Win OS – Error – “Certificate for local system with Thumbprint is about to expire or already expired”

Background

Want to quickly deal with a MS Windows Error.

The error is logged in the Event Viewer and it reads :-

Certificate for local system with Thumbprint is about to expire or already expired.

Event Viewer

Windows Logs

Application

List

List Events
Image

autoEnrollment.20190702.0802PM

Tabulate
  1. Log Name :- Application
  2. Source :- CertificateServicesClient-AutoEnrollment
  3. Event ID :- 64

Trouble Shooting

PowerShell

Outline

  1. Issue Directory command against local machine’s certificate repository
    • Specifically check machine, not services nor user
  2. Return Sorted By
    • Display the following fields
      • Subject
      • Thumbprint
      • Expire Date

 

Code


Set-StrictMode -Version Latest

Write-Host

Write-host "Certificates in Local Machine Store"
Write-host "==================================="

dir cert:\LocalMachine\my | Sort-Object NotAfter | Foreach-Object `
	{

		$log = "{0}" -f $_.subject;
		Write-host $log

		$log = "`tThumprint :- {0}" -f $_.thumbprint;
		Write-host $log

		$log = "`tExpiry Date :- {0}" -f $_.NotAfter;
		Write-host $log

		Write-host
		#Write-Host

	}

Output

listCertsMachine.20190702.0829PM.PNG

Expiration

We can see that one of our certificates expired at 5 AM this morning.

Smart System Menu

Background

Have an application that is not allowing me to resize it’s window.

Sought out tools to help.

Smart System Menu

The most accessible tool I found is the one from Alexander.

The tool’s name is Smart System Menu.

Artifact

The compiled app is here.

artifact.package.20190621

It is open source and it is available here.

 

Download

Downloaded the compiled binary.

Extract

The binary is compressed.

Please un-compress.

artifact.package.extract.20190621.0541PM

Execute

Please execute SmartSystemMenu.exe.

Once started, it runs in the background and accessible via the System Tray.

Usage

The system menu in each application is enhanced.

The enhancements is that we now have :-

  1. Resize Menu Entry
    • Specific Sizes
      • 640×480
      • 800×600
    • Manual
  2. Alignment

Images

Microsoft Windows – Word pad

usage.wordpad.01.20190621.0545PM.PNG

Summary

If you end up with an Application that is not easy to move around on the desktop, please consider Windows Screen sizing tools.

Unfortunately, it did not help with our targeted application.

The developer had chosen to not allow the window to be resized.

Measuring IOPs on MS Windows – Day 01

Background

Wanted to cover a couple of options for measuring Storage IOPs on a MS Windows machine.

Outline

  1. SysGauge – System Monitors
  2. MS Windows Performance Monitor
    • Disk IO
      • Logical Disk
    • SQL Server ( v2014+ )

Choices

SysGuage

Download SysGuage from here.

Install it on targeted machine.

Run it while sufficient load is running.

Images

MS Windows

Performance Monitor

Counter :- Disk IO

Counter :- Disk IO \ Logical Disk
Image

Explanation
  1. You want to look under LogicalDisk
    • Disk Reads/sec
    • Disk Writes/sec
    • Disk Transfers/sec
      • Disk Reads/sec + Disk Writes/sec

Counter :- SQL Server

Object Name :- SQL Server \ Resource Pool Stats

Please keep in  mind that Resource Pool Stats is only available as of SQL Server v2014.

When not running default MS SQL Server Instance, please look for the named instance complement.

Image

Explanation
  1. SQL Server
    • Object Name :- Resource Pool Stats
      • Counter Name
        • Disk Read IO/sec
        • Disk Write IO/sec

Event Viewer – Error – “MMC cannot open the file C:\Windows\system32\eventvwr.msc”

Background

On one of our MS Windows Systems, I  have been Unable to use Event Viewer.

Error

Error Image

MMCCannotOpenTheFile.PNG

Error Text

MMC cannot open the file C:\Windows\system32\eventvwr.msc.

