Filter to view details of the System File Checker process

After SFC /Scannow

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" 

 References:

Use the System File Checker tool to repair missing or corrupted system files - Microsoft Support

Disable IPv6 Windows - PowerShell

 View

Get-NetAdapterBinding | Where-Object ComponentID -EQ 'ms_tcpip6'

Disable one

Disable-NetAdapterBinding -Name 'Ethernet' -ComponentID 'ms_tcpip6'

Disable all

Disable-NetAdapterBinding -Name "*" -ComponentID ms_tcpip6

Searching shutdown logs

Linux

grep -iva ': starting\|kernel: .*: Power Button\|watching system buttons\|Stopped Cleaning Up\|Started Crash recovery kernel' /var/log/messages /var/log/syslog /var/log/apcupsd* | grep -iw 'recover[a-z]*\|power[a-z]*\|shut[a-z ]*down\|rsyslogd\|ups'

Windows

Event ID	Description
41	The system has rebooted without cleanly shutting down first.
1074	The system has been shutdown properly by a user or process.
1076	Follows after Event ID 6008 and means that the first user with shutdown privileges logged on to the server after an unexpected restart or shutdown and specified the cause.
6005	The Event Log service was started. Indicates the system startup.
6006	The Event Log service was stopped. Indicates the proper system shutdown.
6008	The previous system shutdown was unexpected.
6009	The operating system version detected at the system startup.
6013	The system uptime in seconds.

PS C:\> Get-EventLog System -Newest 10000 | `
        Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | `
        Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrapdasd

References

https://geekflare.com/check-linux-reboot-reason/

Windows: Shutdown/Reboot Event IDs - Get Logs - ShellHacks

Remove credentials from SYSTEM context via credential manager

1. Download PsExec and copy to %WINDIR%\system32
2. run: rundll32 keymgr.dll,KRShowKeyMgr

Remove items.

Related to EventID 14 

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos

...

Event ID:      14

....

Description:
The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential Email removed for privacy.

...

Rename AD Domain name

1.  rendom /list
2. notepad Domainlist.xml 
3. (edit file and save)
4. rendom /showforest (show changes)
5. rendom /upload 
6. rendom /prepare
7. rendom /execute
8. Domain controllers restarts themselves
9. Workstations and servers must be rebooted twice to change their names
10. Rename manually domains controllers 
• netdom computername DC01.dominio.com /add:DC01:newdomain.com 
• netdom computername DC01.dominio.com /makeprimary:DC01:newdomain.com 
11. Reboot domain controllers to apply changes
12. gpfixup /olddns:dominio.com /newdns:newdomain.com
13. rendom /clean
14. rendom /end

If DNS problems... (From Changing Domain and Updating DNS (microsoft.com))

Create a new zone for the domain name:

• Create whatever the domain name is called, nedomain.local or newdomain.com (whatever the new AD DNS domain name is).
• Make the zone AD integrated.
• For the replication scope select the center button (To all DNS servers running on domain controllers in the domain), and allow Secure and Unsecure Updates.

Then create the _msdcs zone:

• Create an _msdcs.newdomain.local or _msdcs.newdomain.com zone (as above, whatever the new AD DNS domain name is.
• Make the zone AD integrated.
• For replication scope, select the top button (To all DNS servers running on domain controllers in the forest), and allow Secure and Unsecure updates.

Then either restart the DC, or run the following (which is my usual option):

• ipconfig /registerdns
• Net stop netlogon
• net start netlogon

Increase the number of threads available for Microsoft 365 Apps

 Microsoft 365 Apps that are deployed to multi-session environments are limited to two threads for multithreaded recalculation (MTR) and worker thread pools. 

1. Open Registry Editor.

2. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

3. If the IdealConcurrencyValueOverride entry doesn't exist, right-click the subkey, select New > DWORD (32-bit) Value, and then enter IdealConcurrencyValueOverride as the name of the entry.

   Note: By default, the IdealConcurrencyValueOverride entry doesn't exist, and Microsoft 365 Apps is limited to using two threads.

4. Right-click IdealConcurrencyValueOverride, and select Modify.

5. In the Value data field, enter a number between 2 and 512 to specify the number of threads, and then select OK.

Reference: Heavy Excel workloads run slowly in multi-session environments - Microsoft 365 Apps | Microsoft Learn

Remote MMC

Remote registry

 runas /netonly /user:x.y.z.w\user regedit

Regedit connec other computer

Similar for MMC