1025 replies to this topic

[wimb]

 

And finally to control incoming and outgoing connections, see: Firewall App Blocker (Fab)

Select the white list and then the programs allowed to connect to Internet, usually only the browser is enough, and you can additionally reinforce control with specific inbound and outbound blocking rules too.

 

 

 The Firewall App Blocker (Fab) is working quite well using Enable WhiteList with Allow Internet Browser only

and is probably the easiest way to block unwanted internet traffic including Windows Update.

 

Thanks 

[antonino61]

will that stop etl files from proliferating all over inside the vhd? wonko and I saw otherwise at the outset, etl files being the first and most evident to contribute to used space growth inside the vhd, if I remember correctly.

[Wonko the Sane]

Well, linking them to RAM disk is a good thing, but better would be to prevent them to be written at all.
It seems like Windows 10 is "over-logging", so, see also here:
https://superuser.co...s-10-system-log
 
the "better" thing to do would be to compile a list of these .etl files and disable logging for them programmatically.
 
Is there wevtutil.exe on Windows 10?
 
If yes,

wevtutil.exe el 

https://docs.microso...mmands/wevtutil
 
https://ss64.com/nt/wevtutil.html
 
should provide all the relevant info and also allow enabling/disabling/configuring.
 

Wonko

[antonino61]

I see what wonko means, so we can try and tell windows to write either nothing at all or, if and when it must, do so, pls, on anything but c:\ (eg. ramdisk).

[antonino61]

btw, u guys won't believe this, I'm sure:

I just came across some reduced version of video card drivers, namely nvidia, which made me realize that most of the stuff that gets installed is redundant fluff. so I tried it out on my system and saw it did not save much more space on disk than I already had done by installing periodical driver updates straight from the device manager. I then perused files and folders and saw that program files, program files (x86) and program data contained at least one nvidia and/or nvidia corporation subfolders each, which made me assume most of it was fluff. so I copied the vhd to another drive and ventured to delete all of them, as I thought most of the essential files would be in system32. whatever would not delete for being open, I left where it was and rebooted. It still works fine. So I do not think it is unmaidenly of us to think that there is much more fluff around. Alacrán might call this chopping, I call this effective informed mutilation. the most important thing is that any such change be followed by a registry1staid run to repair any possible missing link. Now I will go around other folders and subfolders on c:\ and tell u if anything of the kind can be safely done on them as well.

[wimb]

will that stop etl files from proliferating all over inside the vhd? wonko and I saw otherwise at the outset, etl files being the first and most evident to contribute to used space growth inside the vhd, if I remember correctly.

 

The *.etl files is not a real problem. They are mostly below 1 MB and a few have size 20 - 50 MB

Who cares about the kB where we have a 6 GB growth problem ....

 

WindowsUpdate is the real problem where fresh Win10x64 2004 version (+ some programs)  of size 5 GB can grow to 11.5 GB just by allowing september Windows Update.

 

The Firewall App Blocker (Fab) using Enable WhiteList with Allow Internet Browser only as Setting can block unwanted internet traffic including Windows Update.

This is the easiest way to prevent the rapid growth of the UsedSize inside the Win10x64 VHD

 

Without using FAB == Using FAB to Block Windows Update and still have access to Internet

 

== 

[antonino61]

tx, wimb, but I took for granted that we wanted no updates at all. I will try fabx64 anyway.

 

works fine with me too. u r right when u say that etl's amount to only a few megs, but it is honestly the only growth I have that is evident (used-space-wise).

 

in any case, since fab proves so effective, it would be wonderful to have a list of all suspects to include in its whitelist in order to discourage and prevent unwanted external editions of, and additions to, whatever is on the vhd.

 

btw, wimb, u may appear to be no theoretical philosopher, but u must definitely be a master of praxis!!!  attaboy, wimb!!!

[wimb]

tx, wimb, but I took for granted that we wanted no updates at all. I will try fabx64 anyway.

 

works fine with me too. u r right when u say that etl's amount to only a few megs, but it is honestly the only growth I have that is evident (used-space-wise).

