On Fri, 30 Jul 2021 15:18:58 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>
>> I really wish BIL was savvy enough to do all you suggest. Once he
>> boots up the Windows DVD it's going to be him reading to me what's on
>> the screen. I seem to remember though that selecting "Custom" install
>> tells you that everything on the drive will be erased. Since there is
>> only one partition on the drive that should replace my install. We
>> are scheduled to do this Tues. AM. How do I let myself get into these
>> things?!! BG
>
>You can do an install in a VirtualBox VM and take
>video of the screen (a built-in recorder inside VBox)
>of the whole thing. Here, I've selected keyframes
>and placed in an animated gif, with a intra-frame
>delay of 1000ms.
>
>https://i.postimg.cc/8PDFxydS/win7-install.gif
>
>On the viewing page for that, is a "Save as Original"
>or similar button, and using the download feature
>preserves the original resolution. Which in this
>case, isn't all that wonderful :-)
>
>Animated GIFs can be dropped on a browser when you
>want to view them. It's possible opening an animated
>GIF in GIMP, will give you the frames as layers
>in the layer dialog. As that's how the animated GIF
>was made in the first place, was using GIMP.

Man, where do you find the time to do all that you do for everyone?!

Thank you very much for doing this. Once I opened it in Photoshop I
could make each layer visible and see how you deleted the two
partitions. It went by too fast for me to see it, playing at normal
speed. Very helpful!

>>>>>>>>>>jetjock<<<<<<<<<<

On Fri, 30 Jul 2021 at 16:10:37, Java Jive <java@evij.com.invalid> wrote
(my responses usually follow points raised):
>On 30/07/2021 15:30, jetjock wrote:
>> I really wish BIL was savvy enough to do all you suggest. Once
>>he
>> boots up the Windows DVD it's going to be him reading to me what's on
>> the screen. I seem to remember though that selecting "Custom" install
>> tells you that everything on the drive will be erased. Since there is
>> only one partition on the drive that should replace my install. We
>> are scheduled to do this Tues. AM. How do I let myself get into these
>> things?!! BG
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>
>Perhaps a zoom video session via mobile phone? I believe you can use
>the service free for 40mins at a time.
>
I have at least twice helped my blind friends restore from a Macrium
image, using Skype over her iPhone to see the screen, so it can be done.
Should be easier in your case as at least you can direct your brother to
point the 'phone at relevant parts of the screen, and he can see what
you want; in my case, she couldn't of course see what the 'phone was
seeing.

(If you're wondering why they have a monitor at all, it's for the
benefit of sighted friends who visit, whom they ask to do various things
on the PC. The restores were both because of replacements of the single
HD that her SFF desktop could take - once when they'd voluntarily wanted
to replace it with a bigger one, once when one of them had died.)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

It is complete loose-stool-water, it is arse-gravy of the worst kind
- Stephen Fry on "The Da Vinci Code"

On Sun, 1 Aug 2021 01:57:01 +0100, "J. P. Gilliver (John)"
<G6JPG@255soft.uk> wrote:

>On Fri, 30 Jul 2021 at 16:10:37, Java Jive <java@evij.com.invalid> wrote
>(my responses usually follow points raised):
>>On 30/07/2021 15:30, jetjock wrote:
>>> I really wish BIL was savvy enough to do all you suggest. Once
>>>he
>>> boots up the Windows DVD it's going to be him reading to me what's on
>>> the screen. I seem to remember though that selecting "Custom" install
>>> tells you that everything on the drive will be erased. Since there is
>>> only one partition on the drive that should replace my install. We
>>> are scheduled to do this Tues. AM. How do I let myself get into these
>>> things?!! BG
>>>
>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>
>>Perhaps a zoom video session via mobile phone? I believe you can use
>>the service free for 40mins at a time.
>>
>I have at least twice helped my blind friends restore from a Macrium
>image, using Skype over her iPhone to see the screen, so it can be done.
>Should be easier in your case as at least you can direct your brother to
>point the 'phone at relevant parts of the screen, and he can see what
>you want; in my case, she couldn't of course see what the 'phone was
>seeing.
>
>(If you're wondering why they have a monitor at all, it's for the
>benefit of sighted friends who visit, whom they ask to do various things
>on the PC. The restores were both because of replacements of the single
>HD that her SFF desktop could take - once when they'd voluntarily wanted
>to replace it with a bigger one, once when one of them had died.)

We are going to try Zoom. Since I will have to get into the BIOS to
check for AHCI and boot order, it will much easier if I can see the
screen,

