Helge Klein

Poll: Do Companies Use Local or Roaming Profiles for Desktop PCs?

Helge Klein — Thu, 04 Mar 2010 20:37:34 +0000

Would it shock you if 35% of all enterprises used roaming profiles on their desktop PCs? Well, that was the average I got when I asked via Twitter. But is that number correct? It might or might not be. It is based on the answers of only ten people, making it hardly statistically relevant. In the resulting discussion that was a topic, too. The obvious next step, suggested by Kimmo Jernstrom, is to ask more people. So here is the poll.

Poll – Please Vote

I am interested in the distribution between local and roaming profiles on corporate desktop computers. I am explicitly referring to traditional desktops only, so no laptops, no Terminal Servers, no virtual desktops (VDI), etc.

Please vote based on your personal experiences only, in other words what you know is out there, not what you think there is. Thank you.

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

Feel free to comment below. The more opinions, the more interesting this gets.

Twitter Poll and Discussion

Here is the Twitter communication that led to this poll.

Question:

@HelgeKlein: Do companies typically use roaming or local user profiles for desktop PC users? What are your experiences? Thanks for a quick reply!

Answers:

@scotty11x: RT @HelgeKlein: Do companies typically use roaming or local user profiles for desktop PC users?>>> local at most of my customers
@tellmers: @HelgeKlein local user profiles
@JimMoyle: @HelgeKlein roaming almost exclusively
@gilwood_cs: @HelgeKlein roaming profiles: typically its rarely thought through so its developed into a slow and painful mess thats become ‘acceptable’
@timarenz: @HelgeKlein Most of our customers are using local user profiles in their traditional (local) desktop environment.
@ralf_hoffmann: @HelgeKlein meine Erfahrung: 40% nutzen roaming profiles, 20% nutzen Folder redirection, 40% machen lokale profile
@stevegreenberg: @HelgeKlein Our customers mostly use roaming profiles and then local. When we are done they are usually flex or appsense
@KimmoJernstrom: @HelgeKlein Local profiles for Desktops
@Knoerre: @HelgeKlein Many people think that roaming profiles don’t work at all because of the trouble they get without folder redirection…
@shawnbass: @HelgeKlein typically I see local. Sometimes with appdata redir (sadly)

Discussion following the answers:

@HelgeKlein: My question on roaming vs. local user profiles on corporate PCs: I got 10 answers. On average: 65% roaming, 35% local. Thanks everybody! Note: As you may have noticed I confused the numbers: it should have been 65% local and 35% roaming.
@shawnbass: @HelgeKlein I’m really shocked the number of responses to roaming was so high. Was there a demographic difference? US vs EU?
@HelgeKlein: @shawnbass Roaming/local difference between EU/US? Could be, good point. From the answers I got, roaming is mostly used in Europe…
@shawnbass: @HelgeKlein Aha! That’s exactly what I expected to find.
@KimmoJernstrom: @HelgeKlein @shawnbass Hey, there were 10 responses (sic). http://en.wikipedia.org/wiki/Statistics
@JimMoyle: @HelgeKlein @shawnbass Interesting, maybe due to greater pressure on space in EU hotdeking is much more prevalent, hence more roamin
@JimMoyle: RT @KimmoJernstrom: @HelgeKlein @shawnbass Hey, there were 10 responses (sic). Ahhh but you could consider those 10 as a meta study :)
@HelgeKlein: RT @KimmoJernstrom: @shawnbass Hey, there were 10 responses (sic). http://bit.ly/JVjL2 <= I know, statistically not relevant, number too low
@KimmoJernstrom: @HelgeKlein: @shawnbass @JimMoyle. I do believe the numbers match up. Guys, build a web quiz on the topic. This is interesting. Really.
@gilwood_cs: @JimMoyle @HelgeKlein @shawnbass maybe we’ve found root cause for US’s growing obesity prob: US admins not implementing roaming profiles :?

.NET Applications on Windows x64 – Easy? Yes and No

Helge Klein — Tue, 02 Mar 2010 21:33:01 +0000

When migrating to 64-bit Windows, traditional “unmanaged” applications can pose challenges. That is because unmanaged binaries contain hardware-dependent CPU instructions – and the view on the hardware differs between 32- and 64-bit mode. But .NET? It should be unaffected of a system’s bitness since “managed” binaries contain instructions in a so-called intermediate language that is executed in a virtual machine at run-time and only then translated to machine language. But is it really? This article is about .NET programs that are dependent on OS bitness.

The Default

When you create a new C# or VB application in Visual Studio it is created as a bitness-independent program by default. That means that it will run as a 32-bit process on 32-bit Windows, and as a 64-bit process on 64-bit Windows, optimally leveraging each platform’s capabilities. That sounds good, and indeed it is a great achievement of the .NET framework to make this possible. But there are caveats, otherwise this article would be quite pointless.

Under the Hood

Each .NET binary (correct: assembly, an EXE or DLL) stores flags marking it as compiled for either:

AnyCPU [default]
x86
x64

There is also Itanium, but let us ignore that soon-to-be obsolete platform.

These flags are relevant at runtime. AnyCPU assemblies are independent of the OS bitness. AnyCPU DLLs can be loaded into 32-bit and 64-bit processes while AnyCPU EXEs are started as 32-bit processes on Windows x86 and as 64-bit processes on Windows x64.

x86 assemblies can be loaded into 32-bit processes only (DLLs) respectively are always started as 32-bit processes (EXEs).

x64 assemblies can be loaded into 64-bit processes only (DLLs) respectively are always started as 64-bit processes (EXEs).

Why the Distinction?

The obvious question at this point: why even create three different types of .NET assemblies if .NET code is platform-independent? The answer is simple: While .NET code is platform-independent, legacy code is not. And a lot of .NET applications rely on unmanaged code.

Consider the following (fictional) scenario: You are writing a nice program for transferring files from one computer system to another. At some point you discover that compressing the files transferred by your program would greatly enhance speed and usability. So you decide to compress files. But how? Write a packing algorithm yourself? No way! The easiest solution is to use something existing. So you might end up with the free 6-zip library, written in unmanaged C++ and available as 32-bit only. And here the problem starts.

