Topic: windows
-
PowerShell error handling for admin scripts: terminating errors, $ErrorActionPreference and $LASTEXITCODE
PowerShell has two error classes that behave differently in a script: terminating errors that try/catch can stop, and non-terminating errors that only $ErrorActionPreference or -ErrorAction can turn into a stop. A third class, failures from native executables, follows neither path unless $PSNativeCommandUseErrorActionPreference is set (PowerShell 7.4+, experimental in 7.3).
-
Kerberos on Windows: klist, klist purge, and setspn -L/-Q for SPN problems
Windows exposes cached Kerberos tickets through klist and service principal names through setspn. Duplicate SPNs and clock skew between a client and a domain controller are the two failures that most often turn into confusing 'cannot authenticate' errors rather than a clear Kerberos message.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Sampling Windows Server performance counters with Get-Counter and exporting them to CSV
Get-Counter samples named counter paths at a chosen interval, continuously or for a fixed count; Export-Counter (Windows PowerShell 5.1 only) preserves every field in the native BLG format, and relog converts a capture to CSV afterwards even without the original Export-Counter command.
-
Windows answer files (unattend.xml): configuration passes and where Setup looks for them
An unattend.xml answer file supplies settings to specific configuration passes of Windows Setup — windowsPE, generalize, specialize and oobeSystem are the ones provisioning touches most. Setup finds the file through a fixed implicit search order and caches it in %WINDIR%\Panther, and Windows System Image Manager builds these files and can hide, but not encrypt, local-account passwords in them.
-
Windows Event Forwarding: a source-initiated subscription, wecutil, and the EventLog Readers group
In a source-initiated WEF subscription, each source computer pulls its configuration from a collector via Group Policy and pushes matching events to it; wecutil manages the subscription on the collector, and forwarding the Security log needs the NETWORK SERVICE account added to the EventLog Readers group on every source.
-
Prioritising October 2026 Patch Tuesday by exploitation evidence and affected assets
A proposed patch-triage protocol turns a large release into an asset-level queue. Confirmed exploitation, exposure and business consequences guide urgency; EPSS assists where exploitation evidence is absent.
-
Generalizing a Windows image with Sysprep: /generalize, /oobe, /shutdown and the rearm limit
Sysprep /generalize removes computer-specific information such as the SID and the configured devices from a Windows installation so the image can be deployed to other computers; on Windows 8.1/Server 2012 and later Sysprep can be run up to 1001 times per image (3 times on Windows 7/Server 2008 R2), and generalize failures leave their trace in the Panther logs under System32\Sysprep.
-
Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do
Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Windows exit codes beyond pass/fail: robocopy's bitmask, msiexec's installer codes, and $LASTEXITCODE
robocopy encodes several independent facts (files copied, extra files, mismatches, failures) into one number below 8 that must be read as a bitmask, not compared to zero; msiexec returns specific Windows Installer codes where 3010 and 1641 mean success with a pending reboot, not failure; and PowerShell's $LASTEXITCODE is the only reliable way to see a native program's real code, with different rules depending on how the script was invoked.
-
Windows Shell CVE-2026-96951: verify the Windows 11 fix and preserve attachment protection
Verify the cumulative update for the exact Windows 11 release, complete the restart, and retain attachment-origin and SmartScreen controls. A missing warning is not evidence that a downloaded file is safe.
-
Windows 10 after October 2026: consumer and organisational ESU coverage
Microsoft's consumer ESU page now states coverage through 12 October 2027. Organisations follow separate annual ESU terms, so record eligibility, programme year, activation and installed updates independently for every retained Windows 10 device.
-
Why NTP still runs inside virtual machines despite guest agents and paravirtual clocks
Virtual machines get time-related help from several layers — kvm-clock, guest agents, Hyper-V integration services — but none of them substitute for an NTP or chrony client running inside the guest. This article explains what each layer actually does and why time sync stays a guest-OS responsibility.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
-
windows_exporter: installing the MSI with enabled collectors, and verifying /metrics on Windows
windows_exporter ships as an MSI that installs itself as a Windows service and can take installer properties for which collectors to enable, the listen port, and a Windows Firewall exception, all set non-interactively through msiexec.
-
Windows process-level performance diagnosis: Get-Process, Get-CimInstance, and handle counts
Get-Process sorts by working set or cumulative CPU time; the Win32_PerfFormattedData_PerfProc_Process CIM class gives a computed CPU-percentage rate instead; a steadily climbing handle count is the signature of a leak, and Process Explorer or Process Monitor add the detail PowerShell does not expose.
-
cmd.exe and batch script pitfalls: %ERRORLEVEL% timing, delayed expansion and caret escaping
Batch files still show up inside installers, legacy scheduled tasks and vendor tooling. %ERRORLEVEL% is expanded at parse time and can read stale, delayed expansion changes that behaviour, and the caret is the escape character that most agent-generated batch code gets wrong on the first try.
-
Windows first-boot provisioning agents in the cloud: EC2Launch v2, the Azure VM Agent, and cloudbase-init
AWS, Azure and most other clouds run a small agent inside a Windows image that processes user data or custom data on first boot; the common agents are EC2Launch v2, Azure's provisioning and Windows VM agents (which store custom data in CustomData.bin but do not execute it) and the open-source cloudbase-init. Each logs to a different location worth checking when provisioning appears to have silently failed.
Machine-readable: JSON