Creating a new Windows profile on Windows 10 (or Windows 8, Windows 7, or Vista)

This is what I consider best practice for creating a new Windows profile on Windows 10.  Typically, I do this if I think the Windows profile is corrupt in some way and I think a new profile will solve the problem.  All of this assumes that you have the user's log in password.

Step 1: Note the default printer and default browser for the existing profile (or any other things that may be unique to the profile, but those are the two big ones).  You might note which programs have been logged in with credentials you don't have as well - Dropbox, Google Drive, Skype, etc

Step 2: Log in with an account that has local administrator privileges.

Step 3: Edit the registry and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Look at the various keys in there and find the one with the value that you want to delete.  For example, in the screen shot below, the value c:\users\dave is in the key that begins with S-1-15-21.  You delete the entire entry that begins with S-1-15-21.

Step 4: Rename the profile that is going to be deleted.  In this example, I'd rename c:\users\dave to c:\users\dave-old

Step 5: Reboot and then log in as the user.  You'll find a brand new profile is created and you can access all the old data in the renamed profile from step 4.

Step 6: Set up the profile as needed including, but not limited to:
1) set up Outlook
2) move back data from old profile to new profile:
 a) desktop
 b) documents
 c) all the other stuff that is in c:\users\%username%
3) set up backup
4) set up VPN
5) add back signature using old sent items

6) add printers (if necessary) and set correct default printer

7) restore browser settings

8) Remind the user that he/she will need to log in to services you don't have the password to (Dropbox, Skype, Google Drive, etc)

removing Windows 10 notification

Option 1:
I created a file that will adjust four registry entries to disable the Windows 10 Upgrades here:
http://www.t-solve.com/software/Disable-Win10.reg

Save that file and run it.

Option 2:
Manually make the adjustments below (credit to the resources comes from here):

1. Type regedit in RUN or Start search box and press Enter. It'll open Registry Editor.

2. Now go to following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

3. Create a new key under Windows key and set its name as GWX

So the final key path would be:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GWX

4. Now select GWX key and in right-side pane create a new DWORD DisableGWX and set its value to 1

---

1. Again in Registry Editor, go to following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

2. Create a new key under Windows key and set its name as WindowsUpdate

So the final key path would be:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

3. Now select WindowsUpdate key and in right-side pane create a new DWORD DisableOSUpgrade and set its value to 1

---

1. Again in Registry Editor, go to following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade

2. In right-side pane, look for two DWORDs AllowOSUpgrade and ReservationsAllowed and change their values to 0

putting text screen saver with specified text on all machines via group policy

A client asked me to put a text based screen saver on all domain computers.  I did this through Group Policy Management.

Creating the group policy to enable the screen saver was easy.  Interestingly, the personalization option did not exist on my Windows 2008 R1 SP 2 server, so I had to make the changes in on my Server 2012 DC.  The changes to initiate the screen saver were here:

user config> admin templates> control Panel/personalization

This was easy, but what it didn't do was set the text.  I found the best way to set the text was via forcing a registry change on each machine that I could push down via group policy (creating a .reg file that is applied on login).

I applied the registry change using the "easy way" as described here:
http://blogs.technet.com/b/askds/archive/2007/08/14/deploying-custom-registry-changes-through-group-policy.aspx

And then I created the .reg file more or less using these instructions: http://www.winhelponline.com/articles/11/1/Customizing-the-SSText3D-screensaver-before-applying-it-to-the-Logon-desktop.html

I made the changes on my own machine and exported the appropriate registry hive (not a single key - but the entire hive of:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d]

And that did it.

Fixing the DNS poisoning patch (MS08-037) on SBS 2003

I found a server that had no ability to interact on the network after a reboot. The IPSec service was stopped and would not start (error 10048). After troublehsooting, I found this - which someone else referred to as the DNS poisoning patch. Making the registry changes solved the issue:

http://blogs.technet.com/sbs/archive/2008/07/17/some-services-may-fail-to-start-or-may-not-work-properly-after-installing-ms08-037-951746-and-951748.aspx

Add these items to:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ReservedPorts

1433-1434
1745-1745
1080-1080
1720-1720
3343-3343
1645-1646
1701-1701
1812-1813
2883-2883
4500-4500

Of note, on another server, without making any changes, I saw this superset list of ports in that registry key:
1433-1434
1801-1801
1745-1745
1080-1080
1720-1720
3343-3343
1434-1434
1645-1646
1701-1701
1755-1755
1812-1813
1900-1900
2460-2460
2535-2535
2701-2704
2883-2883
3527-3527
4011-4011
4500-4500
5004-5005

Live OneCare for computer optimization

I've always looked for easy wasy to optimize systems.  Usually, it just consisted of removing unnecessary items from msconfig.

But when researching the conficker worm, I came across Live OneCare's virus scanner which also does some registry optmization, which I will incorporate into my computer optimization routines.

The Live OneCare routine needs to be run out of IE and is located here:

http://onecare.live.com/site/en-us/default.htm

uninstall TrendMicro Messaging Suite Client without the password

I loathe the Trend Micro Messaging Suite. But I had an instance today where I had to uninstall the client version of the program from a laptop. The thing about this program is that it requires the Trend Micro administrator's password to uninstall it. This was put in place by someone else, so I didn't have it. I found this trick to having it not ask for the password:

Find HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc. and set "Allow Uninstall" = 1