You call the packing routines from the unmanaged 32-bit DLL, test very thoroughly on your 32-bit develepment machine (where everything works great) and deliver the resulting application to your customers. Another job well done! But then one of your customers decides to migrate his systems to Windows x64 – and discovers that your application does not work there.

Why? On 64-bit Windows your AnyCPU assembly runs as a 64-bit process – and a 64-bit process cannot load 32-bit DLLs. But your application tries to do exactly that and fails.

What to Do – As a Programmer

If you are the guy developing the application, you have two options if you want your program to run on both 32-bit and 64-bit Windows:

Compile your managed code as “AnyCPU” but have the installer determine that target system’s bitness and install any unmanaged DLLs in the appropriate bitness. This means you need additional logic during setup.
Compile your managed code as “x86″ – that way it will always run as a 32-bit process, regardless of the bitness of the OS. Since your code is always 32-bit, it is safe to only distribute 32-bit versions of unmanaged DLLs.

What to Do – As an Administrator

If you want to get the application to run on 64-bit Windows, the safest way to do so would be to contact the vendor and ask him to make his software compatible with x64. Only by going back to the vendor will your configuration be supported, which is a requirement especially in larger enterprises.

If vendor support is not paramount you can try the following hack. It is made possible by the fact that all three flavors of .NET assemblies described above are basically identical except for two flags in the PE header of the binary file storing whether this is a x86, x64 or AnyCPU assembly. And flags can be changed easily…

First of all you might want to check your .NET assemblies. There are several ways to do that:

If you find managed AnyCPU EXE files on a 64-bit system, next check if they came with unmanaged 32-bit DLLs. For that you first need to determine whether a DLL is managed or unmanaged, which can be done with CorFlags.exe (see above) – it will complain if it is fed an unmanaged binary. Secondly you need to check if your unmanaged DLL is 32-bit or 64-bit – information that, again, is stored in the PE header. So you need a PE header dumper like PEDump from Matt Pietrek, an oldie but goldie. Unfortunately it crashes when analyzing 64-bit DLLs on 64-bit Windows 7, but only after printing the information we are interested in:

D:\Tools\PEDump>PEDUMP.exe c:\Windows\notepad.exe
Dump of file C:\WINDOWS\NOTEPAD.EXE

File Header
Machine: 8664 (unknown) <<<<<<<<< This means “x64″
Number of Sections: 0006
TimeDateStamp: 4A5BC9B3 -> Tue Jul 14 01:56:35 2009
…

D:\PEDump>PEDUMP.exe c:\Windows\syswow64\notepad.exe
Dump of file C:\WINDOWS\SYSWOW64\NOTEPAD.EXE

File Header
Machine: 014C (i386)
Number of Sections: 0004
TimeDateStamp: 4A5BC60F -> Tue Jul 14 01:41:03 2009
…

Once you have verified that you indeed have a managed EXE compiled as AnyCPU that needs 32-bit unmanaged DLLs, you can change the EXE’s type from AnyCPU to x86 with CorFlags:

CoreFlags.exe TheApp.exe /32BIT+

If you want to revert:

CoreFlags.exe TheApp.exe /32BIT-

Please note that modifying a binary file invalidates its digital signature (if available). Reverting back to the original state reverses this – the signature is valid once again.

References

MSDN: Migrating 32-bit Managed Code to 64-bit

Citrix User Profile Manager 5 Years Ago: Birth

Helge Klein — Thu, 25 Feb 2010 22:07:05 +0000

Citrix User Profile Manager is pretty well-known in the SBC space today. Five years ago, things were quite different. Citrix did not have a user profile solution, and neither did sepago. But we had an idea spinning in our heads we soon came to call Smooth Profiles. Slowly that idea became code, then was renamed to sepagoPROFILE, was acquired by Citrix and renamed again to User Profile Manager and then again to Profile management (with capital P and lower-case m!). You may have heard the latter part of the story. Here is a little something from the very beginning.

A few days ago I stumbled upon an old notebook containing, to my surprise, the very first notes about what was to become sepago’s profile management product:

For those that either do not read German or my handwriting here is a transcript:

Smooth Profiles

Requirements:

User has a mandatory profile
Directory on file server for storage of .reg file

Logoff:

If .reg file exists it is imported to HKCU\$SmoothProfile
Recursively iterate through HKCU and compare each key’s timestamp with %LOGONDATE%
If key in HKCU is newer:
- Copy subkeys (without children) and values to HKCU\$SmoothProfile
Unload HKCU\$SmoothProfile to .reg file

Please note:

Backup and restore privileges (work around that by using a service)
Multiple concurrent logoffs (wait if .reg file is locked)

End of transcript.

It is not dated, but it should be from April 2005.

Remarks

As you may have guessed from the transcript we initially thought it would be sufficient to store registry data since the relevant folders of the profiles would be redirected to a file server anyway.

But apart from that this first draft already shows some characteristics of the later sepagoPROFILE:

Code everything in a Windows service, which gets us all the privileges we need and has the additional advantage of not having to modify logon scripts when deploying the solution.
Use the timestamps on registry keys to determine what has changed during a session.
Robustly handle concurrency in Terminal Server environments (multiple sessions per user).

Which Software Installed That Driver – And When?

Helge Klein — Wed, 17 Feb 2010 22:52:45 +0000

Installing a software that includes a driver may leave your system in an inconsistent state. If the install fails, parts may remain on the system. And if the remaining part is a driver, I get nervous – drivers are not the kind of stuff I want to have lingering around my system’s memory. Here is a way of identifying when a driver actually got installed.

In my case, I installed, or rather tried to install, the Citrix Access Gateway (CAG) Plugin 4.6.2, a VPN client, on Windows 7 x64. That failed – the installer reported a timeout after a couple of minutes of showing a progress bar. I aborted the install, which worked, but when I rebooted the machine, it hung on shutting down. Not good.

