What is Windows Performance Analyzer all about and why should you use it instead of xperfview?

Posted over 2 years ago

by

Jeff Stokes

5 Comments

Consider the following trace in xperfview:

This should be familiar to you, it’s the DPC storm / storport doorbell that looks like this:

So how does this trace look in WPA from the Windows 8 ADK (RP edition)?

A little different, but the Dude isn’t closed minded here, so lets give it a whirl:

Observe. With that LSI_SAS selected, we see the time frame on the top middle where the CPU was doing work in that module. and See the stack? Which view is more in-depth? WPA is the frickin future man. I was a doubting Thomas 100%. But WPA takes xperfview to a whole ‘nother level of magic.

And the Dude believes!

Hats off to Michael Milirud and the Windows Performance Toolkit team. Seriously folks. Job well done.

Another example, why does WINLOGON INIT take so long?

How cool is that? We can see CCMEXEC took 8 seconds, its simple to just scroll down the list and see exactly why WINLOGON INIT took so long, and triage it.

I LOVE IT!

I’m going to build some broken scenarios in my lab and do some more examples of how-tos…

Why do I have long boot times? Pt 1

Posted over 5 years ago

by

Jeff Stokes

4 Comments

So one of the questions that comes to mind every now and then in technical circles (and outside as well) is "Why doesn't it take so long for my machine to boot?". Just what's going on in there while these friendly, soothing graphics come up on the screen, and I wait and wait for a prompt to login?

Great question. I recently purchased a solid state drive for my laptop and after imaging it with Windows 7 and loading it all up with drivers and whatnot, I had the same question. So I went off an looked to find out what the 'deal' was.

So I went to the Windows Performance Analysis website and downloaded and installed the Windows 7 SDK, which includes the Windows Performance Toolkit (mainly, for this exercise, xbootmgr.exe and xperfview.exe.

(So xbootmgr will tell the kernel to start tracing at boot and tell Windows to restart so it can get on with the trace. So be prepared for the system to reboot you when you type this in and hit enter!)

Anway, after download and installation, I did the following from an elevated command prompt:

xbootmgr -trace boot -traceflags BASE+CSWITCH+DISK_IO_INIT

I did this in a directory where I had room for a couple hundred meg etl trace and it was nice and tidy so I didn't have to hunt for anything.

My system rebooted and as soon as I was presented with a command prompt, I logged in. After the shell came up, I had a window on my screen that basically counted down post boot tracing, for 120 seconds. When I see this I just let it do its thing.

After 120 seconds, it wraps all this data into an etl file named boot_BASE+SWITCH+DISK_IO_INIT.etl in the directory where I ran the command prompt.

After the system is done collecting its data and waiting on the prefetcher info and whatnot, I then go in and do the fun bit, open the ETL file with xperfview.

I immediately am drawn to the wide gap where nothing happens in my services list, from the 22 to 38 second mark. Turns out this is the ambient light sensor for my keyboards backlight. It takes the driver a bit of time to figure out the ambient light where I'm at to make a judgement call on if a backlit keyboard is needed. In Windows 7 there is a handy feature for services called "Automatic (Delayed Start)". I put the service into that state and rebooted and I saved 16 seconds on my boot time. A decent gain I think.

Now, this is a very, very rudimentary explanation of how to review an ETL file, something simple to look for, a beginners example. I highly recommend going further with ETL / WPT, as it is a very insightful glimpse into Windows system performance. To dig further, I've collected some links from a list that is floating around internally...

Performance toolkit (XPERF) log & analysis

The required steps to collect xperf logs on XP / Vista are as follows:

1) Download & Install the toolkit on a Vista/2008/Windows 7 machine.
The latest version of the Windows Performance Toolkit is part of the Windows 7 SDK (which is a huge download). The following blog has the steps to download the ‘bare minimum’ to get the WPT toolkit.

http://blogs.msdn.com/jimmymay/archive/2009/11/24/xperf-install-windows-performance-toolkit-wpt-with-242mb-download-not-2-5gb-windows-7-sdk-part-2.aspx

2) Copy the contents of the “C:\Program Files\Microsoft Windows Performance Toolkit” to a folder on Windows XP (or a USB memory stick).

