All posts by Ed Tittel

Full-time freelance writer, researcher and occasional expert witness, I specialize in Windows operating systems, information security, markup languages, and Web development tools and environments. I blog for numerous Websites, still write (or revise) the occasional book, and write lots of articles, white papers, tech briefs, and so forth.
Cool Tools, Insider stuff, PowerShell, WED Blog, Windows 10, Windows 11

WinGet Updates PowerShell, Error Aside

Leave a comment

I have to chuckle. There’s a new PowerShell 7.4.4 out. I just used WinGet to update my production PC and it applied the update package. But when it got the end of the update, it reported “Installation abandoned” and ended the WinGet update session. Because 7.4.4 came when I closed, then re-opened, Windows Terminal it looks like WinGet updates PowerShell, error aside. You can see the sequence in the lead-in graphic.

WinGet Updates PowerShell, Error Aside

Notice that a “Cancelled” item shows up below the “Installation abandoned” notification. I’m guessing this last item refers to jumping out of the WinGet update sequence, because you see a normal command line prompt (spiffed up, thanks to Oh-My-Posh).

And sure enough, running WinGet upgrade –all –include-unknown finishes up the remaining items that appeared below PowerShell in the update list. In the next screencap I show a two-pane Windows Terminal session. On the left, you see the sequence of update packages installed; on the right, you see the PS Version is now 7.4.4.

To the left you see WinGet at work; to the right a newly-opened PS session says it’s v7.4.4. [Click image for full-sized view.]

One more thing: the final item in the upgrade sequence on the X1 Extreme was Winget itself (which appears as Microsoft.AppInstaller inside the upgrade list). At its conclusion, WinGet closes things out a bit more reasonably. It says:

Successfully installed. Restart the application to complete the upgrade.

Cancelled

I think that confirms my suspicion that the cancelled item refers to the WinGet session itself. It even throws a couple of Ctrl-C (^C) characters to make sure things get closed out. Here’s a screencap:

Facebooklinkedin
Facebooklinkedin
Cool Tools, Device drivers, Insider stuff, Remote Desktop (RDP), Security, Thoughts & concerns, WED Blog

Getting Past Crowdstruck Requires Access

3 Comments

Last Friday (July 19), cybersecurity firm Crowdstrike pushed an update to its threat sensors. Ultimately, that ended up with over 8 million Windows PC unable to boot, stuck on a BSOD for invalid references in a kernel-mode driver. Behind the scenes, all kinds of companies from hospitals, to government agencies, to airlines, and more, found themselves unable to use updates machines after a post-update reboot. What really caused the heartburn? Getting past Crowdstruck requires access to affected machines on a one-at-a-time basis.

If you look at the BSOD screencap at the head of this blog post, you’ll see a driver named csagent.sys. This is the CrowdStrike Agent driver which runs at kernel mode by design. That ensures it can’t be easily accessed or tampered with by hackers. But when something runs as a kernel mode driver it must be rigorously and thoroughly tested and vetted, or it can crash any PC on which it runs. Errors, in short, cannot be tolerated. Oops!

Why Getting Past Crowdstruck Requires Access

Part of the Crowdstrike software run as a Windows kernel-mode driver. That means it has the same level of access as privileged parts of the OS itself. If any of this code throws an error — as Crowdstrike has publicly admitted its update did — Windows crashes itself. That’s by design,  out of an abundance of caution to avoid loss of data or other damage to affected systems.

Here’s where things get interesting. Windows can’t boot and run until the offending driver is removed. In turn, the affected PCs must boot into safe mode or a recovery image. Either can operate on the damaged Windows image, remove the bad driver, and stand Windows back up again. This is easy when admins or IT pros have physical access to affected PCs. Indeed, Copilot recommends using the “three strikes” method to get into Windows recovery. (Three consecutive boot failures autoomatically triggers Windows alternate boot.) Then, using WinRE (or Windows itself in safe mode, from the Advanced Boot Options), repairs can go forward.

The problem is that many, if not virtually all, of the affected machines stayed down, stuck in a “boot loop.” They remained that way because their operators DIDN’T have physical access to those PCs. I’ll bet that most of them had to be teleoperated through a KVM device that can work around PC  problems that extend all the way down to the hardware level (outside the scope of normal remote access and RDP). This kind of thing doesn’t scale well, either, so it takes time to work through hundreds to thousands of remote PCs (think of the PC behind the counter at AA or Delta, where the gate or ticket agent is completely clueless about boot-level Windows repairs).

An “Interesting” Problem, Indeed!

