Windows 10: Can we create USN Journal for any VHD of around 1GB?

I am working on extracting timestamp mismatch files from the disk. As part of testing I took a simple volume and modified dates to some of the files. But in my tool, other files, which are newly created or with no date/time modifications are also displayed under timestamp mismatch files. The current filter is based on MFT and Standard file times. Using this filter, is giving me false results sometimes. So to attain precise results, I want to use USN journal records to filter out files with any modifications in its date/time.I read somewhere:"[UsnJrnl] The entries we might find in the Usn

:)

 

Repair SBS 2011 from USN Journal Rollback issue after recovery

Hi,

I was unfortunately forced to use Veeam B&R with NON-Application Aware backup to roll-back entire SBS 2011 server to restore functionality. This brought SBS 2011 into USN Journal Rollback state 0x4, so now I have the following situation:

• SBS 2011 with Exchange into USB Rollback 0x4 state, with NETLOGON service Paused
• and 2 additional DCs in the same domain. Those replicate between each other just fine

Maybe important thing is, that since that happened (yesterday), there has been actually
NO SIGNIFICANT CHANGES to AD objects made since we did rollback. No passwords changed, no GPOs changed, no new users....

I've gone through quite some tech articles, and they suggest DEMOTING problematic DC from domain, which I think in my case is not an option (it's SBS with Exchange...probably will broke). Secondly, they suggest restoring only System State...but unfortunately
no other backup is healthy, only Veeam with non-app-aware state.

But one article suggested this:

1. Check for USN rollback by using the command Repadmin /showutdvec (KB Article: 875495, 885875)

2. Check the Registry value "HKLM\System\CurrentControlSet\Services\NTDS\Parameters, "DSA Not Writable" (REG_DWORD) and its value is
0x4.

Both (1) and (2) are confirmed, state in REG is 0x4, and NETLOGON service paused

3. Delete "DSA Not Writable" (REG_DWORD) from registry and reboot the server.

Hmmm...this looks logical to me. What do you think? Is this my easy solution?

Thoughts?

 

Old Windows Journal

Hi,

It is possible that Windows Journal was removed from certain versions of the Windows operating system due to corrupted system files. To provide you the accurate resolution, we'd like to gather more information:

• Have you made any recent changes prior to this issue?
• Are you getting any error messages?
• Which build and version of Windows 10 are you using?
• What troubleshooting steps have you done so far?

Meanwhile, we suggest that you follow the steps in article on how you can install Windows Journal on
versions of Windows from which it was removed.

Keep us posted if you need additional help.

 

Windows 10 and Journal note writer

I'm having the same issue. There is a note on MS support page that says:

"The Windows Journal Note Writer is deprecated"

• "Note The Journal Note Writer is a printer driver that lets users create Journal files by printing documents from any application."

I hope someone finds a way around this or MS brings the function back. The print to Journal function has been very useful.