SUSDB Maintenance

So, you might be stuck with SUSDB maintenace issues – properly the maintence jobs won’t finish without getting timeouts? Something like this maybe?

Msg 1205, Level 13, State 54, Procedure spUpdateChangeTrackingNumber, Line 11

Transaction (Process ID 110) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.
here is a script that will help you – you might have to run it multiple times

  1. Execute the next Query over then SUSDB database: exec spGetObsoleteUpdatesToCleanup
  2. Write down the number of Rows given by the output. 
  3. You can find the SQL script that executes the same StoredProcedures as the WSUS GUI, but directly over the database. We just need to change the parameter in SELECT TOP (XXXX) for the number of rows detected on the previous step, or higher.  Script download (the script can also be found at http://www.thomasmarcussen.com in the archive folder SUSDBClean.zip)      (Note: The process should be quite faster than the regular CleanUp on the GUI, but is possible that it can enter a DeadLock condition due to other operation from the WSUS Server. In this case, just re-run the Script)
  4. Once the Script finished successfully, try again the CleanUp from the WSUS GUI. Now it should finish very fast.
  5. For last, in order to keep the SUSDB healthy it is recommended to run the Maintenance script again in order to leave the database reindexed.

Should you install Office 2016 32-bit or 64-bit?

There seems to be some doubt about Office 2016 when to install 64-bit version of office vs 32-bit

Limitations of the 64-bit version of Office

The 64-bit version of Office may perform better in some cases, but there are limitations:

  • Solutions using ActiveX controls library, ComCtl controls won’t work.
  • Third-party ActiveX controls and add-ins won’t work.
  • Visual Basic for Applications (VBA) that contain Declare statements won’t work in the 64-bit version of Office without being updated.
  • Compiled Access databases, like .MDE and .ACCDE files, won’t work unless they’re specifically written for the 64-bit version of Office.
  • In SharePoint, the list view won’t be available.

If you have specific add-ins that you use in the 32-bit version of Office, they may not work in 64-bit Office, and vice versa. If you’re concerned, check your current version of Office before installing the new one. Considering testing the add-in with 64-bit Office, or finding out if a 64-bit version of the add-in is available from the developer.

The 64-bit version of Office has some limitations, but is the right choice when:

  • You work with extremely large data sets, like enterprise-scale Excel workbooks with complex calculations, many PivotTables, connections to external databases, PowerPivot, PowerMap, or PowerView. The 64-bit version of Office may perform better for you.
  • You work with extremely large pictures, videos, or animations in PowerPoint. The 64-bit version of Office may be better suited to handle these complex slide decks.
  • You work with extremely large Word documents. The 64-bit version of Office may be better suited to handle Word documents with large tables, graphics, or other objects.
  • You’re working with files over 2GB in Project, especially if the project has many subprojects.
  • You want to keep the 64-bit version of Office that you’re already using. The 32-bit and 64-bit versions of Office programs aren’t compatible, so you can’t install both on the same computer.
  • You’re developing in-house Office solutions, like add-ins or document-level customizations.
  • Your organization requires Hardware Data Execution Prevention (DEP) be enforced for Office applications. DEP is a set of hardware and software technologies that some organizations use to enhance security.

 

Media Creation Tool for Windows 10

If you need to install or reinstall Windows 10, You can use the Media Creation Tool to create a installation media using either a USB flash drive or a DVD.

You will be able to create a media for the following Windows 10 versions

Windows 10 Home
Windows 10 Home N
Windows 10 Home Single Language
Windows 10 Pro
Windows 10 Pro N
x86 & x64

Download: Media Creation Tool x86 or Media Creation Tool x64

For Enterprise editions please visit Volume Licensing Service Center

Access Director 3.0 Released

The future of Windows is coming on July 29

To make your next Windows experience even better – We have just released the next version of Access Director.                                                                                               Using Access Director you will be able to secure your desktop, simple and easy!

– Run your desktop in a non-elevated user context
– Elevate only needed applications with a single click
– Elevate in your current user-context without affecting other unsecured applications like IE or Office

What’s in Access Director 3.0 ?

– Updates to support the next Windows experience (10)
– Support for integration modules
– Minor bug fixes

Get it from the Download Center

Direct Download Link

EasyBoot USB 1.1 has been released

Simpel, but very helpful tool to create Windows Boot or To-Go USB sticks

Download Link

It’s that simple, EasyBoot USB with 4 easy steps and you are ready to go.

