before you drag & drop the next one.

Secondly, please edit the Partition Size or Free Space to increase the available partition size according to your needs or upgrade. I always edit the free space and keep enough for the last partitions. So in this case I left 674MB free for the last partition. Then I simply drag and drop the last one with 674MB to the new hard drive.

Finally, after hitting Next you can define the log file location and save your settings. After that you are ready to start the actual cloning process of the hard drive to the new one. In my case there were three operations (three partitions). Depending on the speed of the old hard drive, the new hard drive as well as the adapter and amount of data this will take some time to process.

Macrium Reflect Free: Cloning ProgressAs soon as the process is finished, you can safely disconnect the new hard drive and start replacing the hardware!
Clone HDD Macrium Reflect

Technology photo created by freepic.diller – www.freepik.com

The post Clone Hard Drive with Macrium Reflect appeared first on HackBuddies.

If your device (laptop or workstation) has a small hard drive, maybe because you have a 120GB solid state drive (SSD) as system drive, you might get into this situation. With such a setup you basically have your operating system (Microsoft Windows) and all your applications installed on the C:\ partition or drive. Due to this setup, if storage usage is growing you could run out of space on your system partition which could cause serious issues. I want to show you how to spot files or folders which are utilizing amounts of storage. When cleaning them up, you will get free space again. Windows Spot Disk Usage

TreeSize Free Portable

For this purpose I definitely recommend you to use the following application: TreeSize Free Portable. It is an portable application so there is no installation required, you can simply put it on your C:\ drive in a temporary folder for example. Just execute the application with administrator privileges so it has access to all of your system directories:

When the application started properly, you can select the drive to scan:

Now it will start to scan all directories located on the selected drive and list it. You can use the mouse or arrow keys to navigate through this structure and go into detail:

It is ordered size descending per default which is great. I definitely suggest you to check the whole directory structure where size is huge. Let us take an example here:

The SoftwareDistribution folder located inside Windows directory has a size of 4GB on this device. But 3,6GB of them are inside folder “old”. I would say that this one is not needed anymore – but to be sure, I always look up the functionality of these folders at Microsoft Docs for example. Do not simply delete any system folders or files without further checking!

Probably this is not the best example because in most cases, you will find some application eating up your storage space with cache or similar inside AppData directory which is straightforward to clean up.

Windows Spot Disk Usage

The post Windows: Spot Disk Usage with TreeSize appeared first on HackBuddies.

Unfortunately you can face sometimes a Bluescreen of Death (BSOD) after installing an unsupported driver or if a driver is outdated. If you have not seen a Windows Bluescreen yet, it looks like this. I want to show you how to Windows 10 Analyze Bluescreens BSOD

Image Source: https://en.wikipedia.org/wiki/Blue_screen_of_death#/media/File:Bsodwindows10.png

In a really bad scenario, the BSOD can even cause a boot loop of your device. Windows starts, and before the lockscreen is visible, you get the Bluescreen. It generates the log information and reboots. Then the same procedure applies again and again. In such a case, you will need to use Safe Mode from Advanced Boot Options, but I will come back to this later.

As a first step, I recommend you to update all drivers and your system’s BIOS in case you did not install any third-party application or driver. You can download them from you manufacturer’s website or if you own a business laptop, there might be a tool to download and install all of them at once (like DELL Command Update or HP Support Assistant).

BluescreenView

The first tool I recommend to get started analyzing Bluescreens is called BluescreenView which is available here for free. Simply download it, there is no installation needed. When you download the zip archive, extract it and start the .exe file:

If you are running the application, it will automatically list all of your Bluescreen Logs which are documented as Minidumps. As my current system had no bluescreens yet, this is an example found on another website to show you how it looks like:

Image Source: https://www.howtogeek.com/howto/6292/how-to-troubleshoot-the-blue-screen-of-death/

The application shows you very important information. You will need the following for further investigation of the error:

• Bug Check String
• Bug Check Code
• Drivers found in stack

With this information available, you can start looking up the different combinations on your favourite search engine. Probably you will find the cause and update the related driver from your manufacturer’s website. If there is nothing displayed despite you got a BSOD, please make sure the Minidumps are enabled in Advanced System Settings:

1.) Open File Explorer, right-click on This PC and select Properties

2.) Open Advanced System Settings

3.) Select Settings for Start-up and Recovery

4.) Make sure that you configure Automatic Memory Dump and check the Dump File Location

Windows 10 Safe Mode

Sometimes, especially in case of an endless boot loop, you will need to enter Windows 10 Safe Mode. This means, that only basic drivers and settings are loaded because they will not probably cause any bluescreen. There are several ways to get into Safe Mode. If your system still starts properly, you can simply hold Shift and click on Restart on your lockscreen. If it is not booting anymore to lockscreen, you need to manually shutdown your device. After it’s starting again, maybe you need to do this one more time. Lately after three unsuccessful starts, it should boot into the Recovery Environment. You can find the whole documentation at Microsoft Support

1.) Select Troubleshoot

2.) Select Advanced Options

3.) Select Startup Settings

4.) Confirm with Restart

At the last screen with the Safe Mode options, select Option 5: Safe Mode With Networking

Image Sources: https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode

If you need to uninstall an application in Safe Mode, you need a little Registry tweak, because the Windows Installer Service is not running per default. Start a Command Line Window as Administrator and copy the following command to add the following registry key:

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer" /VE /T REG_SZ /F /D "Service"

After that, type in the same CMD window this command:

net start msiserver

After that, you are able to uninstall any application via Control Panel. This is extremely useful, because BSODs are often caused by newly installed third party applications which might have installed additional drivers.
Windows 10 Analyze Bluescreens BSOD

Driver Verifier Manager

The Driver Verifier Manager is another tool to find the driver causing BSODs on your device. Please keep in mind that using this tool can result in an unexpected behaviour with new Bluescreens! Nevertheless it is a useful tool in my opinion, thus I want to show you how you can use it.

1.) Start Windows PowerShell as Administrator by right-clicking on Windows icon on the bottom left

2.) Type in verifier and hit Enter
Create Standard Settings

3.) Select driver names from a list

4.) Here I recommend you to select all non-Microsoft drivers as a first step.

After hitting Finish, you will get the message that these settings will be applied after next reboot. So, time to reboot now. Most probably, your system will be able to start normally into Windows because the faulty driver does not get loaded now. If you execute the Driver Verifier Manager now and select Display Information about the currently verified drivers, you will get a list of verified drivers and if they are loaded or not. Another thing which could happen is that Driver Verifier Manager creates new Bluescreens which contain more detailed information about the faulty driver causing the BSOD. Thus it is more easy for you to narrow down the root cause and eliminate the driver.

In most cases I am able to solve the issues with these methods – if you have any more methods or solutions, let me know in the comments 🙂
Windows 10 Analyze Bluescreens BSOD

The post How to find driver causing Bluescreens (BSODs) of your Windows 10 device appeared first on HackBuddies.

Basically it is a very simple script, but I will quickly go through it. Of course you need to define the UNC path to the file share or folder. Then you will loop through all the existing directories with a Foreach. At each folder you will get the permissions with Get-ACL. Then you need another Foreach to get through all the granted permissions which are inherited or directly set. Then you will add each line to your report and finally export it as a CSV file for further processing. That’s it!

$FolderPath = dir -Directory -Path "\\fileserver\fileshare"
$Report = @()
Foreach ($Folder in $FolderPath) {
$Acl = Get-Acl -Path $Folder.FullName
foreach ($Access in $acl.Access)
{
$Properties = [ordered]@{'FolderName'=$Folder.FullName;'AD
Group or
User'=$Access.IdentityReference;'Permissions'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
$Report += New-Object -TypeName PSObject -Property $Properties
}
}
$Report | Export-Csv -path "C:\scripts\FolderPermissions.csv"

You can extend this script by sending the report as email message directly via PowerShell, look here. You can also create a scheduled task / cronjob for this script to Generate ACL Report FileShare periodically.

