Quick and Dirty – Collect an ETW shutdown trace on Windows 7.

Let’s say you need to collect a trace of the shutdown of a Windows 7 box. Or 8, or 10. Whatever.

Maybe it takes forever, hangs up, et etc.

Jeff to the rescue;

For Windows 7, or Window 8.x, download the WADK for 8.1 update. You’re going to say, “but dude, this is for Windows 7”. The dude abides, for reasons I can’t go into, use the 8.1 update ADK please for a Windows 7 trace. Capiche?

Ok. So, Download here

That downloads adksetup.exe. Run it. It’s a web installer, we are going to opt-out of almost all of it; when you get to the below screen, make it look like so:


And then click Install. You’re going to want to know, what do all these do? Later, padwan learner, we’ll get to that sometime in the future.

For now, focus on the present. I know master Yoda says to be mindful of the future, but not at the cost of the now.

Anyway, when it is done, run WPRUI;

On Windows 7, you’ll likely be prompted to disable paging executive. Do it and reboot. This tells Kernel “YO! Keep all those stacks in RAM and don’t outpage them with yo bad self”.

Then rerun WPRUI if you had to reboot. Make the checkboxes look so;


Arrows are where you need to change something. Then hit “start” and reboot.

After you power back up, you’ll find a trace in your appdata by default.

View with WPA (Windows Performace Advisor).


Docker on Windows: MobyLinuxVM failed to realize – fixed

Fix for MobyLinuxVM failed to realize on Docker for Windows install.


  1. Download Docker for Windows (edge or stable branch, doesn’t seem to matter).
  2. Boot up and Docker will fail to start with MobyLinuxVM failed to realize.DBTDIHvU0AAdvLk

The hint is the text “<No file>” in the window above, for my scenario fix anyway.

To fix:

  1. Further investigation reveals the vhd is actually not there, nor is the VM present in Hyper-V manager. Looking further, something is amiss.
  2. Right-click the Docker icon in your system tray, select Settings.2017-06-02_3-44-56
  3. Select Advanced and validate your path for “Images and volumes VHD location”.2017-06-02_3-46-59
  4. Note the path. Does it exist? For me, no. It’s an old setting from a previous installation of Hyper-V on this system. The path is invalid as I removed Hyper-V to a dedicated host and deleted the directories post migration.
  5. Uninstall Docker (rerun the installer you downloaded, select Remove).
  6. Open Hyper-V Manager. (start, type “Hyper-V” and click it) 2017-06-02_4-03-38
  7. Right click your host name in Hyper-V Manager and select “Hyper-V Settings”.
  8. Browse your “Virtual Hard Disks” and “Virtual Machines” paths and set to valid directories, Save/Ok/Apply/etc.2017-06-02_4-05-33.png
  9. Reinstall Docker from the downloaded installer. Now that the Hyper-V path for VM/disks is valid, Docker can place the MobyLinuxVM disk and create the Virtual Machine in Hyper-V and start it. yay.
  10. ???
  11. Profit


Suggestion: Pre-flight installer for Docker for Windows might want to check that the paths are valid for the creation of the vhd file/VM.

Further suggestion: When you run Hyper-V for a bit, then remove the feature from Windows. MAYBE, just maybe, Windows should remove the damn settings so when you re-enable Hyper-V it starts off fresh, instead of with stale info.

Further further suggestion: Live long and prosper.

This is the bug I filed, looks like they might fix it (should be a hyper-v fix too honestly, maybe I’ll feedback that too).


Dude out


Once again, I quit Microsoft…

Dude here, with my first installment of my new blog. For the second time in my life, I’ve left the company I enjoyed working at, in order to try something new. Well, sort of.

Dude here, with my first installment of my new blog. For the second time in my life, I’ve left the company I enjoyed working at, in order to try something new. Well, sort of.

Before I get to that though, some words of advice. I think careers and beach assaults have something in common. Keep moving.

So, first time, I left Microsoft so I could be a VDI architect for a firm. When I arrived, they made me a helpdesk escalation point instead. So yeah.

This time, I left big data (where I have been for the last 2 years or so at Microsoft) to go back to my roots. Takin’ it back old school. Windows client. I have joined Tanium, you see. Endpoint accountability, visibility, etc. I have some ideas, in the noggin here, we’ll see how they pan out.

Anyway, big data didn’t click, to me. Didn’t ‘sing’ so to speak, just was meh. I mean, I ‘get it’, in a way Mr Burton never will, but it didn’t woo me.

I’ve always said, it is important to do something you enjoy for your work, since you spend so much time doing it. So I really enjoyed my days in Microsoft PFE doing endpoint work, analytics of perf, things like that. So we’ll see how this works.