3) Turn off the “No Execute” or ‘Execute Disable” security option for CPU in the BIOS (or if you cannot find the appropriate BIOS setting, add the following switch to the boot.ini file: noexecute=alwaysoff)

4) Either run xbootmgr from the command line, or use the XPerfUI utility which you can download from our codeplex website: http://xperfui.codeplex.com/

5) Copy the resulting .etl file to the Vista machine to use the xperfview GUI to open & analyze it. If a userenv log is generated under %windir%\debug\usermode, it can also be copied to correlate processes & times.

MSDN documentation link for the Windows Performance Toolkit:

http://msdn.microsoft.com/en-us/library/cc305187.aspx

Windows On/Off Transitions Solutions Guide (Diagrams)

http://www.microsoft.com/whdc/system/pnppwr/powermgmt/OnOffTrans.mspx

On/Off Transition Performance Analysis of Windows Vista (Vulnerabilities)

http://www.microsoft.com/whdc/system/sysperf/On-Off_Transition.mspx

Xperf UI – GUI wrapper for the Xperf command line tool
http://xperfui.codeplex.com/

Also a good blog for more information

http://blogs.msdn.com/pigscanfly/pages/xperf-articles.aspx

Two Minute Drill: Introduction to XPerf

http://blogs.technet.com/askperf/archive/2008/06/27/an-intro-to-xperf.aspx

More notes on xperf:

To show if there are any active loggers

Xperf –loggers

To stop any active loggers

Xperf –stop

To view help on available flags

Xperf –providers i

Xperf –help providers

To trace any process ad hoc including cpu, disk and registry

Xperf –on diageasy+registry

Then stop and merge the wmi / etl data into the log file

Xperf –d mytrace1.etl

To view the traces; (only works on Vista or Svr 2008 or later)

Xperf <logname.etl>

Or

Use xperfview as the GUI

Special thanks to Fatih Colgar and Roger Southgate for comprising the "Performance Toolkit (XPERF) Log & Analysis" links and walk through.

Deconstructing the PFE VDI Optimization Script

Posted over 2 years ago

by

Jeff Stokes

Here we deconstruct the post that is located here: http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx

We welcome industry feedback and comments! Hope this helps you.

Jeff

' First things first - enable RDP Connections!!!
RunWait "WMIC rdtoggle where AllowTSConnections=0 call SetAllowTSConnections 1,1"
RunWait "netsh advfirewall firewall set rule group=" & Chr(34) & "remote desktop" & Chr(34) & " new enable=Yes"

Comment: We enable RDP so you can connect to the host in a VDI environment over MSTSC.

' Disable Adaptive Brightness Service
RunWait "sc config SensrSvc start= disabled"

Comment: We disable adaptive brightness as it does not apply to a Virtual Guest and is considered operational overhead.

' Disable Application Layer Gateway Service
RunWait "sc config ALG start= disabled"

Comment: ALG is used for 3rd Party Plug-ins to ICS, which we would assume you are not using in a virtual desktop environment…

' Disable Background Intelligent Transfer Service
RunWait "sc config BITS start= disabled"

Comment: We disable BITS because we are assuming a short lifespan for the guest OS. If you are running a persistent virtual desktop infrastructure that is updated with SCCM or WSUS then this may need to be enabled.

' Disable Background Layout Service
oShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout\EnableLayout", 0, "REG_DWORD"

Comment: This setting governs if Windows will optimize the disk during periods of idleness. In a non-persistent VDI environment, this setting makes no sense. In a persistent VDI environment, it may make some sense, depending on the backend disk infrastructure. Maybe.

' Disable Bitlocker Drive Encryption Service
RunWait "sc config BDESVC start= disabled"

Comment: We are assuming that the individual VMs will not be bitlockered and if disk encryption is necessary, that it is implemented in the disk storage environment where the VHD files are stored.

' Disable Block Level Backup Engine Service
RunWait "sc config wbengine start= disabled"

Comment: It would be unusual to need to backup a VDI environment where typically applications are streamed, VMs are thrown away after one use, and/or user data is stored using UE-V and folder redirection.

' Disable Bluetooth Support Service
RunWait "sc config bthserv start= disabled"

Comment: This MAY break some third party printer drivers, to have this disabled. Your mileage may vary.