>>>>>>>>>>jetjock<<<<<<<<<<

On 7/27/2021 3:05 PM, jetjock wrote:
> On Sat, 24 Jul 2021 11:31:40 -0500, jetjock <jetjock@unkown.com>
> wrote:
>
>> On Fri, 23 Jul 2021 16:04:06 -0400, Paul <nospam@needed.invalid>
>> wrote:
>>
>>> jetjock wrote:
>>>> On Thu, 22 Jul 2021 19:10:44 -0400, Paul <nospam@needed.invalid>
>>>> wrote:
>>>>
>>>>> jetjock wrote:
>>>>>> Brother-in-Law's hard drive went TU and all he has is a Seagate
>>>>>> backup. As far as I have been able to learn about Seagate backups is
>>>>>> all they do is back up data: They don't make a restorable image. First
>>>>>> question, is that right or can he just restore that backup to a new
>>>>>> SSD?
>>>>>>
>>>>>> Next question. Assuming I'm right about his not being able to
>>>>>> restore from his backup, if I were to install Win 7 and Office 2010 on
>>>>>> a new SSD using my computer, would he be able to plug the SSD into his
>>>>>> computer and have it work as required? He is NOT remotely computer
>>>>>> literate, so unless it works out of the box with only minor fixes that
>>>>>> I could help him with over the phone, it's a no go. Thanks!
>>>>>>
>>>>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>>>> This is the very definition of the "bad news bears".
>>>>>
>>>>> https://www.seagate.com/ca/en/support/kb/seagate-dashboard-installation-backup-verify-restore-and-features-006148en/
>>>>>
>>>>> "Note: The software is very sensitive to changes, even small modifications
>>>>> (whether by you or a program) will result in the data being backed
>>>>> up again.
>>>>>
>>>>> The software does not backup programs, system files,
>>>>> hidden folders/items.
>>>>>
>>>>> Some software like Outlook, Quicken, and Quickbooks allow you to
>>>>> backup/export data to the Seagate drive. In these instances
>>>>> you will want to follow those instructions.
>>>>> "
>>>>>
>>>>> If the COA is also scratched off the laptop, I'd
>>>>> find another brother-in-law :-)
>>>>>
>>>>> Did the esteemed gentleman pop blank optical media
>>>>> into the drive, as instructed by the OS/computer ?
>>>>
>>>> No. I'm afraid that he is very handy with tools, but when it comes to
>>>> computers his knowledge stops with the On-Off switch.
>>>>> My Acer asked for four DVDs or so, to make a backup
>>>>> copy of Windows 7 for restoration. This was probably
>>>>> Home Premium. I still have the DVDs.
>>>>>
>>>>> If he has those DVDs, just send him a blank SSD.
>>>>> Booting off the DVDs, starts the recovery sequence onto
>>>>> the SSD.
>>>>
>>>> If only! :-) The dive apparently is toast now as it will not boot at
>>>> all. We tried doing an F-8 boot and repair, but it was unable to
>>>> repair. His computer guy (whom I don't trust) said the drive was
>>>> shot.
>>>>> This won't put Office on there. That will be some separate
>>>>> work over the phone for it.
>>>>
>>>> How much can I pre load on the new drive i.e Office 2010,
>>>> MalwareBytes, Acronis TIH before it will balk when he plugs it into
>>>> his computer as his OS boot drive? I'm pretty sure that Win 7 and
>>>> Office will both have to activated on HIS computer to work, or could
>>>> they be activated on mine using the Toolkit (DAZ Loader)?
>>>>> But with the OS image missing from any backup, there won't
>>>>> be key extraction or anything else to use.
>>>>>
>>>>> There are probably twenty or more backup programs, even
>>>>> the DiscWarrior would have worked, to make this mess, less
>>>>> of a mess.
>>>>
>>>> I intend to give him an old version of my Acronis TIH 2019 since the
>>>> new versions have switched to subscriptions. If I activate it on my
>>>> machine will it still work on his, or does it have to be activated on
>>>> his?
>>>>
>>>> Thank you for the help.
>>>
>>> You could sysprep a drive, but you can see from the amount
>>> of comments about the process, that this is not a hands-off
>>> process complete with "free pony".
>>>
>>> https://superuser.com/questions/412498/what-would-happen-if-i-take-my-hard-drive-out-of-my-current-pc-and-put-it-in-a-n
>>>
>>> I tried a sysprep here once, but it wasn't with Windows 7,
>>> and the damn thing trashed all the pre-staged software,
>>> making the notion kinda useless. It's my noob level of
>>> inexperience with sysprep, that makes me the wrong person
>>> for this task.
>>
>> I don't think sysprep is the way to go here since I will be starting
>> with a clean drive already. Also, I don't think he would know what to
>> do if there were problems with startup.
>>>
>>> Yes, you get to watch a new OS start up, but what
>>> you're left with, has basically only done the
>>> "insert DVD, install, now tons of other stuff to do"
>>> step. This is hardly the level of completion required
>>> for your B-I-L.
>>>
>>> As for installing and activating software on your
>>> machine, putting in a box, item arrives at B-I-L,
>>> how seamless would that process be ? Would the
>>> recipient need excellent observational skills
>>> and the correct vocabulary to describe what
>>> is happening ?
>>>
>>> None of this, in my estimation, involves a "free pony".
>>> Only if the laptop is shipped to you, and you bolt it
>>> all together, is it going to be a "free pony". Even if
>>> you remoted in, I doubt it would be completely seamless.
>>>
>>> Paul
>>
>> If it was a laptop this would be a very simple operation! I will
>> ship him a Win 7 CD and an Office CD along with the drive so if the
>> thing won't boot when he gets it, he ain't any further behind than if
>> he just bought a new SSD. I guess the only way to find out if it
>> will work is to try it. :-)
>
> I thought that anyone following this thread might like to know that it
> didn't work. I installed Win 7 Ultimate 64 on the new drive in an old
> Dell desktop I have, and then moved it to my desktop. It refused to
> boot. Error came up about a driver problem which didn't surprise me.
> At least I tried!
>>
>> Many thanks for your time and help. I always love hearing from you
>> guys who know so much more than I. Appreciated!!
>>
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>
> >>>>>>>>>>jetjock<<<<<<<<<<
>

It is possible to make a Windows install disk with drivers added for any
needed Pc components. I forget at this moment the particular utility I
used to do this.

On Fri, 6 Aug 2021 13:05:18 -0700, Bob F <bobnospam@gmail.com> wrote:

