Martin Zugec blog : Tips&Tricks

Create file with specified size

martin — Mon, 16 Jun 2008 07:46:00 GMT

Yesterday I run into very strange problem with one of my friends - Echo. stopped working.

In batch scripts, you use Echo to output something to screen - and of course you can redirect it to file.

By using Echo. (mind the dot), you specify that you want to output empty line. So if you want to create empty file from batch, you can use Echo. > c:\Temp\Empty.txt

Yesterday one script stopped working - Echo. was not working. It was working for everything else (including log files etc), just not for creating files in one folder. I have absolutely NO IDEA how that was possible (and if someone does, share any ideas, I am very curious about this one).

I remembered of less known feature from FSUtil - FSUtil can create for you empty file with predefined size. And it worked:

FSUtil File CreateNew C:\Temp\Empty.txt 0

In my case I used it only as alternative method because Echo. failed, however it can be useful if you want to benchmark performance or do something similar.

For example if I want to create 10 files with 10GB size, I would run following command:

for /l %i IN (1,1,5) Do FSutil File CreateNew C:\Temp\PerfTest\Test%i 1073741824

This would create 5 files with 10GB size. What I like about it that all files are created within miliseconds.

"Enter email to register" solution

martin — Tue, 10 Jun 2008 08:06:50 GMT

Sometimes I figure out that solution for some problem I am using is not very common between rest of world, so I will try to share such tricks.

One of them is how do I handle websites that require email address for registration. My favorite way to solve it is to use MailExpire - you simply specify your (real) mail address, when you want to expire temporary mail and that's all.

For specified time period everything that is send to that mail address (for example turziosior@farifluset.mailexpire.com) is redirected to your real mailbox. You can change expiration if you want or immediately kill that mail when it is no longer needed.

Martin

Which symlinks are supported in Windows Vista and how to configure them

martin — Sun, 08 Jun 2008 13:25:04 GMT

I would like to write comprehensive article about symlinks\hardlinks\junctions\reparse points and mount points in future - however that topic is so complex, that I would need to spend few days just to prepare materials etc for this...

So for now all I want to tell you is that symlinks were supported by Windows since Windows 2000 - implementation was done through "reparse points", which is something like special tag on NTFS object that allows special FS filter to process them. Biggest limitations were that explorer was not able to handle them correctly (well, it was not able to delete junction, it deleted also target) and only L2L (local to local) symlinks were supported.

In Windows Vista, symlinks are implemented as new NTFS object - so major change is NOT introduction of concept, but rather possibilities and different implementation.

Major difference is that Vista supports all 4 common scenarios:

L2L (local to local) - for example C:\Documents and settings --> C:\Users)
L2R (local to remote) - for example C:\MyShare --> \\Server\Share\Martin.SoulinCorp
R2L (remote to local) - for example \\server\share\DownloadsOnMyPC --> C:\Downloads
R2R (remote to remote) - for example \\server1\share\Data --> \\server2\share\Data

I don't have (yet) experiences with R2L and R2R, however I really love L2L (which is possible also in w2k and wxp) and L2R (which is something new, but I love that functionality).

If (for any reason) you want to disable particular scenario, you can use FSUtil .

Syntax is FSUtil Behavior Set SymlinkEvaluation followed by symlink type (L2L etc) and status.

For example if I want to disable R2L and R2R, syntax is FSUtil Behavior Set SymlinkEvaluation R2L:0 R2R:0

Use RunAs from non-domain computer?

martin — Tue, 03 Jun 2008 17:32:04 GMT

First I would like to make big announcement - after almost 3 years I left DHL and joined company called Login Consultants... So after long time I am consultant (again) and you can expect more posts about different problems I encountered during my consultancy career...

And I already encountered one during my first day - working with domain-based environment from non-domain computer. As mentioned before, I really love Vista (it took me however some time to get used to it) so I immediately installed it on my new laptop (that is no longer under corporate policies and rules). And then I realized that customer have (well, of course) domain and my non-domain laptop won't be able to do much (except accessing remote shares and running RDP\ICA sessions).

So I started to investigate and came with solution. I found MSDN article http://msdn.microsoft.com/en-us/library/ms682434(VS.85).aspx and one specific part of the article grabbed my attention:

LOGON_NETCREDENTIALS_ONLY
0x00000002

Log on, but use the specified credentials on the network only. The new process uses the same token as the caller, but the system creates a new logon session within LSA, and the process uses the specified credentials as the default credentials.