The post Generate ACL Report of File Share with PowerShell to CSV appeared first on HackBuddies.

Last time I had the task to copy massive amounts of data between two file share systems. With massive amounts I talk about Terabytes 🙂 In addition, one of the systems was productive and the other one the new system, so the solution needed to be reliable and stable. So I asked myself, how can I transfer these files and folders? The answer is Robocopy: How to Copy Massive Amounts of Data

So I tried several things and had a look at the possibilites of the systems. I ended up using the simple Robocopy command with the file shares. Of course the client/server executing the Robocopy command had to be in the same local network in order to ensure a good copy speed.

Robocopy offers you the opportunity to define a lot of parameters for your copy job. For example you can define if the Access Control List (NTFS Permissions) should be copied to the destination host, or if you want to create the Access Groups from scratch. Imagine that on the old system there was a lot of direct access set for the users instead of Active Directory groups – in this case building the Access Groups from scratch can be very helpful to get a clean file share.
Another great thing about Robocopy is that it has basically a Resume option because it copies only the changed or new files after comparing source and destination host.

The Robocopy Command

But let’s talk about the command itself which is pretty simple and you can fulfill nearly all requirements with a One-Liner!

Basically you can split the command as following:

• Source
• Destination
• Source Options
• Copy Options

So let’s start with the probably most basic command. We want to copy a local directory from one partition to another

robocopy c:\temp\test d:\temp\

This simple command will copy the folder test and all files to the location d:\temp – but not subfolders!

Copy Everything (including permissions)

If you simply want to copy everything (also subfolders, empty subfolders, file owners) from the source to destination including the NTFS permission (Windows Access Control list) you can use this command.

robocopy c:\temp\test d:\temp\ /E /COPYALL

Copying over Network

If you want to use the Robocopy command for copying over the network, like in my case, I recommend you to use the following options and switches to get a good result.

/E -> copy all subfolders, including empty ones.
/V -> produce Verbose output, showing skipped files.
/ZB -> use restartable mode; if access denied use Backup mode.
/R:1 -> number of Retries on failed copies
/W:1 -> Wait time between retries: default is 30 seconds
/NP -> No Progress – don’t display percentage copied.
/COPYALL -> COPY ALL file info (equivalent to /COPY: DATSOU)
/LOG -> LOG location

robocopy \\source_share\folder \\destination_share\folder /E /V /ZB /R:1 /W:1 /NP /COPYALL /LOG:c:\robocopy.log

So, this ultimative copy job will copy all subfolders, copy all file information, produces verbose output to show skipped files, will retry failed copies and uses the restartable mode with backup mode in case of failed access. In Addition a log file will be generated with all the details of every single file copied. It is simply great! 🙂

Source: https://community.netapp.com/t5/Data-ONTAP-Discussions/Fileserver-Migration-with-robocopy/td-p/118615

Please find the whole documentation of the Robocopy command directly at Microsoft Docs
Robocopy: How to Copy Massive Amounts of Data

The post Robocopy: How to Copy Massive Amounts of Data reliably appeared first on HackBuddies.

Start PowerShell as administrator

1.) Start PowerShell as admin by right-clicking at the Windows Start button and selecting it:

Create Battery Report

2.) Now, simply copy & paste the following command:
powercfg /batteryreport /output “C:\battery-report.html”
After executing it, the report will be saved to the defined directory, in this case directly to the C:\ partition

Of course you can check out the whole documentation of the powercfg command at Microsoft Docs

Check HTML Report

3.) Open up your Windows File Explorer and navigate to the defined directory. Here you will find the .HTML file which can be opened with your favourite browser:

Windows PowerShell Battery Report

Just have a look through the whole Windows PowerShell Battery Report, it is quite interesting and you are able to gain some insights. My new laptop e.g. has a battery cycle count of 23 and the full charge capacity is nearly as good as the design capacity:

Of course you can also check the details of your battery usage with the active time of the sessions and the effective battery drain:

The post Windows PowerShell: Generate Battery Report appeared first on HackBuddies.