>On 7/27/2021 3:05 PM, jetjock wrote:
>> On Sat, 24 Jul 2021 11:31:40 -0500, jetjock <jetjock@unkown.com>
>> wrote:
>>
>>> On Fri, 23 Jul 2021 16:04:06 -0400, Paul <nospam@needed.invalid>
>>> wrote:
>>>
>>>> jetjock wrote:
>>>>> On Thu, 22 Jul 2021 19:10:44 -0400, Paul <nospam@needed.invalid>
>>>>> wrote:
>>>>>
>>>>>> jetjock wrote:
>>>>>>> Brother-in-Law's hard drive went TU and all he has is a Seagate
>>>>>>> backup. As far as I have been able to learn about Seagate backups is
>>>>>>> all they do is back up data: They don't make a restorable image. First
>>>>>>> question, is that right or can he just restore that backup to a new
>>>>>>> SSD?
>>>>>>>
>>>>>>> Next question. Assuming I'm right about his not being able to
>>>>>>> restore from his backup, if I were to install Win 7 and Office 2010 on
>>>>>>> a new SSD using my computer, would he be able to plug the SSD into his
>>>>>>> computer and have it work as required? He is NOT remotely computer
>>>>>>> literate, so unless it works out of the box with only minor fixes that
>>>>>>> I could help him with over the phone, it's a no go. Thanks!
>>>>>>>
>>>>>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>>>>> This is the very definition of the "bad news bears".
>>>>>>
>>>>>> https://www.seagate.com/ca/en/support/kb/seagate-dashboard-installation-backup-verify-restore-and-features-006148en/
>>>>>>
>>>>>> "Note: The software is very sensitive to changes, even small modifications
>>>>>> (whether by you or a program) will result in the data being backed
>>>>>> up again.
>>>>>>
>>>>>> The software does not backup programs, system files,
>>>>>> hidden folders/items.
>>>>>>
>>>>>> Some software like Outlook, Quicken, and Quickbooks allow you to
>>>>>> backup/export data to the Seagate drive. In these instances
>>>>>> you will want to follow those instructions.
>>>>>> "
>>>>>>
>>>>>> If the COA is also scratched off the laptop, I'd
>>>>>> find another brother-in-law :-)
>>>>>>
>>>>>> Did the esteemed gentleman pop blank optical media
>>>>>> into the drive, as instructed by the OS/computer ?
>>>>>
>>>>> No. I'm afraid that he is very handy with tools, but when it comes to
>>>>> computers his knowledge stops with the On-Off switch.
>>>>>> My Acer asked for four DVDs or so, to make a backup
>>>>>> copy of Windows 7 for restoration. This was probably
>>>>>> Home Premium. I still have the DVDs.
>>>>>>
>>>>>> If he has those DVDs, just send him a blank SSD.
>>>>>> Booting off the DVDs, starts the recovery sequence onto
>>>>>> the SSD.
>>>>>
>>>>> If only! :-) The dive apparently is toast now as it will not boot at
>>>>> all. We tried doing an F-8 boot and repair, but it was unable to
>>>>> repair. His computer guy (whom I don't trust) said the drive was
>>>>> shot.
>>>>>> This won't put Office on there. That will be some separate
>>>>>> work over the phone for it.
>>>>>
>>>>> How much can I pre load on the new drive i.e Office 2010,
>>>>> MalwareBytes, Acronis TIH before it will balk when he plugs it into
>>>>> his computer as his OS boot drive? I'm pretty sure that Win 7 and
>>>>> Office will both have to activated on HIS computer to work, or could
>>>>> they be activated on mine using the Toolkit (DAZ Loader)?
>>>>>> But with the OS image missing from any backup, there won't
>>>>>> be key extraction or anything else to use.
>>>>>>
>>>>>> There are probably twenty or more backup programs, even
>>>>>> the DiscWarrior would have worked, to make this mess, less
>>>>>> of a mess.
>>>>>
>>>>> I intend to give him an old version of my Acronis TIH 2019 since the
>>>>> new versions have switched to subscriptions. If I activate it on my
>>>>> machine will it still work on his, or does it have to be activated on
>>>>> his?
>>>>>
>>>>> Thank you for the help.
>>>>
>>>> You could sysprep a drive, but you can see from the amount
>>>> of comments about the process, that this is not a hands-off
>>>> process complete with "free pony".
>>>>
>>>> https://superuser.com/questions/412498/what-would-happen-if-i-take-my-hard-drive-out-of-my-current-pc-and-put-it-in-a-n
>>>>
>>>> I tried a sysprep here once, but it wasn't with Windows 7,
>>>> and the damn thing trashed all the pre-staged software,
>>>> making the notion kinda useless. It's my noob level of
>>>> inexperience with sysprep, that makes me the wrong person
>>>> for this task.
>>>
>>> I don't think sysprep is the way to go here since I will be starting
>>> with a clean drive already. Also, I don't think he would know what to
>>> do if there were problems with startup.
>>>>
>>>> Yes, you get to watch a new OS start up, but what
>>>> you're left with, has basically only done the
>>>> "insert DVD, install, now tons of other stuff to do"
>>>> step. This is hardly the level of completion required
>>>> for your B-I-L.
>>>>
>>>> As for installing and activating software on your
>>>> machine, putting in a box, item arrives at B-I-L,
>>>> how seamless would that process be ? Would the
>>>> recipient need excellent observational skills
>>>> and the correct vocabulary to describe what
>>>> is happening ?
>>>>
>>>> None of this, in my estimation, involves a "free pony".
>>>> Only if the laptop is shipped to you, and you bolt it
>>>> all together, is it going to be a "free pony". Even if
>>>> you remoted in, I doubt it would be completely seamless.
>>>>
>>>> Paul
>>>
>>> If it was a laptop this would be a very simple operation! I will
>>> ship him a Win 7 CD and an Office CD along with the drive so if the
>>> thing won't boot when he gets it, he ain't any further behind than if
>>> he just bought a new SSD. I guess the only way to find out if it
>>> will work is to try it. :-)
>>
>> I thought that anyone following this thread might like to know that it
>> didn't work. I installed Win 7 Ultimate 64 on the new drive in an old
>> Dell desktop I have, and then moved it to my desktop. It refused to
>> boot. Error came up about a driver problem which didn't surprise me.
>> At least I tried!
>>>
>>> Many thanks for your time and help. I always love hearing from you
>>> guys who know so much more than I. Appreciated!!
>>>
>>>
>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>>
>
>It is possible to make a Windows install disk with drivers added for any
>needed Pc components. I forget at this moment the particular utility I
>used to do this.

Mine has SP1 slip-streamed into it. Problem with doing that with
drivers is I never know ahead of time which ones are needed.