If strBranchCache = True Then
' Disable BranchCache Service
RunWait "sc config PeerDistSvc start= disabled"
End If

Comment: It would be an unusual VDI environment where BranchCache would be required or implemented.

' Disable Computer Browser Service
RunWait "sc config Browser start= disabled"

Comment: It is unusual where company's have users browsing the network directly for nodes.

' Disable Diagnostic Policy Service
RunWait "sc config DPS start= disabled"

Comment: If you rely on this for troubleshooting purposes you may want it enabled, but typically this service is disabled in corporate environments with no ill effect.

' Disable Disk Defragmenter Service
RunWait "schtasks /change /tn ""microsoft\windows\defrag\ScheduledDefrag"" /disable"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction\Enable", "N", "REG_SZ"
RunWait "sc config defragsvc start= disabled"

Comment: These settings disable the defragmentation scheduled task, the service, and the boot optimizer as well. We are assuming the environment is non-persistent. Defrag MAY make sense in a persistent virtual environment, depending on disk backend setup.

' Disable Distributed Link Tracking Service
RunWait "sc stop TrkWks"
RunWait "sc config TrkWks start= disabled"

Comment: This service maintains links between NTFS files in a computer or across computers. It is unusual to see a client (or server for that matter) rely upon this process for data handling. In our experience it may be safely disabled but you should of course test 3rd party applications for compatibility.

If strEFS = True Then
' Disable Encrypting File System Service
RunWait "sc config EFS start= disabled"
End If

Comment: This is disabled because again, if you want disk encryption, you should rely upon a larger scale solution than Bitlockering individual VMs or using EFS for individual Files.

' Disable Function Discovery Resource Publication Service
RunWait "sc config fdPHost start= disabled"

Comment: Disabling this cuts down on network chatter. In corporate environments we don’t recommend running SSDP, which relies upon this service. It does disable WS-D, which MAY be needed in your environment, but we’ve found those situations to be fairly remote.

' Disable HomeGroup Listener Service
RunWait "sc config HomeGroupListener start= disabled"

Comment: It would be very unlikely that a virtual machine would be a HomeGroup participant.

' Disable HomeGroup Provider Service
RunWait "sc config HomeGroupProvider start= disabled"

Comment: It would be very unlikely that a virtual machine would be a HomeGroup participant.

If striSCSI = True Then
' Disable Microsoft iSCSI Provider Service
RunWait "sc config msiscsi start= disabled"
End If

Comment: You MAY want iSCSI enabled for VDI to provision a disk for, well, some reason I cannot come up with currently. Typically we disable this.

' Disable Microsoft Software Shadow Copy Provider Service
RunWait "sc config swprv start= disabled"

Comment: We feel in a VDI environment, the disk overhead of having and creating VS Snapshots is unneeded. If the VM fails, recreate it. All user data should be stored off the VM.

' Disable Parental Controls Service
RunWait "sc config WPCSvc start= disabled"

Comment: It is unlikely in a corporate environment this would be needed….

' Disable Secure Socket Tunneling Protocol Service
RunWait "sc config SstpSvc start= disabled"

Comment: This could be needed if you were remote tunneling to servers from the VM. But in most end-user cases this is ok to disable.

' Disable Shell Hardware Detection Service
RunWait "sc config ShellHWDetection start= disabled"

Comment: Hopefully in your virtual machine environment you are not relying on autoplay for anything.

' Disable SNMP Trap Service
RunWait "sc config SNMPTRAP start= disabled"

Comment: You could enable this for monitoring via SNMP, but likely you aren’t and this is ok to disable.

' Disable Superfetch Service
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnableSuperfetch", &H00000000, "REG_DWORD"
RunWait "sc stop SysMain"
RunWait "sc config SysMain start= disabled"

Comment: We created this script with the idea that instead of patching VMs, folks would (even in a persistent VM environment) just deploy new pristine images rather than patch and service VMs over time. Or not persist the VM past the end of a user session at all. With that in mind, this service does nothing except generate disk IO load for the individual VM.

' Disable SSDP Discovery Service
RunWait "sc stop SSDPSRV"
RunWait "sc config SSDPSRV start= disabled"

Comment: SSDP should probably not be relied upon in a corporate environment for device discovery.