After a reset I examined the system: nothing related to the CAG client, but in the properties of my network card I found something suspicious called “Deterministic Network Enhancer”:

But how to know whether it came from the (partly failed) install or from something entirely else? First thought: Check the timestamp of the driver file. By searching the registry, I found the driver’s entries:

To my disappointment the driver file’s dates (dne64x.sys) revealed nothing. I did not install anything in 2008 – I run Windows 7…

Then I had the idea of checking the registry. Each driver has a key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services. And each registry key has a timestamp that gets updated whenever the key itself or a direct sub-object of the key get changed. So I only had to get the timestamp of the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNE in order to know when that driver had been installed.

But… although I run the seventh incarnation of Windows its registry editor has not changed much for at least a decade. Regedit.exe has many shortcomings, one of them being that it does not show timestamps for registry keys. Luckily, other programmers are more than happy to fill the void. I found the interesting tool Registry Commander – one of its capabilities is to show registry key timestamps. It looks like this:

And that was the answer I sought. The DNE driver was indeed installed by the CAG client. Now I can safely disable or uninstall that driver.

What about you? Have you used any alternative registry editors? Do you prefer them over Regedit?

New Articles, Tools, Tips and Tricks: Windows (7 and 2008 R2), PowerShell and Citrix

Helge Klein — Thu, 11 Feb 2010 00:20:33 +0000

Windows General

Good info for troubleshooting DFS-Namespaces in the MS KB: Storage locations, inconsistencies and how to deal with them.

Complex passwords and security guidelines for end users? No, thank you, says MS researcher. I agree.

Here is a hard-to-find list of MS KB article RSS feeds by product.

The free tool ADRecycleBin adds the missing GUI to the Active Directory recycle bin (which is PowerShell only, by default).

An extremely detailed article on Event Tracing for Windows in the NTDebugging blog.

José Barreto compiled a reference for DFS-N (Distributed File System – Namespaces). Lots of useful links there.

UPHClean is officially discontinued. My tip: the beta of 2.0 should NOT be used in production and does not run on Vista and upwards.

Windows System State Analyzer takes and compares snapshots of the entire machine. Great for checking on installers!

How to start any program under the SYSTEM account in session 0 on Vista/Win7 (psexec -sid does not work any more):

.NET apps are platform independent and you can run any .NET app on x64? Think again! Here is how to do it.

MS AskPerf blog on the nightmare of installing 64-bit printer drivers on a 32-bit server. It is way too complicated!

Domain controller stickiness, its problems and the fix introduced in Vista/2008 explained on MSDN (in Remarks)

A cool (albeit somewhat dangerous) way to copy an in-use Windows user profile employing shadow copies / hobocopy.

Windows 7 and Server 2008 R2

How Disk Defragmenter in Windows 7 determines if a volume is on a SSD in order to exclude it from the schedule.

Comparison table of which features are available in which version of Windows 7.

Beta version of Windows Server Migration Tools for Server 2008 R2. Feedback welcome.

Here is a list of features that were removed in Win7/2008 R2 (e.g. NT4 domain join, Quick Launch Toolbar, …).

Looking for a list of all (44) features of Server 2008 R2? Here it is, well hidden in TechNet.

According to Microsoft’s Knowledge Base the only supported way of customizing the default user profile and creating a mandatory profile with Windows 7.

Changes in Functionality in Windows Server 2008 R2 – Microsoft white paper, 211 pages.

MS white paper: Remote Desktop Protocol Performance Improvements in Windows Server 2008 R2 and Windows 7.

PowerShell

PowerShell Configurator tool now in v1 RC: a more flexible replacement for sconfig.

PowerShell Quick Reference (2 pages). Short, but nicely done.

Citrix

10 years of Citrix WebInterface, and it’s still not Web 2.0-ish or even user friendly. So Citrix starts all over again.

Detailed comparison of the architectures of Citrix Resource Manager and EdgeSight.

Good news for all who are using Citrix PVS with app streaming: future versions reduce expensive disk writes.

Citrix application streaming to support isolation/streaming of Windows services.

Citrix User Profile Manager can now stream profiles (transfer files only when used). That should reduce logon times nicely.

Optimizing Windows 7 for XenDesktop. A very good and detailed article by Citrix.

Note: This is mainly a condensed and beautified version of my twitter postings. You can get them unfiltered and without delay by following me.

Are Mandatory User Profiles Deleted at Logoff – or Cached?

Helge Klein — Sun, 24 Jan 2010 01:26:03 +0000

A popular misconception about mandatory user profiles is that they are deleted at logoff. I freely admit that I thought so, too, until I made some tests that proved I was wrong.

Locally Cached Mandatory Profiles

First, if you want to read up on the subject, see my earlier article Mandatory Profiles – The Good, the Bad and the Ugly.

Now let us dig into the subject of this post.

Mandatory profiles are similar to roaming profiles in that a master copy lives on a file server that gets copied down to the local machine at logon. Thus a locally cached version of the mandatory profile is created that is used and changed during the user session. This local copy of the mandatory profile is created once for each user, just as with a roaming profile. And at logoff, it stays where it is, unchanged. Windows does not delete mandatory profiles at logoff. (There was a bug in Windows XP that caused mandatory profiles to be deleted. It has been fixed in service pack 3.)

But wait, are mandatory profiles not reset at each logon? Yes they are. But that does not happen through deletion of the locally cached version during logoff, but by replacing the local copy with the network copy during logon. In other words, everything the user changed during his or her last session is lost – that is what mandatory profiles are all about.

So what is that local cache used for, if it is reset at logon? It has one use only: allow logons when the network is not available. Only in that case the state of an earlier session is available in a later session.

How to Delete Mandatory Profiles

You probably do not want cached profiles to litter your systems. The group policy setting “Delete cached copies of roaming profiles” affects not only roaming, but also mandatory profiles. The setting is located here: Computer Configuration -> System -> User Profiles. If enabled, Windows deletes cached copies of roaming and mandatory profiles at logoff.

