Windows 10: Can you help me debug my DSOD - Opening Threat Following This Article : BSOD Finding and...

Hello,It's been two weeks I have BSOD almost everyday. I've search many ways to find the reason, here are a list o what I did: - Reinstall important drivers NVidia, realtek, asus mother board, nzxt, wacom, .. everything I could- Repair Windows 11- Running Heaven Benchmark 4.0- Running WinDBG and tryin to understand result with the help of ChatGPT -> This provide multiple different bugs report talkin about different problem. The bleu screen seamed not to come from the same source each time.So I...- Reinstall Windows 11 completelyStill got BSOD, so I tried :- Running Windows Memory Diag

:)

 

ECS P67H2-A where to find ADD Debug list?

i need to know where i can find the debug list for ECS' ADD Indicator (Advanced Dual Display Indicator) bcs for the moment the display shows AA and i dunno what that means so a little help here, and fast thx.

 

Ethernet is showing as Kernel Debug Network Adapater

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that you see Kernel Debug Network Adapter in Device Manager. This can happen if debugging is turner on. I would suggest you to turn off debugging by following the steps mentioned below:

1. Type command prompt in the search bar on the
   Taskbar.
   
2. Right click on the command prompt icon and select
   Run as administrator.
   
3. Paste the following commands and hit Enter:
   
   bcdedit /debug off
   

If you still see the Network Adapter, you can disable it from Device Manager without problems. Refer the steps mentioned below:

1. Press Windows Logo key + X, to open
   Device Manager.
   
2. Expand Network adapters.
   
3. Now, right click on the Kernel Debug adapter and select
   Disable device.
   

Let us know how it goes.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

Batch files and instructions for use in BSOD debugging

Post the following lines to point people here to the Batch repository for how to download the batch file and collect the required output data.
LOGS.bat - Click here to go to the BSOD batch repository to download and run this batch file.Step One Download the batch fileStep Two Run the batch fileStep Three Log Collection and description of logs collected


LOGS.bat [/i] Windows Standard Log Collection w/ EventSearch (Technet)



Information Written by JOHN_E_M @ Technet Gallery 01/28/2018
Wrapper batch modified by 09/26/2020
Updated by 02/01/2021
Found and suggest by Zbook 09/18/2020


Contents

• Step One Download the batch file
• Step Two Run the batch file
• Step Three Log Collection and description of logs collected:
• Step Four Legacy - manual creation and execution of Powershell PS1 file

Information LOGS.bat v1.6.3 is a wrapper that contains LOGS.PS1 v1.6.2 by John_E_M. It is from Technet Gallery, which is being retired. That is the the reason why this is now being hosted here for our Tenforums users.

LOGS.PS1 allows you to quickly collect information from a Windows 10 client machine: Main cmdlt functions: Invoke-WebRequest, Get-WinEvent, Get-WindowsUpdateLog, Get-WMIObject, Get-Printer, Get-Process, Select-String, SetupDiag.exe.
Designed to be run from File Explorer.

The LOGS.BAT file will create the LOGS.PS1 file in the same directory it is in, then launch it. It also handles elevation to Admin level if needed.

If you experience an issue running the BAT file Proceed to Step Four Legacy - manual creation and execution of Powershell PS1 file to create and run the PS1 Code in PowerShell ISE w/ Appropriate privileges





Step One [/i] Download the Batch file
Download the LOGS.bat file to your Desktop or Downloads folder.


Download Attachment 298506 CURRENTLY REMOVED



Step Two [/i] Run the batch file
Open File Explore, navigate to the folder you downloaded the LOGS.bat file to. Double click on LOGS.bat or right click on it and select Open.

DO NOT run directly from a Download as your anti-virus may object and prevent it from running.
Always download to your hard drive then run it from there.



When you launch LOGS.bat, you may see this:





If you do, click the Run button or uncheck Always ask before opening this file then click on the [B/Run[/B] button.

You will see the following Window where you can select what functions you want to run. Normally you will run it as shown below. The Event Viewer logs are only collected when requested.

EventSearch Output is unchecked by default as you can see.