' Disable Tablet PC Input Service
RunWait "sc config TabletInputService start= disabled"

Comment: Unless your VM is being fronted by a tablet this is a service that you would not need.

' Disable Telephony Service
RunWait "sc config TapiSrv start= disabled"

Comment: This service is rarely used in VDI, but if you need it, enable it.

' Disable TPM Base Services Service
RunWait "sc config TBS start= disabled"

Comment: A VM has no access to the TPM chip of a server, so we can disable this service.

' Disable UPnP Device Host Service
RunWait "sc config upnphost start= disabled"

Comment: Hopefully your corporate LAN/WAN does not rely upon uPnP for port servicing of the firewall(s).

' Disable Windows Backup Service
RunWait "sc config SDRSVC start= disabled"

Comment: We advise you to not allow users to store data on a VM but use folder redirection to corral user data. With that in mind, backups are not needed.

' Disable Windows CardSpace Service
RunWait "sc config idsvc start= disabled"

Comment: Some 3rd party applications may rely upon this but likely you can run with this disabled.

' Disable Windows Color System Service
RunWait "sc config WcsPlugInService start= disabled"

Comment: This might be needed for 3rd party graphics programs, maybe…

' Disable Windows Connect Now - Config Registrar Service
RunWait "sc config wcncsvc start= disabled"

Comment: Doubtful Windows VDI guests would need to do WPS.

' Disable Windows Defender Service
RunWait "schtasks /change /tn ""microsoft\windows Defender\MPIdleTask"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows Defender\MP Scheduled Scan"" /disable"
RunWait "sc stop WinDefend"
RunWait "sc config WinDefend start= disabled"

Comment: We are relying upon your AV vendor of choice to handle this work.

' Disable Windows Error Reporting Service
RunWait "sc config WerSvc start= disabled"

Comment: Unless you are using WER harvesting in your environment somehow this is ok to disable.

' Disable Windows Media Center Receiver Service
RunWait "sc config ehRecvr start= disabled"

Comment: This service is used for TV Tuners and FM Radio reception, probably not needed.

' Disable Windows Media Center Scheduler Service
RunWait "sc config ehSched start= disabled"

Comment: This starts and stops recording of TV shows…

' Disable Windows Media Player Network Sharing Service
RunWait "sc config WMPNetworkSvc start= disabled"

Comment: This is used to share Windows Media Player Libraries and likely not needed in a VDI environment.

' Break out Windows Management Instrumentation Service
RunWait "winmgmt /standalonehost"
RunWait "sc config winmgmt group= COM Infrastructure"

Comment: No harm by doing this, some benefit in that if WMI becomes an issue, it will be easier and quicker to troubleshoot.

'Disable Windows Search Service
If strSearch = True Then
RunWait "sc stop WSearch"
RunWait "sc config WSearch start= disabled"
End If

Comment: Disabling this completely will disable content indexing of files/email/etc. When a VM boots up for the first few times, it will spend a lot of disk and CPU time indexing with this enabled.

' Disable Wireless Zero Configuration Service
RunWait "sc config WZCSVC start= disabled"

Comment: Going on the assumption you aren’t using wireless in your VMs.

' Disable WLAN AutoConfig Service
RunWait "sc config Wlansvc start= disabled"

Comment: See above.

' Disable WWAN AutoConfig Service
RunWait "sc config WwanSvc start= disabled"

Comment: Assuming we aren’t using any WWAN devices in VDI.

' // ================
' // MACHINE SETTINGS
' // ================

' Do you want users to have the ability to use Aero themes for their desktop when connecting?
' If so, leave these two services enabled. Disabling these services will disable Aero and DWM, and
' thus disable the use of any Aero themes:
If strAero = True Then
    ' Disable Desktop Window Manager Session Manager Service
    RunWait "sc config UxSms start= disabled"
    ' Disable Themes Service
    RunWait "sc config Themes start= disabled"
End If

Comment: Script comments self explanatory

' Disable Hard disk timeouts
RunWait "POWERCFG /SETACVALUEINDEX 381b4222-f694-41f0-9685-ff5bb260df2e 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0"
RunWait "POWERCFG /SETDCVALUEINDEX 381b4222-f694-41f0-9685-ff5bb260df2e 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0"

Comment: Increase the timeouts in the likely event storage takes too long at some point.

