Some Notes on the Machines

Try URLs like this, for an ISO of Windows 10 build 1909:

https://archive.org/details/windows-1909

Unfortunately, archive.org lacks the bandwidth for rapid downloads of monsters like those. Here’s a source which can set you up to do it in 10 minutes if your side is fast enough:

https://www.heidoc.net/joomla/technology-science/microsoft/67-microsoft-windows-and-office-iso-download-tool

This one has a lot of very nice performance tweaks, and a defrag within that seems to do a good job, though one cannot defrag an SSD, only TRIM.

www.wisecleaner.com/wise-care-365.html

Here is a newest method as of right now. There was a warning seen when using a previous method, stating that previous methods will no longer be available fairly soon.

Set-Executionpolicy Bypass -Scope Process 
Install-Module PowerShellGet -Force -AllowClobber
Install-Module ExchangeOnlineManagement -Force -AllowClobber

and then, changing the below appropriately:

Connect-ExchangeOnline -UserPrincipalName adminuser@domain.com

This has become fraught with peril lately, even after initiation it can be far from easy to figure out what to do next. What to do next, after the transfer has initiated, is, we browse here:

www.networksolutions.com/manage-it/transfer-status.jsp

and we put the transfer authorization code, from the outgoing registrar, after finding the appropriate Network Solutions account number for the order, and scrolling in the above page (if there are more than one; if you do a lot of this, there will be a pile, if not, just one) to find that account number. Then open the account and enter the code.

If you have trouble finding that account number, browse here:

www.networksolutions.com/my-account/order-history

and the account number will be listed with the order for the transfer.

Sometimes, the legacy/traditional Devices and Printers window does not come up in Windows 11. If you see this, browse to this in File Explorer:

shell:::{A8A91A66-3A7D-4424-8D24-04E180695C7A}

The following TXT record contents:

v=DMARC1; p=reject; pct=100; adkim=s; aspf=s

at least theoretically, should harden SPF and, if present, DKIM. “=s” means “strict”. According to DMARC documentation, DMARC can be used without DKIM, and experiences with a first setup of the above without DKIM are playing out well so far.

To use the above, create a TXT record of name _dmarc with those contents.

Some more info is here:

www.dmarcanalyzer.com/how-to-create-a-dmarc-record/

Run it like this from administrative CMD, in two steps. In the first step just check everything off. The second step runs it all. Cleans a whole lot more than any other way, and after you do the first step, the second step stays put, the number is actually the maximum index of sets of cleanup that you can keep around for future semi/automatic use.

Cleanmgr /sageset:65535 

Cleanmgr /sagerun:65535

I have an Evercross H5 and an NIU KQ3i. I like the careful design and self-control of the NIU, but I have had to do a few things. Here’s a reference pic of my NIU:

First of all, on every single screw of the stem, I’ve added Blue Permatex Gel. This has kept them all from loosening.

Secondly, concerning the two silver screws on each opposite side near the bottom of the stem. These loosened often for me, even with B.P.G. I thought about trying Red Permatex, but there’s common advice to avoid this because you’re not going to get the screw out without serious heat, and we’re screwing into aluminum here. So I looked far and wide, and found some thin countersink washers that fit:

from McMaster-Carr (a great source for lots of things, click on the image for detail)

and used one of those on each silver screw. By the time I got that far, I had stripped the head of one of the silver screws, and I replaced it using McMaster:

You’ll notice that my replacement is Torx, not hex; this is deliberate, Torx is more resistant to stripping. Also, that screw is made of a very durable alloy. Have had zero trouble with either silver screw since.

I also tightened the larger hex bolts further down, you can see one of the two in the first pic above.

Lubrication has been helpful also, around bearings and really all over, though you don’t want it on your brake disks. The best so far has probably been CRC Electrical Silicone Lubricant. The “Electrical” part is very important because this is a very electrical device, and we don’t want anything sneaking in and either damaging or shorting anything out!

