MyComputingArt

How to restore user profile

While I was logging on from a remote console through RDP I've got a message telling me that the user profile is damaged. I was able to log on and I lost all the settings: desktop, menu and all the settings of the various applications, as if my user had just been created; that means, the user registry was corrupted and it has been replaced with the default user registry.

Event Viewer reported these error messages:

DETAIL - The process cannot access the file because it is being used by another process. for C:\Documents and Settings\Z24\ntuser.dat

Windows has backed up this user's profile. Windows will automatically try to use the backed up profile the next time this user logs on.

Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

I don't know what would have happened logging off and on again (the original profile would have been restored automatically?), by the way I recovered it this way:

I created a new user, just to be sure to be able to logon if something went bad
I rebooted into linux
I copied the user registry file C:\System Volume Information\_restore{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\RPyy\snapshot\_REGISTRY_USER_NTUSER_S-z-z-zz-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzz-zzzz to C:\Documents and Settings\USERNAME\ntuser.dat:
the x's in the restore path are hex digits and yy is a number: the exact restore path where to look in should be the one with the most recent date and time before the date and time of the unsuccessful logon, i.e. yesterday's date if the error happened at today's first logon;
S-z-z-zz... is the user's SID (see how to associate username and SID);
and USERNAME is the username
I also copied the file _REGISTRY_USER_USRCLASS_S-z-z-zz-zzzzzzzzzz-zzzzzzzzzz-zzzzzzzzz-zzzz from the same path to C:\Documents and Settings\USERNAME\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

At the next logon my windows settings and my applications settings came back!

Posted by: Z24 | Thu, Aug 21 2008 | Category: /windows | Permanent link | home
Tagged as: howto, windows, xp

How to associate username and SID

To know which is the username associated with a known SID (Security Identifier), open the registry (regedit.exe) at this location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.

Registry editor with SID keys (62k)

Each SID key has a ProfileImagePath string whose value is the user path which contains the username.
To know which is the SID associated with a known username, select the ProfileList key and search the username.

There is also a SysInternals command-line utility which shows the SID associated with a known username:

C:\>psgetsid Z24

PsGetSid v1.43 - Translates SIDs to names and vice versa
Copyright (C) 1999-2006 Mark Russinovich
Sysinternals - www.sysinternals.com

SID for WAM2\Z24:
S-1-5-21-1993962763-2139871995-725345543-1003

or the username associated with a known SID:

C:\>psgetsid S-1-5-21-1993962763-2139871995-725345543-1003

PsGetSid v1.43 - Translates SIDs to names and vice versa
Copyright (C) 1999-2006 Mark Russinovich
Sysinternals - www.sysinternals.com

Account for WAM2\S-1-5-21-1993962763-2139871995-725345543-1003:
User: WAM2\Z24

Posted by: Z24 | Thu, Aug 21 2008 | Category: /windows | Permanent link | home
Tagged as: command-line, howto, windows, xp

Launching control panel dialogs from command line

It is possible to directly open the control panel configuration dialogs writing commands in the Run dialog or in a dos prompt window:

control command in Run dialog (10k)
control admintools: open Administrative Tools
control date/time: open the Date and Time properties
control desktop: open the Display properties
control color: open the Display properties and go to Appearance tab
control folders: open Folder Options
control fonts: open the Fonts properties
control infrared: open the Infrared properties
control keyboard: open the Keyboard properties
control mouse: open the Mouse properties
control netconnections: open Network Connections
control telephony: open Phone and Modem Options
control printers: open the Printers properties
control international: open the Regional Settings
control schedtasks: open the Scheduled tasks
control userpasswords: open the User Accounts properties
control userpasswords2: open the Advanced User Accounts properties
control: open the control panel

If the "Safely Remove Hardware" icon disappears, the control command can help:
control hotplug.dll: open the "Safely Remove Hardware" window

Every *.cpl file in the Windows directory can be opened with the control cplfile command:
control vp7dec_settings.cpl: open the On2 VP7 Decompressor Settings, if VP7 codec is installed.

Moreover, some cpl files accept two arguments:
control cplfile[,[@first][,second]]: the first argument indicates the function (if a cpl file controls multiple functions), the second argument indicates the tab of the window to display.
control main.cpl,@0,2: show the 3rd tab of the mouse properties (main.cpl controls mouse and keyboard, @0 is for mouse properties, 2 is the 3rd tab)
control main.cpl,@1,0: show the 1st tab of the keyboard properties (@1 is for kbd properties, 0 is the 1st tab)

Posted by: Z24 | Fri, Sep 21 2007 | Category: /windows | Permanent link | home
Tagged as: command-line, windows, xp

Windows Remote Desktop (RDP)

Windows Remote Desktop allows to remotely get a Windows session on a Windows XP/2000/2003 machine on which it is enabled from any machine running the RDP client: the RDP client asks the name of the machine and the user and password and then the client opens a window showing the desktop of the server machine.
I'll show:

See full post ...

