Hi All,

Win 10 home 21H2 & 22H2

I worked on a customer yesterday with major
performance issues. I fixed!

One of the issues was a `jump 0` problem (dog
chasing his tail) trying to update from 21H2
to 22H2. 100% disk usage. I manually upgraded
him to 22H2 from ISO and that fixed that (the
disk 100%).

His antivirus ran all the way through
his hard drive without issue either. I did
remove about 40 pieces of junkware -- shhhheesh.
His hard drive passed diagnostics too. Fast
startup was off and I got a couple of nice
reboots too.

But what I find odd still is that under 21H2,
`sfc /scannow` froze at 40%. And under 22H2 it
froze at 10%. Weird.

Other than that, the dead came back to life and
his computer is running quite nicely.

You guys have any thoughts on the sfc matter?

Many thanks,
-T

On 5/24/2023 4:26 AM, T wrote:
> Hi All,
>
> Win 10 home 21H2 & 22H2
>
> I worked on a customer yesterday with major
> performance issues.  I fixed!
>
> One of the issues was a `jump 0` problem (dog
> chasing his tail) trying to update from 21H2
> to 22H2.  100% disk usage.  I manually upgraded
> him to 22H2 from ISO and that fixed that (the
> disk 100%).
>
> His antivirus ran all the way through
> his hard drive without issue either.  I did
> remove about 40 pieces of junkware -- shhhheesh.
> His hard drive passed diagnostics too.  Fast
> startup was off and I got a couple of nice
> reboots too.
>
> But what I find odd still is that under 21H2,
> `sfc /scannow` froze at 40%.  And under 22H2 it
> froze at 10%.  Weird.
>
> Other than that, the dead came back to life and
> his computer is running quite nicely.
>
> You guys have any thoughts on the sfc matter?
>
> Many thanks,
> -T
>

Well, the online help is not helping.

You can see the developers have never had to deal
with a "problem" with their creation.

*******

PS C:\ > sfc /?

Microsoft (R) Windows (R) Resource Checker Version 6.0
Copyright (C) Microsoft Corporation. All rights reserved.

Scans the integrity of all protected system files and replaces incorrect versions with
correct Microsoft versions.

SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
[/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory> [/OFFLOGFILE=<log file path>]]

/SCANNOW Scans integrity of all protected system files and repairs files with
problems when possible.
/VERIFYONLY Scans integrity of all protected system files. No repair operation is
performed.
/SCANFILE Scans integrity of the referenced file, repairs file if problems are
identified. Specify full path <file>
/VERIFYFILE Verifies the integrity of the file with full path <file>. No repair
operation is performed.
/OFFBOOTDIR For offline repair, specify the location of the offline boot directory
/OFFWINDIR For offline repair, specify the location of the offline windows directory
/OFFLOGFILE For offline repair, optionally enable logging by specifying a log file path

e.g.
sfc /SCANNOW
sfc /VERIFYFILE=c:\windows\system32\kernel32.dll
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows /OFFLOGFILE=c:\log.txt
sfc /VERIFYONLY

*******

That means we get Procmon running, then filter on SFC later on,
and see where it stops. Perhaps Windows Defender or Tamper Proofing
setting are a problem ?

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

*******

from Reddit, I get:

"I know it sounds dumb, but try hitting enter a few times.
I've had scans get stuck until I do that."

Perhaps for an online scan, it is doing some network activity,
and it is stalled as it waits for a missing resource on the
server end.

Modern ProcMon, now includes the logging of
networking events. The only problem with this, is the network
identifiers in the listing, are things like "Akamai" and this is
generally useless for any forensic class work. If all the sooper
sekret Microsoft internal IPs end up as "Akamai" (a CDN), the situation
is hopeless. That's what happened the first time I needed that. You
can use Wireshark (but only for the simpler things in life).