Found by the profound Brigg Bush:

$writers = vssadmin list writers | 
    Select-String -Context 0,4 'Writer name:' | 
    ? {$_.Context.PostContext[2].Trim() -ne "Last error: No error"} | 
    Select Line | 
    % {$_.Line.tostring().Split("'")[1]}



 $ServiceNames = $writers | 
    ForEach-Object {
        switch ($_) {
            'ASR Writer' { $Result = 'VSS' }
            'Bits Writer' { $Result = 'BITS'}
             'Certificate Authority' { $Result = 'EventSystem'}
            'COM+ REGDB Writer' { $Result = 'VSS'}
            'DFS Replication service writer' { $Result = 'DFSR'}
            'Dhcp Jet Writer' { $Result = 'DHCPServer'}
            'FRS Writer' { $Result = 'NtFrs' }
            'IIS Config Writer' { $Result = 'AppHostSvc'}
            'IIS Metabase Writer' { $Result = 'IISADMIN'}
            'Microsoft Exchange Writer' { $Result = 'MSExchangeIS'}
            'Microsoft Hyper-V VSS Writer' { $Result = 'vmms'}
            'MS Search Service Writer' { $Result = 'EventSystem'}
            'NPS VSS Writer' { $Result = 'EventSystem'}
            'NTDS' { 'EventSystem'}
            'OSearch VSS Writer' { $Result = 'OSearch'}
            'OSearch14 VSS Writer' { $Result = 'OSearch14'}
            'Registry Writer' { $Result = 'VSS'}
            'Shadow Copy Optimization Writer' { $Result = 'VSS'}
            'Sharepoint Services Writer' { $Result = 'SPWriter'}
            'SPSearch VSS Writer' { $Result = 'SPSearch'}
            'SPSearch4 VSS Writer' { $Result = 'SPSearch4'}
            'SqlServerWriter' { $Result = 'SQLWriter'}
            'System Writer' { $Result = 'CryptSvc'}
            'WMI Writer' { $Result = 'Winmgmt'}
            'TermServLicensing' { $Result = 'TermServLicensing'}
        }
        $result
    }

If ($ServiceNames) { Restart-Service -Name ($ServiceNames | Select-Object -Unique) -WhatIf }

If ($Result) { Restart-Service -Name ($ServiceNames | Select-Object -Unique) -WhatIf }

The hidden NTFS “System Volume Information” folders on Windows machines, can build up and up and up in size. I’ve seen instances ranging from 20G to hundreds of gigabytes, and every time this occurs, the overall system slows down, and often slows down a whole lot. SpaceSniffer is my favorite method of identifying this situation, but there are many. The only preventative I have been able to identify so far, is here.

But here we are discussing cleanup. If you have SentinelOne (S1) installed on this machine, you need to know that S1 considers deletion of volume shadows to be very bad actor behavior. This is because it often is a way that cryptolockers and others delete last-known-good checkpoints. S1 will not let you clear SVI, unless you disable it first, and it will complain very loudly if you try. Instructions for disabling S1, are at the end of this article. There may well be other security tools which will behave similarly, and need similar interaction beforehand.

General cleanup steps:

1. vssadmin delete shadows /all
2. Only if this is a server, check System Volume Information size again. If it’s still big, we have two options.
   1. The first is to do these two:
      diskshadow
      (then within diskshadow’s command line) delete shadows all
      
      This can take a while, especially if SVI is big, e.g., more than 20-30 gigabytes. It can get huge occasionally, hundreds of gigabytes. I recently saw 1,022 shadow copies deleted (it tells you the count at the end) from one server.
   2. The second is to do this:
      wmic shadowcopy delete /nointeractive
      which runs the cleanup nicely, and possibly a bit faster than the other.

Special case cleanup steps

Special cases do occur. Here are steps which can help a lot.

• Sometimes the steps above quit in the middle. Start them over again. Often they’ll complete.
• If the above does not completely solve the situation (if the SVI folder is still huge), do vssadmin resize shadowstorage for the relevant drive(s) (try /? for syntax…), first to 10%, then back to whatever it was. Sometimes Windows will do a lot of steady cleanup for you, sometimes over hours of time. You’ll see it by watching File Explorer.
• Run CHKDSK /F at reboot.

To disable SentinelOne:

1. First get the Passphrase for the machine, from the S1 console. It’s under Actions, you can choose Show Passphrase. Do be aware that your S1 admin may receive a notice that you have asked for this.
2. cd "C:\Program Files\SentinelOne\Sentinel*"
3. Please put the actual passphrase in, and the quotes are necessary:
   .\sentinelctl.exe unload -slam -k "<passphrase>"

Then, and only then, will the cleanup commands above work.

To reenable S1:

4. .\sentinelctl.exe load -slam

If you should need to reenable S1 and your command prompt is not where you need it, here’s a paste:

cd "C:\Program Files\SentinelOne\Sentinel*"
.\sentinelctl.exe load -slam