Posted by: Z24 | Sat, Sep 15 2007 | Category: /windows | Permanent link | home
Tagged as: client-server, rdp, security, software, vnc, windows, xp

Accessing and changing the registry from outside Windows

Problem: I got myself locked out of my pc
Solution: access the registry from outside Windows and change the account lockout settings

After enabling Remote Desktop access to access from my notebook to my pc through my wireless LAN, I was playing around with account locking settings to defend from possible brute force attacks coming through the WLAN (supposing the attacker cracked the WPA-PSK password): I set the lock so that after two failed attempts to login the account would be locked until the administrator (me) unlocks it manually.
I wanted to adopt such a security measure for RDP access only, but unfortunately the account lockout policy is valid for any login attempt, being it local or remote.
Then, as a slight security measure, I also disabled the administrator user (my user is already an administrator and an attacker should also find a valid username).
I mistyped the password twice and I got myself stuck: administrator and guest were disabled and my account was locked.
After rebooting, at the logon screen there were no more users, so that the "To begin, click your username" sentence on the left sounded like a joke, having absolutely nothing on the right.

The solution was obvious:

try to access and change the registry from linux (I have dual boot)
manually restore a previous version of the registry

I solved using Offline NTPassword & Registry Editor, an offline regitry editor on a boot disk; I made the floppy, rebooted and then I started looking in the registry the affecting keys, but it was not necessary: there's a feature to edit the accounts, and that allowed me to enable the administrator.

I also found dumphive, a useful program to dump the registry hives to text files.

Instead on www.beginningtoseethelight.org there's plenty of Windows NT, 2000 and XP low level settings and hacks, I would say "all about the registry": for instance, where and how users and passwords, including account statistics and policies, are stored and encoded in the SAM hive of the registry, and a schematic explanation of the registry structure; and don't miss the other sections of the site, they're enlightening too.
About the second option, there's a Microsoft article that explains how to manually restore the registry to a previous state.

Posted by: Z24 | Fri, Apr 20 2007 | Category: /windows | Permanent link | home
Tagged as: system recover, windows, xp

Debian on Windows with VMWare, Linux applications in Windows using X server

With this little and very simple tutorial I will explain what I did to:

install VMWare for Windows
run Debian virtual appliance
connect from Windows host to Linux guest and connect from Linux guest to Windows host
run seamless Linux applications in the Windows graphical environment using an X server

See full post ...

Posted by: Z24 | Mon, Oct 09 2006 | Category: /windows | Permanent link | home
Tagged as: client-server, linux, security, virtualization, VMWare, windows

Ubuntu 6.06 Dapper Drake 32 bit on Windows XP with Qemu, Qemu networking, Linux applications in Windows using X server

With this little tutorial I will explain what I did to:

install Qemu and its accelerator kqemu
create an image file where the guest operating system will be installed
install and then run Ubuntu 6.06 Dapper Drake 32 bit as a guest operating system
connect from Windows host to Linux guest with qemu redir option
connect from Windows host to Linux guest and connect from Linux guest to Windows host using tap driver
run seamless Linux applications in the Windows graphical environment using an X server

See full post ...

Posted by: Z24 | Sat, Sep 16 2006 | Category: /windows | Permanent link | home
Tagged as: client-server, linux, qemu, virtualization, windows, xp

Install and boot Windows on a second hard disk

I have a SATA disk and a EIDE disk, I installed Linux on the SATA disk and now I want to install Windows on the EIDE disk.
Because Windows must be installed on the disk that boot first, I entered BIOS and changed the boot order as this:
cdrom
EIDE disk
SATA disk
Then I installed Windows on the EIDE disk.
I want to configure dual boot this way:

default choice: Linux (booting from SATA disk)
second choice: Windows (booting from EIDE disk)

I changed BIOS boot order as it was previously (SATA disk before EIDE disk) and booted Linux, then I added these lines to /boot/grub/menu.list (on Ubuntu or Debian; if grub is not installed try apt-get install grub):

title WinXP
map (hd0,0) (hd1,0)
map (hd1,0) (hd0,0)
rootnoverify (hd1,0)
chainloader +1

That means Windows believes the EIDE disk is the first and SATA is the second, so it's happy and if I reboot and choose WinXP from grub menu it starts.

Posted by: Z24 | Wed, Aug 30 2006 | Category: /windows | Permanent link | home
Tagged as: grub, linux, windows

http://www.mycomputingart.com/

To contact the webmaster and author write to: info<at>mycomputingart<dot>com
© mycomputingart.com, year(today()).