Cloning Windows among drives

Cloning a Windows install is usually simple but you can also run into trouble (say with dynamic disks of various sizes). The most resiliant method is here on the ArsTechnica forums, but here's a copy-paste:

• Install Windows 7 onto the SSD, don't bother configuring. This sets up the partions and makes it bootable.
• Boot to a Linux rescue CD, and use gparted to resize the source Windows 7 partition to the same size as the SSD partition. (Windows disk management will not do this resize if you need to shrink past the "unmovable" files in the middle of the partition).
• This fails because gparted cannot resize a partition on a dynamic disk, but it does move the "unmovable" files.
• Now boot back into Windows, wait for the checkdisk run, and use Disk Management to shrink the partition.
• Boot back to a linux rescue CD and use DD to clone the source Windows partition over the top of the destination Windows partition on the SSD (make sure the partition sizes match when resizing). e.g. "dd if=/dev/sdb2 of=/dev/sda1 bs=4096 conv=notrunc,noerror". Don't get them the wrong way around.
• Note that you can use Clonezilla or many other tools (Acronis, AOMEI backupper) instead of DD.
• Boot to a Windows rescue CD (made from the Backup and Restore utility) and use the automated boot-fix step to fix the boot manager.

One thing to note - if a Windows install CD says that "This version of System Recovery Options is not compatible with the version of Windows", when booting up, hit F11, the boot options should specify UEFI boot of the CD (instead of AHCI).

RDP - function request not supported

As of Microsoft's security patch in May 2018, RDP from patched clients to unpatched hosts gives a 'function request not supported' error. In the event that one can't (for some reason) patch the host, one workaround is to change group policy on the local computer:

In gpedit.msc:
Computer configuration -> Administrative Templates -> System -> Credential Delegation -> Encryption Oracle Remediation.

Choose 'Enable' and change protection level to 'Vulnerable' and apply (restart usually not needed).

Another option is this workaround, which I haven't tested:
http://blog.fmsinc.com/remote-desktop-authentication-error-function-requested-is-not-supported-credssp/

Accessing Windows shares

I've come across problems accessing Windows shares, specifically, where \\server\share doesn't work but \\ip\share does. I resolved this through SFC (see previous blog post), but deleting the CSC cache is also often suggested, as per:

https://superuser.com/questions/384981/can-access-windows-share-by-ip-or-fqdn-address-but-not-by-hostname/

Run SFC on external (or other) drive

Useful info on running SFC on an external (or second installed) drive:

https://www.ghacks.net/2017/05/21/run-sfc-scannow-on-external-drives/

sfc /scannow /offwindir=d:\windows /offbootdir=d:\

 

Proxy script for blocking websites

This proxy script can be used in Windows to either block individual websites (blacklisting) or allow only specific websites (whitelisting), this example is for whitelisting:

function FindProxyForURL(url, host) {
 // Bypass the proxy for *.blogger.com
 if (dnsDomainIs(host, ".blogger.com")) {
               return "DIRECT";
 }
 return "PROXY http://127.0.0.1:18080";
 } // End of function

This is saved as a .pac file. In Control Panel, in the Internet Options, find the Connections tab, LAN settings. Uncheck “Automatically Detect Settings”. Click to check the box named “Use automatic configuration script”.

In the address field, type the location of .pac file as the following:

File://C:/Path/script.pac

More here.

Partly unnecessary Win7 services

A nice rundown of possibly unnecessary Win7 services, useful for slightly speeding up older computers.

Add a trusted location in Windows

Because you usually want to leave UAC on in Windows, it's sometimes useful to add a trusted location:

1. Control Panel → Network and Intranet → Network and Sharing Center
2. Bottom left there is a 'See Also' section, click on 'Internet Options'.
3. Select Local intranet zone on the Security tab then click the Sites button
4. Click Advanced button
5. Enter file://[computer name]
6. Make sure 'Require server verification...' is unticked

Listing all installed software in Windows

A handy trick for listing all software instlled in Windows, from PS or cmd, run:

wmic
/output:C:\InstallList.txt product get name,version

Trust relationship between machine and AD failed

I've run into this problem only a couple of times and Technet has quite a few possible solutions - the one that worked for me was using Netdom.

Slow network share browsing

I recently had a couple of new computers with Windows 7 (64 bit Professional) in an AD environment experience seriously slow browsing of network folders with JPEG files. Windows Explorer would slow to a crawl, often crashing outright. Googling the problem provides many, many supposed solutions, mostly centering around the network adapter properties (disabling remote Differential Compression, disabling Autotuning, disabling Flow Control, etc), none of which worked.

As of this writing, disabling SMB2 (and SMB3) on the client side seems to have worked (speaking to the former admin this was already disabled on the Win2K8 server).