Unfortunately this group policy setting does not seem to have any effect on Server 2008 SP1. I simply could not get that version to delete cached mandatory profiles at logoff although cached roaming profiles were deleted as expected. There might be a bug in Windows Server 2008 SP1 breaking the deletion of cached mandatory profiles. After updating the machine to SP2 the problem was gone. On all other versions of Windows I tested (see below) mandatory profiles were deleted correctly if “Delete cached copies of roaming profiles” was enabled.

Applies to

The information in this article applies to Windows in general. However, I have tested on these versions:

XP (x86) SP3
Server 2003 x64 SP2
Server 2008 x64 SP1
Server 2008 x64 SP2
Windows 7 RTM
Server 2008 R2 RTM

Non-Paid Advertisement

Looking for a job? We have offerings. Check out our career pages and also Claudia’s blog.

Syntax Highlighting PowerShell Code in HTML – With a PowerShell Script

Helge Klein — Mon, 18 Jan 2010 17:41:57 +0000

When you are publishing PowerShell code on the web, you soon discover that it looks much nicer with syntax highlighting – as did I. There are several ways to add syntax highlighting to your blog or web site, most of which rely on external (Wordpress) plugins or JavaScript on the page. I do not like that approach too much. I prefer to have the syntax highlighting embedded in the HTML code. That way I have full control over the appearance (and the highlighting also works in Google Reader). The logical solution is to use a script that embeds HTML coloring tags directly into the script.

Highlight-Syntax.ps1

My script Highlight-Syntax.ps1 is a much stripped down and slightly changed version of Lee Holmes’ Set-ClipboardScript.ps1 – thank you for making it available, Lee!

You call Highlight-Syntax.ps1 with the name of a .PS1 script which it parses and then generates an HTML file with a colorized version of that script. If you input “Get-AppVPackageDependencies.ps1″ you will get “Get-AppVPackageDependencies.ps1.html”. That is it. The code in the HTML file can then easily be pasted into your favorite blog editor.

Highlight-Syntax.ps1 does not create fully-featured HTML files with head and body tags. That is by design. It simply takes your code and adds color information to it.

The Code – And a Sample

Here is the script which doubles as a sample of what its output looks like.

#
# Original Author: Lee Holmes, http://www.leeholmes.com/blog/MorePowerShellSyntaxHighlighting.aspx
#
# Modified by: Helge Klein, http://blogs.sepago.de/helge/
#

#
# Syntax highlights a PowerShell script.
#
# Usage: Supply the script to syntax hightligh as first and only parameter
#
# Output: Copy of original script with extension ".html"
#
# Example: .\Highlight-Syntax.ps1 .\Get-AppVPackageDependencies.ps1
#

[CmdletBinding()]
param($path)

$tokenColours = @{
    'Attribute' = '#FFADD8E6'
    'Command' = '#FF0000FF'
    'CommandArgument' = '#FF8A2BE2'
    'CommandParameter' = '#FF000080'
    'Comment' = '#FF006400'
    'GroupEnd' = '#FF000000'
    'GroupStart' = '#FF000000'
    'Keyword' = '#FF00008B'
    'LineContinuation' = '#FF000000'
    'LoopLabel' = '#FF00008B'
    'Member' = '#FF000000'
    'NewLine' = '#FF000000'
    'Number' = '#FF800080'
    'Operator' = '#FFA9A9A9'
    'Position' = '#FF000000'
    'StatementSeparator' = '#FF000000'
    'String' = '#FF8B0000'
    'Type' = '#FF008080'
    'Unknown' = '#FF000000'
    'Variable' = '#FFFF4500'
}

# Generate an HTML span and append it to HTML string builder
$currentLine = 1
function Append-HtmlSpan ($block, $tokenColor)
{
   if (($tokenColor -eq 'NewLine') -or ($tokenColor -eq 'LineContinuation'))
   {
      if($tokenColor -eq 'LineContinuation')
      {
         $null = $codeBuilder.Append('`')
      }

      $null = $codeBuilder.Append("
`r`n")
   }
   else
   {
      $block = [System.Web.HttpUtility]::HtmlEncode($block)
      if (-not $block.Trim())
      {
         $block = $block.Replace(' ', ' ')
      }

      $htmlColor = $tokenColours[$tokenColor].ToString().Replace('#FF', '#')

      if($tokenColor -eq 'String')
      {
         $lines = $block -split "`r`n"
         $block = ""

         $multipleLines = $false
         foreach($line in $lines)
         {
            if($multipleLines)
            {
               $block += "
`r`n"
            }

            $newText = $line.TrimStart()
            $newText = " " * ($line.Length - $newText.Length) + $newText
            $block += $newText
            $multipleLines = $true
         }
      }

      $null = $codeBuilder.Append("$block")
   }
}

function Main
{
   $text = $null

   if($path)
   {
      $text = (Get-Content $path) -join "`r`n"
   }
   else
   {
      Write-Error 'Please supply the path to the PowerShell script to syntax highlight as first (and only) parameter.'
      return
   }

   trap { break }

   # Do syntax parsing.
   $errors = $null
   $tokens = [system.management.automation.psparser]::Tokenize($Text, [ref] $errors)

   # Initialize HTML builder.
   $codeBuilder = new-object system.text.stringbuilder

   # Iterate over the tokens and set the colors appropriately.
   $position = 0
   foreach ($token in $tokens)
   {
      if ($position -lt $token.Start)
      {
         $block = $text.Substring($position, ($token.Start - $position))
         $tokenColor = 'Unknown'
         Append-HtmlSpan $block $tokenColor
      }

      $block = $text.Substring($token.Start, $token.Length)
      $tokenColor = $token.Type.ToString()
      Append-HtmlSpan $block $tokenColor

      $position = $token.Start + $token.Length
   }

   # Build the entire syntax-highlighted script
   $code = $codeBuilder.ToString()
   
   # Replace tabs with three blanks
   $code   = $code -replace "\t","   "

   # Write the HTML to a file
   $code | set-content -path "$path.html"
}

. Main

Download

You can download a digitally signed version of the script here.

