tim11g's questions

I'm trying to use the sysinternals pslist64 (latest version v1.4) to diagnose memory issues. In a Windows 10 system, pslist64 -m provides this data (subset of the first 25 lines of output):

Name                Pid      VM      WS    Priv Priv Pk   Faults   NonP Page
Idle                  0       8       8      60      60        9      0    0
System                4  302132  197472     776     912  2563343      0    0
Registry            148  163316   56004    8980  195936   176551     24  323
smss                580 2151718540    1036    1072    1136     1340      3   12
csrss               916 2151774964    5396    1988    2216     7733     29  297
wininit            1020 2151746364    6288    1408    1948     2554     11   74
csrss               104 2151824756    5884    4328    4996  1859083     39  323
services            920 2151769324   16628    9040   15344   218823     15  213
lsass              1040 2151808560   31496   14932   16264    61249     37  224
svchost            1156 2151833136   36628   16904   19976   122177     29  702
fontdrvhost        1188 2151763536    6820    5468    5468     3148      8   63
WUDFHost           1236 2151821936   10444    8452    8704     4454     16  182
svchost            1296 2151784348   22436   14960   15416    97254     20  217
svchost            1344 2151763788   13616    6732    7120     7113     12  127
winlogon           1404 2151782260   14732    6164    7208    25359     12  144
fontdrvhost        1468 2151877724   18512   10668   11944    27406     12  274
svchost            1572 2151781208   11796    6100    6720     8654     12  103
svchost            1592 2151809396   14924    8544    8968    23063     21  148
svchost            1624 2151760240   10868    5264    5484     5696     13   83
svchost            1632 2151756972   10628    9572   10108    10702     35   67
svchost            1648 2151759324   10492    5260    5668     4079     14   83
svchost            1668 2151762416   13756    5092    5320     5076     10   88
svchost            1676 2151772828   15172    6676    6904     6220     24  108
svchost            1892 2151761008   10732    5960    6948     6881     11   89
svchost            1900 2151768044   13112    6292    7156     7409     16  106

The VM value seems strange. The values are displayed in KB, per the -h help. Many of the values seem to be of the form 2^31 + X where X is a value that could be considered a "reasonable value" of a few GB. If I add up the VM column numbers as shown, for all the instances of svchost and other processes. the total is over 380 TB.

My hypothesis is that memory values are represented as 32 bit, and there is a high bit "tag" of 0x80000000 on some values, which is not accounted for in the pslist -m display of the VM column which formats as an unsigned int. Can anyone provide further details or interpretations? I did not find any more information on Microsoft PSLIST docs or the sysinternals blog.

Edit - I confirmed the same behavior on other Windows 10 systems. I also tested on an older Windows Server 2008r2, and it does not exhibit the display issue with VM values:

Name                Pid      VM      WS    Priv Priv Pk   Faults   NonP Page
Idle                  0       0      24       0       0        1      0    0
System                4    3340     304     124    9508   186576      0    0
smss                240    3984     316     452     548      678      1   10
csrss               432   55392    1680    3216    3944   916722     16  162
wininit             504   45364     520    1476    1784     1358      9   88
csrss               524  146700   13528   25196   25384  7364214     22  314
services            572   44032    5576    6296    9416   599010     13   69
lsass               580   57124    9768    8568   10308   166219     29  112
lsm                 588   31284    2828    3348    3596   226338     10   55
winlogon            688   27304     392    1776    2008     1899      7   45
svchost             744   47692    4604    4836    5184  1256663     13   89
svchost             820   37980    5188    5436    5656  2221819     16   92
svchost             972 1337980   39400  645160  645164  3386113    155 1455
svchost             376  546332   48508   54132  901184 190381045    159  372
svchost              12  107232   12088   12564   14108   422579     39  172
svchost             644   73208    6572    6668    6792  4528076     19  131
svchost             760  162264   11360   16848   18304  1859017     38  161
svchost            1092   55856    7020   12540   13548  5757388     32   89

Edit 2 - I checked on a Windows 11 system. It does not have the same results as either of the preceding examples. The values are closer to Windows 10, but the VM values for svchost are all 4194303.

I found the command wmic cpu get LoadPercentage was recommended as a way to get a CPU load estimate from a command line.

It works as expected from a Windows 10 system:

c:\>wmic cpu get LoadPercentage
LoadPercentage
21

c:\>

From a Windows 2008r2 server, it doesn't return a value:

c:\>wmic cpu get LoadPercentage
LoadPercentage


c:\>

What can be done to allow this to work, or to get the data another way? I tried some of the other approaches in the referenced article and they didn't work either.