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock <jetjock@unkown.com> wrote:
....
> >It is possible to make a Windows install disk with drivers added for any
> >needed Pc components. I forget at this moment the particular utility I
> >used to do this.

> Mine has SP1 slip-streamed into it. Problem with doing that with
> drivers is I never know ahead of time which ones are needed.

Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
--
2021 is repeating 2020. :( Please get your vaccine shot(s) if you haven't done so! :)
Note: A fixed width font (Courier, Monospace, etc.) is required to see this signature correctly.
/\___/\ Ant(Dude) @ http://aqfl.net & http://antfarm.home.dhs.org.
/ /\ /\ \ Please nuke ANT if replying by e-mail.
| |o o| |
\ _ /
( )

On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:

>jetjock <jetjock@unkown.com> wrote:
>...
>> >It is possible to make a Windows install disk with drivers added for any
>> >needed Pc components. I forget at this moment the particular utility I
>> >used to do this.
>
>> Mine has SP1 slip-streamed into it. Problem with doing that with
>> drivers is I never know ahead of time which ones are needed.
>
>Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?

Don't know. It might still be there.

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock wrote:
> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>
>> jetjock <jetjock@unkown.com> wrote:
>> ...
>>>> It is possible to make a Windows install disk with drivers added for any
>>>> needed Pc components. I forget at this moment the particular utility I
>>>> used to do this.
>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>> drivers is I never know ahead of time which ones are needed.
>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>
> Don't know. It might still be there.
>

What do you need to do an install ?

1) Microsoft Basic Display Adapter driver AKA VESA driver.
This makes the frame buffer work. No 3D acceleration.

2) SATA driver. Must be able to boot from hard drive or SSD.

3) Network driver. A nice to have, but can also be solved by
using the motherboard CD.

F6 was mainly for adding the AHCI driver on WinXP. The
IDE driver was already in the OS. There are other things
that need drivers, such as your PERC, but if you own a
PERC, you probably own a clue too :-) The PERC is likely
inbox, with a few others of that nature (Areca). Part of the
boring portion of installer CD startup, was going through
the list of RAID controller cards, one at a time.

The situation does not look that "tense" to me.

And you have things like DISM. The WADK has the tools
you need to spin new ISO files.

Paul

On Sun, 08 Aug 2021 14:15:20 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>>
>>> jetjock <jetjock@unkown.com> wrote:
>>> ...
>>>>> It is possible to make a Windows install disk with drivers added for any
>>>>> needed Pc components. I forget at this moment the particular utility I
>>>>> used to do this.
>>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>>> drivers is I never know ahead of time which ones are needed.
>>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>>
>> Don't know. It might still be there.
>>
>
>What do you need to do an install ?
>
>1) Microsoft Basic Display Adapter driver AKA VESA driver.
> This makes the frame buffer work. No 3D acceleration.
>
>2) SATA driver. Must be able to boot from hard drive or SSD.
>
>3) Network driver. A nice to have, but can also be solved by
> using the motherboard CD.
>
>F6 was mainly for adding the AHCI driver on WinXP. The
>IDE driver was already in the OS. There are other things
>that need drivers, such as your PERC, but if you own a
>PERC, you probably own a clue too :-) The PERC is likely
>inbox, with a few others of that nature (Areca). Part of the
>boring portion of installer CD startup, was going through
>the list of RAID controller cards, one at a time.
>
>The situation does not look that "tense" to me.
>
>And you have things like DISM. The WADK has the tools
>you need to spin new ISO files.
>

Many thanks for the great info. Now all I have to do is look up what
all the abbreviations mean! (Except RAID & ISO) :-)

I did manage to get all the needed drivers installed except for SM Bus
Controller. I couldn't find anything at HP's Site, or anywhere else
for that matter, so I got Driver Easy and will see if it can find one.
He has been tied up since we last worked on his computer, but we will
get back to it on Thurs. or Fri.

Just for info purposes, that HP computer was the biggest pain in the
ass to work on of any machine I have ever used.

First off, they have this cutesy splash screen during boot up that
only gives you a key stroke to get into some HP setup area; nothing to
tell you how to get into the BIOS. After trying DEL, ESC, F2, F6, &
F8, we finally found that F10 was what we needed. Then, when I
finally got into the BIOS and looking at every setting, there was
nothing there for checking onboard SATA type or sleep state. I
realize that this is all a function of the Motherboard (Pegatron
IPISB-CU Carmel 2), but HP chose to use it. I was able to find a
place to set the boot order, but once again it turned into a
convoluted, needlessly complicated process. Then the fun began!! The
damn machine would boot to the Windows DVD, but simply refused to
start installing on the SSD. I finally had to unplug the SSD, start
the install and hot plug the SSD (I know...very bad thing, but it was
the only way to get that machine to start the install!!). Once I
figured all that out, over ZOOM no less, the install went smoothly.
The only further hiccup was getting a network driver installed so I
could use Team Viewer. Once BIL "remembered" that he had a wireless
plug in dongle, and a CD with the driver, (after spending 15 minutes
trying to figure out why he didn't have any network connections
available), we were in business. By then we had killed about 1 1/2
hours doing what should have taken 15 minutes! Now it's just a matter
of getting that SM Bus Controller driver and installing software.

I really appreciate all of you who have helped with your advice and
suggestions. Many thanks!!

