Tip, Verifying Windows Box state, before and after installing a software

Monitor an Install Program Without Using Any (Expensive) Tools

Finding out what files have been copied/updated by another install program is very easy when you know how.

   1. First of all, take a 'clean' machine, i.e. one that has only got an operating system on it.

   2. Make a dump of the file list.  This can be done by typing
      DIR c:\*.* /s/one >c:\before.txt
   3. Open REGEDIT.EXE and go to Registry->Export Registry File and save the registry as   c:\before.reg
   4. Install the product that you want to monitor

   5. Make another dump of the file list by typing
      DIR c:\*.* /s/one >c:\after.txt

   6. Open REGEDIT.EXE and go to Registry->Export Registry File, as before, and save the registry as c:\after.reg

You now have all the information required to find out everything about the program that you installed 
---------------------------------------- ---------------------------------------- ----------------------------------------

tcpdump - for win :P

A friend of mine (thanks Kabrinsky ;) told me that there is a tcpdump for win boxes that doesn't need's instalation.

I searched... found it, and it's very nice, here are some brief tips, for me (i really don't have a good memory, soo a write stuff...to remember):

Where to find it:

hxxp://www.microolap.com/products/network/tcpdump/

usage: 

+ find your box interfaces

   tcpdump.exe -D

+ listen to everything on interface 5

   tcpdump.exe -i 5 -nn -vv

+ listen to everything on interface 5 and save it to a file

  tcpdump.exe -i 5 -nn -vv -w tt.pcap

+ listen only to some ip's and save it to a file

  tcpdump.exe -i 5 -nn -vv -w tt.pcap host 192.168.1.254 and host 192.168.1.64

+ to save all the packet data: -s 0
  tcpdump.exe -i 5 -nn -s 0 -vv -w tt.pcap host 192.168.1.254

that's it.

.

.

Tips for Windows Uninstalls

Recently i had a problem with my laptop and Win7, and i did a little research for uninstallations here's some tips:


On the Registry here's the KEY were you can find the uninstalls strings:
HKLM\Software\microsoft\windows\currentversion\uninstall


You will find some folders and inside each the corresponding application and uninstall strings ;)


One of the applications that microsoft gives for uninsttaling drivers is "dpinst.exe"


If you need to look at the install or uninstall log, goto 
c:\windows\dpinst.log


That's it, just another quick tip.
.

Windows - Create file to test filesystem - utility

To create a file filled with zero's on windows;

fsutil file createnew name-of-file.txt 2000 (this is the length in bytes)

This will create a new file with 2000 bytes.

This can usefull for copy / perfomance disk testing.

.
.

Active Directory Database - Files

Important files of Active Directory.

Active Directory Database is stored in %systemroot%\NTDS\
the DB file is ntds.dit

The files in this directory, and what they do;
1:ntds.dit : this is the main database file for active directory.
2:edb.log  : When a transaction is performed to AD database, it will be stored to this file, and then after it will be sent to the Database
3:res1.log : Used as a reserved free space, in case of disk low space, default size is 10MB.
4:res2.log : Same of the above.
5:edb.chk  : Records transactions committed to the AD database. During shutdown, "shutdown statement" is written to this file, if it is not found during system startup the AD database checks the edb.log for updated information.

Ntdsutil: tool that can verify database integrity

.