Gut gemacht Microsoft

Ja Microsoft das habt Ihr wirklich wieder gut gemacht. Ein Upgradeprogramm auf Windows 10, dass 16 Megabyte groß ist und das einzige was es mir sagen kann wenn ich es auf einem ganz gewöhnlichen Windows 7 laufen lasse ist:

Wirklich starke Leistung wenn man bedenkt, dass das komplette Windows 3.1 ein kleinerer Download war.

New "Case of the unexplained" and "Malware hunting" session recordings with Mark Russinovich

If you really want to learn how to solve problems in Windows i really recommend to watch the latest versions of this sessions at TechED of Mark Russinovich the creator of the Sysinternals tools.

In the Cease of the unexplained session Mark shows you how to analyze program crashes, sluggish performance, blue screens and other windows problems.


In the malware hunting session Mark explains how to use the fabulous sysinternals tools to detect and remove malware from your computer.


And the best thing about the sessions with Mark is that they are not only packed with very useful stuff, but are also very funny to watch. I like him to make jokes about Microsoft products although he is a Microsoft employee

Holiday Readings or what i pack in my suitcase for this year holidays. (Part I)

The holiday season is coming with big steps and so the every year question is,  which books should i pack in my suitcase (or load on my kindle ;-)) to learn new things and improve my skills in various IT topics.

My first priority this year is to improve my understanding of how Windows internals works and how i can solve typical problems in windows more efficient. The most efficient tool to solve windows problems is the Sysinternals suite. But to get the most out of this tools you need a deep understanding how they work and which tool is used for which use case. Fortunately the creators of the Sysinternals suite have written and published a reference manual. If you use the tools regularly you should really take this one with you on your journey.

Windows Sysinternals Administrator's Reference

If you want to go more in detail how Windows works you can have a look at the Windows Internals  books. This books target the windows system developer, but i think they are also a chest full of treasures for the advanced windows admin. Because many mystery problems in windows will become understandable when you know how windows works under the hood.

 Windows Internals Part 1

Windows Internals Part 2

All books are available as softcover or as Kindle Edition.

How Microsoft gurus remove malware and ransomware from their windows installation

The readers of my blog knows, that i am big fan of Microsoft guru and creator of the sysinternals tools Mark Russinovich. So i was really happy that Mark has posted a detailed description how to remove spyware and ransomware from Windows when i got a computer from a friend full with trojans and spyware. With his hints it was very easy to remove the autostarted malware and make my friend a Happy camper again.

If you have also Windows installations to clean from adware, spyware and ransomware have a look at his blog post and his presentation which makes this task really very easy:

Hunting Down and Killing Ransomware by Mark Russinovich


As a bonus the presentation of Mark gives you a good introduction to the fabulous Sysinternals tools.

Beheben der Sicherheitswarnung von Windows bei Dateien aus dem Internet

Windows besitzt eine Sicherheitsfunktion die bewirkt, dass Dateien die aus dem Internet heruntergeladen mit einem speziellen Flag versehen werden. Durch dieses Flag kommt beim Aufrufen der Datei eine Sicherheitswarnung die einen darauf aufmerksam macht, dass das Ausführen dieser Datei potentiell gefährlich ist.

Bei komprimierten Dateien wird dieses Flag sogar auf alle in dem Archiv befindlichen Dateien vererbt. Diese Vererbung führt dazu, dass in dem Archiv befindliche Hilfedateien nach dem Entpacken nicht richtig funktionieren. Egal welches Hilfethema man anklickt, wird immer eine leere Seite angezeigt.

Deshalb empfiehlt es sich bei allen heruntergeladenen Dateien insbesondere bei Archiven von denen man weiß, dass Sie aus einer zuverlässigen Quelle sind, dieses Flag vor der Verwendung zu entfernen.

Dafür muss man einfach die heruntergeladene Datei mit der rechten Maustaste anklicken und den Punkt "Eigenschaften aus dem Kontextmenü auswählen. In dem Eigenschaftendialog kann man jetzt beim Punkt Sicherheit über die Schaltfläche "Zulassen" das Sicherheits Flag entfernen. Dann bekommt man keine lästigen Dialoge mehr und auch die Hilfefunktion funktioniert einwandfrei.

Interesting introduction of Windows 2012 R2

Windows 2012 R2 is a big step forward for Microsoft Server technology. I especially like the much improved Hyper V in Windows 2012 R2. For details watch the following presentation from Teched:

Print Screen Key freezes Windows

Today i had a strange problem on my windows machine that every time i press the "Print Screen" key to capture a screenshot windows will freeze immediately. I thought that this is only a temporary problem,  but after a hard reset i got the same problem again after retrying to create a screenshot.

It took me some time to figure out that the problem is not bug, but a feature. Last week i have used the Windows Kernel Debugger on my machine and one of the feature of the Debugger is that when you press the "Print Screen" key the kernel stops and try to connect to a WinDbg session. When there is no Debugger attached it will wait infinitely. So if you have the problem that your windows freezes on print screen check if the kernel debugger is enabled.

To check/deactivate the debugger start "msconfig.exe" with admin privileges and disable the debugger in the extended options on the start tab.

Performance Tuning Guidelines for Windows Server

The whole Internet is full of more or less useful tips for performance tuning on windows server. Many tips to change some mystery registry settings are not only not useful, but the can cause serious problems on your servers. Some popular performance tricks in the Internet make only sense in older releases and are obsolete in newer versions of Windows Server. You should really carefully evaluate every tip before you implement it on your production servers.

But why trust on tips from the Internet when there are very good performance tuning guidelines from the creators of Windows Server like the

Performance Tuning Guidelines for Windows Server (Windows 2008, 2008 R2, 2012)
Performance Tuning Guidelines for Windows Server 2012 R2

This guides are packed with useful tips&tricks and detailed explanations how Windows server work and which settings should be applied in different scenarios like File, Application or Web servers. My recommendation is to not change any settings on your windows server before you have read and understood the above documents!

Windows memory management explained in Detail

There are so many myths about memory management in windows. Often people use the task manager to show that program X is a resource hog, because it is eating too much main memory. But most time they are using the wrong columns and make wrong assumptions whats going on. Analyzing memory problems on windows needs a deep understanding how memory management in windows works and which tools you can use to find problems.

One of the best sources for this kind of information is Mark Russinovich the author of the famous Sysinternals tools. If you want to become a memory management guru, than watch his presentation "Mysteries of Memory Management Revealed Part1, Part2".