Paul

T wrote:
> Hi All,
>
> Win 10 home 21H2 & 22H2
>
> I worked on a customer yesterday with major
> performance issues.  I fixed!
>
> One of the issues was a `jump 0` problem (dog
> chasing his tail) trying to update from 21H2
> to 22H2.  100% disk usage.  I manually upgraded
> him to 22H2 from ISO and that fixed that (the
> disk 100%).
>
> His antivirus ran all the way through
> his hard drive without issue either.  I did
> remove about 40 pieces of junkware -- shhhheesh.
> His hard drive passed diagnostics too.  Fast
> startup was off and I got a couple of nice
> reboots too.
>
> But what I find odd still is that under 21H2,
> `sfc /scannow` froze at 40%.  And under 22H2 it
> froze at 10%.  Weird.
>
> Other than that, the dead came back to life and
> his computer is running quite nicely.
>
> You guys have any thoughts on the sfc matter?
>
> Many thanks,
> -T
>
Did you use updated media for the ISO?
The Microsoft 22H2/21H2 MCT/Visual Studio/etc. routes(for Win11/Win10)
for creating USB/DVD/ISO was updated this month(May 2023) with new code
for a staged deployment of addressing a Secure Boot vulnerability.

<https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/>

Quick Summary:
Update Boot Media, image after applying May 2023 cumulative update,
after applying the May update use updated boot media(USB/DVD/ISO) for
installation/re-installation/repair.

Further info see:
<https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/>
then read
<https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d>

For your sfc issue:
Don't run sfc unless its known that the Windows Image and Component
store *do not* need restoring Health and Component Cleanup.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

DISM /Online /Cleanup-Image /AnalyzeComponentStore
DISM /Online /Cleanup-Image /StartComponentCleanup

Note: After 'fixing' anything always run the Check, Scan, Analyze DISM
commands.

Finally, the use of an ISO[1] has a long history of successfully
updating a feature update upgrade when other routes(Windows Update,
Online Upgrade/Update Assistant and MCT USB/DVD routes fail).

[1] Especially when the expanded/extracted ISO files(after mounting) are
copied to a new folder on the Windows partition(or spare internal drive
partition), unmount the ISO and then run setup.exe from that folder
**instead of the mounted ISO**! i.e. Don't run the ISO mounted as a
virtual drive. Once upgraded, delete the ISO folder.

--
....w¡ñ§±¤ñ

On 5/24/23 13:15, Paul wrote:
> Perhaps for an online scan, it is doing some network activity,
> and it is stalled as it waits for a missing resource on the
> server end.
Thumped return a bunch, ctrl-c, cuss words or two etc.
I have seen this issue with installing Dot Net
years ago. If I had a USB flash drive that was
read only, the installer would lock (with regular
read/write, you could see the installer scanning
the stupid flash drive's led). This customer
had about five USB flash drives showing. Since
I was remoted in, I could to remove them.
So I wonder ...

