The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,830 other subscribers

Archive for the ‘Windows’ Category

PowerShell Get-WinEvent XML Madness: Getting details from event logs – Ashley McGlone – disappeared from blogs.technet.microsoft.com

Posted by jpluimers on 2026/07/28

This post originally appeared on [Wayback/Archive] PowerShell Get-WinEvent XML Madness: Getting details from event logs – GoateePFE – Archived, but due to link rot got lost including the images. I restored this post from the Wayback Machine archived version including the comments so the content gets re-indexed in search engines as this was one of the few posts detailing how to filter and extract XML from Windows Event logs using PowerShell.

I needed this content for a future blog post that is going to appear in a day or so: Some links on getting the most recent defragmentation time of a Windows volume

Queries:

Read the rest of this entry »

Posted in .NET, CommandLine, Development, Power User, PowerShell, PowerShell, Scripting, Software Development, Windows | Tagged: | Leave a Comment »

GitHub – Botspot/bvm: Windows 11 Virtual Machine on ARM Linux

Posted by jpluimers on 2026/07/27

This is way easier than I thought (but you need Raspberry Pi 5 or it will be dead slow on earlier models): [Wayback/Archive] GitHub – Botspot/bvm: Windows 11 Virtual Machine on ARM Linux

And yes, there are other write-ups for doing this, but this repository is so much easier and reliable than the others.

Did not test it outside of Raspbian yet, so not sure on which other distributions it runs. It will likely run on more plainDebian, but my guess is that Fedora, Ubuntu, OpenSuSE and others will be out.

Oh: better use NVMe instead of MicroSD for speed too.

Via:

--jeroen

Posted in *nix, *nix-tools, bash, CommandLine, Development, Power User, PowerShell, Scripting, sh, Sh Shell, Windows, Windows 11 | Leave a Comment »

Forensics: Automating Active Directory Account Lockout Search with PowerShell (an example of deep XML filtering of event logs across multiple servers in parallel) – where the images disappeared from blogs.technet.microsoft.com

Posted by jpluimers on 2026/07/22

Yes, the text of this post is still on [Wayback/Archive] Forensics: Automating Active Directory Account Lockout Search with PowerShell (an example of deep XML filtering of event logs across multiple servers in parallel) | Microsoft Learn but the original images from blogs.technet.microsoft.com as well as the code snippet got lost due to link rot and incomplete migration. I restored the blog post with comments from the Wayback Machine archives.

I needed the images and the snippet to be able to write future blog post Some links on getting the most recent defragmentation time of a Windows volume hat is appearing in a week or so.

The script is downloadable from LockoutEventsXML.ps1 or via [Wayback/Archive] TechNetGalleryArchive/LockoutEventsXML.ps1 at master · GoateePFE/TechNetGalleryArchive · GitHub at [WaybackSave/Wayback/Archive] github.com/GoateePFE/TechNetGalleryArchive/raw/refs/heads/master/LockoutEventsXML.ps1 by [Wayback/Archive] GoateePFE (Ashley McGlone) · GitHub.

Note the blog post uses @" strings – with $using.variable to pass local variables to remote sessions. See these entries for more information about that topic:

Queries:

Read the rest of this entry »

Posted in .NET, CommandLine, Development, Power User, PowerShell, PowerShell, Scripting, Software Development, Windows | Tagged: , , , , , , | Leave a Comment »

What is the best way to get Windows 11 Pro Key for cheap ? : bootcamp

Posted by jpluimers on 2026/06/12

Needed this for some Windows 11 Virtual Machine experiments of Windows 11 on Apple Silicon ARM under VMware Fusion to see how well the Intel x64 emulation on ARM provided by Apple Rosetta or/and Microsoft Windows actually works: [Wayback/Archive] What is the best way to get Windows 11 Pro Key for cheap ? : bootcamp

At the time of writing (especially the “/Archive]” versions of the links below under “Queries” show remarkably cheap licenses):

Wondering what these will do during Black Friday and Cyber Monday.

In the meantime: reset timer galore (:

TL;DR from most links below on activating Windows 11 on ARM under VMware Fusion: it should work, but back in the experimental days (around 2021-2022) it sometimes failed.

Read the rest of this entry »

Posted in Power User, Windows, Windows 11 | Leave a Comment »

Figuring out which COM Surrogate dllhost.exe process to kill (via The Old New Thing)

Posted by jpluimers on 2026/05/25

A while ago, ejecting a CompactFlash card on Windows 10 failed with the dreaded message “The action can’t be completed because the file is open in COM Surrogate.”

I was in a hurry, and it was a long time since I bumped into a similar message, so I simply rebooted as I knew that for certainly would fix it.