SolarWinds has been in the news due to the hack of their servers. It is unclear how far back the compromise goes. The only product I have used from them is their free TFTP server. Has the "fingerprint" of the compromise been documented to allow determination if a specific download is affected? Are the compromised files now detectable with commercial virus/malware scanners?

I'm installing PostgreSQL on a Windows 2008r2 Server, with the intention to use with a Delphi 7 application over ODBC.

I followed the PostgreSQL 12.2 Documentation Not needing to install from source as described in chapter 17, I opted for the Installer that was linked to Following the guidance of the Installation Guide (Installers) I completed the install process without errors.

After restarting the server, I can see the service postgresql-12-x64 is running.

I created the user postres, and was able to start the commandline using runas:

c:\>runas /user:postgres "C:\Program Files\PostgreSQL\12\bin\psql.exe"
Enter the password for postgres:
Attempting to start C:\Program Files\PostgreSQL\12\bin\psql.exe as user "****\postgres" ...

The installer apparently did not update the path, so I had to provide the full path. Now I have a command window on the server machine with a postgres-# prompt.

Next, I want to verify that I can connect to the server from another machine. Posts I find say to use a command like:

psql -h SERVER-IP -U postgres

However, psql.exe is installed on the server not the client machine. What is a "test" executable that can be run from the client to verify that it is able to communicate with the server? Is it as simple as copying psql.exe from the server's C:\Program Files\PostgreSQL\12\bin folder to a temp folder on the client? I tried that and psql.exe closes without any output or error indication:

H:\temp>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time<1ms TTL=128    
^C
H:\temp>psql -h 192.168.2.1 -U postgres

H:\temp>

Server is Win 2008r2, non-domain. Client is Windows 7.
User XYZ on client has matching account on server in group Users. Credentials for server account for XYZ are stored in credential manager on client.

Server has Drive X: and the entire drive is shared as SHARE1 Under Sharing user XYZ is explicitly included in users for SHARE1. Under Security, Group "Everyone" has Read/Execute rights. Group "Users (server/users)" has Full Control. Client can automatically log in to \server and access \server\SHARE1 using stored credentials.

My expectation is that since XYZ is a member of group Users on the server, accessing SHARE1 from the client machine would have Full Control permissions. The actual result it that user XYZ has only Read/Execute permissions (presumably from the Everyone group), and has Access Denied when trying to write.

What am I missing? What tools can I use to diagnose this type of problem?

I have a task that reports "The task is currently running" (0x41301) in Task Scheduler. I can right click on the task and select "End" and nothing changes. The status remains "The task is currently running".

I have restarted the server, and when it comes back up, the task is still reported "The task is currently running". There are many other tasks that are operating normally. The problem task will run normally and terminate normally when run from Task Schedule right-click, Run.

The task is running as Administrator.

I have tried the suggestion to add a "Start in" directory, but that was already present.

What could cause a scheduled task to think it is running, be unaffected by manually termination, and maintain the running status through a reboot? Where is the "state" of a running task maintained in system? I don't find any auto-runs in the usual places in the registry. Furthermore, there is no evidence the task is actually running, as it causes significant disk activity if it is. I do see an instance of "taskeng.exe" in the tasklist output, but I don't know if that is this phantom task or something else.

I have scripts on Windows Server 2008r2 that access specific resources on other server systems using limited credentials. If a person or other script has also accessed that system from this server with different credentials and didn't log out, scripts fail with Error 1219 "The network folder specified is currently mapped using a different user name and password"

How to ensure that my script deletes all connections to this specific machine before trying to map a new drive?

C:\> net use //server /d  

doesn't work on its own. I can follow it up with net use and see that a drive is still shared:

C:\> net use \\server /d
\\server was deleted successfully.


C:\> net use
New connections will be remembered.


Status       Local     Remote                    Network

-------------------------------------------------------------------------------
Disconnected           \\server\somedrive       Microsoft Windows Network
The command completed successfully.

The disconnected drive will still cause the same Error 1219.

Can anyone suggest a more elegant solution than deleting an exhaustive list of all shares that exists on that machine?

net use \\server\share1 /d
net use \\server\share2 /d
net use \\server\share3 /d
etc...

Also

net use \\server\* /d

fails with "connection not found".

I found a PowerShell script that I thought I could adapt to my purposes.

