Category Archives: IT Tips

Reading a memory.dmp or other .dmp file

This can be accomplished with 7 easy steps:

Step 1. Obtain and install the debugging tools.

Debugging Tools Windows

All you need to install is the “Install Debugging Tools for Windows as a Standalone Component (from Windows SDK)” and during the install only select “Debugging Tools for Windows”. Everything else is used for more advanced troubleshooting or development, and isn’t needed here. Today I followed the link to “Install Debugging Tools for Windows as a Standalone Component (from Windows SDK)” although for a different OS you may need to follow a different link.

Step 2. From an elevated command prompt navigate to the debugging folder. For me with the latest tools on Windows Server 2012 it was at C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\. You can specify the path during the install.

Step 3. Type the following:

kd –z C:\Windows\memory.dmp (or the path to your .dmp file)

Step 4. Type the following:

.logopen c:\debuglog.txt

Step 5. Type the following:

.sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols

If you computer can’t connect to internet, you can download the symbols from below link:

https://developer.microsoft.com/en-us/windows/hardware/download-symbols

Step 6. Type the following:

.reload;!analyze -v;r;kv;lmnt;.logclose;q

Step 7. Review the results by opening c:\debuglog.txt in your favorite text editor. Searching for PROCESS_NAME: will show which process had the fault. You can use the process name and other information from the dump to find clues and find answers in a web search. Usually the fault is with a hardware drivers of some sort, but there are many things that can cause crashes so the actual analyzing of the dump may take some research.

Often times a driver update will fix the issue. If the summary information doesn’t offer enough information then you’ll need to dig further into the debugging tools or open a CSS case with Microsoft. The steps above will provide you with a summary mostly-human-readable report from the dump. There is much more information available in the memory dump although it gets exponentially more difficult to track down the details the further you get into windows debugging.

Hopefully these quick steps are helpful for you as you troubleshoot the unwelcome BSOD.

Use CNTML to pass through NTML proxy

Lots of company require end users to use a proxy to access internet. Some of them are using NTML proxy such as ISA. But some software such as Xshell, putty are not supporting NTML proxy.
So we can use CNTML to pass through NTML proxy.

Official website:http://sourceforge.net/projects/cntlm/
You can also refer to wiki:http://sourceforge.net/apps/mediawiki/cntlm/index.php?title=Main_Page

1. Download CNTML. I suggest to download the zip version due to users may not have admin rights.
2. Unzip it.
3. Modify configuration file cntlm.ini,Please note that the password is in plain text and it’s a security risk:

Username: Your domain username
Domain: Your domain name
Password : Your domain password. (It seems that if you have # in your password, you may get some problem)
Proxy : You NTML proxy address, such as 10.0.0.1:8080
Listen cntlm: By default it’s 3128

4. Create a shortcut for cntlm.exe, and then right click the shortcut, choose property. And add ” -c cntlm.ini” at the end of target. Otherwise CNTML will try to laod the configuration files in C:\Program Files\cntlm中的cntlm.ini, and you’ll get an error.
5.Double click the shortcut to start CNTML. And then open task manager, you can find that cntml is running.
6. In Xshell, create a new proxy which is 127.0.0.1:3128

Fix”Video Schedule Internal Error”blue screen problem

I just set up a new Z170/6700K machine which is running windows 10. But I always got the blue screen with error message Video_Schedule_Internal_Error.

bluescreen

After investigation, I found that this problem was caused by the latest Intel Video card driver win64_15407.4279.
The workaround is to change the shared memory settings for the Intel Video card. You need to assign 128M memory for per 8G memory. It means:

If you have 8G memory, assign 128M memory for the Video card;
If you have 16G memory, assign 256M memory for the Video card;
If you have 32G memory, assign 512M memory for the Video card;

Exclude certain Office programs when deploying Office 365 / Office 2016

1, Download Office 2016 Deployment Tool
https://www.microsoft.com/en-us/download/details.aspx?id=49117

2, create a configuration.xml similar to below

<Configuration>

      <Add SourcePath="F:" OfficeClientEdition="64" >
        <Product ID="ProplusRetail">
          <Language ID="en-us" />
          <ExcludeApp ID="Access" />
          <ExcludeApp ID="Groove" />
          <ExcludeApp ID="InfoPath" />
          <ExcludeApp ID="Lync" />
          <ExcludeApp ID="Outlook" />
          <ExcludeApp ID="Project" />
          <ExcludeApp ID="Publisher" />
          <ExcludeApp ID="SharePointDesigner" />
           <ExcludeApp ID="Visio" />
        </Product>
      </Add>
</Configuration>

3. Put the configure file in the same folder with deployment tool, then run below command as administrator:

setup.exe /configure configuration.xml

Done

Please note you need to modify Product ID to match the version you purchased,
For office 2016, use Product ID=”ProplusRetail”;
For office 365, use Product ID=”O365ProPlusRetail”

Remove / Uninstall OneDrive in Windows 10

1. Run CMD as administrator, and then kill OneDrive process

    taskkill /f /im OneDrive.exe

2. Uninstall OneDrive for 32bit Windows 10

    %SystemRoot%System32OneDriveSetup.exe /uninstall

3. Uninstall OneDrive for 64bit Windows 10

    %SystemRoot%SysWOW64OneDriveSetup.exe /uninstall

4. Delete OneDrive folder

    rd "%UserProfile%OneDrive" /Q /S
    rd "%LocalAppData%MicrosoftOneDrive" /Q /S
    rd "%ProgramData%Microsoft OneDrive" /Q /S
    rd "C:OneDriveTemp" /Q /S

5. Delete registry keys for OneDrive.

    REG Delete "HKEY_CLASSES_ROOTCLSID{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f
    REG Delete "HKEY_CLASSES_ROOTWow6432NodeCLSID{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f