' Disable TCP/IP / Large Send Offload
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableTaskOffload", &H00000001, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BNNS\Parameters\EnableOffload", &H00000000, "REG_DWORD"

Comment: Some Hyper-Visors do not allow access to the physical NIC for offloading.

' Disable hibernate
RunWait "powercfg -h off"

Comment: We don’t need VMs hibernating typically.

' Disable System Restore
Set objWMIService = GetObject("winmgmts:\\.\root\default")
Set objItem = objWMIService.Get("SystemRestore")
objItem.Disable("")
RunWait "schtasks /change /tn ""microsoft\windows\SystemRestore\SR"" /disable"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR", &H00000001, "REG_DWORD"

Comment: Don’t need System Restore in most VDI environments.

' Disable NTFS Last Access Timestamps
RunWait "FSUTIL behavior set disablelastaccess 1"

Comment: Disabling this will prevent Windows from writing to the file every time we read it. This will help on io load.

If strMachPass = True Then
' Disable Machine Account Password Changes
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange", &H00000001, "REG_DWORD"
End If

Comment: If we have non-persistent VMs, we don’t need the Machine account to rotate passwords.

' Disable memory dumps
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LogEvent", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\SendAlert", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\AutoReboot", &H00000001, "REG_DWORD"

Comment: In a non-persistent VM you won’t be able to collect the memory dump once it boots anyway.

' Disable default system screensaver
oShell.RegWrite "HKEY_USERS\.DEFAULT\Control Panel\Desktop\ScreenSaveActive", 0, "REG_DWORD"

Comment: Leave enabled if you want a screensaver on the VM. Better to implement this at the physical end-point though for CPU considerations.

' Increase service startup timeouts
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout", &H0002bf20, "REG_DWORD"

Comment: During a boot storm of many VMs it is likely you will time out the start of some services. This change makes that acceptable.

' Increase Disk I/O Timeout to 200 seconds.
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\TimeOutValue", &H000000C8, "REG_DWORD"

Comment: Increasing disk timeouts for boot storm and other saturation of disk I/O considerations.

' Disable Other Scheduled Tasks
RunWait "schtasks /change /tn ""microsoft\windows\Application Experience\AitAgent"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Application Experience\ProgramDataUpdater"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Autochk\Proxy"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Customer Experience Improvement Program\Consolidator"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Customer Experience Improvement Program\KernelCeipTask"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Customer Experience Improvement Program\UsbCeip"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Diagnosis\Scheduled"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Maintenance\WinSAT"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\MobilePC\HotStart"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Power Efficiency Diagnostic\AnalyzeSystem"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\RAC\RacTask"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Ras\MobilityManager"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Registry\RegIdleBackup"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\SideShow\AutoWake"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\SideShow\GadgetManager"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\SideShow\SessionAgent"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\SideShow\SystemDataProviders"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\WDI\ResolutionHost"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Windows Filtering Platform\BfeOnServiceStartTypeChange"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Windows Media Sharing\UpdateLibrary"" /disable"
RunWait "schtasks /change /tn ""microsoft\windows\Windows Backup\ConfigNotification"" /disable"

Comment: Disable a bunch of scheduled tasks we likely don’t need in a virtual environment.

' Configure Event Logs to 1028KB (Minimum size under Vista/7) and set retention to "overwrite"
Set oEventLogs = GetObject("winmgmts:{impersonationLevel=impersonate,(Security)}!//./root/cimv2").InstancesOf("Win32_NTEventLogFile")
For Each e in oEventLogs
    e.MaxFileSize = 1052672
    e.OverWritePolicy = "WhenNeeded"
    e.OverWriteOutdated = 0
    e.Put_
    e.ClearEventLog()
Next

oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Application\Retention", 0, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Security\Retention", 0, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\System\Retention", 0, "REG_DWORD"

Comment: Set event logs to 1024 KB and overwrite. This is done so we don’t consume large amounts of disk space on logging we will never see in a non-persistent VM, or rarely need to see in a persistent VM.

' Set PopUp Error Mode to "Neither"
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\ErrorMode", 2, "REG_DWORD"

Comment: Tell the Windows Error manager to not bother the end user.