It contains this line that formats the output:

$largeSizefiles = get-ChildItem -path $filesLocation -include $Extension -recurse -ErrorAction "SilentlyContinue" | ? { $_.GetType().Name -eq "FileInfo" } | where-Object {$_.Length -gt $fileSize} | sort-Object -property length  | Select-Object Name, @{Name="Size In KB";Expression={ "{0:N0}" -f ($_.Length / 1KB)}},@{Name="LastWriteTime";Expression={$_.LastWriteTime}},@{Name="Path";Expression={$_.directory}} -first $filesLimit

The key part seems to be this:

Select-Object Name, @{Name="Size In KB";Expression={ "{0:N0}" -f ($_.Length / 1KB)}},@{Name="LastWriteTime";Expression={$_.LastWriteTime}},@{Name="Path";Expression={$_.directory}} -first $filesLimit

I have read the ss64.com tutorial on Select-Object, but I don't find anything to explain how the expressions of the form @{.....} are formatting the text.

The ss64.com page on the @ operator shows it in the format of @( ... ), with parens, not braces.

The code above results in the following output:

Name          : RPI-Image-1-Copy.img
Size In MB    : 29,477
Path          : D:\VirtualDriveShare
LastWriteTime : 8/18/2015 6:27:51 PM

I'm familiar with a number of programming languages, but this is non-obvious to me, and I haven't found any clear explanation online. Can anyone point me to a good tutorial?

I'm looking for ways to reduce exposure of a server's shares if ransomware gets onto a client. Users need access to the server's shares, and normally that is read/write access. Write access is needed less often, though.

I thought about making the normal privileges on the share read-only, with write access "on demand".

Logging in and out of multiple server accounts with different privileges is not desirable - it complex and time consuming for the user, and seems to lead to 1219 errors in many cases. Users are likely to forget to log out of the read/write account anyway.

Is there any way to temporary elevate a user's permission to read/write (on request by the user), have those permissions persist for a limited time, and then revert to read-only? (Ideally the permission could be set to remain for X minutes after the last write)

I didn't find anything relevant when searching, but maybe I used the wrong terms.

This is a very small environment with a few users on Windows 7 and 10, and one Windows 2008r2 server (workgroup, not AD/Domain)

DHCP is managed by a Windows 2008r2 server. I want to convert a lease into a reservation so the IP will be fixed. Normally, I create a reservation based on the assigned IP address, and when the lease expires, it uses the reservation.

Most of my devices have Client Hardware address that look like this: ab-cd-ef-00-12-34.

I have one new device (A Raspberry Pi), that has a Client Hardware Address that looks like this: eb-ea-ad-06-00-01-00-01-1c-dd-60-60-b8-27-eb-ea-ad-06

That is 18 bytes instead of the normal 6. The first 4 are the same as the last 4.

I created a reservation with the last 6 bytes (b8-27-eb-ea-ad-06), but when the original lease expired, it didn't use the reservation, but received a new IP address from the pool.

I found this post that explains a possible solution on the client side.

I tried adding send dhcp-client-identifier = hardware; into /etc/dhcp/dhclient.conf

The line was there and I un-commented it. After rebooting the Pi to get a new address, the Windows server still sees the device as having the 18-byte HW address. I also triedsend dhcp-client-identifier = b8-27-eb-ea-ad-06; (which is the actual address reported on the Pi by ifconfig. Windows still sees the 18 byte address.

I can create a reservation with the 18 byte HW address, but I'm wondering if that will be stable over time. IE will the "extra" bytes vary depending on where in the network the Pi is connected?

Is there any other solution?

In a Windows environment, are executable programs that are used to process piped output guaranteed to be unique tasks if called from different CMD environments?

For example, suppose script1.cmd contains this line:

echo "some logging information" | my_pipe_program >> logfile1.txt

Also there is script2.cmd that contains this line:

echo "some other information" | my_pipe_program >> logfile2.txt

If script1 and script2 happen to run at the same time, is Windows going to call separate instances of my_pipe_program.exe?

I'm getting sporadic errors where a command script fails with the error "The process cannot access the file because it is being used by another process" This error always occurs right after a line that pipes through my_pipe_program.exe.
It causes the CMD script to stop right at that spot, leaving the CMD window open.

The conflict could be with my_pipe_program.exe or it could be logfile2.txt. The program my_pipe_program.exe is used in multiple CMD files, which could potentially run at the same time. The logfile is unique to the CMD file, so it seems less likely to be the culprit, unless Windows is failing to close it after the CMD file exists. Is there any approach to diagnose the problem and fix the error?

