<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Przemysław Łukawski&#039;s blog &#187; Windows 8</title>
	<atom:link href="http://p-lider.lideve.eu/wordpress/?cat=19&#038;feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://p-lider.lideve.eu/wordpress</link>
	<description>Solutions for IT technical problems admins and developers may face with.</description>
	<lastBuildDate>Tue, 23 Sep 2014 18:29:49 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=4.2.22</generator>
	<item>
		<title>Cloning Windows 8 or Windows 8.1 on UEFI/GPT disk configuration</title>
		<link>http://p-lider.lideve.eu/wordpress/?p=183</link>
		<comments>http://p-lider.lideve.eu/wordpress/?p=183#comments</comments>
		<pubDate>Mon, 06 Jan 2014 16:12:02 +0000</pubDate>
		<dc:creator><![CDATA[p_lider]]></dc:creator>
				<category><![CDATA[Operating Systems]]></category>
		<category><![CDATA[Windows 8]]></category>
		<category><![CDATA[Boot]]></category>
		<category><![CDATA[Clone]]></category>
		<category><![CDATA[Partition]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://p-lider.lideve.eu/wordpress/?p=183</guid>
		<description><![CDATA[Recently I bought a new SSD disk for my new laptop. I didn’t want to install the whole operating system from scratch so I decided to just clone an existing operating system to this new disk. In the past I never worked with GPT formatted disk, so I thought that the process of cloning disk [&#8230;]]]></description>
				<content:encoded><![CDATA[<p>Recently I bought a new SSD disk for my new laptop. I didn’t want to install the whole operating system from scratch so I decided to just clone an existing operating system to this new disk. In the past I never worked with GPT formatted disk, so I thought that the process of cloning disk will be similar – and that was a bad assumption.</p>
<p>When I looked how the existing original disk was partitioned to my surprise I saw 5 (that’s right &#8211; five) partitions. They were marked as follows:</p>
<ol>
<li><strong>OEM Partition</strong> (1023 MB in size) – now I know that such partition contains Windows Recovery Environment</li>
<li><strong>EFI System Partition called ESP</strong> (360MB in size) – it is similar to “Active Partition” known in MBR formatted disks, the UEFI looks for boot manager only on partitions of this type</li>
<li><strong>Boot, Primary partition</strong> – the first partition which is actually seen in My Computer as C: drive and it contains Windows system files</li>
<li><strong>Primary Partition</strong> – the second and biggest partition which contains my other data (seen as drive D: in My Computer)</li>
<li><strong>OEM Partition</strong> (labeled “Recovery Image”) – contains recovery image which was created by laptop manufacturer</li>
</ol>
<p>&nbsp;</p>
<p>So the biggest question was – which of those partitions should I clone to the new disk and how to do this? In the past, when working with Windows XP and MBR formatted disks the only partition I had to clone was the partition, that contained the Windows system files (in the above scenario it would be number 3). But here it was not the case. The files that are required for the system to boot lie on the partition number 2. So after checking what these all 5 partitions contain I went to conclusion, that I need to clone at least 2 partitions:</p>
<ul>
<li>EFI System Partition (partition number 2 in my case)</li>
<li>Boot, Primary Partition (partition number 3 in my case)</li>
</ul>
<p>&nbsp;</p>
<p>When I finally identified which partitions I should clone, I then needed to chose a tool to actually clone them. In the past I was using <strong><em><span style="color: #4f81bd;">SelfImage</span></em></strong> to do such work, however for some reason this program has problems with GPT disks. So then I used a good old tool, known from UNIX like systems, called DD. There is a port of this wonderful tool for Windows called “<a href="http://www.chrysocome.net/dd">DD for Windows</a>“.</p>
<p>Having all my questions answered I started to work with cloning the partitions. This is the procedure I followed to successfully clone my current system to a new SSD disk:</p>
<ol>
<li>Create 2 partitions on new disk (EFI System partition and Windows Primary partition)
<div>
<pre>		
select disk &lt;destination_disk_number&gt;
clean
convert gpt
create partition efi size=SOURCE_EFI_PARTITION_SIZE
format quick fs=fat32 label="SYSTEM"
create partition primary
format quick fs=ntfs label="Windows"
exit</pre>
</div>
</li>
<li>Using DD program (or any other partition cloning program) copy all contents of source EFI System partition and Windows Primary partition to the new, just created, partitions.