Far too many cybersecurity and IT pros found themselves in the grip of the old Chinese curse (“May you live in interesting times”) after the *291* driver for Crowdstrike  tried to run on Friday. Organizations that prepare and drill for these kinds of outages were doubtless at an advantage in already knowing how to broker and run boot repairs remotely. I can only imagine the hair-pulling that went on at other outfits less well-equipped to handle this outage.

Here’s a moral to ponder for those who run remote Windows PCs where physical access is impossible, difficult or impractical: Can your remote management infrastructure and automation work with a Windows PC that’s not booting, and won’t boot until it’s restarted in some special way? If your answer is “yes,” you’re probably over the Crowdstruck hump already. If your answer is “no,” you’ll probably make that a top priority as soon as you can kick-start and repair all remaining affected Windows nodes. In the meantime, my deepest sympathies…

Facebooklinkedin
Facebooklinkedin
Cool Tools, Insider stuff, Recent Activity, USB devices, WED Blog, Windows 11

Copilot+ PCs Bring Better USB4 Support

Leave a comment

When I went to build recovery media for the Lenovo Yoga Slim 7x Copilot+ PC last week, I dropped a Belkin TB3 dock into one of its 3 USB-C ports. Why? Because I needed a USB-A port into which to plug the Mushkin Atom UFD I targeted for that purpose. The lead-in graphic shows the dock at the “other end” of USB4 host router 1 (right-click the graphic and open in its own tab to see the whole thing). The next screencap shows the Hardware tab from Properties for that recovery drive (E:). Thus, I claim that Copilot+ PCs bring better USB4 support because until USB4 hubs and devices appeared in settings, users had to run a separate (and less informative) Thunderbolt app from Intel to see what was what. This has improved!

Copilot+ PCs Bring Better USB4 Support.e-drive-hwprops

The Mushkin E: drive is an older USB 3.0 Atom device.

So What If Copilot+ PCs Bring Better USB4 Support?

Though I’ve yet to see any laptops or PCs endowed with USB 4 2.0 (you can see version 1.0 in the lead-in graphic) this is now part and parcel of Windows 11 as well. It will also allow channel speeds to double from 40 Gbps (which 1.0 supports) to 80 Gbps (2.0 only, and primarily limited to video links). This probably doesn’t matter much right now, given that these top-of-the-line versions aren’t yet widely available. But for those who need the speed, this will matter once the peripherals and docks gain USB4 2.0 support.

I’ve got a Qualcomm Copilot+ Developer Kit SFF PC showing up here at Chez Tittel in the next day or two (today, even, maybe). I’ll be quite curious to see what Settings > Bluetooth & devices > USB > USB4 hubs and devices has to tell me about what’s inside and the docks and other devices I plan to hook up. Indeed, I’m going to start with a Lenovo P27u20 monitor, with its integrated TB4 docking capability. Hopefully, it will not only provide a great display, but also the means to hook up my keyboard and mouse. Stay tuned! These USB4 adventures will continue…

Facebooklinkedin
Facebooklinkedin
Device drivers, Networking, Recent Activity, Troubleshooting, WED Blog, Windows 10

Disappearing Printer Gets IP-based Fix

Leave a comment

This weekend, we went out looking at new housing developments. To prepare for our quest, I went to print street addresses for model homes in Liberty Hill and Georgetown (two small towns north of here). But when I tried to fire off a print job to the Samsung networked printer next to my desk, Devices and Printers told me it was offline. I’ve learned to recognize it as a sign of driver corruption, so my disappearing printer gets IP-based fix. Let me explain…

Why Say: Disappearing Printer Gets IP-based Fix?

My Samsung ML 2850 is old enough that it does not support the Microsoft Universal Print drivers. I have to load a bespoke device driver to make it work. In turn, that means automated discovery of this network attached printer doesn’t work right, either. That’s why you see the IP address info for the device below in the lead-in graphic (courtesy of Advanced IP Scanner). I use the Add a Printer option that depends on its IP address instead.

The drill is familiar and runs something like this:

1. Notice the Printer is offline
2. Basic troubleshooting doesn’t help
3. Right click the icon in Devices and printers, select delete
4. Use the Add a printer dialog to start the process going
5. Click the “Printer I want isn’t found” option
6. Click the use IP address or hostname on the next pane
7. Use the printer’s IP address to install the current driver

This actually takes longer to explain than it does to execute. But it does work, and it seems I have to do this once every three months or so. I guess that’s the outcome of using a 10-year-old printer (that still works like a champ, BTW). Windows has left it behind, but it still keeps chugging along. Kind of like your humble author, I guess…

Windows 11 Proves More Friendly

Just for grins, I tried discovering the Samsung ML 2850 from a Windows 11 host on the same network. At first, it couldn’t see that device, either. But when I clicked the radio button labeled “My printer is a little older. Help me find it.” the Samsung device did turn up. I had to know enough to select the Microsoft PCL6 Class driver (which handles the interface between the Samsung and the Universal Printing stuff). But once I did that, everything worked as it should. Seems like MS has made Windows 11 rather more printer friendly than I expected (and friendlier even, in this case, than Windows 10). A pleasant surprise indeed!