This error message says the following: “This could indicate that an incompatible app installed on your PC is blocking the upgrade process from completing. Check to make sure that any incompatible apps are uninstalled and then try upgrading again.”
At the following URL you can find the description to common error codes like this:
https://support.microsoft.com/en-us/help/10587/windows-10-get-help-with-upgrade-installation-errors

Okay, so the incompatible application needs to get identified and upgraded or removed. But how can this be done? Luckily, there exists a log file containing the necessary information. It can be found in the hidden folder “$WINDOWS.~BT” on your system disk C:\
Firstly, you need to find the latest file containing “HumanReadable.xml” at the end of the file name. Here is the full path in my case:

"C:\$WINDOWS.~BT\Sources\Panther\Bqe4BQ0Je0qHIIyg.6.0.2.3.6.0.0_APPRAISER_HumanReadable.xml"

Secondly, simply open the file in your favourite editor and search the following string:

String "<Property Name="DT_ANY_FMC_BlockingApplication" Value="TRUE" Ordinal="1" />"

Finally, above this string, there is an block called “<Asset>”. This block will tell you the software application which is causing this error. In my case it was an outdated version of Kaspersky Endpoint Security. After uninstalling the software, the Windows feature update worked properly.

<Asset>
      <PropertyList Type="Inventory">
        <Property Name="AssetType" Value="File" />
        <Property Name="BinFileVersion" Value="10.3.0.6294" />
        <Property Name="BinaryType" Value="pe32_i386" />
        <Property Name="FileId" Value="00008bd04e7b9321576015250cd9edda93cfd209cf21" />
        <Property Name="LongPathHash" Value="avp.exe|859880e241e1a5ab" />
        <Property Name="LowerCaseLongPath" Value="c:\program files (x86)\kaspersky lab\kaspersky endpoint security 10 for windows sp2\avp.exe" />
        <Property Name="ProgramId" Value="0000e829fe542bb43daac314e763e672a9fa00000904" />
        <Property Name="Size" Value="0x0000000000202528" />
      </PropertyList>
      <PropertyList Type="DataSource">
        <Property Name="ApplicableTargetVersion" Value="RS5" Ordinal="1" />
        <Property Name="SdbAppGuid" Value="{XXXXX}" Ordinal="1" />
        <Property Name="SdbAppName" Value="Kaspersky Endpoint Security" Ordinal="1" />

        <Property Name="SdbAppVendor" Value="Kaspersky Lab" Ordinal="1" />
        <Property Name="SdbBlockOverrideType" Value="SDB_UX_BLOCKTYPE_OVERRIDE_UPGRADE_BLOCK" Ordinal="1" />
        <Property Name="SdbBlockType" Value="BlockUpgrade" Ordinal="1" />
        <Property Name="SdbEntryGuid" Value="{XXXXX}" Ordinal="1" />
        <Property Name="SdbGenericMessageSummary" Value="Führen Sie ein Update auf die neueste Version von Endpoint Security oder eine Deinstallation aus, um Setup fortzusetzen." Ordinal="1" />
        <Property Name="SdbGenericMessageSummaryStringPresent" Value="TRUE" Ordinal="1" />
        <Property Name="SdbGenericMessageTitle" Value="Endpoint Security" Ordinal="1" />
        <Property Name="SdbGenericMessageTitleStringPresent" Value="TRUE" Ordinal="1" />
      </PropertyList>

Update

This post applies to the following Windows feature updates / builds, see also Microsoft Docs:

SCCM Windows Feature Update: Error Code 0xC1900208
You might want to check out other Windows-related posts here

The post SCCM Windows Feature Update: Error Code 0xC1900208 appeared first on HackBuddies.