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock wrote:
> On Sun, 08 Aug 2021 14:15:20 -0400, Paul <nospam@needed.invalid>
> wrote:
>
>> jetjock wrote:
>>> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>>>
>>>> jetjock <jetjock@unkown.com> wrote:
>>>> ...
>>>>>> It is possible to make a Windows install disk with drivers added for any
>>>>>> needed Pc components. I forget at this moment the particular utility I
>>>>>> used to do this.
>>>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>>>> drivers is I never know ahead of time which ones are needed.
>>>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>>> Don't know. It might still be there.
>>>
>> What do you need to do an install ?
>>
>> 1) Microsoft Basic Display Adapter driver AKA VESA driver.
>> This makes the frame buffer work. No 3D acceleration.
>>
>> 2) SATA driver. Must be able to boot from hard drive or SSD.
>>
>> 3) Network driver. A nice to have, but can also be solved by
>> using the motherboard CD.
>>
>> F6 was mainly for adding the AHCI driver on WinXP. The
>> IDE driver was already in the OS. There are other things
>> that need drivers, such as your PERC, but if you own a
>> PERC, you probably own a clue too :-) The PERC is likely
>> inbox, with a few others of that nature (Areca). Part of the
>> boring portion of installer CD startup, was going through
>> the list of RAID controller cards, one at a time.
>>
>> The situation does not look that "tense" to me.
>>
>> And you have things like DISM. The WADK has the tools
>> you need to spin new ISO files.
>>
>
> Many thanks for the great info. Now all I have to do is look up what
> all the abbreviations mean! (Except RAID & ISO) :-)
>
> I did manage to get all the needed drivers installed except for SM Bus
> Controller. I couldn't find anything at HP's Site, or anywhere else
> for that matter, so I got Driver Easy and will see if it can find one.
> He has been tied up since we last worked on his computer, but we will
> get back to it on Thurs. or Fri.
>
> Just for info purposes, that HP computer was the biggest pain in the
> ass to work on of any machine I have ever used.
>
> First off, they have this cutesy splash screen during boot up that
> only gives you a key stroke to get into some HP setup area; nothing to
> tell you how to get into the BIOS. After trying DEL, ESC, F2, F6, &
> F8, we finally found that F10 was what we needed. Then, when I
> finally got into the BIOS and looking at every setting, there was
> nothing there for checking onboard SATA type or sleep state. I
> realize that this is all a function of the Motherboard (Pegatron
> IPISB-CU Carmel 2), but HP chose to use it. I was able to find a
> place to set the boot order, but once again it turned into a
> convoluted, needlessly complicated process. Then the fun began!! The
> damn machine would boot to the Windows DVD, but simply refused to
> start installing on the SSD. I finally had to unplug the SSD, start
> the install and hot plug the SSD (I know...very bad thing, but it was
> the only way to get that machine to start the install!!). Once I
> figured all that out, over ZOOM no less, the install went smoothly.
> The only further hiccup was getting a network driver installed so I
> could use Team Viewer. Once BIL "remembered" that he had a wireless
> plug in dongle, and a CD with the driver, (after spending 15 minutes
> trying to figure out why he didn't have any network connections
> available), we were in business. By then we had killed about 1 1/2
> hours doing what should have taken 15 minutes! Now it's just a matter
> of getting that SM Bus Controller driver and installing software.
>
> I really appreciate all of you who have helped with your advice and
> suggestions. Many thanks!!

For Win7, SMBUS driver might be located in the "chipset driver package".

Let us hope this is on the driver CD, as the search for this
could be an obnoxious one (Intel site, Intel not interested in
supporting Win7).

A word associated with this driver is "INFINST". Knowing the
chipset number, then matching to the chipset name, helps
verify you're in the right territory.

https://en.wikipedia.org/wiki/Platform_Controller_Hub#Cougar_Point

For example "Cougar Point" or "cougar.inf" might be associated
with that chip. The chip number might be Q65 (Cougar Point with
Management Engine enabled). And identifiers like this, might be
part of verifying you have the right INFINST file.

Quite frequently, the driver installer adds a text string to
Device Manager, but no DLL is added to the Driver Store. These
are sham drivers from Intel. Only a few of the drivers are "essential".
Most of the drivers simply tidy up the appearance of the Device
Manager when you review it.

For Windows 7, an Intel USB3 driver is "real". A USB2 driver
has #include usbport, to call up the Microsoft driver file
to do the real install. Intel is not allowed to add DLLs for
USB2, but is allowed to do that for USB3 ports (if they exist),
but only on Windows 7. On Win8 or Win10, Microsoft provides
the USB3 drivers and Intel does not.