Facebooklinkedin
Facebooklinkedin
Insider stuff, Recent Activity, WED Blog, Windows 11

Restoring Start11 Start Button Proves Tricky

Leave a comment

I have to laugh! I’ve been mucking around with start menu and taskbar settings lately, working on a story for Tom’s. In the process I managed to switch my start button logo on a test machine. When I reinstalled Start11v2 on that PC, I said to myself “No prob: I’ll just use the Start Button item in the left-hand controls to restore the old start button.” But restoring Start11 Start Button proves tricky, because it’s missing from the Start 11 gallery of StartButtons, as shown in the lead-in graphic.

Why Restoring Start11 Start Button Proves Tricky

Fortunately, the Stardock developers also include a “Download” button on the same page where you can pick from its start button icon gallery. This takes you to the Start Menu Buttons Gallery page at WinCustomize.com. There, I had to flip through to page 5 (of 50!) where I found what I was looking for:

And sure enough, it did the trick! Even though it leaves me wondering why Stardock doesn’t include the Windows 11 default start button by conscious, deliberate choice, it’s always nice to find a way to get where you want to go. Problem solved, and my test PC is back to where it should be, and working as I want it to. Isn’t that just how things go sometimes in Windows-World, where one change often leads to another? Or, where a change that produces the desired effect also causes something else that’s less desirable? Sure enough: it’s true.

Facebooklinkedin
Facebooklinkedin
Cool Tools, Device drivers, Insider stuff, Recent Activity, Troubleshooting, WED Blog

Calc Key Follies Fixed

Leave a comment

Here’s an interesting one. I have a Microsoft Comfort Curve 4000 ergonomic keyboard (and two more in my parts closet: I LIKE them). Lately, though, when I press the “Calculator” (Calc) key on the very top row of long, narrow silver keys at furthest right something odd occurs. Calc shows me a “blank face,” as you can see in the lead-in graphic. Basically it’s just a big blue block of nothing much. Attend, and I’ll explain I I got these Calc key follies fixed.

For the record, I don’t *want* to see the blank face of Calc. I want to see the keypad so I can use the darn thing, like so:

Multiple Methods Get Calc Key Follies Fixed

I discovered these methods partly by searching the web, and partly by experimentation. There are three of them, to wit:

Method 1: Close Calc, then hit the Calc key again. This one’s my favorite so it’s my go-to now. It involves the lease effort and goes fastest.

Method 2: Open the Calc app from the Start Menu. Even though pressing the Calc key shows a blank face, visiting the Calculator app through Start always works. It takes added mouse clicks, though. Until I figured out Method 1 by experimentation, this was my go-to method.

Method 3: Go to Settings > Installed Apps, click on the ellipsis for Calculator, Click the Advanced Options button, scroll down to Reset, then click the Repair button. That’s 5 mouse clicks and a bit of scrolling. Waaaaaaay too long for me, but it does do the trick. But then the question is: why does this condition keep coming back, even after an app reset? I think I know the answer: read on, please.

Special Keys Require a Custom Driver

The Comfort Curve 4000 keyboard has a whole row of elongated, narrow silver keys that use special, driver-based, context-sensitive macros. These do things like jump to the home screen, open a search window, open email, access the volume controls (up and down), and so forth. And yes, at far right you can see the Calc key that’s been acting up lately. They occupy the top row from left almost to the numeric keypad at right, as shown here:

My best guess is that something in the driver is losing its proper connection to the Calc app so that when the key is pressed once, it gets close to launch but not all the way there. Fortunately, it’s relatively easy to get the Calculator working as I’ve described.

But gosh, aren’t these little foibles fascinating? It’s a bit of a pain to run into them, true. But it’s a blast to figure out what’s happening and why, and then to find fixes or workarounds. Just another day here in Windows-World!

 

Facebooklinkedin
Facebooklinkedin
AI, Cool Tools, Insider stuff, Recent Activity, WED Blog, Windows 11

MS Intel/AMD Copilot+ PC Date Drop

Leave a comment

Though the details aren’t terribly specific, MS has provided an inkling of when Copilot+ PCs running Intel and AMD CPUs should ship. In an item about a new incremental update technique dated July 15, MS provides the snippet depicted in the lead-in graphic above. This states that “Windows 11, version 24H2 will be available as a traditional feature update to all devices later this year.” Thus, I call this an MS Intel/AMD Copilot+ PC date drop — of sorts, at least.

What Does This MS Intel/AMD Copilot+ PC Date Drop Mean?

I confess: I’m reading somewhat between the lines as I interpret this. But I’m not alone: you’ll find stories at WindowsLatest, TechRadar, Windows Central, and elsewhere that draw the same conclusions I do. Of course, the words “later this year” could occur any time between now and December 31, 2024, so that stipulation is far from precise or narrowly targeted.

That said, I’m in accord with most industry watchers — including the afore-linked stories — in believing that 24H2 is likely to drop some time in Q4 2024. My best guess would be “after Thanksgiving, but before Christmas” to give room to steer around major end-of-year holidays and associated time off for breaks. But it could happen earlier, to get 24H2 out of the way before the holiday season kicks off in late November. Only time will tell…

Further Points of Possible Confirmation

Intel’s May 20 press release for its Lunar Lake CPUs reads “Starting Q3 2024 in time for the holiday season, Intel’s upcoming client processors … will power more than 80 new laptop designs across more than 20 [OEMs]…” A June 2 press release from AMD steers clear of dates for its Ryzen AI 300 Series CPUs, but does mention partnerships with ” Acer, ASUS, HP, Lenovo and MSI” that will surely ship at or about the time time that Intel’s OEM partners offer up their competing laptops and so forth.

Could it be that interesting options for end-of-year gifting might include snazzy new technology toys? MIght you or I want one? For sure!

Facebooklinkedin
Facebooklinkedin
Backup/Restpre, Cool Tools, Insider stuff, USB devices, WED Blog, Windows 11

Channel Speed Trumps Device Speed

Leave a comment

I kind of knew this already, but I wanted to prove it to myself through hands-on experience. Thus, I sprung for what Tom’s Hardware calls “the fastest SSD” around right now. It’s depicted in the lead-in graphic: The Crucial T705. It’s read/write ratings range from 13,600/10,200 MB/sec for big items to 1,400K/1,750K IOPS on random 4K items. That’s fast!

Why Say: Channel Speed Trumps Device Speed?

I know this NVMe drive would scream if I mounted it in an M.2 PCIe x5 slot on a motherboard. But I wanted to see if it made any difference if plugged into the M.2 slot inside a 40Gbps USB4 NVMe enclosure. Long story short: it doesn’t. It runs more or less indistinguishably from the 2022 model WD Black SN770 I replaced in the US$53 Maiwo USB4 fan-cooled enclosure.

Although the T705 is much faster than the SN770, those speed differences only count when the bandwidth from the SSD to the CPU is fast enough to actually show off such deltas. Because Lenovo sent me the Yoga Slim 7x with a smaller, slower C: drive device, I’ll probably end up plugging into that PCIe channel to see what it does as an internal drive.

But that’s a project for another day. Today, I have two “lessons learned” to share:

1. A PCIe x3 or x4 NVMe SSD is plenty fast enough for even the fastest, most expensive USB4 drive enclosures currently available.

2. The T705 at US$165 is about twice as expensive as the SN770 (and the SN770 2TB model at US$120 is a much better deal, $/GB-wise)

What can I say? I had to know. Now I do, and I’m moving on to other, better uses for the T705. I may have to use Linux to clone the existing 0.5TB NVMe in the Slim 7X, but I’ll figure out how to make that swap work. As I said earlier: that’ll have to wait for another day.

Facebooklinkedin
Facebooklinkedin
Uncategorized

Copilot+ PC Backup Options Are Scarce

8 Comments

Having finally round the “round tuit” needed to check, I came to a stunning realization this weekend. As this blog post’s title reads: Copilot+ PC backup options are scarce. “How scarce?” is the next and inevitable question. Scarce enough that my fave tool — Macrium Reflect — throws an error when I attempted to install it. But it gets worse…

It’s True: Copilot+ PC Backup Options Are Scarce

Here’s a test to ponder: Tim Fisher’s November 2023 Lifewire story 32 Best Free Backup Software Tools gives us a lot of options for free Windows backup tools. Of those 32, take a guess as to how many can back up an ARM-based Copilot+ PC?

I didn’t want to guess so I asked Copilot to check for me with this query: “Of the Windows backup packages cited in this article <URL>, which ones will run on a Copilot+ PC with ARM Snapdragon X CPU?” Of all 32 items mentioned in the story, none qualified. Instead, Copilot recommended Fullback Pro and the old. long-deprecated Control Panel item: Backup and Restore (Windows 7). Indeed it cites an ElevenForum thread to explain how to do this. Approaches also include using DISM to capture (and then restore) the ARM64 Windows 11 image at the command line. Sheesh!

Google Does Better Than Copilot…

With the search string “ARM64-compatible Windows backup software” Google produces more and arguably better results than Copilot does. Most properly-endowed packages cost money. Indeed, I predict it’ll be a while before the freeware/donationware items mention in Fisher’s Lifewire story catch up. Indeed here’s further detail from the Macrium Support team about why MR8 does not support ARM systems:

ARM systems are not supported in reflect for the following reasons:

1) Can’t create snapshots
2) Can’t create a working rescue environment
3) Install CBT and your computer will BSOD on boot

With this, we have decided to block installs on ARM systems to prevent the software from bricking your machine

I suspect many other backup software vendors are up against the same kinds of things. I detect a “wait and see” stance that seeks to determine if the Snapdragon X Copilot PCs represent something real and enduring, before committing resources to supporting them.

What IS Out There?

Here’s a short list of packages that assert out-and-out ARM64 support:

  • Zinstall FullBack (Copilot was right about this, as it turns out, though it’s under new ownership). It’s also a monthly service that starts at US$14.90 per PC.
  • Veeam Agent 6.0 (backs up files on an ARM64 CPU, but only an AMD64 PC can initiate and drive a restore). Cost: ~US$130/year per deployed production agent.

At present, that’s all I can find. There’s nothing mentioned at the ver (Windows ARM Software) aggregration page. It seems pretty bleak at the moment, in fact.

But Wait: There’s More (or Less)!!

The same situation also applies to disk partition/disk management tools and for many of the same reasons: a lack of low-level drivers to interact with the Volume Shadow Service (VSS) on ARM64 systems running Windows 11 (or 10, for that matter). This is turning out to be more interesting and potentially vexing than I thought. Stay tuned! I’ll keep digging.  And it looks like ComputerWorld wants a short news item about this situation as well. Stay tuned!

As of October 8, Macrium Reflect X Goes Public

My favorite imaging backup, restore and repair utility — Macrium Reflect — dropped its latest version (X, as in the Roman numeral) on October 8. Among its many new capabilities, it supports ARM CPUs (and is running on my lone Copilot+ PC with Snapdragon X processor right now). It also runs noticeably faster than version 8 and has a few other new tricks up its sleeve as well. Visit the Reflect X is here! page for all the deets…

As for myself I’ve been using the beta version since late August/early September with great enjoyment and success. Although the company has transitioned from a perpetual license plus maintenance to an annual subscription approach, I just happily paid US$200 to get onto the Reflect X bus for the period through August 2024.

Facebooklinkedin
Facebooklinkedin
Insider stuff, Recent Activity, Troubleshooting, WED Blog

Intermittent Mouse Needs New Battery

Leave a comment

I have a kind of love-hate relationship with mice. Because I work on a desktop PC by choice, I’m more or less forced to use a USB-attached pointing device. I’ve switched back and forth between wired and wireless models because their weaknesses sometimes vex me. For the wired meese, the wire tends to snarl up with other cables on my desk. For wireless models, what frosts my jowls is intermittent or imprecise cursor stuttering or movement. I started to experience that on my current mouse this morning: a usually unflappable (and wireless) Microsoft Mobile Mouse 4000. Then I noticed a dimly pulsating red indicator light atop the device. Oho! This intermittent mouse needs new battery to work properly.

Why My Intermittent Mouse Needs New Battery

According this MS Community thread, the light is a battery life or status indicator. When you plug a new battery in, it shows green for 5 seconds, then turns itself off. Ditto when you power the mouse back on. When the battery is starting to fail, it shows red for the same interval upon power-up. And when battery levels are going critical — that is, it’s about to die — the dim red pulsations begin. Good to know!

We shop at Costco, so we always have lots of batteries around. As soon as I swapped out the old AA for a new one, I got the green glow for 5 seconds. Now it’s dark again. And presto! The mouse is no longer stuttering, and it’s tracking exactly where I want it to go. Yay!

The Best Issues Get Quick, Easy Fixes

Working with PCs in Windows-World means there’s always something in need of fixing or figuring out. Once you identify an issue, the troubleshooting process begins. Over my decades working with this stuff, I’ve learned to appreciate problems that are easy to recognize, diagnose and fix. Today’s successful battery swap definitely falls in that category, even if another one bits the dust as a result.

Facebooklinkedin
Facebooklinkedin