' Disable bootlog and boot animation
RunWait "bcdedit /set {default} bootlog no"
RunWait "bcdedit /set {default} quietboot yes"

Comment: Speeds up boot slightly.

' Disable UAC secure desktop prompt
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop", &H00000000, "REG_DWORD"

Comment: This will force the UAC prompts to the users session.

' Disable New Network dialog
RunWait "reg add HKLM\SYSTEM\CurrentControlSet\Control\Network\NewNetworkWindowOff"

Comment: Very unlikely we would be presented with a new network.

' Disable AutoUpdate of drivers from WU
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching\searchorderConfig", 0, "REG_DWORD"

Comment: Disable Windows Updates. We want a strong managed single ‘gold’ image of Windows that we boot from, new and fresh every month.

' Turn off Windows Gadget Platform, Media Center, Tablet PC Components, Windows DVD Maker, and Windows SideShow
RunWait "dism /online /Disable-Feature /FeatureName:WindowsGadgetPlatform /NoRestart"
RunWait "dism /online /Disable-Feature /FeatureName:MediaCenter /NoRestart"
RunWait "dism /online /Disable-Feature /FeatureName:TabletPCOC /NoRestart"
RunWait "dism /online /Disable-Feature /FeatureName:OpticalMediaDisc /NoRestart"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Sideshow\Disabled", 1, "REG_DWORD"

Comment: No DVD on a VM, don’t need slideshow, or the other items, in a typical VM. Unless your enterprise is using gadgets.

' Disable IE First Run Wizard and RSS Feeds
oShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize", 1, "REG_DWORD"

Comment: Make things easier on the end user

' Disable the ability to clear the paging file during shutdown
oShell.RegWrite "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\ClearPageFileAtShutdown", 0, "REG_DWORD"

Comment: This causes a long delay at shutdown and shouldn’t be necessary in a secure data center VDI environment.

' Perform a disk cleanup
' Automate by creating the reg checks corresponding to "cleanmgr /sageset:100" so we can use "sagerun:100"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Active Setup Temp Folders\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Downloaded Program Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Internet Cache Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Memory Dump Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Offline Pages Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Old ChkDsk Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Previous Installations\StateFlags0100", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Recycle Bin\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Setup Log Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\System error memory dump files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\System error minidump files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Setup Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Thumbnail Cache\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Upgrade Discarded Files\StateFlags0100", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Archive Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Queue Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting System Archive Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting System Queue Files\StateFlags0100", &H00000002, "REG_DWORD"
oShell.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Upgrade Log Files\StateFlags0100", &H00000002, "REG_DWORD"
RunWait "cleanmgr.exe /sagerun:100"

Comment: Cleaning up various files that aren’t needed to reduce disk footprint.

' // =============
' // USER SETTINGS
' // =============

' Reduce menu show delay
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\MenuShowDelay", "0", "REG_SZ"

Comment: Speed up Menu for the user.

' Disable cursor blink
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\CursorBlinkRate", "-1", "REG_SZ"
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\DisableCursorBlink", &H00000001, "REG_DWORD"

Comment: Make the cursor always show. If it blinks while they are connected remotely, network jitter and packet loss could hide the cursor temporarily.

' Force off-screen composition in IE
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Force Offscreen Composition", &H00000001, "REG_DWORD"

Comment: This is to help with rich video content rendering not flickering through terminal session.

' Disable screensavers
oShell.RegWrite "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaveActive", "0", "REG_SZ"
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveActive", "0", "REG_SZ"
oShell.RegWrite "HKEY_USERS\.DEFAULT\Control Panel\Desktop\ScreenSaveActive", "0", "REG_SZ"

Comment: We don’t need screen savers on the VMs eating CPU.

' Don't show window contents when dragging
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\DragFullWindows", "0", "REG_SZ"

Comment: This reduces the video that needs to be rendered over network.

' Don't show window minimize/maximize animations
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\MinAnimate", "0", "REG_SZ"

Comment: See above

' Disable font smoothing
oShell.RegWrite "HKEY_CURRENT_USER\Control Panel\Desktop\FontSmoothing", "0", "REG_SZ"

Comment: Reduces CPU load a little and shouldn’t be needed.