This value can be used to create a process that uses a different set of credentials locally than it does remotely. This is useful in inter-domain scenarios where there is no trust relationship.

The system does not validate the specified credentials. Therefore, the process can start, but it may not have access to network resources.

Sounds very interesting - so I started to play with this API and it turned out (to make it very simple) that it acts as token that contains multiple credentials (Logon SIDs):

Notice the Logon SID - there are 2 values

This way you can specify MULTIPLE accounts you want to use. In example below I have 3 different credentials:

Cmd with 3 Logon SIDs

Just be aware, based on my testing each credential should be from different domain, otherwise only FIRST match is used.

I tested this solution today - and it works like charm :) For accessing local PC, I am using my account (MartinNB\Martin), for accessing any domain resources, I am using Domain\Operator account automatically. I tried this with accessing remote shares, MMC console (AD Users and Computers) and also PsExec with implicit authentication (that means no username\password defined).

When I knew what I was looking for, it turned out that my whole research was partially waste of time - this functionality is already included in RunAs itself through /NetOnly parameter :)

To show you example how to use it:

We have company XYZ. They provided account SuperAdmin for me with password SuperPassword.

I will first run command RunAs /NetOnly /User:XYZ\SuperAdmin cmd and specify password SuperPassword when prompt appear. New cmd window will automatically appear.

Now I can simply kill explorer (taskkill /f /im explorer.exe) and run it again (explorer.exe) - my desktop will switch, so from now on I can normally work with XYZ domain AND my non-domain laptop :D

I am just thinking about writing some small utility that would allow you to easily switch between different customers profiles (codename Desperate Consultant)... I wrote to Joe from Joeware if he is willing to add this (NetOnly functionality) to his cool utility CPAU - if he agrees, I will wait for him and build it, otherwise I will create some wrapper around RunAs.

Idea is that you will predefine any credentials and that easily merge that credentials into your session.

Lnk, shortcuts - real disaster??

martin — Thu, 29 May 2008 22:20:57 GMT

Maybe you noticed that one of my projects I would like to finish in summer is also offline shortcuts editor - and you probably think "why some editor when I can build shortcuts using Explorer?"...

Think twice - it's not as easy as it looks like and you will be maybe surprised how many gotchas are there.

Problem with .lnk files is that they are WYSINWYG (What You See Is NOT What You Get). Windows is sometimes too "intelligent" - and it can be very, very annoying.

My blog is primarily focused on scripting, deployment and SBC - so I expect that my audience have also some experiences with this. And most people tried to create some shortcut and copy it somewhere else (you create shortcut to some drive letter on your PC and then copy it to desktop of all users for example). Problem is that together with shortcut you provide more information that you know - you provide also last successful resolution of that shortcut and you won't see this information anywhere in properties of such shortcut.

Let me show you example. You map home drives of your users to H: drive. You want to have shortcut to H:\MyDocs on your desktop. So if you create shortcut to H:\MyDocs, then you just need to distribute it to all your workstations and its done. You open properties of this shortcut and you see that it points to H:\MyDocs, so it should work everywhere, right?

WRONG - don't forget, Windows can be sometimes unpredictable ;) If you open properties of your .lnk file, you can see that it is (still) pointing to H:\MyDocs - however .lnk file also contains information that H:\MyDocs is in fact \\Servers\Administrator$\MyDocs and it will automatically open this folder even from different PC! Quite nasty, right?

And thats not all - try to remove that drive letter and open shortcut - because it remembers that location, it will automatically map H: to \\Servers\Administrator$\MyDocs

If you will try to map something else (\\Servers\Projects) to H: drive, Windows will surprise again - not only it will map that shortcut to different drive (X:), but it will also modify your shortcut so it is automatically changed from H:\MyDocs to X:\MyDocs... Which means that if you have 50 shortcuts pointing to H: drive, 1 accidental click can corrupt that shortcut for you.