Next time, these links will help me find which dllhost.exe process to kill:

Read the rest of this entry »

Posted in Power User, Windows, Windows 10, Windows 11 | Leave a Comment »

You thought Windows drivers from 2006 were old, wait’ll you see the Intel drivers from 1968! – The Old New Thing

Posted by jpluimers on 2026/05/19

ImageInteresting strategy that driver vendors use to prevent their drivers to be installed when newer versions are installed [Wayback/Archive] You thought Windows drivers from 2006 were old, wait’ll you see the Intel drivers from 1968! – The Old New Thing

Or in other words: with this mechanism drivers can be a generic alternative to be installed when no more specific or newer driver is available.

Via [Wayback/Archive] ⚜ 8-bit Hero (aka Sven) ⚜ on Twitter: “Wow, Intel has been writing windows divers for a long time! Had no idea.”

Related

Intel Drivers dated 1970 shown by [Wayback/Archive] Kevlin Henney (@KevlinHenney) in his Keynote streamed at around the 1200 second mark: [Wayback/Archive] KotlinConf’23 – Effectenbeurszaal Day 2 – YouTube.

Read the rest of this entry »

Posted in Conference Topics, Conferences, Development, Event, Java Platform, Kotlin, Power User, Software Development, Windows | Leave a Comment »

An easier to understand first time Scoop install command

Posted by jpluimers on 2026/05/13

The Scoop repository lists this first time Scoop install command at [Wayback/Archive] ScoopInstaller/Scoop: A command-line installer for Windows. – installation:

Run the following command from a non-admin PowerShell to install scoop to its default location C:Users<YOUR USERNAME>scoop.

iwr -useb get.scoop.sh | iex

[Wayback/Archive] ScoopInstaller/Install: 📥 Next-generation Scoop (un)installer is very similar:

Run this command from a non-admin PowerShell to install scoop with default configuration, scoop will be install to C:Users<YOUR USERNAME>scoop.

irm get.scoop.sh | iex
# You can use proxies if you have network trouble in accessing GitHub, e.g.
irm get.scoop.sh -Proxy 'http://<ip:port>' | iex

The Scoop homepage at [Wayback/Archive] Scoop.sh is not much better:

Read the rest of this entry »

Posted in Batch-Files, CommandLine, Development, Power User, PowerShell, PowerShell, Scoop, Scripting, Software Development, Windows | Leave a Comment »

Wondering if the takeown/icacls/del trick still work to screw up %windir%\system32 (via Patrick Doyle on Twitter)

Posted by jpluimers on 2026/05/07

A few years back this trick was shown to screw up %windir%\system32 [Wayback/Archive] Patrick Doyle on Twitter: “@SwiftOnSecurity @RoseAreaZero Delete any file in three easy steps: > takeown /F "example.ext" > icacls "example.ext" /grant "%USERNAME%":F > del "example.ext".

Like [Wayback/Archive] SwiftOnSecurity (@SwiftOnSecurity) / Twitter (see the long thread further below), I was expecting that Windows would either prevent you from doing this at all, or allow for easy recovery with System File Protection (now Source: Windows File Protection).

That didn’t prevent or recover it back then.

I wonder if that has been changed by now.

From the above Tweet:

Delete any file in three easy steps:
> takeown /F "example.ext"
 > icacls "example.ext" /grant "%USERNAME%":F
 > del "example.ext"

Read the rest of this entry »

Posted in Batch-Files, Development, Power User, Scripting, Security, Software Development, Windows, Windows 10, Windows 11, Windows Development | Leave a Comment »

Updating Microsoft Office on Windows from a batch file

Posted by jpluimers on 2026/04/21

This batch file works for modern Click-to-Run (sometimes called ClickToRun, Click2Run or C2R) based Office installations (note the odd lowercase microsoft shared which indeed is the actual directory name):

if exist "%CommonProgramFiles%\microsoft shared\ClickToRun\OfficeC2RClient.exe" (
  "%CommonProgramFiles%\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user
) else (
  echo could not find the Office Updater
)

This for sure does not work for MSI based Office 2013 and lower (which are updated through Windows Update anyway). Since I only have 2021 online (Click-to-Run) installs and higher to test with: those work fine.

Read the rest of this entry »

Posted in Batch-Files, Development, Office, Office 2021, Office Development, Power User, Scripting, Software Development, Windows, Windows Development | Leave a Comment »

MIME decoder for Windows – Super User

Posted by jpluimers on 2026/04/17

More than 10 years ago, I needed a MIME decode for Windows as I was developing some software which implemented S/MIME could sign automatically generated emails and verify incoming ones.

I wrote more about the latter part in Some notes on OpenSSL, S/MIME, email, various RFC standards and their relations.

Now finally the post about what I wanted to schedule for posting back then as well: my question looking for a [Wayback/Archive] MIME decoder for Windows – Super User:

Read the rest of this entry »

Posted in *nix, *nix-tools, base64, Development, Encoding, Linux, MIME, Power User, Software Development, Windows, WSL Windows Subsystem for Linux | Leave a Comment »