How to List All Installed Applications From the Command Line

Helge Klein — Thu, 14 Jan 2010 20:27:28 +0000

How to easily create a list of all programs and (MSI) packages installed on a system for later processing? That sounds like a simple task, and it is. Interestingly, a quick web search revealed primarily more complex solutions where a script is used to iterate through the uninstall information in the registry. That not only is far too complicated, but also inaccurate.

Putting WMIC to Work

As often, the local WMI database contains all the information we need. The simplest way of extracting the required data is via the WMI command line, wmic:

wmic product

Yes, that is all. It runs for a while and then spits out very detailed information on what is installed on the local system. If you need the information in a file for later processing, use the following variation of above command to have wmic create a CSV file:

wmic product get /format:csv > Software_%Computername%.csv

The result is a nice complete list in CSV format in a file that already contains the computer name for easier processing later on. Here is some sample output from my machine:

Node,AssignmentType,Caption,Description,HelpLink,HelpTelephone,IdentifyingNumber,InstallDate,InstallDate2,InstallLocation,InstallSource,InstallState,Language,LocalPackage,Name,PackageCache,PackageCode,PackageName,ProductID,RegCompany,RegOwner,SKUNumber,Transforms,URLInfoAbout,URLUpdateInfo,Vendor,Version,WordCount
NB-HKLEIN,1,Microsoft Office Visual Web Developer 2007,Microsoft Office Visual Web Developer 2007,,,{90120000-0021-0000-0000-0000000FF1CE},20091110,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0021-0000-0000-0000000FF1CE}-C\,5,0,C:\Windows\Installer\47a476.msi,Microsoft Office Visual Web Developer 2007,C:\Windows\Installer\47a476.msi,{8F0496DA-7F60-40C3-871B-DA76B0DABD0C},VisualWebDeveloperWW.msi,82503-694-0000007-62461,sepago GmbH,Helge Klein,,C:\Windows\Installer\{90120000-0021-0000-0000-0000000FF1CE}\ShellUI.MST,,,Microsoft Corporation,12.0.4518.1066,2
NB-HKLEIN,1,Microsoft Office Visual Web Developer MUI (English) 2007,Microsoft Office Visual Web Developer MUI (English) 2007,,,{90120000-0021-0409-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0021-0409-0000-0000000FF1CE}-C\,5,1033,C:\Windows\Installer\47a46c.msi,Microsoft Office Visual Web Developer MUI (English) 2007,C:\Windows\Installer\47a46c.msi,{1B68F013-A620-44FC-BC81-4F7A8B8375A0},VisualWebDeveloperMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Visio Professional 2007,Microsoft Office Visio Professional 2007,,,{90120000-0051-0000-0000-0000000FF1CE},20091014,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0051-0000-0000-0000000FF1CE}-C\,5,0,C:\Windows\Installer\2b3646.msi,Microsoft Office Visio Professional 2007,C:\Windows\Installer\2b3646.msi,{821068B0-013F-40CE-A1D0-37B087A8FF2F},VisProWW.msi,89405-861-5535692-63715,sepago GmbH,Helge Klein,,C:\Windows\Installer\{90120000-0051-0000-0000-0000000FF1CE}\ShellUI.MST,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office OneNote MUI (German) 2007,Microsoft Office OneNote MUI (German) 2007,,,{90120000-00A1-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-00A1-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b35dd.msi,Microsoft Office OneNote MUI (German) 2007,C:\Windows\Installer\2b35dd.msi,{41063EDF-1369-4DD6-AE98-7878A8021E0B},OneNoteMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office InfoPath MUI (German) 2007,Microsoft Office InfoPath MUI (German) 2007,,,{90120000-0044-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0044-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3588.msi,Microsoft Office InfoPath MUI (German) 2007,C:\Windows\Installer\2b3588.msi,{BD4F14DE-A9E4-4B93-887F-790DC2ADB443},InfoPathMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Visio MUI (German) 2007,Microsoft Office Visio MUI (German) 2007,,,{90120000-0054-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0054-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3625.msi,Microsoft Office Visio MUI (German) 2007,C:\Windows\Installer\2b3625.msi,{079E3665-529F-4D94-AAF0-E057A1C63343},VisioMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Access MUI (German) 2007,Microsoft Office Access MUI (German) 2007,,,{90120000-0015-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b35d5.msi,Microsoft Office Access MUI (German) 2007,C:\Windows\Installer\2b35d5.msi,{5BCE6E56-AE94-4509-8D68-47F2AE3E87E1},AccessMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Shared Setup Metadata MUI (English) 2007,Microsoft Office Shared Setup Metadata MUI (English) 2007,,,{90120000-0115-0409-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\,5,1033,C:\Windows\Installer\47a464.msi,Microsoft Office Shared Setup Metadata MUI (English) 2007,C:\Windows\Installer\47a464.msi,{B098E01B-7F1F-48DC-8A6D-2243E942FD6F},OfficeMUISet.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Excel MUI (German) 2007,Microsoft Office Excel MUI (German) 2007,,,{90120000-0016-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3566.msi,Microsoft Office Excel MUI (German) 2007,C:\Windows\Installer\2b3566.msi,{194C8759-3D69-46DD-B05C-4CB4A1FA6000},ExcelMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office PowerPoint MUI (German) 2007,Microsoft Office PowerPoint MUI (German) 2007,,,{90120000-0018-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3578.msi,Microsoft Office PowerPoint MUI (German) 2007,C:\Windows\Installer\2b3578.msi,{7449EBEE-BAD7-4D44-96C6-F23996C7B613},PowerPointMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Publisher MUI (German) 2007,Microsoft Office Publisher MUI (German) 2007,,,{90120000-0019-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b35c3.msi,Microsoft Office Publisher MUI (German) 2007,C:\Windows\Installer\2b35c3.msi,{2439A177-3D7B-415E-8B2D-6885571CA072},PublisherMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Outlook MUI (German) 2007,Microsoft Office Outlook MUI (German) 2007,,,{90120000-001A-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-001A-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b356f.msi,Microsoft Office Outlook MUI (German) 2007,C:\Windows\Installer\2b356f.msi,{20612ECC-02E8-42B6-89A7-0C52005ED9DB},OutlookMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Office 64-bit Components 2007,Microsoft Office Office 64-bit Components 2007,,,{90120000-002A-0000-1000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{91120000-002E-0000-0000-0000000FF1CE}-C\,5,0,C:\Windows\Installer\2b35e6.msi,Microsoft Office Office 64-bit Components 2007,C:\Windows\Installer\2b35e6.msi,{BB540498-3B22-45D7-8E2F-F80F8C08354E},Office64WW.msi,,,,,C:\Windows\Installer\{90120000-002A-0000-1000-0000000FF1CE}\ShellUI.MST,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Shared 