You can find many (well, not tons of, but still few of them exists) offline shortcuts editors, however most of them covers only situation I described above (and not of all them covers this). There are some bugs that are (as far as I know) not solved by any existing product - for example if you use variables to define your folders (for example %Programs% for D:\Programs), you WON'T be able to create such shortcut if variable is not defined. When you try to create it, C:\ prefix is automatically appended (so %Programs% is in fact pointing to C:\D:\Programs, which is invalid value).

Well, this was just quick overview why I want to have offline editor where all such bugs will be fixed (btw I already have first version of code and it works correctly there, so it must be something in Explorer itself)... There are tons of other bugs - I will try to spend some time testing different results and share results with you. I am now very sorry Microsoft didn't implement something like XLNK in Windows Vista :(

When is storing configuration in Windows directory good idea?

martin — Thu, 29 May 2008 09:30:00 GMT

Well, I know this is quite controversial, but in some cases (specially scripting frameworks) I think it is good idea to use Windows directory to store some settings\configuration...

Why that? Generally you can always divide such solutions to push or pull (and mixed of course) - that means that (if we talk about servers), sometimes you push some data to server (from your workstation\laptop) and sometimes you want server to retrieve information from some central storage\share.

Windows directory is suddenly only directory that is easily accessible both locally and remotely - from remote system you can use \\Server\Admin$ and from server itself you can simply use %WinDir% variable.

I know most people would say that you can use \\Server\C$ and %SystemDrive%, but you never know if C: drive really exists (this is happening in SBC environment when you want to have client's C: drive mapped at C letter).

So for these reasons I like to use Windows directory - and then I make symlink\junction to some other location (so for example C:\Windows\CentralStorage\MyFramework --> C:\MyFramework). That way all required files are easily accessible for scripts (both push and pull) and also for administrators or people working with such environment.

There are of course another ways how to achieve that - create new shares etc, however this method is most reliable and can be easily accessible for all scripts\tools and also for all administrators.

SystemSherlockGUI - one package that rules them all ;)

martin — Mon, 26 May 2008 20:42:13 GMT

Good news everyone - I just received email from Roger (a.k.a. Kephyr) - he is author of brilliant SystemSherlock. He allowed me to include SystemSherlock in one package with my GUI - so now you can download one package with both GUI and command line interface :)

To remind you, SystemSherlock is snapshoting utility (like Regshot), that can track changes on your filesystem or registry...

Snapshoting is sometimes (often) better than using ProcMon\RegMon\FileMon - you only see real changes, no reads etc... So I prefer snapshoting when I for example want to find where in registry are some changes hapenning.

Compared to RegShot, SystemSherlock is I think much better - you can compare unlimited dumps (not only 1st & 2nd snapshot) and I like GUI more ;)

Download and enjoy :)

P.S.: If you have any feature requests or bugs to report, feel free to contact me, I would like to keep SystemSherlock alive

Elevator - command line

martin — Mon, 19 May 2008 15:15:39 GMT

If you tried elevator, you probably know that it is running thought context menu:

It is assigned only to exe files (if it is needed, I can extend it)... But sometimes you may want to change shortcut to always run specific action using elevator.

In fact it is pretty easy - just run ElevatorRunner.exe with filename and parameters and you are all set :)

First parameter is executable you want to run and then any command line arguments you want to include.

For example if you want to elevate MMC.exe, simply runs ElevatorRunner MMC.exe and thats it.

To also show example with command line parameters, this is command line I use to run Joost:
C:\Data\SkipUAC\ElevatorRunner.exe "C:\Program Files (x86)\Joost\xulrunner\tvprunner.exe" "C:\Program Files (x86)\Joost\application.ini"

In following screenshot you can see few examples:

It is also pretty easy to modify shortcuts to use Elevator:

Martin

SystemSherlock - snapshot using GUI or CMD

martin — Sat, 17 May 2008 21:32:00 GMT

Recently I wrote about SystemSherlock Lite - really nice snapshoting tool that supports command line... I also posted small utility for parsing log files.

After that I started to heavily use SystemSherlock - and I must say that it is really really great utility. Problem is that usually you want to have command line AND GUI interface - and SystemSherlock is cmd only :(

So I decided to create wrapper around it - and for me combination of GUI and SystemSherlock is much better snapshoting tool than RegShot or InstallRite...

SystemSherlock GUI consists of 3 different tabs - one for creating snapshots, second for comparing snapshots and third for displaying log files in friendly structure.

