Category: Windows 10 General

  • Slightly clear the fog around BlackLotus mitigations

    Hi, I’m Helmut Wagensonner, a Cloud Solution Architect at Microsoft. Despite the detailed information we’ve previously provided about mitigating the UEFI BlackLotus bootkit, it appears there is still considerable confusion surrounding the entire process. What specifically needs to be addressed, and why are manual steps required to activate the mitigations? Understanding BlackLotus and its mitigations…

  • Remotely create a combined trace

    Why combined remote tracing? Sometimes the machine you need to investigate is physically inaccessible, hung, or its GUI has become unresponsive. In such cases, you can still capture rich diagnostic data—kernel events, network traffic, and user‑mode system calls—by driving tracing entirely from a separate “Admin PC.” Combining multiple trace types into one workflow lets you…

  • Create a performance trace

    Performance traces can help to figure out, which processes slow down the system. To create a performance trace, we use XPERF and NETSH commands. NETSH is part of the operating system while XPERF is a part of the Windows ADK (Assessment and Deployment Kit) and needs to be downloaded and installed. Find the latest version…

  • May 2023 cumulative update for Win10/Win11 explained

    Hi all, mitigating the Secure Boot UEFI bootkit using the May 2023 cumulative update still causes misunderstandings at some of my customers.  So I wrote this short article to give you an overview and illustrate how this update works, especially regarding the elemination of the BlackLotus bootkit, covered in CVE-2023-24932. A very detailed description can…

  • How to get your Intune package source files back

    Hi community! I am Helmut Wagensonner, a customer engineer for Windows client OS at Microsoft. This blog is about getting back the source files of a Win32 app uploaded to Microsoft Intune. Not long ago, I updated one of my tools (https://technet.blogs.ms/stayawake-updated/) and I wanted to add it as a new app package in my Intune…

  • Create a boot trace using WPR

    Hi all, I am Helmut Wagensonner, a Customer Engineer at Microsoft. This blog post gives a short overview on how to create a boot trace with Windows Performance Recorder. It does not cover trace analysis. Creating a boot trace is basically quite self-explaining but as I often need to explain it to customers, I thought…

  • UE-V Template Generator Error

    Related to: ADK 1703, 1709, 1803, 1809 After installing the UE-V Template generator it throws an error when you try to create a custom template. In the following example I’m trying to create a template for 7ZIP. Clicking Next triggers the UAC. After confirming the UAC window with Yes, following error appears. Additionally, the SCM…