Remediation

Outline

  1. Launch Microsoft Management Console ( MMC.exe) shell
    • mmc.exe
  2. In new empty shell
    • Add Event Viewer SnapIn
      • From the “Available snap-ins”
        • Select “Event Viewer”
      • Click Add Button
      • SnapIn should appear under “Selected Snapins”
    • Save Console
      • Save Console under a new name
  3. Launch new MMC Console
  4. Once happy
    • Once happy, return to MMC and overwrite original Event Viewer

Image

New Empty Shell

Console.MMC.01.PNG

Select Computer

Console.MMC.03.SelectComputer.20190425.0153PM.PNG

Add or Remove Snap-ins

Console.MMC.02.AddAndRemove.20190425.0152PM.PNG

Save SnapIn

Save SnapIn – Save As – 01

OSDesktop.Windows.System32.saveAs.20190425.0256PM

Save SnapIn – Save As – 02

OSDesktop.Windows.System32.saveAs.20190425.0258PM.PNG

Pathping / Day 01

Background

Wanted to talk very little about using pathping to get an idea of the route between one and a destination host.

Syntax

The syntax is generic enough.

Enter pathping and the destination’s hostname or IP Address.

Sample


 pathping Haaretz.com

Output

Tracing Route

pathping.haaretz.01.20190310.0756PM

Computing Statistics

pathping.haaretz.02.20190310.0800PM_x

Interpretation

 

There are two sections to pathping’s output.

The sections are “Tracing Route” and “Computing Statistics“.

 

Tracing Route

Each router that is responsible for forwarding the network packet is listed.

Computing Statistics

Allotted Time

Depending on how many routers are encountered time is allotted for processing.

Each router is pinged one hundred times every 0.25 seconds.

That is, 25 seconds is allotted for each router.

Columns

  1. Hop
    • Increasing number for each router
  2. RTT
    • RTT means Round Trip Time
    • The is how long it took to receive response back from that router
  3. Source to Here / Loss / Sent Percentage ( % )
    • Percentile of packets lost
    • If 100 packets were sent, but only 20 acknowledgement was received
    • This number will be ( 100-20) / 100 or 80%
  4. This Node Link / Loss / Sent Percentage ( % )
    • Packet loss information specific to this router
  5. Address
    • Router’s Address

Summary

  1. If you see 100% packet loss, but entries beyond that point
    • That specific router is likely dropping ICMP traffic

 

Win OS – Error – “An unhandled win32 exception occurred in spoolsv.exe”

Background

Have a few MS Windows 2003 computers running in our LAB.

Error

When I do bother to use them there is an arresting error that I have been receiving.

Error – “An unhandled win32 exception occurred in spoolsv.exe”

Image

spool.20190210.png

Textual


An unhandled win32 exception occurred in spoolsv.exe

Trouble Shooting

Control Panel

Printers and Faxes

Outline

  1. Accessed Control Panel
    • Reviewed Printers and Faxes

Images

controlPanel.printersAndFaxes.20190210.png

Event Viewer

Event Viewer \ System

Outline

  1. Launched Event Viewer
    • Review System Events
      • Event ID :- 7031
        • Event #1
          • Source :- Service Control Manager
          • Event ID :- 7031
          • The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Images

eventViewer.system.20190210.png

 

Remediation

We have an HP LaserJet computer that we have not used in a while.  It is currently turned off.

Outline

  1. Computer
    • Remove HP LaserJet Software installed on computer
    • MS Windows Registry Cleanup

 

Tasks

Remove HP LaserJet Software installed on computer

Removed any installed HP LaserJet software.

MS Windows Registry Cleanup

Outline

Cleanup MS Windows Registry using regedit :-

  1. Start regedit
  2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers
  3. Export Registry sub-key out to a file for safe keeping
  4. Under this key, there will be the keys Version-2 and Version-3
    • The sub-keys under these contain the printer driver configuration information
    • One or the other of these may be absent – not a problem
  5. Maintain each Sub-key
  6. But, search each sub-key for drivers no longer present on the computer
    • On each found sub-key, remove found sub-key
    • In our case
      • HP Laser Jet 2100
      • HP Laser Jet 2100 PCL6

Images

Image – Before

registry.noor.20190210.0159PM.png

Image – After

registry.noor.20190210.0308PM.png

Crediting

Crediting Mr. Shafique Cheena ( Profile )

Shafique Cheena

Event ID 7031 Print Spooler terminated unexpectedly

Link

credit.shafique.20190210