Create snapshot

Below is GUI used for taking snapshots:

It allows you to create snapshot configuration, specify output file and also to include exclusion list if you want to ignore particular entries. This is configured snapshot for detecting HKCU and C:\Temp folder:

I tried to implement quite logical interface, so there are feature like auto-suggest or auto-repair of entries (for example HKLM is automatically translated HKEY_LOCAL_MACHINE)... Another feature is that entry type is automatically detected (you can see it in video - I don't select whether entry is registry or filesystem, it is automatically filled):

Update: Embedded video from Jing doesn't work :( So click on following link instead).

Once you specified what you want to monitor, just click on create button - dump is automatically created. Then do whatever you want - and just click on Create button again. One of SystemSherlock advantages is that it allows you to create as many dumps as you want - you can even compare current dump with one created months ago...

When finished, move to Compare snapshots tab.

Compare snapshots

Below is screenshot of Compare snapshots tab:

It is divided to two parts - on left you can see source dumps and on right target dumps. Source dumps are the ones that were taken first - this is VERY important to understand that source must be always older.

System Sherlock Lite can report unexpected results if you are not aware of this behavior - if you will swap source and target (so target will be older file and source will be newer file), results will be opposite (for example if you deleted folder between snapshots, it will report that this folder was created etc.).

For this reason I implemented some logic to processing. When you select any file on left, ONLY newer files then selected are displayed on right.

Parse logs

When you compare two dumps, differences between these two entries are automatically displayed in GUI.

Current version should be already functional, but I am sure that there will be some issues - after all, this is really first version I just finished. If you encounter any problems or you have some features requests, feel free to post them in comments - if nothing, I will at least respond (but probably also implement such changes).

Advantages compared to RegShot:

Fully supports command line - can be scripted
Imho better GUI
Supports multiple dumps - not only comparison of 2 snapshots (easily review historical changes)
Exclusion list based on RegExes
GUI for reading log files

Download

Utility to display logs from SystemSherlock Lite

martin — Thu, 15 May 2008 10:29:00 GMT

As mentioned in my post about SystemSherlock Lite, I really love this tool after few days... Only problem I had is that it can take some time to realize what really happened - you need to read pretty big log files and you can spend precious time reading through temporary entries or documents and settings and miss one important entry saying that applications copied something to your System32 folder.

I was playing with Sherlock yesterday and I spent lot of time parsing through log files generated by SystemSherlock. Then I spend 20 minutes writing some automated parser and I want to share with you ;)

Usage is pretty simple - just click on Open log file, select your log file and output similar to following should appear:

I dont know what else to add - this utility is pretty simple, however can save your time ;) One more notice - log parse is able to handle also mixed logs (so if you have one log where you store different entries together with log output from SystemSherlock Lite, you can use it and it will only show entries from SystemSherlock Lite.

Any comments, requests? Feel free to post comments...

Google maps with Wikipedia and Photos

martin — Wed, 14 May 2008 13:12:00 GMT

Yesterday I wrote blog entry about Live Maps and Wikipedia... I really like mesh ups (using existing data sources), so I just wanted to check if this isnt supported also by Google Maps.

Google Maps supports Wikipedia - and result is far better then Live Maps implementation (which feels like beta).

To test it, just go to maps.google.com, search for any location.

Then click on More button (upper-right) and select Wikipedia (and definitely try also Photos).

This is really REALLY nice and I love it :)

Make snapshots of filesystem and registry using command line

martin — Wed, 14 May 2008 12:43:00 GMT

Some installers can be very mysterious - this suddenly applies for MSI packages, even using full logging, it is not easy to find out which registry keys or files were modified\deleted\added. If you have application that is using some custom installer, this can be hell...

Colleague of mine came with really nice idea - what about using some tool like InstallRite or RegShot for monitoring all installations and reporting what was changed during that installation? From idea it is usually not far to implementation - you only need some tools to do it...

I used utility called System Sherlock Lite - it is very simple to use command line utility that can take snapshots from filesystem\registry and compare them. Of course it is freeware ;) It also supports exclusion list (using regexes), so you can easily configure it for your needs and ignore entries you are not interested in (usually log files or temporary folders).

So what I did is that I created 2 different scripts - StartMonitor and StopMonitor.

StartMonitor is creating first snapshot.

