My notes, things I have learned, and documentation I have created.

Change the OEMBackground registry key from 0 to 1. The location is outlined below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background]
“OEMBackground”=dword:00000001

Navigate to:

C:\Windows\System32\oobe\info\backgrounds

Rename the existing image from backgroundDefault.jpg to something else like backgroundDefault.jpg.orig.

Then, you are going to put the image you want in this directory. The key is making the image you replace it with is 256Kb or less, and is a jpg. Once you have such an image that you want to use, put it in the “C:\Windows\System32\oobe\info\backgrounds” directory and name it backgroundDefault.jpg.

This is just a matter of knowing where the image is stored and getting on that it correct size to replace it.

The default picture, the orange flower, is stored in:

C:\ProgramData\Microsoft\User Account Pictures\

Rename the original user.bmp to something like user.bmp.orig.

Then, create or resize or find the 128×128 pixel image you want to replace it with and convert it to a bmp if it is not already. When you have the image, simply paste it in the “C:\ProgramData\Microsoft\User Account Pictures\” directory and rename it to user.bmp.

This will set the default wallpaper for all users who login to a Windows 7 machine.

First, login to the machine with an Administrator level account.

Open up regedit.

Load the Default profile ntuser.dat. (see http://jim-zimmerman.com/?p=196)

I loaded the hive using JGZ for the name. Navigate to:

[HKEY_USERS\JGZ\Software\Microsoft\Windows\CurrentVersion\Policies]

Note: If you do not have a System key under Policies, create one now.

[HKEY_USERS\JGZ\Software\Microsoft\Windows\CurrentVersion\Policies\System]

Then, in the System key, add the following two String Values:

“Wallpaper”=”C:\\Windows\\Web\\Wallpaper\\mydirectory\\myimage”
“WallpaperStyle”=”4”

Note: I put my wallpaper in a subdirectory I created in the Wallpaper directory.

Unload the Default hive, and reboot.

This pertains to a new Windows 8 installation, but you purchased a Windows 8 upgrade license key.

From an administrator level account in your new Windows 8 installation bring up regedit from an administrative level command prompt.

Navigate to

HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Setup/OOBE/

Modify the MediabootInstall key.

If the value is a 1, change it to a 0.

Back to the elevated command prompt, enter

slmgr /rearm

Then, reboot.

shutdown /r /y /t 0

To disable the last user logged in on Windows 7, you need to enable the DontDisplayLastName registry entry. There is a downside to enabling this. Since Windows 7 supports multiple concurrent logins, having this enabled prevents you from easily seeing who else is logged in. Probably, the easiest way to tell who else is logged is by bringing up the Task Manager and clicking on the Users tab.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
“DontDisplayLastUsername”=dword:00000001

If you have problematic Outlook plugin installed and want to disable it, you will want to do it from Outlook when it is running in Safe Mode.

A couple ways you can do it are as follows:

1) Hold down the Ctrl key while opening Outlook.

2) Locate the Outlook.exe file and execute it from a Command prompt or Run with a /safe switch.

c:\> outlook.exe /safe

You might get a message like the following:

Click Yes and Outlook will open up.

Note: In Outlook 2013, I was only prompted to choose the Profile to use.

OS: Windows 2012 R2

For years, I used to get upset when I knew that a simple network trace would give me the answer to an issue only to find that netmon or an equivalent was not installed on the server. Well, with the later versions of Windows, the “netsh trace” command is there to help. Netsh is a very powerful command that I continue to turn to for help.

Just a few of the “netsh trace” options:
report: Creates an HTML report file that I found pretty useless. However, this also creates a CAB file that contains potentially a lot of useful information.
scenario: You can choose different scenarios. To determine the list of possible scenarios, you can look at the following registry key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetTrace\Scenarios]

Or you can do:
netsh trace show scenarios

I chose NetConnection, but I just wanted to capture the traffic.
persistent: If yes, the trace will restart when the server is rebooted. Would almost never want that on, which is the default.
maxsize: To specify the maximum size of the trace file. the default is 250MB.
correlation: The will try to group related packets together.
tracefile: The name and location of where you want the file(s) to be saved.

Start a trace:

C:\>netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=1024 correlation=yes tracefile=trace.etl

Trace configuration:
——————————————————————-
Status: Running
Trace File: trace
Append: Off
Circular: On
Max Size: 1024 MB
Report: On

Stop a trace:

C:\>netsh trace stop
Correlating traces … done
Merging traces … done
Generating data collection and report … done
The trace file and additional troubleshooting information have been compiled as
“C:\trace.cab”.
Tracing session was successfully stopped.

If you open up the etl file using NetMon and see the following messages in the description:

MicrosoftWindowsTCPIP: Windows stub parser: Requires full Common parsers. See the “How Do I Change Parser Set Options(Version 3.3 or before) or Configure Parser Profile (Version 3.4)” help topic for tips on loading these parser sets.

Then, you need to enable to Windows Parser under Parser Profiles in Network Monitor. In version 3.4, it is in the top right corner of the window. In the Options, you can set it to be the default parser profile.