Paul

On Mon, 09 Aug 2021 13:53:48 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> On Sun, 08 Aug 2021 14:15:20 -0400, Paul <nospam@needed.invalid>
>> wrote:
>>
>>> jetjock wrote:
>>>> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>>>>
>>>>> jetjock <jetjock@unkown.com> wrote:
>>>>> ...
>>>>>>> It is possible to make a Windows install disk with drivers added for any
>>>>>>> needed Pc components. I forget at this moment the particular utility I
>>>>>>> used to do this.
>>>>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>>>>> drivers is I never know ahead of time which ones are needed.
>>>>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>>>> Don't know. It might still be there.
>>>>
>>> What do you need to do an install ?
>>>
>>> 1) Microsoft Basic Display Adapter driver AKA VESA driver.
>>> This makes the frame buffer work. No 3D acceleration.
>>>
>>> 2) SATA driver. Must be able to boot from hard drive or SSD.
>>>
>>> 3) Network driver. A nice to have, but can also be solved by
>>> using the motherboard CD.
>>>
>>> F6 was mainly for adding the AHCI driver on WinXP. The
>>> IDE driver was already in the OS. There are other things
>>> that need drivers, such as your PERC, but if you own a
>>> PERC, you probably own a clue too :-) The PERC is likely
>>> inbox, with a few others of that nature (Areca). Part of the
>>> boring portion of installer CD startup, was going through
>>> the list of RAID controller cards, one at a time.
>>>
>>> The situation does not look that "tense" to me.
>>>
>>> And you have things like DISM. The WADK has the tools
>>> you need to spin new ISO files.
>>>
>>
>> Many thanks for the great info. Now all I have to do is look up what
>> all the abbreviations mean! (Except RAID & ISO) :-)
>>
>> I did manage to get all the needed drivers installed except for SM Bus
>> Controller. I couldn't find anything at HP's Site, or anywhere else
>> for that matter, so I got Driver Easy and will see if it can find one.
>> He has been tied up since we last worked on his computer, but we will
>> get back to it on Thurs. or Fri.
>>
>> Just for info purposes, that HP computer was the biggest pain in the
>> ass to work on of any machine I have ever used.
>>
>> First off, they have this cutesy splash screen during boot up that
>> only gives you a key stroke to get into some HP setup area; nothing to
>> tell you how to get into the BIOS. After trying DEL, ESC, F2, F6, &
>> F8, we finally found that F10 was what we needed. Then, when I
>> finally got into the BIOS and looking at every setting, there was
>> nothing there for checking onboard SATA type or sleep state. I
>> realize that this is all a function of the Motherboard (Pegatron
>> IPISB-CU Carmel 2), but HP chose to use it. I was able to find a
>> place to set the boot order, but once again it turned into a
>> convoluted, needlessly complicated process. Then the fun began!! The
>> damn machine would boot to the Windows DVD, but simply refused to
>> start installing on the SSD. I finally had to unplug the SSD, start
>> the install and hot plug the SSD (I know...very bad thing, but it was
>> the only way to get that machine to start the install!!). Once I
>> figured all that out, over ZOOM no less, the install went smoothly.
>> The only further hiccup was getting a network driver installed so I
>> could use Team Viewer. Once BIL "remembered" that he had a wireless
>> plug in dongle, and a CD with the driver, (after spending 15 minutes
>> trying to figure out why he didn't have any network connections
>> available), we were in business. By then we had killed about 1 1/2
>> hours doing what should have taken 15 minutes! Now it's just a matter
>> of getting that SM Bus Controller driver and installing software.
>>
>> I really appreciate all of you who have helped with your advice and
>> suggestions. Many thanks!!
>
>For Win7, SMBUS driver might be located in the "chipset driver package".
>
>Let us hope this is on the driver CD, as the search for this
>could be an obnoxious one (Intel site, Intel not interested in
>supporting Win7).
>
>A word associated with this driver is "INFINST". Knowing the
>chipset number, then matching to the chipset name, helps
>verify you're in the right territory.
>
>https://en.wikipedia.org/wiki/Platform_Controller_Hub#Cougar_Point
>
>For example "Cougar Point" or "cougar.inf" might be associated
>with that chip. The chip number might be Q65 (Cougar Point with
>Management Engine enabled). And identifiers like this, might be
>part of verifying you have the right INFINST file.
>
>Quite frequently, the driver installer adds a text string to
>Device Manager, but no DLL is added to the Driver Store. These
>are sham drivers from Intel. Only a few of the drivers are "essential".
>Most of the drivers simply tidy up the appearance of the Device
>Manager when you review it.
>
>For Windows 7, an Intel USB3 driver is "real". A USB2 driver
>has #include usbport, to call up the Microsoft driver file
>to do the real install. Intel is not allowed to add DLLs for
>USB2, but is allowed to do that for USB3 ports (if they exist),
>but only on Windows 7. On Win8 or Win10, Microsoft provides
>the USB3 drivers and Intel does not.

Final update for this thread, mainly for Paul.

During the Win install, it showed the system reserved partition and
the main partition that had Win already installed from when I had done
it on my machine. Remembering what Paul had showed me to delete both
partitions before installing the new OS, I tried deleting them both.
Was able to delete the system reserved one but it wouldn't delete the
OS one.

Install did proceed normally and after the install of Win 7 Ultimate
on BIL's computer, we got everything running and a few programs
installed. Had to quit then and computer sat for about a week while
he was gone. When we got back to it, things acted kind of flaky. i.e,
Windows Explorer would connect to Google & MSN, but would not connect
to DuckDuckGo; the control panel was empty, etc. The more I tried
working with it, the worse it got until I finally decided that Windows
was so borked that it had to be reinstalled.

During this install, we were able to delete both partitions and
install on a clean SSD. I have no idea why I couldn't delete the OS
partition the first time. Most likely operator error. From there on,
once we got all the drivers installed using Driver Easy Pro,
everything went smoothly (so far). We were able to transfer all the
data files from his old Seagate backup to the new OS successfully. We
still have to test the Acronis Boot Recovery disk, install
MalwareBytes and configure Avast AV, but since we have a good backup
to fall back on if needed now, we should be home free.

Thanks again to all who contributed! :-)