' Disable most other visual effects
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\VisualFXSetting", &H00000003, "REG_DWORD"
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarAnimations", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewWatermark", &H00000000, "REG_DWORD"
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow", &H00000000, "REG_DWORD"
RegBinWrite "HKEY_CURRENT_USER\Control Panel\Desktop", "UserPreferencesMask", "90,12,01,80"

Comment: Trying to reduce the pain of working through a remote session for the user.

' Disable Action Center
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth", &H00000001, "REG_DWORD"

Comment: Probably don’t need the action center bothering our users in a controlled environment.

' Disable IE Persistent Cache
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Persistent", 0, "REG_DWORD"
oShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Feeds\SyncStatus", 0, "REG_DWORD"

Comment: Set cache to not persist.

' Done
WScript.Quit

' // ================
' // HELPER FUNCTIONS
' // ================

Function Run(sFile)
Run = oShell.Run(sFile, 1, False)
End Function

Function RunWait(sFile)
RunWait = oShell.Run(sFile, 1, True)
End Function

Function RunWaitHidden(sFile)
RunWaitHidden = oShell.Run(sFile, 0, True)
End Function

Function IsServer()
    IsServer = False
    On Error Resume Next
    For Each objOS in GetObject("winmgmts:").InstancesOf ("Win32_OperatingSystem")
        If objOS.ProductType = 1 Then IsServer = False
        If objOS.ProductType = 2 Or ObjOS.ProductType = 3 Then IsServer = True
    Next
End Function

Sub RegBinWrite (key, value, data)
key = "[" & key & "]"

    If value <> "@" then
        value = chr(34) & value & chr(34)
    End if

valString = value & "=" & "hex:" & data

    tempFile = GetTempDir() & "\regbinaryimport.reg"
    Set txtStream = oFSO.CreateTextFile(tempFile,true)
    txtStream.WriteLine("Windows Registry Editor Version 5.00")
    txtStream.WriteLine(key)
    txtStream.WriteLine(valString)
    txtStream.Close

oShell.Run "regedit.exe /s """ & tempFile & """", 1, true

oFSO.DeleteFile tempFile
End Sub

Function GetTEMPDir()
    GetTEMPDir = oEnv("TEMP")
    If InStr(GetTEMPDir, "%") Then
        GetTEMPDir = oShell.ExpandEnvironmentStrings(GetTEMPDir)
    End If
End Function

Download this KB now!

Posted over 1 year ago

by

Jeff Stokes

16 Comments

And test it first please.

An enterprise hotfix rollup is available for Windows 7 SP1 and Windows Server 2008 R2 SP1

http://support.microsoft.com/kb/2775511

This is a collection of the various updates we kept (we being PFEs who do WDRAP in particular) and Yong Rhee published for us, like http://blogs.technet.com/b/yongrhee/archive/2012/02/19/list-of-performance-hotfixes-post-sp1-for-windows-7-sp1.aspx.

This is now a Rollup for Enterprises. It is not in Windows Update, but is in the Catalog here:

http://catalog.update.microsoft.com/v7/site/Search.aspx?q=2775511

Most customers should see a minute or more reduced from boot, and a more peppy system, as a result.

This was a great collaborative effort amongst CTS, WINSE, PFE and MCS. A huge thanks to everyone involved.

Jeff Stokes

“The Dude”

Anti-Virus Exclusions and You!

Posted over 4 years ago

by

Jeff Stokes

7 Comments

So there is some amount of confusion on what exclusions are needed for various Microsoft products. This blog is not necessarily meant to be a definitive list, but is a compilation, a list, of KB articles that point to the various products and their individual guidance on AV exclusions.

A special shout-out to Aaron Ellison for compiling this list internally! Go team PFE!

(social wiki has a dynamic list that may be more updated here:

http://social.technet.microsoft.com/wiki/contents/articles/953.aspx)

Enterprise Configuration Recommendations:

http://support.microsoft.com/kb/822158

Forefront Configuration:

http://support.microsoft.com/kb/943556

Forefront:

http://support.microsoft.com/kb/943620

http://technet.microsoft.com/en-us/library/cc707727.aspx

Windows / Active Directory:

http://support.microsoft.com/kb/822158