<p>WARNING: cloning of the partition which contains Windows system files must be done when the system contained on it is not running – I did that using Win7PE DVD, but you could do this using for example any live Linux distribution.</li>
<li>After cloning is complete you have to assign a letter to both cloned partitions (assume that ESP will be mounted to S, and Windows partition will be mounted to W). Although assigning a letter to cloned Windows partition is not a big deal (you can do this from Disk Management), then assigning the letter to the cloned ESP is not so easy – you cannot do this from Disk Management snap-in. To assign a drive letter to ESP partition you have to do this using DISKPART utility:
<div>
<pre>		
select disk &lt;destination_disk_number&gt;
select partition &lt;index_of_cloned_esp_partition&gt;
assign letter=s
exit</pre>
</div>
</li>
<li>Process of cloning the ESP partition makes one nasty thing to boot manager contained on it – it invalidates the “device” and “osdevice” variables stored within its configuration. So to make the cloned system bootable without BSOD, after the letter to cloned partitions are assigned, you have to edit boot manager configuration contained on ESP partition and properly set the “device” and “osdevice” variables so they point to cloned Windows partition. To do so use the BCDEDIT utility (I assumed below that you mounted cloned ESP partition under S letter and cloned Windows partition was mounted under letter W):
<div>
<pre>		
bcdedit /store s:\boot\bcd /set {default} device partition=W:
bcdedit /store s:\boot\bcd /set {default} osdevice partition=W:</pre>
</div>
<p>WARNING: It is very important to use here a cloned ESP and Windows partitions (mounted under letter S and W), not the original ones.</li>
<li>Done – you should now have a working, cloned Windows 8 system on a new disk.</li>
</ol>
]]></content:encoded>
			<wfw:commentRss>http://p-lider.lideve.eu/wordpress/?feed=rss2&#038;p=183</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Windows registry autorun locations</title>
		<link>http://p-lider.lideve.eu/wordpress/?p=159</link>
		<comments>http://p-lider.lideve.eu/wordpress/?p=159#comments</comments>
		<pubDate>Sun, 17 Nov 2013 12:14:46 +0000</pubDate>
		<dc:creator><![CDATA[p_lider]]></dc:creator>
				<category><![CDATA[Operating Systems]]></category>
		<category><![CDATA[Windows 7]]></category>
		<category><![CDATA[Windows 8]]></category>
		<category><![CDATA[Windows Explorer]]></category>
		<category><![CDATA[Windows Server 2003]]></category>
		<category><![CDATA[Windows Server 2008 and 2008 R2]]></category>
		<category><![CDATA[Windows XP]]></category>

		<guid isPermaLink="false">http://p-lider.lideve.eu/wordpress/?p=159</guid>
		<description><![CDATA[Many times people ask me to check their computers for malware or for the reason it is working slow. The first thing I do is to check all programs that automatically start with windows. Normally I remember 4 or 5 locations in registry where to look for such programs and almost all the time I [&#8230;]]]></description>
				<content:encoded><![CDATA[<p>Many times people ask me to check their computers for malware or for the reason it is working slow. The first thing I do is to check all programs that automatically start with windows. Normally I remember 4 or 5 locations in registry where to look for such programs and almost all the time I must search the internet for another ones. That made me to write this post, which will allow me to always have the full (or almost full) list about the registry locations for auto startup purpose in one place.</p>
<p>In the below table I described all of the registry locations I know which programs are using to start automatically with Windows:</p>
<style>
.descrcell {
	border: 1px solid #000000; 
	padding-top: 0cm; padding-bottom: 0.1cm; padding-left: 0.1cm; padding-right: 0.1cm;
}
.tablecell {
	border: 1px solid #000000;
	padding-top: 0cm;
	padding-bottom: 0.1cm;
	padding-left: 0.1cm;
	padding-right: 0cm;
}
</style>
<div style="overflow: auto; height:500px;">
<table width="707" cellspacing="0" cellpadding="4">
<colgroup>
<col width="15" />
<col width="360" />
<col width="200" /></colgroup>
<tbody>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><b>No.</b></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><b>Registry Location (<span style="color: #0047ff;">blue </span>ones are present in 64bit OS only)</b></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><b>Description</b></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">1</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKML\Software\Microsoft\Windows\CurrentVersion\Run\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed when any user logs in.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">2</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKML\Software\Microsoft\Windows\CurrentVersion\RunOnce\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed when any user logs in. After execution<br />
the values are being deleted.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">3</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKML\Software\Microsoft\Windows\CurrentVersion\RunServices\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed as services when any user logs in.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">4</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKML\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed as services when any user logs in.<br />
After execution the values are being deleted.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">5</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows\CurrentVersion\Run\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed when current user logs in.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">6</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All values<br />
under this key are executed when current user logs in. After<br />
execution the values are being deleted.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">7</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Used only by<br />
setup. A progress bar is being displayed.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">8</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKU\.Default\Software\Microsoft\Windows\CurrentVersion\Run\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Same as 5 but<br />
applies to LOCAL SYSTEM user only.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">9</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKU\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Same as 6 but<br />
applies to LOCAL SYSTEM user only.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">10</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\Software\Microsoft\Windows<br />