On 5/24/23 14:43, ...winston wrote:
> T wrote:
>> Hi All,
>>
>> Win 10 home 21H2 & 22H2
>>
>> I worked on a customer yesterday with major
>> performance issues.  I fixed!
>>
>> One of the issues was a `jump 0` problem (dog
>> chasing his tail) trying to update from 21H2
>> to 22H2.  100% disk usage.  I manually upgraded
>> him to 22H2 from ISO and that fixed that (the
>> disk 100%).
>>
>> His antivirus ran all the way through
>> his hard drive without issue either.  I did
>> remove about 40 pieces of junkware -- shhhheesh.
>> His hard drive passed diagnostics too.  Fast
>> startup was off and I got a couple of nice
>> reboots too.
>>
>> But what I find odd still is that under 21H2,
>> `sfc /scannow` froze at 40%.  And under 22H2 it
>> froze at 10%.  Weird.
>>
>> Other than that, the dead came back to life and
>> his computer is running quite nicely.
>>
>> You guys have any thoughts on the sfc matter?
>>
>> Many thanks,
>> -T
>>
> Did you use updated media for the ISO?
> The Microsoft 22H2/21H2 MCT/Visual Studio/etc. routes(for Win11/Win10)
> for creating USB/DVD/ISO was updated this month(May 2023) with new code
> for a staged deployment of addressing a Secure Boot vulnerability.
>
> <https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/>
>
> Quick Summary:
>  Update Boot Media, image after applying May 2023 cumulative update,
> after applying the May update use updated boot media(USB/DVD/ISO) for
> installation/re-installation/repair.
>
> Further info see:
> <https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/>
> then read
> <https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d>
>
> For your sfc issue:
>  Don't run sfc unless its known that the Windows Image and Component
> store *do not* need restoring Health and Component Cleanup.
>
> DISM /Online /Cleanup-Image /CheckHealth
> DISM /Online /Cleanup-Image /ScanHealth
> DISM /Online /Cleanup-Image /RestoreHealth
>
> DISM /Online /Cleanup-Image /AnalyzeComponentStore
> DISM /Online /Cleanup-Image /StartComponentCleanup
>
> Note: After 'fixing' anything always run the Check, Scan, Analyze DISM
> commands.
>
> Finally, the use of an ISO[1] has a long history of successfully
> updating a feature update upgrade when other routes(Windows Update,
> Online Upgrade/Update Assistant and  MCT USB/DVD routes fail).
>
> [1] Especially when the expanded/extracted ISO files(after mounting) are
> copied to a new folder on the Windows partition(or spare internal drive
> partition), unmount the ISO and then run setup.exe from that folder
> **instead of the mounted ISO**!  i.e. Don't run the ISO mounted as a
> virtual drive.  Once upgraded, delete the ISO folder.
After I figured out I was dealing with a jmp 0 from
the 22H2 auto update and the sfc froze on me, I
did a
dism /Online /cleanup-image /revertpendingactions
Reboot and no symptom change. Hard Drive was back
at 100%.
I downloaded the ISO with the Media Creation Tool.
When I went to manually mount the ISO, I found that
"mount" did not exist on the right click context menu.
Hmmmm. So I used the power shell as admin method:
--> Power shell as administrator
--> Mount-DiskImage -ImagePath "PATH\TO\ISOFILE"
Note that you have to enter the whole stinkin' path.
For example:
Mount-DiskImage -ImagePath c:\Drivers\Microsoft\Windows-22H2.iso
I do believe, if I remember, that the iso mounted as
drive E:
I did not try to fix the mount context problem as I
was about install a whole new build.
After 22H2 when on without issue, I never when back
and double checked the right click context issue.
The customer still cuts CD's and he adore Roxio's
cutter. That was the default on the context menu.
Maybe the had something to do with the missing "mount".
And maybe all the extra flash drives he had mounted had something to do
with the sfc freeze up.
Anyway, I stopped troubleshooting as his computer
came back to life and was running rather nicely
after the build update and all the clean up I did.

On 5/24/2023 8:05 PM, T wrote:
> On 5/24/23 13:15, Paul wrote:
>> Perhaps for an online scan, it is doing some network activity,
>> and it is stalled as it waits for a missing resource on the
>> server end.
>
> Thumped return a bunch, ctrl-c, cuss words or two etc.
>
> I have seen this issue with installing Dot Net
> years ago.  If I had a USB flash drive that was
> read only, the installer would lock (with regular
> read/write, you could see the installer scanning
> the stupid flash drive's led).  This customer
> had about five USB flash drives showing.  Since
> I was remoted in, I could to remove them.
>
> So I wonder ...

You should be able to eject USB flash drives.

A harder thing to do, is "reload" them once they've
been ejected. There are codes which claim to be
able to do that, but no strong evidence they work
in every possible circumstance.

https://www.uwe-sieber.de/drivetools_e.html

The problem is, there are "more things in heaven and earth"
when it comes to USB, and no end of device states. For example,
having an optical drive tray locked after an OS reboot (to
a different OS). Some states you can park hardware in, require
power cycling to defeat them. This is why "mere software" is
simply not capable of recovering from every possible parking state.
The people who park the devices, are more clever than the people
who unpark them.

While some installers have an irritating habit of
unpacking on randomly selected partitions (top level),
I see less mention of this today than in the past. There
would be a folder name, with a lot of numbers in the name.

Paul

You must be really proud of yourself, Skippy!
Now be a good boy and clean Gampaw's penis
with your mouth.

On 5/24/23 18:26, Paul wrote:
> A harder thing to do, is "reload" them once they've
> been ejected.

I just reboot when I need them remounted.
But in this instance, I just did not think
of it.