Related question - is there any way to trap and handle the "...being used by another process" error and prevent the CMD file from aborting?

Running Windows Server 2008r2. DHCP Logging is enabled (Server Manager, Roles, DHCP Server, , IPv4, Properties, General, Enable DHCP Audit Logging).

In the DHCP event log (Event Viewer, Custom Views, Server Roles, DHCP Server) I see events for the DHCP server starting, but new DHCP address leases are not logged.

How can I enable the logging to include new leases?

I recently installed a Windows 2008r2 server (workgroup only, no AD or Domain). This server has DNS enabled.

From a different client machine on the LAN, I run NSLOOKUP to test DNS operation.

When starting up, it correctly lists the server name and IP address.

when I type in "realdomain.com" from the > prompt, NSLOOKUP returns:

Non-authoritative answer:
Name:   realdomain.com.my.domain.net
Address:  67.215.65.132

The client system is able to resolve names, so DNS is working to some extent, but I don't understand why "my.domain.net" is appended.

The 67.215.65.132 address returned for realdomain.com is also incorrect. The address actually belongs to OpenDNS. I am using OpenDNS as the forwarders, but those addresses are 208.67.xxx.xxx.

"my.domain.net" is the primary DNS suffix of the my local LAN server. It is not a publicly visible domain, since the server is on a private network.

This question seems to be quite similar, but I don't understand how to apply the solution: "...remove the wild card entry from your network solutions configuration". What wild card entry? Where is the "network solutions configuration"?

As in the referenced question, if I enter realdomain.com. (with the period at the end), it works correctly and returns the correct address.

The lowest resolution that Windows Server 2008r2 allows through the screen properties dialog is 800x600. I have a special secondary display that needs to run at 640x480. This has previously been running on Windows Server 2000, which supports 640x480 just fine. I want to retire the Win 2000 system and move the application to the 2008r2 box.

Is there any way (registry etc) to re-enable the 640x480 resolution option on the secondary monitor?

The display does not support DDC and is identified as an unknown analog monitor.

I'm setting up a VPN using a self-signed certificate. My certificate is was generated on the server and is installed on the server. It shows up in the MMC console under "Certificates (Local Computer) / Personal / Certificates"

I have verified the binding of the certificate to the SSL listener with "netsh http show sslcert", which reports back:

SSL Certificate bindings:
-------------------------

IP:port                 : 0.0.0.0:443
Certificate Hash        : bc21f475405f********a97aa4cdecd3bfe257d3
Application ID          : {ba195980-cd49-458b-9e23-c84ee0adcd75}
Certificate Store Name  : MY
Verify Client Certificate Revocation    : Enabled
Verify Revocation Using Cached Client Certificate Only    : Disabled
Usage Check    : Enabled
Revocation Freshness Time : 0
URL Retrieval Timeout   : 0
Ctl Identifier          : (null)
Ctl Store Name          : (null)
DS Mapper Usage    : Disabled
Negotiate Client Certificate    : Disabled

IP:port                 : [::]:443
Certificate Hash        : bc21f475405f********a97aa4cdecd3bfe257d3
Application ID          : {ba195980-cd49-458b-9e23-c84ee0adcd75}
Certificate Store Name  : MY
Verify Client Certificate Revocation    : Enabled
Verify Revocation Using Cached Client Certificate Only    : Disabled
Usage Check    : Enabled
Revocation Freshness Time : 0
URL Retrieval Timeout   : 0
Ctl Identifier          : (null)
Ctl Store Name          : (null)
DS Mapper Usage    : Disabled
Negotiate Client Certificate    : Disabled

However, "netstat -aon" does not report anything listening on port 443. I checked the registry at "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SstpSvc\Parameters" and found that ListenerPort was set to 0. I changed it to 443. I restarted the SSTP service, but still nothing is listening on 443. "sc query sstpsvc" and "sc query remoteaccess" both report "State 4 Running"

The error is shown on the client. The VPN client is a Windows 7 machine on the local LAN. The VPN is configured to use only SSTP. If I change it to use PPTP, it connects instantly. I have exported the self-signed certificate and imported it into the client system. I used the answer in this question to install the certificate in the client's trusted root store.

I have reviewed this article, and used the steps in this article to verify that the certificate was correctly bound.

This article discusses various error codes from SSTP connections, but unfortunately Error 0x8007274C is not mentioned. There is not very much useful information on that error found in Google. Can anyone offer any insight is fixing this problem?

I would like to install an SSTP VPN server on a Win2008r2 server that I use for personal purposes (not using Active Directory). I will have 3 or 4 of my computers and other mobile devices connecting at most.