NT\CurrentVersion\Winlogon\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US">„<span style="">Shell”<br />
and „Userinit” values contain file names separated<br />
with comma which are executed when any user logs in.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">11</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows<br />
NT\CurrentVersion\Winlogon\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US">„<span style="">Shell”<br />
and „Userinit” values contain file names separated<br />
with comma which are executed when current user logs in.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">12</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\Software\Microsoft\Active<br />
Setup\Installed Components\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKLM\Software\Wow6432Node\Microsoft\Active<br />
Setup\Installed Components\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">All subkeys<br />
are evaluated for execution when any user logs in. The “StubPath”<br />
value under each subkey describes the program being run.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">13</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Control<br />
Panel\Desktop</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US">„<span style="">SCRNSAVE.EXE”<br />
value is executed when screen saver is being displayed for current<br />
user.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">14</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\System\CurrentControlSet\Control\Session<br />
Manager\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">The<br />
„BootExecute” value is being executed at boot time.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">15</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\System\Control\WOW\cmdline</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Value is<br />
executed when 16 bit application is being run for all users.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">16</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\System\Control\WOW\wowcmdline</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Value is<br />
executed when 16 bit DOS application is being run for all users.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">17</span></p>
</td>
<td sclass="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad\</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Values<br />
contains GUID for COM library which is being run after explorer<br />
finished loading.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">18</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows<br />
NT\CurrentVersion\Windows\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">The „run”<br />
and „load” values are executed when current user logs<br />
in. </span></p>
<p lang="en-US">
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">19</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\Software\Microsoft\Windows<br />
NT\CurrentVersion\Windows\AppInit_DLLs</span></p>
<p lang="en-US"><span style="color: #0047ff;"><span style="">HKLM\Software\Wow6432Node\Microsoft\Windows<br />
NT\CurrentVersion\Windows\AppInit_DLLs</span></span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">AppInit_DLLs<br />
value contains dll file names separated with comma which are being<br />
loaded into every process being run in the system.</span></p>
<p lang="en-US"><span style=""><strong>IMPORTANT</strong>:<br />
Very dangerous entry used by many malware programs.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">20</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Same as 5.<br />
Normally values are named here as numbers starting from „1”.</span></p>
</td>
</tr>
<tr valign="TOP">
<td class="tablecell" width="15">
<p lang="en-US"><span style="">21</span></p>
</td>
<td class="tablecell" width="360">
<p lang="en-US"><span style="">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\</span></p>
</td>
<td class="descrcell" width="226">
<p lang="en-US"><span style="">Same as 1.<br />
Normally values are named here as numbers starting from „1”.</span></p>
</td>
</tr>
</tbody>
</table>
</div>
<p>Some information in the above table has been taken from this forum: <a href="https://forums.hak5.org/index.php?/topic/12112-registry-autostart-locations/">Registry AutoStart Locations</a></p>
]]></content:encoded>
			<wfw:commentRss>http://p-lider.lideve.eu/wordpress/?feed=rss2&#038;p=159</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>AMD SB8XX RAID + Windows 8 = BSOD</title>
		<link>http://p-lider.lideve.eu/wordpress/?p=141</link>
		<comments>http://p-lider.lideve.eu/wordpress/?p=141#comments</comments>
		<pubDate>Tue, 18 Dec 2012 20:44:21 +0000</pubDate>
		<dc:creator><![CDATA[p_lider]]></dc:creator>
				<category><![CDATA[Hardware]]></category>
		<category><![CDATA[Windows 8]]></category>

		<guid isPermaLink="false">http://p-lider.rootnode.net/wordpress/?p=141</guid>
		<description><![CDATA[If you are using RAID feature of AMD SB8XX chipsets you can encounter a lot of BSODs when using Windows 8 even during system installation. This is caused by a buggy amdsbs.sys driver which is integrated into Windows 8 distribution media. To be able to successfully install Windows 8 in such situation you must set SATA [&#8230;]]]></description>
				<content:encoded><![CDATA[<p>If you are using RAID feature of AMD SB8XX chipsets you can encounter a lot of BSODs when using Windows 8 even during system installation. This is caused by a buggy <strong>amdsbs.sys</strong> driver which is integrated into Windows 8 distribution media.</p>
<p>To be able to successfully install Windows 8 in such situation you must set SATA controller mode of system hard disk to IDE for the time of system installation. After the system is installed first thing to do is to install the newest RAID driver from AMD site and disable the buggy <strong>amdsbs.sys</strong> driver in the registry (without disabling it you will still sporadically encounter BSODs even though the newer and bug free driver from AMD is installed). To completely disable the buggy driver you have to perform the following steps:</p>
<ol>
<li>Open Registry Editor</li>
<li>Navigate to the &#8220;<strong>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdsbs</strong>&#8221; key.</li>
<li>In the right pane find &#8220;Start&#8221; parameter, double click it and set its value to 4.</li>
<li>Close the Registry Editor and reboot the system.</li>
</ol>
<p>After installing the newest RAID driver and disabling the buggy one, you can set back the SATA mode of your disks to RAID and the Windows will be working stable now.</p>
]]></content:encoded>
			<wfw:commentRss>http://p-lider.lideve.eu/wordpress/?feed=rss2&#038;p=141</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