 

You are booting with Win10x64 LTSC from RAMDISK with small size so that you have no Windows Update problem.

 

In booting the normal available Win10x64 version 2004 as FILEDISK then the UsedSize due to Windows Update is growing by 6GB 

That problem is easily solved with the Firewall App Blocker (Fab) using Enable WhiteList with Allow Internet Browser only as Setting

which can block unwanted internet traffic including Windows Update.    and that you still have access to Internet.

 

Windows Update can be Paused for 35 days , but it is better to use the Firewall App Blocker (Fab) so that the Windows Update problem is solved 

 

[gbrao]

@wimb

 

I stop win updates with

https://www.sordum.o...e-blocker-v1-5/

 

Not sure if that's approp for your usage.

[wimb]

I stop win updates with

https://www.sordum.o...e-blocker-v1-5/

 

 

Sure, that is a very good solution to Block Windows Update    Very nice App.

 

With Firewall App Blocker (Fab) you can simply Block everything including Windows Update and still Allow your Internet Browser to have Access to Internet.

 

Both Apps are very useful  

[gbrao]

Are you sure FAB disables Windows Update ?

 

I use both :-)

[wimb]

Are you sure FAB disables Windows Update ?

 

I use both :-)

 

Yes when you use FAB Enable WhiteList and Allow only Internet Browser for Access to Internet.

 

As you can see Windows Update is Blocked with this setting.

In fact everything is Blocked except your Internet Browser which is on the WhiteList. 

 

[antonino61]

@wimb

getting back to the shrinking and used space bulging detection, have u checked the softwaredistribution subfolder in windows and programdata? that is periodically one of the culprits. 

[gbrao]

Yes when you use FAB Enable WhiteList and Allow only Internet Browser for Access to Internet.

 

As you can see Windows Update is Blocked with this setting.

In fact everything is Blocked except your Internet Browser which is on the WhiteList. 

 

 

This is what the dev says re FAB in whitelist mode : "Probably yes, could you please test it and share the result with us."

 

[Wonko the Sane]

This is what the dev says re FAB in whitelist mode : "Probably yes, could you please test it and share the result with us."

 

... and ?

 

What did you want\expect, an unlimited perpetual warranty? 

 

Is it safe?

 

https://www.imdb.com...uotes/qt0247572

 

Wonko

[gbrao]

... and ?

 

What did you want\expect, an unlimited perpetual warranty? 

 

Is it safe?

 

https://www.imdb.com...uotes/qt0247572

 

Wonko

All i wanted was for the dev to say yes or no.

As a dev he would know.

[Wonko the Sane]

All i wanted was for the dev to say yes or no.

As a dev he would know.

Not necessarily.

 

The idea of the whitelist mode is to block *everything* BUT the whitelisted app.

 

So, in theory the answer is yes (or of course yes or definitely yes), but in practice it may vary, from probably yes to likely yes or plausibly yes.

 

Things are usually not black and white, they tend to be all shades of gray:

http://reboot.pro/to...lack-and-white/

 

Wimb actually tested it and showed how, on his machine, it worked just fine, don't you trust his report?

 

 

Wonko

[gbrao]

 

Programs on Sordum.org are teamwork. BlueLife contributes to program coding. We have tested it on Windows 10 and update failed while Fab White List mod is active.

From the dev.

[alacran]

Then you should be convinced now, to me wimb test was enough.

 

alacran

[wimb]

 

The present approach of Apply Compact LZX mode as FILEDISK with UsedSize = 3 - 5 GB and Apply WimBoot mode as RAMDISK with UsedSize 200 - 600 MB works quite well.

So there is no need to chop Or reduce size which has the advantage that the Win10x64 OS has full functionality.

What I can do is integrate Reduce WinSxS of cdob as extra Option in Apply Compact modes of VHD_WIMBOOT. That does not reduce the functionality.

 

from alacran

 

But I suggest to apply it before Capture, doing it this way will help reduce the captured WIM file too (which is good for Wimboot too), or maybe better if added as a separate and independent feature, to let the user run it when he prefers, even on already made final VHD Compact mode installations, letting this way to test it, before make a rebuild.