64-bit MUI (German) 2007,Microsoft Office Shared 64-bit MUI (German) 2007,,,{90120000-002A-0407-1000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002A-0407-1000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3590.msi,Microsoft Office Shared 64-bit MUI (German) 2007,C:\Windows\Installer\2b3590.msi,{BF63F822-3F4B-4B71-8F56-371FEF051B70},Office64MUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Groove MUI (German) 2007,Microsoft Office Groove MUI (German) 2007,,,{90120000-00BA-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-00BA-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b3580.msi,Microsoft Office Groove MUI (German) 2007,C:\Windows\Installer\2b3580.msi,{9062E123-7F0D-48E7-A4EB-07FA087EC55D},GrooveMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Word MUI (German) 2007,Microsoft Office Word MUI (German) 2007,,,{90120000-001B-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-001B-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b35cc.msi,Microsoft Office Word MUI (German) 2007,C:\Windows\Installer\2b35cc.msi,{D0FEB987-B949-4FBB-9443-8EF5E4C63B24},WordMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Proofing (German) 2007,Microsoft Office Proofing (German) 2007,,,{90120000-002C-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b35bb.msi,Microsoft Office Proofing (German) 2007,C:\Windows\Installer\2b35bb.msi,{9DF79774-8369-46FD-AB0F-29C4BE379FB7},Proofing.msi,,,,,,,,Microsoft Corporation,12.0.4518.1014,2
NB-HKLEIN,1,Microsoft Office Shared MUI (German) 2007,Microsoft Office Shared MUI (German) 2007,,,{90120000-006E-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-006E-0407-0000-0000000FF1CE}-C\,5,1031,C:\Windows\Installer\2b355e.msi,Microsoft Office Shared MUI (German) 2007,C:\Windows\Installer\2b355e.msi,{1DE51602-63F6-4ACA-AF7E-787D1DA2C87B},OfficeMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Shared MUI (English) 2007,Microsoft Office Shared MUI (English) 2007,,,{90120000-006E-0409-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\,5,1033,C:\Windows\Installer\47a45c.msi,Microsoft Office Shared MUI (English) 2007,C:\Windows\Installer\47a45c.msi,{3A4478D0-B2FD-4A3C-8C5F-889692F35C99},OfficeMUI.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Proof (Italian) 2007,Microsoft Office Proof (Italian) 2007,,,{90120000-001F-0410-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.it\,5,1040,C:\Windows\Installer\2b3598.msi,Microsoft Office Proof (Italian) 2007,C:\Windows\Installer\2b3598.msi,{27C30CC2-60AB-4AF3-BEF6-FBCD8EA92802},Proof.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Proof (German) 2007,Microsoft Office Proof (German) 2007,,,{90120000-001F-0407-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.de\,5,1031,C:\Windows\Installer\2b35a1.msi,Microsoft Office Proof (German) 2007,C:\Windows\Installer\2b35a1.msi,{4C5774D8-1C30-42A7-AA9C-E8C9F1A22970},Proof.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Proof (English) 2007,Microsoft Office Proof (English) 2007,,,{90120000-001F-0409-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.en\,5,1033,C:\Windows\Installer\2b35b3.msi,Microsoft Office Proof (English) 2007,C:\Windows\Installer\2b35b3.msi,{FCE6A278-C1AE-431F-BBCA-EA6CF34C0BCF},Proof.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Proof (French) 2007,Microsoft Office Proof (French) 2007,,,{90120000-001F-040C-0000-0000000FF1CE},20090901,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.fr\,5,1036,C:\Windows\Installer\2b35aa.msi,Microsoft Office Proof (French) 2007,C:\Windows\Installer\2b35aa.msi,{A57F3989-21C1-4267-9019-088688971275},Proof.msi,,,,,,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Office Ultimate 2007,Microsoft Office Ultimate 2007,,,{91120000-002E-0000-0000-0000000FF1CE},20100113,,C:\Program Files (x86)\Microsoft Office\,C:\MSOCache\All Users\{91120000-002E-0000-0000-0000000FF1CE}-C\,5,0,C:\Windows\Installer\2b35f1.msi,Microsoft Office Ultimate 2007,C:\Windows\Installer\2b35f1.msi,{C633FD41-60F4-4BF5-B60F-D5B473AE9127},UltimaterWW.msi,81608-861-1008552-65194,sepago GmbH,Helge Klein,,C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\ShellUI.MST,,,Microsoft Corporation,12.0.6425.1000,2
NB-HKLEIN,1,Microsoft Application Error Reporting,Microsoft Application Error Reporting,http://support.microsoft.com,,{95120000-00B9-0409-1000-0000000FF1CE},20091026,,,F:\1a7cba7f5674b7973ea697\PreReq\Watson\amd64\,5,1033,C:\Windows\Installer\50aef01.msi,Microsoft Application Error Reporting,C:\Windows\Installer\50aef01.msi,{F47058A9-F4BF-420D-B567-104C552A3F63},dw20sharedamd64.msi,,,,,,http://support.microsoft.com,,Microsoft Corporation,12.0.6015.5000,2
NB-HKLEIN,1,Microsoft Windows SDK for Visual Studio 2008 SP1 Tools,Microsoft Windows SDK for Visual Studio 2008 SP1 Tools,http://go.microsoft.com/fwlink/?linkid=55774,,{62EED300-E841-4083-A1D6-60B906271804},20090902,,,C:\Users\hklein\AppData\Local\Temp\IXP05D7A.tmp\wcu\winsdk\,5,1033,C:\Windows\Installer\47a506.msi,Microsoft Windows SDK for Visual Studio 2008 SP1 Tools,C:\Windows\Installer\47a506.msi,{EF4F5D7E-FD77-4634-B9A9-C05AD3C5C46F},VistaClientSDKTools-x64.msi,12345-111-1111111-99479,,hklein,,,,http://go.microsoft.com/fwlink/?linkid=55774,Microsoft Corporation,6.1.5294.17011,0
NB-HKLEIN,1,Microsoft Network Monitor 3.3,Microsoft Network Monitor 3.3,,,{365C5A10-6561-454F-B975-56EA878D0A06},20091216,,,C:\Users\HKLEIN~1.SEP\AppData\Local\Temp\IXP000.TMP\,5,1033,C:\Windows\Installer\162356b.msi,Microsoft Network Monitor 3.3,C:\Windows\Installer\162356b.msi,{315EB3CE-C69D-4965-92DB-4B6333C37DD2},netmon.msi,none,,hklein,,,,,Microsoft Corporation,3.3.1641.0,2
NB-HKLEIN,1,Microsoft Visual Studio Team System 2008 Development Edition - ENU,Microsoft Visual Studio Team System 2008 Development Edition - ENU,,,{6721AC10-3743-38F1-B178-C0EC6C9A4108},20091014,,,h:\,5,1033,C:\Windows\Installer\47a4a1.msi,Microsoft Visual Studio Team System 2008 Development Edition - ENU,C:\Windows\Installer\47a4a1.msi,{E5CAF2F5-394A-4BAC-857E-1846B024872B},vs_setup.msi,91904-270-8202896-60643,Microsoft,Microsoft,,,,,Microsoft Corporation,9.0.30729,0
NB-HKLEIN,1,ActivePerl 5.10.1 Build 1006,ActivePerl 5.10.1 Build 1006,http://www.activestate.com/Support/index.html,,{E7DF4F40-A0CE-430E-8B3B-DB7C8DF1C1A2},20090916,,C:\Program Files (x86)\Perl\,D:\temp\,5,1033,C:\Windows\Installer\2746354.msi,ActivePerl 5.10.1 Build 1006,C:\Windows\Installer\2746354.msi,{1FF10207-45B8-44CC-81B0-ECA3FD866665},ActivePerl-5.10.1.1006-MSWin32-x86-291086.msi,none,,hklein,,,http://www.activestate.com/,http://www.activestate.com/ASPN/Downloads/ActivePerl,ActiveState,5.10.1006,2
[...]