  1. Insert USB stick
  2. Choose between the following types
    1. UEFI
    2. BIOS
    3. Windows To Go
  3. Browse to your ISO file
  4. Click Start

EasyBoot USB

The tool is pretty much self-explanatory

Do not hesitate to ping me with bugs, feature requests or ideas for new tools 🙂

 

 

 

Windows 10 – Windows Updates troubleshooting

If you experience problems with Windows Updates and need to debug on the actual process, WindowsUpdates.log has always been a good place to start……… but not on Windows 10

According to Microsoft these steps are relevant only for the January Tech Preview of Windows 10.

Windows Update uses Event Tracing for Windows (ETW) to generate diagnostic logs. This method improves performance and reduces disk space usage. However, the logs are not immediately readable as written. To decode the resulting ETL files and create a log that you can read, follow these steps.

  1. Download the public symbols by following the directions here. Install these symbols to a directory such as C:\symbols.
  2. Download the Tracefmt.exe tool by following the instructions here.
  3. Open a command prompt with administrative rights.
  4. Create a temporary folder, such as %systemdrive%\WULogs.
  5. Locate the directory that contains Tracefmt.exe, as downloaded and installed in step 2. Then, copy Tracefmt.exe to %systemdrive%\WULogs.
  6. Run the following commands at a command prompt, in the order presented:
    • cd /d %systemdrive%\WULogs
    • copy %windir%\Logs\WindowsUpdate\* %systemdrive%\WULogs\
    • tracefmt.exe -o windowsupate.log <each windows update log delimited by space> -r c:\Symbols

For example, the last line might resemble the following:

tracefmt.exe -o windowsupate.log Windowsupdate.103937.1.etl Windowsupdate.103937.10.etl -r c:\Symbols

Lucky for us, we don’t always need to dig deep – there is a deprecated logfile we can use for now (January Tech Preview) WindowsUpdate_AU_deprecated.log

Allowing non-Administrators to control Hyper-V

By default Hyper-V is configured such that only members of the administrators group can create and control virtual machines.  I am going to show you how to allow a non-administrative user to create and control virtual machines.

Hyper-V uses the new authorization management framework in Windows to allow you to configure what users can and cannot do with virtual machines.

Hyper-V can be configured to store it’s authorization configuration in Active Directory or in a local XML file.  After initial installation it will always be configured to use a local XML file located at \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition.  To edit this file you will need to:

Open the Run dialog (launch it from the Start menu or press Windows Key + R).
Start mmc.exe
Open the File menu and select Add/Remove Snap-in…
From the Available snap-ins list select Authorization Manager.
Click Add > and then click OK.
Click on the new Authorization Manager node in the left panel.
Open the Action menu and select Open Authorization Store…
Choose XML file for the Select the authorization store type: option and then use the Browse… to open \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition (programdata is a hidden directory so you will need to type it in first).
Click OK.
Expand InitialStore.xml then Microsoft Hyper-V services then Role Assignments and finally select Administrator.
Open the Action menu and select Assign Users and Groups then From Windows and Active Directory…
Enter the name of the user that you want to be able to control Hyper-V and click OK.
Close the MMC window (you can save or discard your changes to Console 1 – this does not affect the authorization manager changes that you just made).

The user that you added will be able to completely control Hyper-V even if they are not an administrator on the physical computer.

Poweshell under the security context of another user (RunAs)

Recently i needed to run some powershell scripts under multiple security context’s – the main reason for this was my client’s strict delegation model.

We ended up with multiple service account with rights only to the needed systems (Its not such a bad thing!)

The result was this powershell script to change security context

$SPAccountName = “<username>”;
$AccountPassword = “<password>”;
$AccountPasswordAsSecureString = $AccountPassword | ConvertTo-SecureString -Force -AsPlainText
$credential = New-Object System.Management.Automation.PsCredential(“$env:userdomain\$SPAccountName”,$AccountPasswordAsSecureString)
$SvcAccSession = New-PSSession -Credential $credential;
Invoke-Command -Session $SvcAccSession -Script { Import-Module ActiveDirectory }
Invoke-Command -Session $SvcAccSession -Script { Get-AdGroupMember “Some-group”}

In the above example we just get the member of some application group – but really, you can do whatever you like.

If you need it to query a specific server you can use -Computername <servername> right after New-PSSession.

This method also came in rather handy when running service-side powershell execution invoked by a webservice.. but more on that later