 

Here it is      WinSxS_Reduce_Trusted as a separate tool

 

Download: WinSxS_Reduce_Trusted from GitHub Or WinSxS_Reduce_Trusted from reboot.pro - Use 7-zip context menu to Unpack here

 

Download and Unpack here and just double click to run WinSxS_Reduce_Trusted.cmd to Reduce WinSxS folder in Offline Windows e.g. Mounted VHD

 

The Used Size inside Win10x64 2004 Compact LZX VHD is reduced in 10 seconds of time from 5.36 GB down to 4.66 GB - Reduction of 0.70 GB in Compact LZX Install

 

In my case initially WinSxS has 51.969 files in 15.463 folders - After WinSxS Reduce in 10 seconds I have 57 files in 22 folders   

 

More Info:

 -Double click on WinSxS_Reduce_Trusted.cmd to Reduce WinSxS folder in Offline Windows e.g. Mounted VHD

- Program requires to be Trusted Installer in Windows 7/8/10 x64 OS and can also be used in Win10XPE x64 environment 

- In WinSxS_Reduce_Trusted.cmd the App AdvancedRun.exe is used in case of 7/8/10 x64 OS to launch WinSxS_Reduce_x64.exe as Trusted Installer

 

Credits and Thanks to:

- cdob for making the core batch program base_winsxs.cmd slightly modified by wimb as base_winsxs_2.cmd

- Nir Sofer for making AdvancedRun (64-bit)

 

Prog User Interface == WinSxS Before == WinSxS Reduce == WinSxS After == WinSxS Boot VHD

 

==  ==  == ==

 

[antonino61]

Dear Wimb, 

it works fine, but for 2 pieces of software, for which I have to restore the original manifests subfolder. I think I have already posted this minor perplexity weeks ago. I still don't know which files from the original manifests the system needs in order for the software to work back again, otherwise I would add only those files. is there anyway to determine that before copying back the whole manifests subfolder?

[alacran]

And I think you will never know,

 

I think only way to find those required for your needs is removing one by one untill your problematic programs faill, just by curiosity I checked the folder Windows\WinSxS\Manifests on my Win10x64 2004 and in my case it has 17,044 files, almost all of them are smaller than 1 KB (this means 4 KB of disk used size each). Too much work to find the culprit(s)

 

Or maybe send to recycle bin on batches of 50 or 100 files each time and once the programs faill, restore that batch and remove smaller size batches, to isolate in which batch is one of the culprits.

 

Hope you enjoy the task.

 

alacran

[wimb]

Dear Wimb, 

it works fine, but for 2 pieces of software, for which I have to restore the original manifests subfolder. I think I have already posted this minor perplexity weeks ago. I still don't know which files from the original manifests the system needs in order for the software to work back again, otherwise I would add only those files. is there anyway to determine that before copying back the whole manifests subfolder?

 

You might check what is the change in the Manifests folder when you Install the two pieces of software. Then you know what Manifests are needed in your case.

Just use Dir_List on Manifests folder before and after you Install the two pieces of software and then use notepad++ to compare the filelists ....

 

How about re-install the two pieces of software After using WinSxS_Reduce_Trusted.cmd ?

Does the software work and what Manifests have been added ?

It will be an easy task since after WinSxS_Reduce_Trusted.cmd there are only 24 files in the Manifests folder 

[Wonko the Sane]

 almost all of them are smaller than 1 KB (this means 4 KB of disk used size each).

Only for the record not really-really (on NTFS).

If they are below 700 bytes or so (it depends on their filename , that usually is very loong for those files) they will take no storage clusters on a 512 bytes/sector disk, as they will be resident in the $MFT, JFYI:

https://www.forensic...-resident-data/

 

https://www.forensic...a/#post-6565939

 

On a 4 K disk the limit is around 3700 bytes.

 

Wonko

[antonino61]

@wimb

they won't even install right after the reduction, as was the case a few weeks ago.