Recently I wanted to connect to a machine with my admin user but then I realized that this user had been locked out in Active Directory. The counter for bad passwords is relatively high and gets resetted frequently, like every 15 minutes. So what could cause this issue? There must be some wrong configuration. I started to investigate. Analyze User Lockout AD

Imagine a setup with multiple Domain Controllers. Firstly, you have to find out which DC causes the lockout. Microsoft offers an amazing toolbox called “Account Lockout and Management Tools”. They are available at the following URL:
https://www.microsoft.com/en-us/download/details.aspx?id=18465

LockoutStatus.exe

Simply start the LockoutStatus.exe with a Domain Admin or at least with sufficient permissions and enter the target admin user who had been locked out. The tool will determine all Domain Controllers and show you a list of “Last Bad Password”, “Bad Password Counter” , “Last Password Change Date” and so on. Now you should know the involved Domain Controller.

Check Event Log on DC to analyze User Lockout AD

Secondly, you will connect via Remote Desktop Connection (RDP) to the mentioned Domain Controller and start the Event Viewer there. Navigate to System -> Security:

Now filter the current log for the event ID: 4625

After that you should be able to see the corresponding log entries. Search for the affected user to get the right entry. The important part here is the Caller Machine Name. This name will tell you the server which is causing the bad logins. Another crucial detail is the value of the logon type. With this value you can localize the cause. The possible values are listed here:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

Finally, it should be relatively easy to solve. The possible sources of the bad logins are for example:

• Scheduled tasks
• Services
• Stored credentials
• File share access
• …

Thus, you can check now the local client of the user in order to find the root cause, for example in Credential Manager and delete the stored credentials, re-map the network drive or adapt the scheduled task. Analyze User Lockout AD

The post Analyze why an user gets locked out in Active Directory appeared first on HackBuddies.

Last time I had the problem, that the password of my administrator account was expired due to changes to the password policies. The expiry date had been reduced and the last change was long ago, so it was expired and I could not log on anymore to any machine via remote desktop protocol (RDP). I also had no access to a domain admin account to reset the password of the other account, so how can you solve this and reset the password of the administrator account?

If you try to connect to a machine using this account, the following error message is displayed:
“This user account’s password has expired. The password must change in order to logon. Please update the password or contact your system administrator or technical support.”

The first possible solution that I found after a fast research was, to save the .rdp file and edit it by adding this line at the end:

enablecredsspsupport:i:0

Unfortunately this did not work because another error message is displayed:
“The remote computer requires Network Level Authentication, which your computer does not support.”

Then I found the information that the “RD Web Access role” can be installed and the remote password change option get enabled (Link). Then your IIS webserver should provide a page where the password can be changed. But I have not tried this yet, maybe you can tell me your experience in the comment section 🙂

The post How to change an expired Windows password via remote desktop protocol (RDP)? appeared first on HackBuddies.

There are some crucial functionalities of Windows which are needed very often. Imagine being connected to a Windows computer which is installed in a foreign language. How can you quickly access those functions? There are some handful commands.

Programs and features

You can access the installed programs and features like this:

Press "Win + R" to run the dialog box
Type "appwiz.cpl" and press "Enter"

Device manager

You can access the device manager like this:

Press "Win + R" to run the dialog box
Type "devmgmt.msc" and press "Enter"

Date and time

You can access the date and time like this:

Press "Win + R" to run the dialog box
Type "timedate.cpl" and press "Enter"

Internet options

You can access the internet options like this:

Press "Win + R" to run the dialog box
Type "inetcpl.cpl" and press "Enter"

Power options

You can access the power options like this:

Press "Win + R" to run the dialog box
Type "powercfg.cpl" and press "Enter"

There are also a lot of third party applets – Simply check if there is one available for a specific software.

The post Quickly access important Windows functionalities appeared first on HackBuddies.