References

Examples that show how to use WMIC commands from Microsoft

PowerShell Script Lists App-V Package Dependencies (Dynamic Suite Composition, DSC)

Helge Klein — Wed, 06 Jan 2010 22:01:36 +0000

App-V’s Dynamic Suite Composition is a powerful feature in that it allows multiple “bubbles” to share the same virtual environment. In other words, package A can be made dependent on package B. But if DSC is used extensively, dependencies between packages tend to become difficult to manage – there seems to be no simple way of listing all packages’ dependencies. Well, I have written a PowerShell script that does just that.

Using Get-AppVPackageDependencies

Just call the script with the path (UNC or local) to a folder containing packages. The script will recursively search the path given for OSD files and analyze each OSD file for dependencies. Here is some sample output:

PS D:\> .\Get-AppVPackageDependencies.ps1 .\

============================================================
Dependencies found:
============================================================

DaveSoft_CopyRite_Vista.CopyRite -> Nvu
Opera -> Firefox_JRE

============================================================
All packages found:
============================================================

Name                             GUID
----                             ----
Nvu                              3AAC7EE6-84C4-4021-966B-56C52FF95AAF
WinDirStat                       3C5E1C59-D56E-4463-B9A0-5190034E6223
DaveSoft_CopyRite_Vista.CopyRite 4A7697E4-ED02-4D87-A8F0-88D7DEB914DE
Firefox_JRE                      999E8458-D477-4975-B3C8-3BCE1252B991
Opera                            24D14B13-1838-45B2-9DAC-78D0A7432F69

In the example above, the script was located in the same folder as the packages, thus the parameter “.\”.

Get-AppVPackageDependencies – the Script

Here is the source code. Let me know if it is useful to you.

#
#   Get-AppVPackageDependencies by Helge Klein, sepago GmbH, http://blogs.sepago.de/helge/
#
#   Usage:
#
#   Get-AppVPackageDependencies 
#

#Requires -Version 2

param(
   [ValidateNotNullOrEmpty()] 
   [System.String[]] $PackageBasePath
)

# Initialize a hash table that stores GUID -> name associations
$Packages = @{}

# Get a list of all .OSD files below the base path passed in
$SFTFiles   = Get-ChildItem $PackageBasePath -filter *.osd -force -recurse

# Store each OSD file's data (name and GUID)
foreach ($SFTFile in $SFTFiles)
{
   # Read the OSD file
   [xml]   $SFTFileXML   = Get-Content $SFTFile.FullName
   
   # Store relevant information
   $PkgName   = $SFTFileXML.SOFTPKG.NAME
   $PkgGUID   = $SFTFileXML.SOFTPKG.IMPLEMENTATION.CODEBASE.GUID

   if ($Packages.ContainsKey($PkgGUID) -eq $false)
   {
      $Packages.Add($PkgGUID, $PkgName)
   }
}

Write-Output "`n============================================================`nDependencies found:`n============================================================`n"

# Process each package's dependencies
foreach ($SFTFile in $SFTFiles)
{
   # Read the OSD file
   [xml]   $SFTFileXML   = Get-Content $SFTFile.FullName
   