SSTP requires a server certificate. I can generate a server certificate with CACERT, but it is linked to a specific domain. I do own a domain, but it is not hosted at the address where the VPN server will be running. The VPN server has a dynamic DNS address.

If I install a server certificate for my domain, and bind the certificate to the VPN, will it be possible for clients to connect? I don't mind if I have to approve a one-time exception at the clients.

If there are other issues, how can I work around them?

Thanks!

I have a Windows 2000 server with a Windows 7 client that occasionally gets "error 53" when accessing the server by name (net view \\server). It still works by IP address (net view \\192.168.0.1).

The server's primary IP address (as shown in "routing and remote access" as "Gigabit Ethernet" is 192.168.0.1. There is also a secondary IP address shown as "Internal" which is 192.168.0.50

The server also supports VPN. When a VPN user connects, it gets an address in the range of 192.168.0.51 to .59.

Normally (when there is no error), when the local LAN client runs "ping server", it resolves to 192.168.0.1. When the Error 53 problem happens, "ping server" resolves to 192.168.0.50.

This problem seems to be related to when a user connects or has recently connected to the server VPN.

Is there some connection between the VPN services on the server and the DNS services on the server that could cause a local LAN client to become confused about which IP address to use for the server? Or is there a misconfiguration in the VPN or DNS?

I saw that Robocopy can limit network bandwidth in this answer How do you limit the bandwidth for a file copy?

I have plenty of bandwidth on the LAN, but I don't want to saturate the disk on the system originating the copy (Windows 7).

I vaguely remember reading that Win7 has some facilities for disk prioritization and/or throttling. Is there a version of RoboCopy that takes advantage of those OS features?

Or is there a different way to limit the disk impact of a large file copy job?

I'm trying to set up a SLIP link using a serial connection between two XP computers. This is to test some specialized communications hardware that only supports IP via SLIP.

As a starting point, I'm simply connecting the two computers with a null modem cable to verify the SLIP connection is working. I configured the Guest computer's SLIP connection following this guide.

I have not found a comparable guide for configuring the host side, but I tried to create a complementary procedure: Network Properties / New Connection / Set up an Advanced Connection / Connect Directly To Another Computer / Host / COM1 / {choose users} / {finish}. This results in a new section in Network Properties labeled "Incoming" which has an item named "Incoming Connections".

After connecting the null modem cable between computers, I can successfully connect from the guest computer to the host. The Guest machine shows "Connected" in Network Properties, and I see the IP address in IPCONFIG. However on the Host computer, the status of the "Incoming Connections" device remains as "No Devices Connected". There is no new IP address in IPCONFIG, and there is no new interface in ROUTE PRINT.

On the Host machine, under Connection Properties / Networking / TCP/IP / Properties, there is a "Incoming TCP/IP Properties" dialog. I have set this for "Specify TCP/IP addresses, and I gave a range of 10 IP addresses in the 192.168.1.0 network. I checked "Allow Calling Computer to specify its own IP address", since per the PDF document (above) I specified an IP address (within this range of 10).

Both computers already have Ethernet networks on 192.168.0.0/24. I tried setting the SLIP addresses in unused space on the 192.168.0.0/24 network. I also set them to a completely different network: 172.16.1.1 and 172.16.1.2. Same result: SLIP connection from Guest seems to connect, Guest gets an IP, but there is no evidence of any connection on the Host machine (No IP address, no route)

An LED monitor on the serial line shows traffic from Guest to Host when attempting PING the host over the serial cable. All pings time out - there is no response from the Host.

I verified the serial connections by running terminals on both machines. The serial connection works fine. As an additional test, I reversed the host and guest roles. Again, the Host machine does not acknowledge an incoming connection, or assign an IP address.

Since there is no IP address on the host machine, I can't connect or PING across the SLIP link. What am I missing in this configuration for SLIP?

I have recently installed a Rosewill RSV-S5 eSATA RAID array on a Windows 2000 Server. I'm not using any RAID features - it is configured as 5 discrete drives (JBOD).

The system is based on the Silicon Image Sil3726 and Sil3132R5 chipsets, which support hotswap of SATA drives.

There is no problem inserting a drive into the box while it is running. The drive is recognized an comes online as expected, just like a USB drive would. My question is how to "safely" remove the drive. The drives in the RSV-S5 do not appear in the "Safely Remove Hardware" list where USB drives appear.

How can I safely unmount and remove a drive without shutting down the server?