StopMonitor will create second snapshot, compare it with first snapshot and store differences in installation log file. Then it will delete both snapshots.

This implementation is really easy, but is working really nice. Now I can easily monitor all installation I want automatically without any knowledge about installer being used or installation method. It allows me to easily debug anything from logon\logoff scripts to software installations...

Martin

Live Maps with integrated Wikipedia results?

martin — Mon, 12 May 2008 17:11:39 GMT

Well, almost ;)

I love Google, but I also love Live :) For me rivalry of Google vs. Live is good thing, because it moves both of them forwards...

Talking about searching web, I still prefer Google - I use Live Search sometimes, but after they removed my favorite functionality (at beginning they were loading new entries when you scrolled to bottom of page automatically, you can still see this behavior when searching for images), I was really disappointed. Live Search is also missing Groups search, which is no. 1 when trying to find answer to some technical problem.

For some searching I prefer Live - best examples are maps (with all collections, drawing, integration with Outlook etc), videos (they include live preview if you hover mouse over thumbnail) or pictures (there are many features I love when searching for pictures - for example collections, which is really handy if you need to gather some pictures etc)...

Today I found feature in Live Maps I was not aware of - Live Search is automatically indexing Wikipedia and displaying articles that contains geographical information...

It is quite easy to use it:

1.) Search for location you want to see. When it is found, click on Explore collections:

2.) From filter, select Wikipedia:

3.) Locations defined in Wikipedia are displayed on map... Hovering above number will provide detailed information about location:

Vista - better and better?

martin — Fri, 11 Apr 2008 10:44:39 GMT

First warning - this is not really technical article, it is more user oriented... So if you enjoy all articles about scripting etc, go to next entry in your feed reader ;)

Maybe some of you know I had few presentations about Windows Vista beta2 - at that moment I saw huge advantages in "under the hood" changes, but it was still only beta - for example it was constantly crashing on my desktop...

I haven`t reviewed any RC or any newer version of Vista after beta2 - and based on too many disappointed people all around the internet I thought Microsoft probably messed up something - even thought I was not expected them to do so. When I got my new desktop, I decided it is time to move on and try Vista - and 64 bit version ;)

After some time spend with Vista I must say I really love it - performance is really great (well, in my case better than XP definitely) and I love small changes they have done. Vista is my first OS where my first action was not "Optimize for best performance".

In last few days two features really interested me - features that were missing for too long.

First one - if you are same like me you don`t use Windows Explorer - instead Total Commander or something that is more keyboard (and user) friendly. Sometimes you however need to do something from explorer - for example TortoiseSVN have sometimes problems with TC.

I always hated how you copy\move files and folders using explorer, specially if you wanted to move 3 files that are not next to each other - you had to hold ctrl and select items one by one and it was too easy to simple remove all your selected entries. Yesterday I found out that in Vista you can enable check boxes to select items:

I think this was already possible in XP, please correct me if I am wrong (I have feeling that I used it once loooooooooong time ago).

If you want to copy something now, just select all check boxes and drag&drop or hit ctrl+c:

There is also option to select all items by one checkbox:

As I said, I think this is not new to Vista - but for me it makes explorer much more useful tool.

Another feature I really like is the way how address bar of explorer is handled - you don`t see static structure like before (for example C:\Temp), instead you see all elements that makes path:

Of course you can click on all elements - I got used to this almost immediately and (from user perspective) it is one of most useful changes in Vista for me.

I always hated favorites in all Windows:

Because I don`t really use My Documents (don`t like that folder structure) and I probably never used My Network Places or My Recent Documents, I only used My Computer (in fact to get to my C: drive) and Desktop (for download -> read -> delete documents)...

There were some ways how to change items that are displayed here, but they were (for me) not worthy spending precious time on ;) In Vista these shortcuts are JUST ONE FOLDER:

You can add there whatever you want, remove it... Really easy and nice... It looks like after all those years I will maybe give explorer a second try (I did the same with Windows Media Player 11 some time ago and I was really impressed - but then I switched to Last.FM :D).