   $PkgDependencies   = $SFTFileXML.SOFTPKG.IMPLEMENTATION.VIRTUALENV.DEPENDENCIES
   
   foreach ($PkgDependency in $PkgDependencies)
   {
      # Extract package information (again)
      $PkgName   = $SFTFileXML.SOFTPKG.NAME
      $PkgGUID   = $SFTFileXML.SOFTPKG.IMPLEMENTATION.CODEBASE.GUID
      
      # Extract the GUID the package depends on
      $PkgDependencyGUID   = $PkgDependency.CODEBASE.GUID
      
      # Look up the depending package's name
      if ($PkgDependencyGUID -ne $null -and $Packages.ContainsKey($PkgDependencyGUID))
      {
         Write-Output "$PkgName -> $($Packages.Get_Item($PkgDependencyGUID))"
      }
   }
}

Write-Output "`n============================================================`nAll packages found:`n============================================================"
Write-Output $Packages | format-table -auto @{Label="Name";Expression={$_.Value}},@{Label="GUID";Expression={$_.Name}}

Download

You can also download a digitally signed version of the script here.

How to Analyze Kernel Performance Bottlenecks (and Find that ATI’s Catalyst Drivers Cause 50% CPU Utilization)

Helge Klein — Mon, 04 Jan 2010 17:10:15 +0000

Normally, finding the cause for high CPU utilization is easy – just start Task Manager. But what if the component consuming CPU cycles is a driver that runs in the kernel? In that case, there is no regular process Task Manager could attribute the usage to. You will see the “System Idle Process” at around 98%, but the “Performance” tab might indicate 50% CPU usage. How can that be?

Problem

I recently had this exact scenario when I installed a new graphics card in a private PC. Here is how it looked in Task Manager:

Analysis

It looks like some kernel-mode component eats up CPU cycles. But which one? The tool of choice here is Microsoft’s Kernrate Viewer. It collects kernel-mode CPU performance data and later displays a summary of the most active modules (drivers). This is what I got:

C:\Programme\KrView\Kernrates>Kernrate_i386_XP.exe
 /==============================\

 \==============================/
Date: 2009/12/24   Time: 14:46:59
Machine Name: OTTOSPC
Number of Processors: 1
PROCESSOR_ARCHITECTURE: x86
PROCESSOR_LEVEL: 15
PROCESSOR_REVISION: 2f02
Physical Memory: 2047 MB
Pagefile Total: 2613 MB
Virtual Total: 2047 MB
PageFile1: \??\C:\pagefile.sys, 720MB
OS Version: 5.1 Build 2600 Service-Pack: 3.0
WinDir: C:\WINDOWS

Kernrate User-Specified Command Line:
Kernrate_i386_XP.exe

Kernel Profile (PID = 0): Source= Time,
Using Kernrate Default Rate of 25000 events/hit
Starting to collect profile data

***> Press ctrl-c to finish collecting profile data
===> Finished Collecting Data, Starting to Process Results

------------Overall Summary:--------------

P0     K 0:00:19.562 (59.4%)  U 0:00:00.078 ( 0.2%)  I 0:00:13.281 (40.3%)  DPC 0:00:00.000 ( 0.0%)  Interrupt 0:00:19.3
43 (58.8%)
       Interrupts= 14033581, Interrupt Rate= 426269/sec.

Total Profile Time = 32921 msec

                                       BytesStart          BytesStop         BytesDiff.
    Available Physical Memory   ,      1396867072,      1396502528,         -364544
    Available Pagefile(s)       ,      2206572544,      2206597120,           24576
    Available Virtual           ,      2132484096,      2131435520,        -1048576
    Available Extended Virtual  ,               0,               0,               0

                                  Total      Avg. Rate
    Context Switches     ,         8041,         244/sec.
    System Calls         ,        71045,         2158/sec.
    Page Faults          ,          447,         14/sec.
    I/O Read Operations  ,          195,         6/sec.
    I/O Write Operations ,           36,         1/sec.
    I/O Other Operations ,          972,         30/sec.
    I/O Read Bytes       ,        73962,         379/ I/O
    I/O Write Bytes      ,         8838,         246/ I/O
    I/O Other Bytes      ,        86695,         89/ I/O

-----------------------------

Results for Kernel Mode:
-----------------------------

OutputResults: KernelModuleCount = 132
Percentage in the following table is based on the Total Hits for the Kernel

Time   13125 hits, 25000 events per hit --------
 Module                                Hits   msec  %Total  Events/Sec
ati2mtag                               6477      32921    49 %     4918592
hal                                    6284      32921    47 %     4772030
ntkrnlpa                                196      32921     1 %      148841
VIDEOPRT                                 54      32921     0 %       41007
win32k                                   46      32921     0 %       34932
ati2dvag                                 27      32921     0 %       20503
ati3duag                                  8      32921     0 %        6075
ati2cqag                                  7      32921     0 %        5315
USBPORT                                   7      32921     0 %        5315
naveng                                    3      32921     0 %        2278
atikvmag                                  3      32921     0 %        2278
usbccgp                                   2      32921     0 %        1518
Ntfs                                      2      32921     0 %        1518
navex15                                   1      32921     0 %         759
watchdog                                  1      32921     0 %         759
SPBBCDrv                                  1      32921     0 %         759
SYMTDI                                    1      32921     0 %         759
SYMEVENT                                  1      32921     0 %         759
savrt                                     1      32921     0 %         759
usbehci                                   1      32921     0 %         759
CLASSPNP                                  1      32921     0 %         759
ACPI                                      1      32921     0 %         759

================================= END OF RUN ==================================
============================== NORMAL END OF RUN ==============================

It looks like the module “ati2mtag” consumed most CPU cycles.

Resolution

A quick web search later I had the solution: ATIs catalyst drivers seem to have a problem in certain scenarios that is related to HD audio. Disabling “Microsoft UAA Bus Driver for High Definition Audio” in Device Manager fixed this issue for me.

Here is a screen shot from Task Manager right after disabling said audio driver: