Microsoft describes the svchost.exe as

…a generic host process name for services that run from dynamic-link libraries (DLLs).

At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.

So, in a nutshell, svchost.exe is a container for services that run via DLL files.

Great, but when a user is trying to diagnose what is eating CPU cycles it masks what is really going on. What can one do to remove the wool over their eyes and find out what is truly going on?

It’s rather simple. Drop to command prompt and run the following command:

Tasklist /svc /fi “IMAGENAME eq svchost.exe"

You will be presented with a list similar to the one below:

Conveniently the tasklist command breaks down each instance of svchost.exe, lists the PID (use this to track it in Task Manager) and what services are running via it.

I was able to use the above command recently to find Windows Defender service was still running despite the installation of Symantec Endpoint Protection and thus was chewing CPU cycles.

Hopefully, it will come in handy for you to. Let me know in the comments section or on Twitter if it does!

The people like choice

For reasons unknown to me, Microsoft decided not to do this when Windows 7 came around. Sorry, I lie. They did but you no longer had a choice (at least with Technet ISOs). Instead each installation medium was coded for each SKU and only that SKU. Download the Ultimate ISO, Ultimate is what you got. Consequently, download the Enterprise ISO, Enterprise is what you got etc…

However there is a small trick you can do to bring back the power of choice! Simply remove sources\ei.cfg from the installation medium (if you have already burnt it to DVD you will have to edit the original source and burn it again) and you will now get the choice of what SKU to install.

Like anything though, we must embrace the change – twist and manipulate it to help further the machine to glory. Unfortunately, Microsoft never really provided any enterprise methods to manage the Libraries experience.

The problem for the user as it stands is despite having a personal network drive/share (commonly mapped to H:\) attached to their Active Directory account and implementing folder redirection so the local profile points to their existing data on the personal network drive/share Windows 7 defaults to Libraries whenever you want to open or save a file. This can lead to a user save a document on the local machine which is a strict NO-NO on a shared machine. This document is forever lost to them unless they go back to the original machine.

With Windows 7 Libraries, these three are called upon more than ever!

Frustrating to both the user and the sysadmin but the light is shining; we can fix it!

Requirements:

• Notepad++ (or any other text editor that provides a right-click contextual menu entry)

Providing the current user account you are using has not changed the default Library experience lets navigate to %userprofile%\Appdata\roaming\Microsoft\Windows\Libraries\. What you will be presented with is your four existing Libraries and if you double-click on any of them, they will take you to the particular library. So they are a shortcut right? Nuh-ah.

 More than just your average shortcut

Tricky Microsoft at play here. These are actually .library-ms files which are XML based files which control all aspects of that particular library ranging from the icon used, location(s), private or public and more.

Lets open up the Documents Library in Notepad++ and take a look by right-clicking on the Documents file and using the Edit in Notepad++ menu item.

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>@shell32.dll,-34575</name>
  <ownerSID>S-1-5-21-2313706764-2019408444-1191095620-1001</ownerSID>
  <version>8</version>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1002</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <searchConnectorDescriptionList>
    <searchConnectorDescription publisher="Microsoft" product="Windows">
      <description>@shell32.dll,-34577</description>
      <isDefaultSaveLocation>true</isDefaultSaveLocation>
      <simpleLocation>
        <url>knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</url>
        <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQBRAAAAQjWHqIhPzcAnvzZQ+K5MHQib76aZwOzBAAEAAAAAAAABAAAAAAAAAAAAAAAAAAAA8WAUAwHQB+TQDi66kGEiiNCAsCMw0ZGA8CR6wFAAAAAAAAAAAAAAAAAAAAAAAAA0BQMAAAAAAQLAVgNRAQVzVmczBAYAgAAEAw7+qCQyTVLAVgNqAAAAMCAAAAAAEAAAAAAAAAAAAgNAAAAAAQVAMHAlBgcAMHAAAAQAMHAoBQZAwGAsBwMAIDAuAAZAwGAsBALA0CAyAQMAgDAxAwMAAAAUAATAEDAAAAAAsCQklDEAoUYtV2cAgDAIAABA8uvqAETVtCQkljKAAAAmAAAAAAACAAAAAAAAAAAAAAAAAAAAoEAhBQbAUGAzBAAAQBAACQMAAAAAAwTAVNnRAARPNUVNVkfxAAAoBACAQAAv7rKA1UVGBUqJpCAAAwLAAAAAAgAAAAAAAAAAAAA+AAAAAAAEBwbAMGA1BQbAUGAuBAdAMHAAAAQAMHAoBQZAwGAsBwMAIDAuAAZAwGAsBALA0CAyAQMAcDA3AAMAAAAYAAAAsEAAAAHAAAABAAAAwBAAAQMAAAAAAAAAoEAAAQFAAAADAAAA8WC+TGEAAAAEFEVBBAR6wVVzVmczxlSh1WZzxFRvNWdtVmb0NHAAABAAAQBAAAoFAAAA0WAAAAHAAAALAAAgCtmT3/jj8qRtSLbFi0ApdcbBAAAZCAAAkAAAAajAAAAxMFUTJuiYZEvMhzQ7y/ETaCmt5ccAAAAEAAAAAwHAAAAvAAAAMFAtAQMA0CA1AQLAIDAxAQLAIDAzAQMAMDA3AAMAYDA3AgNAQDAtAgMAADAxAQOAQDAwAAOAQDA0AANA0CAxAQMAkDAxAAMAkDA1AgNAIDAwAQLAEDAwAAMAEDAAAAAAAAAAAAAAAAAgBAAAMAAAAKWAAAAAAAAA02b092avBAAAAAAAAAAAAgNA8IHTe5ON5K1tMS/UUePxgY8o21OhHxkZD+yOJmTibDAPyxkXuTTuSdLj0PFl3TMIGPqdtT4RMZ2gvsTi5k4AAAAAA</serialized>
      </simpleLocation>
    </searchConnectorDescription>
    <searchConnectorDescription publisher="Microsoft" product="Windows">
      <description>@shell32.dll,-34579</description>
      <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>
      <simpleLocation>
        <url>knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634}</url>
        <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQBRAAAAAF2EYChPzcArdSUlFc0MHwanEVZBHNzBAAEAAAAAAAABAAAAAAAAAAAAAAAAAAAAsZAUAwHQB+TQDi66kGEiiNCAsCMw0ZGA8CR6wFAAAAAAAAAAAAAAAAAAAAAAAAA0BQMAAAAAAQLAVgNRAQVzVmczBAYAgAAEAw7+qCQyTVLAVgNqAAAAMCAAAAAAEAAAAAAAAAAAAgNAAAAAAQVAMHAlBgcAMHAAAAQAMHAoBQZAwGAsBwMAIDAuAAZAwGAsBALA0CAyAQMAgDAxAwMAAAAUAAeAEDAAAAAA0CQjhTEAAVdixWajBAAiBACAQAAv7rKANPVtA0Y4oCAAAgmBAAAAAQAAAAAAAAAAAAA4AAAAAAAQBQdAIGAsBQaAMGAAAAQAMHAoBQZAwGAsBwMAIDAuAAZAwGAsBALA0CAyAQMAgDAxAgNAAAAWAAgAEDAAAAAA0CQjhTEAQ0TDVVTF5XMAAAaAgAAEAw7+qCQzTVLANGOqAAAA4ZAAAAAAEAAAAAAAAAAAAgPAAAAAAARA8GAjBQdA0GAlBgbAQHAzBAAAAEAzBAaAUGAsBAbAMDAyAgLAQGAsBAbAwCAtAgMAEDA4AAMAEDAAAAGAAAAMBAAAwBAAAQAAAAAcAAAAEDAAAAAAAAALBAAAUBAAAwAAAAAvlg/kBBAAAARBRVQAQkOcV1clJ3ccBVdixWajxFRvNWdtVmb0NHAAABAAAQBAAAouAAAAkZAAAAHAAAALAAAg+KJI1O5cjaRBKO/5VGC2QTmBAAAZCAAAkAAAAajAAAAxMFUTJuiYZEvMhzQ7y/ETaCmt5ccAAAAEAAAAAwHAAAAvAAAAMFAtAQMA0CA1AQLAIDAxAQLAIDAzAQMAMDA3AAMAYDA3AgNAQDAtAgMAADAxAQOAQDAwAAOAQDA0AANA0CAxAQMAkDAxAAMAkDA1AgNAIDAwAQLAEDAwAAMAEDAAAAAAAAAAAAAAAAAgBAAAMAAAAKWAAAAAAAAA02b092avBAAAAAAAAAAAAgNA8IHTe5ON5K1tMS/UUePygY8o21OhHxkZD+yOJmTibDAPyxkXuTTuSdLj0PFl3jMIGPqdtT4RMZ2gvsTi5k4AAAAAA</serialized>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Now if we are going to deploy this en-masse, we first must eliminate a few snippets to generalise it.

First we shall remove from line 20 to line 27. This removes the “Public Documents” folder from our Library (as we want the user to just use their network drive/share and not anything on the local machine)

Next, take out the <ownerSID>…</ownerSID> line followed by anywhere you find the <serialized></serialized> tags.

The only thing left is to change the location of Documents library, in our case we want to point to H:\My Documents\ but you can point it to where ever you like. To do so, edit between the <url>…</url> tags and should end up with something like the following:

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>@shell32.dll,-34575</name>
  <version>8</version>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1002</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <searchConnectorDescriptionList>
    <searchConnectorDescription publisher="Microsoft" product="Windows">
      <description>@shell32.dll,-34577</description>
      <isDefaultSaveLocation>true</isDefaultSaveLocation>
      <simpleLocation>
        <url>H:\My Documents\</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Nice and basic. No riff-raff, just does the job and does it well. Save the file name it Documents.library-ms and we are half way there.

Part 2 will come deployment of our new settings to all the computers in your enterprise via Group Policy Preferences

Over the seven years I have been at my current place of employment, I have gone from deploy printers via KIX script (more or less net use with variables) to Group Policy and finally Group Policy Preferences. Despite using 3 different methods not one has worked satisfactory… that is until now.

Before I get into the Group Policy deployment side of things I will first give you an idea of the environment I am working with.

• Windows Server 2008 Print Server / Domain Controller (could have gone 08 R2 but didn’t want the headache of x64 drivers AND x86 drivers)
• 30+ different print queues with varying models and brands ranging from HP Black & White Lasers to Xerox Multifunction Devices (fancy name for Photocopiers that can fax/print/scan/copy)
• Windows 7 SP1 clients predominately with a scattering of Vista and XP clients (all x86)
• Majority of the clients DO NOT have administrative privileges and thus are standard users

With the above in mind lets dig into the Printer Group Policy I use:

In the below section we share our each printer queue that is to be deployed via Group Policy:

User Configuration>Preferences>Control Panel Settings>Printers

Go ahead and create a new Shared Printer with the following properties:

The three important bits is the Action is set to Create, Share path is set to the SMB share path of your printer (use the … button to browse and point the printer if you do not know the path from memory) and that Run in logged-on user’s security context (user policy option) is ticked.

Now according to Microsoft, all that is left is to apply the policy to your choice of Organisational Unit and you should have printers being deploy left, right and centre. Depending on your environment this could be true however in our case this is not enough.

In the same Policy we are adding the printers go to the below sections and add the following:

Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>User Rights Assignment

• Load and unload device drivers
• BUILTIN\Users

Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options

• Devices: Prevent users from installing printer drivers
• Disabled

If it is not obvious already the above to settings will allow standard users to install printer drivers. Makes sense right?

Now with the above complete this was enough for most of our printer queues to be deployed without issue. Unfortunately & weirdly all our copiers refused to deploy (along with a couple of lasers). I am unsure what the technical reason that connects all these printers together but after reading what others have done when deploying printers via Group Policy Preferences I applied the next few policies:

Computer Configuration>Policies>Administrative Templates>Printers

• Only use Package Point and print
• Disabled
• Package Point and print – Approved Servers
• Disabled
• Point and Print Restrictions
• Disabled

With the above applied, all 30+ printer queues came through.

With this many printer queues, logon times are significantly increased upon first logon to a machine while the drivers are pulled from the Print Server and installed. On shared machines this can be frustrating to the end user (1:1 machines aren’t affected as subsequent logins do not have to reapply the policy unless there is a change) so my next task is to test if deploying the printers in Computer Configuration rather than User Configuration will only install the printers upon first domain user login and any subsequent domain user login will use the existing drivers/configuration.

Now go forth and give them all the printers they can handle!

Where there is a problem, we shall find a solution right?

After a bit of Google-fu & testing, I give you a script to output all SMTP addresses to an Excel document

Requirements:

• Exchange Powershell (tested 2007, should work on 2010)

Get-Mailbox -ResultSize Unlimited |Select-Object DisplayName,ServerName,PrimarySmtpAddress, @{Name=“EmailAddresses”;Expression={$_.EmailAddresses |Where-Object {$_.PrefixString -ceq “smtp”} | ForEach-Object {$_.SmtpAddress}}} | Export-Csv c:\mailbox_alias.csv

If we examine the code above you can see that this will export all SMTP address to a CSV formatted file named mailbox_alias.csv in the root of C:\ (make sure you have the rights to write there or change the path to somewhere you do have rights). This CSV file will have columns in the following layout:

DisplayName ServerName PrimarySMTPAddress EmailAddresses

The important thing to note is the final column EmailAddresses will provide any secondary/added SMTP address for those you use more than one email address.

In my specific case I needed to get email addresses from one specific mailbox database (staff and students are on seperate databases to make it easier to apply mailbox limits) and thus the script is a little different:

Get-Mailbox -Database "Mailserver\Databasename" -ResultSize Unlimited |Select-Object DisplayName,ServerName,PrimarySmtpAddress, @{Name=“EmailAddresses”;Expression={$_.EmailAddresses |Where-Object {$_.PrefixString -ceq “smtp”} | ForEach-Object {$_.SmtpAddress}}} | Export-Csv c:\mailbox_alias.csv

You will note the addition of -Database “Mailserver\DatabaseName” to the script which allows you to choose a specific mailbox database to pull email addresses from.

So, there you have it; all your email addresses outputted to a nicely formatted CSV file. Too easy!

First thing to do is check the event viewer. This tool is a god-send and if you are not already familiar with it, I suggest you immediately introduce yourself and become friends. You should be presented with a error something similar to the following:

The key in the above image is AdobePDF.dll is listed under the Faulting Module Path. Pesky Adobe has done it again in this case.

Now we know which driver is causing the spooler to fail (and in this case we can quickly surmise which printer it is based off the driver name) we can simply remove the printer from Devices & Printers right? Wrong. The second we start up the Print Spooler service its going to come crashing down once again.

So how do we remove a printer when we have no access to it via the GUI? Regedit, another friend you should familarise yourself with (having said that, knowing the registry of Windows from top to bottom is a mean feat, I have doubts I will ever know it THAT well).

Right, load up regedit and dive into

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

Under the Print key, you will find 3 keys that are of interest today; Environments, Monitors & Printers.

Under these 3 keys, purge anything to do with the aforementioned driver (in this case AdobePDF.dll) and you should be able to safely bring back up the Print Spooler service

Note: As with any circumstances involving Regedit, backup before you start changing. You have been warned!

There you have it, a nice and quick way to solve your print spooler failure loops.

I first happened upon Girls’ Generation after clicking on a rather inviting topic title on NeoGAF forums that promised to mesmerise and surprise. So with cautious excitement I proceeded to watch a video linked in the opening post of this topic. I was presented with nine beautiful ladies, dancing in sync, singing powerfully to a quick bass beat. Never have I been a great fan of anything pop related; I have always stuck to metal, electro & rock, but something in the beat had me hooked. It wasn’t long before I was constantly replaying this video, over & over. Simply astonishing was the whole package that came before me; both visual and aural senses completely overwhelmed. I craved more…

After returning to the topic that brought me to the video I started to dig, dig for anything related to this group, and I found more, lots more. Little had I known Girls’ Generation has been around since 2007 and there were plenty more hits than the one I had experience, even different versions of the same song.

This was back in 2010, I have since not only discovered more fantastic music & dance from the world of Korean Pop but I have even seen Girls Generation live, in the flesh when they, along with many others came to Sydney for the K-POP Music Fest.

Fast forward back to today and we have Girls’ Generation debuting on American TV (they have performed in the US but only in concert, never on public television) with a remixed version of their latest hit ‘The Boys’. With any luck (and early feedback is looking positive), Girls’ Generation will become a less of a leading group in a niche genre and more of a household name. Like TVQX and BoA did for Korean POP in Japan, Girls’ Generation hope to pave the first stones to success in the otherwise elusive American music market.

Watch and judge for yourself

The music & dance in Korean Pop is simply the tip of a very large ice berg. I implore you to go out and explore the crazy world of Korean Pop if you are interested in something outside the culture you grew in.

Good luck and enjoy the ride

This year I chose to taken it upon myself to come up with the method and couldn’t think of a better solution than Powershell. Considering all the work Microsoft seems to be putting behind this scripting & command engine it couldn’t hurt to try.

The script I cobbled together is VERY basic (as I have practically zero knowledge of PS) but worked for me, hopefully it can be of use to anyone else.

Requirements:

• Powershell v2
• Active Directory Module for Powershell (installed by default on WK8R2 Domain Controllers or available in the latest RSAT tools)

import-csv .\import.csv | %{new-aduser -Name $_.Name -DisplayName $_.DisplayName -GivenName $_.GivenName -SamAccountName $_.SamAccountName -UserPrincipalName $_.UserPrincipalName -Description $_.Description -Surname $_.Surname -Path ‘OU=example,DC=domain,DC=com' -CannotChangePassword $false -ChangePasswordAtLogon $false ; Set-ADAccountPassword -identity $_.SamAccountName -NewPassword (ConvertTo-SecureString -AsPlainText $_.AccountPassword -Force) -Reset ; Enable-ADAccount -identity $_.SamAccountName}

Save the above code, paste into your favourite text editor and save as a .ps1 (Powershell Script).

Next, create import.csv in the same directory as the script file and open it up in Excel. Now lets get the following headers inserted:

Name DisplayName GivenName SamAccountName UserPrincipleName Description Surname AccountPassword

All that is left is to fill in the csv with your data from where-ever that may be and run the script.

If I ever get around to it I hope to improve the script so that all that is required is GivenName, Surname & SamAccountName as the rest should either be generated from the 3 listed or grabbed from the environment (UserPrincipleName). Currently I perform a bit of Excel formula magic to do this but it adds time and that’s what we are trying to cut down right?

I would also like to be able to add group memberships in the future but one thing at a time.

Hopefully that saves any SysAdmin’s a day on trying to workout their own solution, if not, it certainly was a fun experience and a achievement for the day!

FA-18 Super Hornet going ballistic