Fix Windows 10 / 11 Issues - Ping, High CPU, Disable Update, etc - NETSEC

Latest

Learning, Sharing, Creating

Cybersecurity Memo

Friday, January 29, 2021

Fix Windows 10 / 11 Issues - Ping, High CPU, Disable Update, etc

Met all kinds of issues while using Windows 10. Resolved them usually by googling online. List some of typical ones here:


Enable Ping Through Windows Firewall

  1. Search for Windows Firewall, and click to open it.
  2. Click Advanced Settings on the left.
  3. From the left pane of the resulting window, click Inbound Rules.
  4. In the right pane, find the rules titled File and Printer Sharing (Echo Request - ICMPv4-In).
  5. Right-click each rule and choose Enable Rule.
Right click File and Printer Sharing (Echo Request - ICMPv4-In)rule and enable it.



Check Applied Group Policy

Method 1: View Applied Group Policies Using the Resultant Set of Policy tool

  1. Press the Windows key + R to open the Run box. Type rsop.msc and press Enter.

  2. The Resultant Set of Policy tool will start scanning your system for applied group policies.

  3. After scanning, the tool will show you a management console that lists out all group policies applied to your currently logged-on account.

Note: The Resultant Set of Policy tool allows you to see what policies are in effect, and you’re unable to change any policy settings from there.

Method 2: View Applied Group Policies Using Command Prompt or PowerShell

  1. Press the WIN + X key combination to open the WinX menu, and then choose “Command Prompt (Admin)” or “Windows PowerShell (Admin)“.

  2. To view all the policies applied to a specific account on your computer, run the following command and press Enter.

    gpresult /user your_account_name /h c:\gpo.html /f

  3. It will generate a report of the applied group policy settings and saves it in HTML format as a file named gpo.html. Open the HTML file using your web browser and you can view applied policies under both Computer Configuration (Computer Details) and User Configuration (User Details).



High CPU Usage

This case is caused by Windows Software Protect Service (Sppsvc.exe)

  • Click Win key + R, type regedit, and press Enter.
  • Navigate to the HKLM\\SYSTEM\\CurrentControlSet\\Services\\sppsvc using the left pane.
  • Modify the Start value from any number to 4



 


.




Office can't find your license 

Microsoft Office can't find your license for this application or Windows is not activated

Issue is relating to disabled Windows Software Protect Service (Sppsvc.exe).

If HKLM\\SYSTEM\\CurrentControlSet\\Services\\sppsvc value is 4 and sppsvc.exe Software Protection service is disabled. You will need to change HKLM\\SYSTEM\\CurrentControlSet\\Services\\sppsvc value to 2 or 3 to enable it to get your Microsoft software license activated automatically.













Windows 10 Defaultuser0 password Issue

Sometimes, during install or update Windows 10, the process was interrupted or lost communication, Windows 10 will only show you user defaultuser0 to log in with a password. No one knows this password. To resolve this issue, basically, you will just need to restore to a good saving point or reset it and wipe all of your configuration.

Step One:Boot up your computer.

Step Two:When booted up hold down your "shift" key and click on the restart button on the bottom right of your screen.

Step Three:This will bring you into the Advanced Option menu. From there click on "Troubleshooting" and then "System image restore".
*What this will do is bring you to your system restore screen and prompt you with restore points*



Step Four:Select your most recent restore point and start the restore process.
*When prompt to select an account you will see administrator. Simply click is and DO NOT PUT IN A PASSWORD leave it blank*
*Will only be one restore point if a clean install of windows 10*

Step Five:When your computer finishes this (time will vary) simply restart when prompt and it will start loading up the Windows 10 Setup screen.

Step Six:
Create your Account.

What the restore did was bring your computer back to the point where windows 10 just finished installing but hasn't setup a profile yet. This will just bring you through the step by step instructions to create a user account you can actually use.

If you did not save a restore point, you had better to reset it to wipe every personal stuff. Click “Troubleshoot”, then “Reset This PC”, and finally “Remove Everything”. You’ll drop to a black screen with the word “Preparing” in the large, friendly letters characteristic of Windows 10. Eventually, you will return to a blue screen asking if you want to clean the drives as well. Click “Just remove my files” and then the “Reset” button on the next page. The screen will go black again and display the Windows 10 progress indicator while it chugs through the reset process.



Can't open gpedit.msc


Tried to use gpedit.msc and got following messages:

Failed to open the Group Policy Object on this computer. You might not have the appropriate rights — unspecified error.

Solution:

Rename machine folder name to something else at C:\Windows\System32\GroupPolicy,

You also can choose to delete all the files inside the Machine folder instead of renaming it. Windows will automatically recreate the required files when you relaunch the policy editor.


Account restrictions are preventing this user from signing in

Trying to run a program using administrator account but got following error:

Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign in times are limited, or a policy restriction has been enforced.

I am sure there is no blank password and limited sign in time. It must be restricted by group policy. 

  1. Run gpedit.msc. Once the Windows Local Group Policy Editor opens up, navigate to the following directory:
    Computer Configuration > Administrative Templates > System > Credentials Delegation
  2. There, on the right-hand side, locate the ‘Restrict delegation of credentials to the remote servers’ policy.
  3. Double-click it to edit it. Set it to Disabled, click Apply and then hit OK.
  4. Following two policies changes
  5. Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
  6. Accounts: Administrator account status - Enabled
  7. Accounts: Limit local account use of blank passwords to console login only - Disabled


Disable Windows Updates

Option 1


1  Automatically using a small program - Windows Update Blocker

You can find this program from : https://www.sordum.org/9470/windows-update-blocker-v1-6/




2  Manually Disable Services and Change Settings

Disable following four services:
1. Background Intelligent Transfer Service 2. Windows Update 3. Update Orchestrator Service 4. win10 upgraded to after version 1800, ,there is one more service to disable “Windows Update Medic Service” ———————————————— Also, you will find there are two services which will need to use registry key to disable them. 1. Update Orchestrator Service 2. Windows Update Medic Service ================================================= If your services come back running again after a couple of days , you might want to try following two methods: Method 1: Here is another registry key, you might want to give it a try: Navigate to the following path in the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows 1. Right-click the Windows (folder) key, select New, and then click the Key option.Name the new key WindowsUpdate and press Enter. 2. Right-click the newly created key, select New, and click the Key option.Name the new key AU and press Enter. 3. Right-click on the right side, select New, and click the DWORD (32-bit) Value option.Name the new key NoAutoUpdate and press Enter. 4. Double-click the newly created key and change its value from 0 to 1. Click the OK button.Restart your computer. ----------------------------- Method 2: Another way is to use group policy. Run gpedit.msc as administrator then navigate to the following path: Computer Configuration\Administrative Templates\Windows Components\Windows Update 1. Double-click the Configure Automatic Updates policy on the right side. 2. Check the Disabled option to turn off the policy. Click the Apply then OK button



Related Post: 

  • https://itprosec.com/index.php/2022/10/27/use-windows-update-blocker-to-easily-disable-windows-update/


Option 2:


Features

  • Stops Windows updates.
  • Stops forced upgrades.
  • Stops annoying upgrade notifications.
  • Restore updates with one-click.
  • Pauses updates.
  • Disables Windows 7-8 'End of support' and 'End of Service' notifications.

Benefits:

  1. Easy to disable and re-enable Windows updates.
  2. StopUpdates10 does not delete files, does not change file rights or another destructive actions.
  3. StopUpdates10 is lightweight.
  4. StopUpdates10 is free of charge.


Enter Windows 10 Safe Mode

1  From Troubleshooting Mode




Troubleshoot > Advanced options > Startup Settings > Restart.



2  From Normal Windows Mode

  1. Press Win +R
  2. Type Msconfig , Enter
  3. Choose Boot Option
  4. Check Safe Boot with Minimal option







How to Delete EFI (System) Partition in Windows 11/10/8/7

For users who want to delete the EFI system, there are two methods available. One is to delete with the Windows built-in tool - Diskpart and the other is to apply a simple third-party tool - EaseUS Partition Master. To avoid unnecessary file loss, make sure you have backed up the ESP files in advance.

As a command-line utility, DiskPart is sort of complex for average users to apply. Please be very careful while following the below command lines to delete EFI partition:

Step 1. Open DiskPart on your PC.

  1. 1. Hit "Windows Key + R" to open the run dialogue box.
  2. 2. Enter diskpart and click "OK" to open a black command prompt window.

Step 2. Change EFI system partition ID and set it as a data partition.

Type the below command lines and hit Enter each time:

  • "list disk" (It displays all the disks of your computer. )
  • "sel disk 0" (It identifies which disk you need to work with. Here 0 stands for the disk letter.)
  • "list partition" (It displays all partitions and EFI system partitions on the selected disk.)
  • "sel partition 1" (Select the EFI partition that you want to delete. Here, 1 stands for the volume number of EFI.) (This step is not always needed)
  • "SET ID=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7"

By doing so, it will make the EFI system partition deletable. Continue with the following steps to remove this partition on your hard drive.

Step 3. Delete the EFI partition with the command line.

Type the below command lines and hit Enter each time:

  • "list partition" (It displays all the volumes on the hard drive.)
  • "sel partition 1" (It identifies which partition you want to remove. Here 1 stands for the volume letter.)
  • "delete partition override" (It removes the EFI partition from Windows disk.) 

Step 4. Complete EFI deleting process.

Finally, type "exit" to close the windows when you receive the message that says, 'DiskPart successfully deleted the selected partition'.










No comments:

Post a Comment