If you select EventSearch Output then you will see the following Windows when the process completes:

This is Top "Errors" via EVTX:








Step Three [/i] Log Collection and description of logs collected:
The log collection tool will determine the %temp% location and create a “LOGS” folder there into which all collected logs will be transported.
This translates to C:\users\<username>\AppData\Local\LOGS
Once the Script has finished collecting logs you should see a pop-up from Explorer.exe which will open to the %temp%/LOGS location. This is what you would zip up to upload to a file sharing site, then post a link to in your Tenforums thread.

This is the LOGS folder and is opened in File Explorer automatically. This is what you would want to ZIP up then upload to a file sharing site. When done then post a link to it in your thread at Tenforums. It can be as large as 400MB, depending primarilly on the size of the EVTX folder, before you ZIP it. Once zipped, my test run went from 172MB down to 27MB.





This is an example of what Event logs (.evtx) are collected.





At the time of this writing the following logs are collected by the script:

• Major Event Logs including Application Event, System and Store Logs
• All Event logs are queried for the string “Error” and located errors are written to TOP-ERRORS.TXT:
• Top-Errors will display the most frequent errors experienced on a per day basis and sort these in descending order with the date, the message ID and provider from which the error was located – these can be used to quickly locate errors which have been experienced on the machine in ALL EVTX locations:
• Use the date and Provider Name to Investigate further in the actual logs on the machine – note that additional logs outside of Application and System Event are located under Applications and Services Logs/Microsoft/Windows in the Windows Event Viewer.
• Power management logs including powercfg /a, energy report and battery report if the machine is a laptop – these are stored in the /POWER folder under /LOGS
• Any files located in /WER on the system (Windows Error Reporting)
• DXDiag, MSINFO32 and Winsat logs
• A list of all installed applications on the system – this is useful to verify 3rd party software installed on the system – we also pull running processes under Get-Process.TXT
• WLAN diagnostics written to wlan.txt if the machine is WiFi enabled
• A CHKDKSK performed on the system reserved partition of the machine – this is achieved by quickly mounting and unmounting the system reserved partition to y: during the collection
• GPRESULT.TXT contains Group Policy and Domain information to verify if the machine is domain joined or has policies applied
• UPDATE-ERRORS.TXT contains a count of all 0x8######## errors located through regex scans on Windows-Update.log or WindowsUpdate.log respectively
• REG_SystemProductName.TXT contains the registry value for the SystemProduct – when invalid we have seen this cause issues with Windows Update

Step Four [/i] Legacy - manual creation and execution of Powershell PS1 file
Since you've had problems running the batch file, you can manually create and run the Powershell .PS1 file.
Open a command prompt.
Navigate to the folder you have LOGS.bat in. Lets use your Desktop for an example.
In the Command prompt window, copy and paste the following command:

MORE /E +10 "%userprofile%\Desktop\LOGS.bat" > "%userprofile%\Desktop\LOGS.PS1"
Or do it the long way using Notepad:
Open File Explorer and navigate to the folder you have LOGS..bat stored in.
Click in an empty area and select New then Text Document. You should now have a file called New Text Document.txt in the folder.
Click on it then Press F2 or right click and select Rename. Name it LOGS.PS1.
Click on Yes when asked if you are sure you want to change it.

Right click on LOGS.bat and select Open with. Make sure Notepad is default option and click OK.
Select everything from line 10 (this line: ####LOGS.PS1 v.1.6.3#####) to the end of the file.
Press Ctrl+C or right click then Copy to copy the selected data to the clipboard.
Close Notepad (click on the X).

Right click on LOGS.PS1 you created and select Open with. Make sure Notepad is default option and click OK.
Press Ctrl+V or right click and select Paste to paste the contents of the clipboard into the Notepad window.
Click on File then Save.
You now have the Powershell script by itself without the batch file wrapper.

The following is a video showing you how to run LOGS.PS1 in the Powershell ISE. No idea how long the video will be available though as it belongs to the author John_E_M.

Video showing how to run LOGS.PS1 in Powershell ISE

Ignore the part about creating the Powershell script from the web site as I already covered that locally above.