How to launch programs from the Windows Logon screen

It does happen from time to time, that I want to start some troubleshooting tools before a user logs on to the system. For example Sysinternals Process Monitor or xperf / wpr etc.

There are several ways to do it, as with most things with IT. You can either logon with another user, start the tools and then use Fast User Switching.
Or enable Boot Logging to get the full boot sequence + logon for a user.
Or use Psexec from a remote system, etc etc
Another way to do it, is to execute any tool of your choice from the Windows logon (winlogon) screen. The nice side effect is that you will be executing the tool as System, with full permissions.

I recently had to troubleshoot a “Password Reset” solution, which launches a browser from the Logon screen and it were unable to connect to the web-service. If you ran it from within windows as a normal user account, or system account, it worked. So I had to troubleshoot the problem as it was happening.

  1. Logon as a local administrator
  2. Make a copy of %windir%\system32\utilman.exe
  3. Take ownership of %windir%\system32\utilman.exe
  4. Grant yourself full control permission on the file.
  5. Replace utilman.exe with cmd.exe (or any other tool of your choise, though CMD is good as you can execute other tools from that one).
  6. At the windows logon screen press the “Accessibility icon” in the bottom left corner.
  7. Wahoo, you now have a command prompt with System Access

This works on Vista, Windows 7 and Windows 8.

 

List computer certificates that will expire with Powershell

Just a small simple script that will list all Computer Cerificates that will expire in 90 days, to give you a heads up and time to renew them.

To list computer certificates that will expire in 90 days:

Just change “-lt 90” to some other value to adjust the expiry period.

List all Unsigned Drivers with Powershell

I had a need for getting all Unsigned drivers in a Windows 8 system to help out with some debugging.

 

As I’m still learning Powershell there might be better and faster ways of solving this problem, but this seems to work good enough for me, and hopefully for you too.

It’s a quite straight forward and easy script to use and change if there is a need, such as instead of showing Unsigned drivers, list all Signed Drivers by using IsSigned -EQ “TRUE”.
Use driverquery.exe to list all Unsigned Drivers to CSV, then import that CSV into Powershell and display all Drivers that’s unsigned (-EQUAL “False”). You will actually just get the .INF file at this point which kind of sucks, not the driverfile which we need in this case.
So for each returned .INF file, we are then opening those files in c:\windows\INF (that’s where Windows stores all installed INF/diver files) and find all .SYS files (drivers) referenced in the INF files. And after some more filtering, it then outputs a list of the unsigned drivers ($UnSigned), like this.

PS C:> $UnSigned VClone.sys nvhda32.sys nvhda64.sys nvhda32v.sys nvhda64v.sys PS C:>
PS C:> $UnSigned
VClone.sys
nvhda32.sys
nvhda64.sys
nvhda32v.sys
nvhda64v.sys
PS C:>

I’ll then use that list and pass the unsigned drivers list to “Verifier.exe /standard /driver $UnSigned” to enable some Special driver Verification for finding the cause of some blue-screens.
I guess this script should work quite well also on Windows 7, but I’ve not tried it.

 

Hello world!

Welcome to my new Blog Site which will cover Geek Stuff in my life, mainly related to Windows and Microsoft infrastructure things that I find interesting in my work.

I’m working for TrueSec as an Executive Response Engineer, which is kind of the same role I had when I was working for Microsoft with Critical Problem Solving on site at customer.

Besides doing troubleshooting of critical (or not so urgent) problems, and normal consulting jobs, I’m also a MCT (Microsoft Certified Trainer) delivering trainings related to Windows and Security.  Both Microsoft Official Courses and more in-depth Mastering classes at Labcenter in Sweden and Truesec Inc in the States.