Next week I am going to US to attend MVP Summit - after that I would like to write some technical drill down of symlinks, hardlinks, junction, reparse points, mounting points etc in Windows XP and Windows Vista, so if it is interesting for you, watch my blog closely ;)

Troubleshooting Windows Vista performance?

martin — Sun, 06 Apr 2008 19:00:48 GMT

As mentioned in my previous post about Windows Vista, I think it is too soon to judge new OS from Microsoft. What is important is that once we will get applications designed for Vista AND users\administrators will learn what advantages this OS really holds, we will be able to decide whether or not Windows Vista is success.

I am comparing Windows Vista to LAUNCH version of Windows XP - and because my judgements are mostly based on Vista internals and not based on pretty face (and features that are publicly promoted by Microsoft), I can see big potential in Windows Vista.

One of my expectations is that Vista will be able to run stable (with good performance) for longer time than XP - I think everybody knows situation that XP started after few months to be sluggish, respond slower, sometimes stops thinking about some philosophical problems...

For example as you probably already noticed Vista introduces much more complex log viewer structures - and today I found out that you can use event log to troubleshoot your performance - just go to Microsoft\Windows\Diagnostics-Performance\Operational.

Currently I can see only reports related to shutdown\startup\standby - and one problem related to desktop window manager (I was testing how much it can take ;)):

In details you can also see details what causes slow down. For example here NlaSvc shut down took 20009ms, which means degradation by 19617ms (in this case it was rare problem, so I dont need to to care):

This is just example of small extras that are implemented in Windows Vista - there is still lot to learn about this new OS ;)

Map external drive to local folder

martin — Sun, 30 Mar 2008 13:17:00 GMT

As mentioned before, I bought new desktop - and with new computer, there comes usually new challenges.

My new PC have built-in card reader - but as you know, if you have card reader with NO media inside, it will still occupy your drive letters and this can be quite confusing. Specially because I am using external USB drive and I am used that it is mapped to drive E: on my laptop - on desktop it is drive J:

So I decided to use some less known functionality of Windows - to map disks to local folders instead of drive letters. To achieve that, you have to follow these steps:

1.) Create some local folders - I created C:\Links (which is my storage of symlinks shortcuts) and there I created folder ExternalHDD

2.) Right click on Computer and select Manage

3.) Select Disk Management

4.) Right click on selected disk, select Change Drive Letters and Paths

5.) Remove current drive letter:

6.) Click on Add. Instead of specifying new drive letter select "Mount in the following empty NTFS folder" and specify folder you created in step 1:

7.) Click OK

Now you can check that your external HDD is no longer available through drive letter, but it is instead mapped to your local drive :)

I also created C:\Links\CardReaders - and I am mapping all my (empty) card readers as folders (so SD will be SD, MMC will be MMC etc...) to better organize my stuff:

So here is after all my final picture from Computer:

I really like to use symlinks to organize my data and to make them easily accessible. Microsoft is also using symlinks - and this is one of examples where you can run into hidden implementation of symlinks.

UPDATE: Forgot to mention - it is NOT Windows Vista specific feature, it definitely works on Windows XP and probably on Windows 2000 (I am using this feature for looooooong time)

How to detect if library requires registration II.

martin — Mon, 10 Mar 2008 10:08:00 GMT

As you maybe noticed, I released small utility that allows you to detect all libraries (dlls or ocxs) that requires registration using RegSvr32 and can potentially lead to DLL hell (and are very dangerous in SBC environments, specially with strong NTFS security)...

In this utility I am using LoadLibraryA API to load library and then try to detect existance of DLLRegisterServer function. Problem is that this API is too "intelligent" - it is not really silent and sometimes it will popup some message box like "This application has failed to start because xxx.dll was not found. Re-installing the application may fix this problem.". LoadLibrary requires also all dependent libraries to be loaded successfully and that is why such messages are returned.

Because there is nothing I can do about this error and COMDetector is command line tool that should be used for parsing, I decided I must found another way how to detect such files. Another approach was to detect OLESelfRegister. After some investingation I found that this is present as part of the Version information, so I tried to have a look through normal GUI and voila - to my surprise this information is really there :)

So (if you want to do it quickly) easiest way how to detect if DLL\OCX requires registration is to right-click on such file, select Properties, Version and locate OLESelfRegister - if it is there, you must register such component (or generate manifest as I wrote in another article).

Right now I am rewriting COMDetector to implement this new scan technique, I am also adding switch for recursive scanning. If you want to request any additional functionality, just let me know.