Posted by jpluimers on 2021/08/31
This helped me big time finding failed logon attempts: [WayBack] Event Log Hell (finding user logon & logoff) – Ars Technica OpenForum
Alternatively, you can use the XPath query mechanism included in the Windows 7 event viewer. In the event viewer, select “Filter Current Log…”, choose the XML tab, tick “Edit query manually”, then copy the following to the textbox:
Code:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[EventID=4624] and EventData[Data[@Name='TargetUserName'] = 'USERNAME']]</Select>
</Query>
</QueryList>
This selects all events from the Security log with EventID 4624 where the EventData contains a Data node with a Name value of TargetUserName that is equal to USERNAME. Remember to replace USERNAME with the name of the user you’re looking for.
If you need to be even more specific, you can use additional XPath querying – have a look at the detail view of an event and select the XML view to see the data that you are querying into.
Thanks user Hamstro!
Notes:
- you need to perform this using
eventvwr.exe running as an elevated process using an Administrative user CUA token.
USERNAME needs to be the name of the user in UPPERCASE.- replacing
TargetUserName with subjectUsername (as suggested by [WayBack] How to Filter Event Logs by Username in Windows 2008 and higher | Windows OS Hub) fails.
- there are more relevant EventID values you might want to filter on (all links have screenshot and XML example of an event):
- blank (empty passwords) can only be used for local logon, so they disable network logon. That can be a useful security strategy.
Related:
–jeroen
Like this:
Like Loading...
Posted in Development, Microsoft Surface on Windows 7, Power User, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Vista, Windows XP, XML/XSD | Leave a Comment »
Posted by jpluimers on 2021/08/23
lFor Mac keyboard keys, almost all (except the old solid and open Apple logo’s) have a Unicode code point, see for instance the modifier keys from the [WayBack] List of Mac/Apple keyboard symbols · GitHub (the “Alt” column has a solid Apple logo in the bottom right; on non-Mac systems it will look differently as it is in the Unicode private range: [WayBack] Unicode Character ” (U+F8FF): ‘<Private Use, Last>’):
| Sym |
Key |
Alt |
| ⌃ |
Control |
|
| ⌥ |
Option |
|
| ⇧ |
Shift |
|
| ⌘ |
Command |
|
These are the code points for the “Sym” column:
Keys on many platforms
Read the rest of this entry »
Like this:
Like Loading...
Posted in Microsoft Surface on Windows 7, Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 95, Windows 98, Windows NT, Windows Server 2000, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | 1 Comment »
Posted by jpluimers on 2021/08/09
[WayBack] How to turn on automatic logon in Windows
Describes how to turn on the automatic logon feature in Windows by editing the registry.
Most archivals of the above post fail with a 404-error after briefly flashing the content, but this particular one usually succeeds displaying.
It is slightly different from the one referenced in my blog post automatic logon in Windows 2003, and because of the archival issues, I have quoted most of it below.
A few observations, at least in Windows 10 and 8.1:
- Major Windows 10 upgrades will disable the autologon: after each major upgrade, you have to re-apply the registry patches.
- If the user has a blank password, you can remove the DefaultPassword value.
- Empty passwords allow local logon (no network logon or remote desktop logon), no network access and no RunAs, which can actually help improve security. More on that in a later blog post
- For a local machine logon, you do not need the DefaultDomainName value either (despite many posts insisting you need them), but you can technically set it to the computer name using
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d %ComputerName% /f
- If another user logs on and off, the values keep preserved, so after a reboot, the correct user automatically logs on
- you need a full reboot cycle for this to take effect
- The AutoLogon tool does not allow blank passwords
I wrote a batch file enable-autologon-for-user-parameter.bat that makes it easier:
if [%1] == [] goto :help
:enable
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
:setUserName
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d %1 /f
:removePasswordIfItExists
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f
if [%2] == [] goto :eof
:setPassword
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d %2 /f
goto :eof
:help
echo Syntax:
echo %0 username password
The article quote:
Read the rest of this entry »
Like this:
Like Loading...
Posted in Batch-Files, Development, Microsoft Surface on Windows 7, Power User, Scripting, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »
Posted by jpluimers on 2021/07/16
This tool can help resetting monitor/display configurations for when your machines gets out of suspend/sleep/shutdown mode and resets the displays to wrong defaults (especially wrong scaling).
Documentation and download: [WayBack] Custom Resolution Utility (CRU)
Custom Resolution Utility (CRU) allows custom resolutions to be defined for both AMD/ATI and NVIDIA GPUs by creating EDID overrides directly in the registry without dealing with .inf files. Download:
Note the requirements:
- Windows Vista or later (Windows XP does not support EDID overrides)
- AMD/ATI or NVIDIA GPU with appropriate driver installed (Microsoft Basic Display Adapter driver does not support EDID overrides)
- Some Intel GPUs and laptops with switchable graphics are supported with one of these drivers:
Old version at [WayBack] GitHub – radamar/Custom-Resolution-Utility-ToastyX: Custom Resolution Utility for Windows by ToastyX, duplicated so the source won’t be lost..
Short instructions (but be sure to read the long ones above as well) slightly rephrased for readability:
- For each monitor
- Disable all of the default “Established Resolutions”
- Delete all of the default “Detailed Resolutions”
- Delete all of the default “Standard Resolutions”
- Add a new “Detailed Resolution”
- Under new “Detailed Resolution” I left all of the settings the same except for the active horizontal and vertical pixel dimensions, which is obviously where you set your desired screen resolution.
- Once all monitors are configured properly, close CRU and run the restart.exe or restart64.exe included with CRU and you should be good to go!
Read the rest of this entry »
Like this:
Like Loading...
Posted in Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows Vista | Leave a Comment »
Posted by jpluimers on 2021/06/11
From my answer at [WayBack] hard drive – defrag /x – consolidate free space not really working – Windows Server 2012 – Server Fault
I’ve tried many tools, starting with defrag C: /X (which tries, but doesn’t give good results) and found out these steps give the best results:
- Perform an Ultradefrag full optimisation
- Perform a MyDefrag
Consolidate free space script on the drive.
Note that MyDefrag (formerly named JkDefrag) is not maintained any more but the 4.3.1 version in the WayBack machine still works very well as the underlying defragmentation APIs in Windows haven’t changed.
References:
The original MyDefrag disappeared two times (temporarily in 2014 because the domain expired, then permanently in 2017 because the domain went off-line).
Luckily, the WayBack machine at archive.org has the latest version saved (not all the links from the archive.org search page have an executable as sometimes it shows the expired domain or a non-existing redirect when the domain got off-line):
Note that chocolatey install --yes mydefrag --version 4.3.11 fails because of the missing download. See [WayBack] Chocolatey Software | MyDefrag 4.3.1.
(The --version parameter trick is from [WayBack] Chocolatey – How to install hidden and unlisted package? – Super User, via [WayBack] “This package is unlisted and hidden from package listings.” – Google Search).
–jeroen
Like this:
Like Loading...
Posted in Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »
