Author: hewagen

  • Slightly clear the fog around BlackLotus mitigations

    Hi, I’m Helmut Wagensonner, a Cloud Solution Architect at Microsoft. Despite the detailed information we’ve previously provided about mitigating the UEFI BlackLotus bootkit, it appears there is still considerable confusion surrounding the entire process. What specifically needs to be addressed, and why are manual steps required to activate the mitigations? Understanding BlackLotus and its mitigations…

  • Remotely create a combined trace

    Why combined remote tracing? Sometimes the machine you need to investigate is physically inaccessible, hung, or its GUI has become unresponsive. In such cases, you can still capture rich diagnostic data—kernel events, network traffic, and user‑mode system calls—by driving tracing entirely from a separate “Admin PC.” Combining multiple trace types into one workflow lets you…

  • Create a performance trace

    Performance traces can help to figure out, which processes slow down the system. To create a performance trace, we use XPERF and NETSH commands. NETSH is part of the operating system while XPERF is a part of the Windows ADK (Assessment and Deployment Kit) and needs to be downloaded and installed. Find the latest version…

  • Windows 10 or Windows 11 GPO ADMX – Which One To Use For Your Central Store?

    Hi community, My name is Helmut Wagensonner. I’m a Customer Engineer at Microsoft and this blog should help you to understand, which Administrative Templates (admx) to choose for your Windows 11 / Windows 10 mixed environment. Note: The content of this article is only useful if you use ADMX file versions released before 21/07/23. All…

  • May 2023 cumulative update for Win10/Win11 explained

    Hi all, mitigating the Secure Boot UEFI bootkit using the May 2023 cumulative update still causes misunderstandings at some of my customers.  So I wrote this short article to give you an overview and illustrate how this update works, especially regarding the elemination of the BlackLotus bootkit, covered in CVE-2023-24932. A very detailed description can…

  • How to get your Intune package source files back

    Hi community! I am Helmut Wagensonner, a customer engineer for Windows client OS at Microsoft. This blog is about getting back the source files of a Win32 app uploaded to Microsoft Intune. Not long ago, I updated one of my tools (https://technet.blogs.ms/stayawake-updated/) and I wanted to add it as a new app package in my Intune…

  • StayAwake (Updated)

    Good day everyone! Some time ago, I created myself a little tool to prevent my computer from going to sleep or standby. I worked with it the last couple of years but lately I thought about an option to disable the tool at a certain time, like “Keep my PC alive until 7 pm and…

  • Powershell Few-Liners (Miscellaneous)

    This article is part of the few-liner series, where you can find some useful powershell examples. Of course, you need to adjust the values/paths to your needs. Also, I know there may be other ways to achieve the same results but this is not a base for an “which-command-is-better” competition. Depending on the time you…

  • Powershell Few-Liners (Active Directory)

    This article is part of the few-liner series, where you can find some useful powershell examples. Of course, you need to adjust the values/paths to your needs. Also, I know there may be other ways to achieve the same results but this is not a base for an “which-command-is-better” competition. Depending on the time you…

  • Powershell Few-Liners (Windows Events)

    This article is part of the few-liner series, where you can find some useful powershell examples. Of course, you need to adjust the values/paths to your needs. Also, I know there may be other ways to achieve the same results but this is not a base for an “which-command-is-better” competition. Depending on the time you…