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock graced us with on 8/14/2021 9:06 AM:
> On Mon, 09 Aug 2021 13:53:48 -0400, Paul <nospam@needed.invalid>
> wrote:
>
>> jetjock wrote:
>>> On Sun, 08 Aug 2021 14:15:20 -0400, Paul <nospam@needed.invalid>
>>> wrote:
>>>
>>>> jetjock wrote:
>>>>> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>>>>>
>>>>>> jetjock <jetjock@unkown.com> wrote:
>>>>>> ...
>>>>>>>> It is possible to make a Windows install disk with drivers added for any
>>>>>>>> needed Pc components. I forget at this moment the particular utility I
>>>>>>>> used to do this.
>>>>>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>>>>>> drivers is I never know ahead of time which ones are needed.
>>>>>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>>>>> Don't know. It might still be there.
>>>>>
>>>> What do you need to do an install ?
>>>>
>>>> 1) Microsoft Basic Display Adapter driver AKA VESA driver.
>>>> This makes the frame buffer work. No 3D acceleration.
>>>>
>>>> 2) SATA driver. Must be able to boot from hard drive or SSD.
>>>>
>>>> 3) Network driver. A nice to have, but can also be solved by
>>>> using the motherboard CD.
>>>>
>>>> F6 was mainly for adding the AHCI driver on WinXP. The
>>>> IDE driver was already in the OS. There are other things
>>>> that need drivers, such as your PERC, but if you own a
>>>> PERC, you probably own a clue too :-) The PERC is likely
>>>> inbox, with a few others of that nature (Areca). Part of the
>>>> boring portion of installer CD startup, was going through
>>>> the list of RAID controller cards, one at a time.
>>>>
>>>> The situation does not look that "tense" to me.
>>>>
>>>> And you have things like DISM. The WADK has the tools
>>>> you need to spin new ISO files.
>>>>
>>> Many thanks for the great info. Now all I have to do is look up what
>>> all the abbreviations mean! (Except RAID & ISO) :-)
>>>
>>> I did manage to get all the needed drivers installed except for SM Bus
>>> Controller. I couldn't find anything at HP's Site, or anywhere else
>>> for that matter, so I got Driver Easy and will see if it can find one.
>>> He has been tied up since we last worked on his computer, but we will
>>> get back to it on Thurs. or Fri.
>>>
>>> Just for info purposes, that HP computer was the biggest pain in the
>>> ass to work on of any machine I have ever used.
>>>
>>> First off, they have this cutesy splash screen during boot up that
>>> only gives you a key stroke to get into some HP setup area; nothing to
>>> tell you how to get into the BIOS. After trying DEL, ESC, F2, F6, &
>>> F8, we finally found that F10 was what we needed. Then, when I
>>> finally got into the BIOS and looking at every setting, there was
>>> nothing there for checking onboard SATA type or sleep state. I
>>> realize that this is all a function of the Motherboard (Pegatron
>>> IPISB-CU Carmel 2), but HP chose to use it. I was able to find a
>>> place to set the boot order, but once again it turned into a
>>> convoluted, needlessly complicated process. Then the fun began!! The
>>> damn machine would boot to the Windows DVD, but simply refused to
>>> start installing on the SSD. I finally had to unplug the SSD, start
>>> the install and hot plug the SSD (I know...very bad thing, but it was
>>> the only way to get that machine to start the install!!). Once I
>>> figured all that out, over ZOOM no less, the install went smoothly.
>>> The only further hiccup was getting a network driver installed so I
>>> could use Team Viewer. Once BIL "remembered" that he had a wireless
>>> plug in dongle, and a CD with the driver, (after spending 15 minutes
>>> trying to figure out why he didn't have any network connections
>>> available), we were in business. By then we had killed about 1 1/2
>>> hours doing what should have taken 15 minutes! Now it's just a matter
>>> of getting that SM Bus Controller driver and installing software.
>>>
>>> I really appreciate all of you who have helped with your advice and
>>> suggestions. Many thanks!!
>> For Win7, SMBUS driver might be located in the "chipset driver package".
>>
>> Let us hope this is on the driver CD, as the search for this
>> could be an obnoxious one (Intel site, Intel not interested in
>> supporting Win7).
>>
>> A word associated with this driver is "INFINST". Knowing the
>> chipset number, then matching to the chipset name, helps
>> verify you're in the right territory.
>>
>> https://en.wikipedia.org/wiki/Platform_Controller_Hub#Cougar_Point
>>
>> For example "Cougar Point" or "cougar.inf" might be associated
>> with that chip. The chip number might be Q65 (Cougar Point with
>> Management Engine enabled). And identifiers like this, might be
>> part of verifying you have the right INFINST file.
>>
>> Quite frequently, the driver installer adds a text string to
>> Device Manager, but no DLL is added to the Driver Store. These
>> are sham drivers from Intel. Only a few of the drivers are "essential".
>> Most of the drivers simply tidy up the appearance of the Device
>> Manager when you review it.
>>
>> For Windows 7, an Intel USB3 driver is "real". A USB2 driver
>> has #include usbport, to call up the Microsoft driver file
>> to do the real install. Intel is not allowed to add DLLs for
>> USB2, but is allowed to do that for USB3 ports (if they exist),
>> but only on Windows 7. On Win8 or Win10, Microsoft provides
>> the USB3 drivers and Intel does not.
>
> Final update for this thread, mainly for Paul.
>
> During the Win install, it showed the system reserved partition and
> the main partition that had Win already installed from when I had done
> it on my machine. Remembering what Paul had showed me to delete both
> partitions before installing the new OS, I tried deleting them both.
> Was able to delete the system reserved one but it wouldn't delete the
> OS one.
>
> Install did proceed normally and after the install of Win 7 Ultimate
> on BIL's computer, we got everything running and a few programs
> installed. Had to quit then and computer sat for about a week while
> he was gone. When we got back to it, things acted kind of flaky. i.e,
> Windows Explorer would connect to Google & MSN, but would not connect
> to DuckDuckGo; the control panel was empty, etc. The more I tried
> working with it, the worse it got until I finally decided that Windows
> was so borked that it had to be reinstalled.
>
> During this install, we were able to delete both partitions and
> install on a clean SSD. I have no idea why I couldn't delete the OS
> partition the first time. Most likely operator error. From there on,
> once we got all the drivers installed using Driver Easy Pro,
> everything went smoothly (so far). We were able to transfer all the
> data files from his old Seagate backup to the new OS successfully. We
> still have to test the Acronis Boot Recovery disk, install
> MalwareBytes and configure Avast AV, but since we have a good backup
> to fall back on if needed now, we should be home free.
>
The only other suggestion I would offer would be to consider installing
Macrium Reflect 7.3 Free (https://www.macrium.com/reflectfree?mo) after
the system becomes stable. I've been using it for a couple of years to
do Clone backups and, recently with the help from Paul and others) to
use the multi-volume image backups instead of disk cloning. It really is
one of the most robust system backup programs out there, imo.

ymmv

--
Sailfish
CDC Covid19 Trends: https://www.facebook.com/groups/624208354841034
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg

On Sat, 14 Aug 2021 09:18:53 -0700, Sailfish
<NIXCAPSsailfish@NIXCAPSunforgettable.com> wrote:

>jetjock graced us with on 8/14/2021 9:06 AM:
>> On Mon, 09 Aug 2021 13:53:48 -0400, Paul <nospam@needed.invalid>
>> wrote:
>>
>>> jetjock wrote:
>>>> On Sun, 08 Aug 2021 14:15:20 -0400, Paul <nospam@needed.invalid>
>>>> wrote:
>>>>
>>>>> jetjock wrote:
>>>>>> On Sat, 07 Aug 2021 17:38:20 -0500, ant@zimage.comANT (Ant) wrote:
>>>>>>
>>>>>>> jetjock <jetjock@unkown.com> wrote:
>>>>>>> ...
>>>>>>>>> It is possible to make a Windows install disk with drivers added for any
>>>>>>>>> needed Pc components. I forget at this moment the particular utility I
>>>>>>>>> used to do this.
>>>>>>>> Mine has SP1 slip-streamed into it. Problem with doing that with
>>>>>>>> drivers is I never know ahead of time which ones are needed.
>>>>>>> Doesn't Windows have that F6 key to manually add drivers like in older Windows? Or did MS remove it?
>>>>>> Don't know. It might still be there.
>>>>>>
>>>>> What do you need to do an install ?
>>>>>
>>>>> 1) Microsoft Basic Display Adapter driver AKA VESA driver.
>>>>> This makes the frame buffer work. No 3D acceleration.
>>>>>
>>>>> 2) SATA driver. Must be able to boot from hard drive or SSD.
>>>>>
>>>>> 3) Network driver. A nice to have, but can also be solved by
>>>>> using the motherboard CD.
>>>>>
>>>>> F6 was mainly for adding the AHCI driver on WinXP. The
>>>>> IDE driver was already in the OS. There are other things
>>>>> that need drivers, such as your PERC, but if you own a
>>>>> PERC, you probably own a clue too :-) The PERC is likely
>>>>> inbox, with a few others of that nature (Areca). Part of the
>>>>> boring portion of installer CD startup, was going through
>>>>> the list of RAID controller cards, one at a time.
>>>>>
>>>>> The situation does not look that "tense" to me.
>>>>>
>>>>> And you have things like DISM. The WADK has the tools
>>>>> you need to spin new ISO files.
>>>>>
>>>> Many thanks for the great info. Now all I have to do is look up what
>>>> all the abbreviations mean! (Except RAID & ISO) :-)
>>>>
>>>> I did manage to get all the needed drivers installed except for SM Bus
>>>> Controller. I couldn't find anything at HP's Site, or anywhere else
>>>> for that matter, so I got Driver Easy and will see if it can find one.
>>>> He has been tied up since we last worked on his computer, but we will
>>>> get back to it on Thurs. or Fri.
>>>>
>>>> Just for info purposes, that HP computer was the biggest pain in the
>>>> ass to work on of any machine I have ever used.
>>>>
>>>> First off, they have this cutesy splash screen during boot up that
>>>> only gives you a key stroke to get into some HP setup area; nothing to
>>>> tell you how to get into the BIOS. After trying DEL, ESC, F2, F6, &
>>>> F8, we finally found that F10 was what we needed. Then, when I
>>>> finally got into the BIOS and looking at every setting, there was
>>>> nothing there for checking onboard SATA type or sleep state. I
>>>> realize that this is all a function of the Motherboard (Pegatron
>>>> IPISB-CU Carmel 2), but HP chose to use it. I was able to find a
>>>> place to set the boot order, but once again it turned into a
>>>> convoluted, needlessly complicated process. Then the fun began!! The
>>>> damn machine would boot to the Windows DVD, but simply refused to
>>>> start installing on the SSD. I finally had to unplug the SSD, start
>>>> the install and hot plug the SSD (I know...very bad thing, but it was
>>>> the only way to get that machine to start the install!!). Once I
>>>> figured all that out, over ZOOM no less, the install went smoothly.
>>>> The only further hiccup was getting a network driver installed so I
>>>> could use Team Viewer. Once BIL "remembered" that he had a wireless
>>>> plug in dongle, and a CD with the driver, (after spending 15 minutes
>>>> trying to figure out why he didn't have any network connections
>>>> available), we were in business. By then we had killed about 1 1/2
>>>> hours doing what should have taken 15 minutes! Now it's just a matter
>>>> of getting that SM Bus Controller driver and installing software.
>>>>
>>>> I really appreciate all of you who have helped with your advice and
>>>> suggestions. Many thanks!!
>>> For Win7, SMBUS driver might be located in the "chipset driver package".
>>>
>>> Let us hope this is on the driver CD, as the search for this
>>> could be an obnoxious one (Intel site, Intel not interested in
>>> supporting Win7).
>>>
>>> A word associated with this driver is "INFINST". Knowing the
>>> chipset number, then matching to the chipset name, helps
>>> verify you're in the right territory.
>>>
>>> https://en.wikipedia.org/wiki/Platform_Controller_Hub#Cougar_Point
>>>
>>> For example "Cougar Point" or "cougar.inf" might be associated
>>> with that chip. The chip number might be Q65 (Cougar Point with
>>> Management Engine enabled). And identifiers like this, might be
>>> part of verifying you have the right INFINST file.
>>>
>>> Quite frequently, the driver installer adds a text string to
>>> Device Manager, but no DLL is added to the Driver Store. These
>>> are sham drivers from Intel. Only a few of the drivers are "essential".
>>> Most of the drivers simply tidy up the appearance of the Device
>>> Manager when you review it.
>>>
>>> For Windows 7, an Intel USB3 driver is "real". A USB2 driver
>>> has #include usbport, to call up the Microsoft driver file
>>> to do the real install. Intel is not allowed to add DLLs for
>>> USB2, but is allowed to do that for USB3 ports (if they exist),
>>> but only on Windows 7. On Win8 or Win10, Microsoft provides
>>> the USB3 drivers and Intel does not.
>>
>> Final update for this thread, mainly for Paul.
>>
>> During the Win install, it showed the system reserved partition and
>> the main partition that had Win already installed from when I had done
>> it on my machine. Remembering what Paul had showed me to delete both
>> partitions before installing the new OS, I tried deleting them both.
>> Was able to delete the system reserved one but it wouldn't delete the
>> OS one.
>>
>> Install did proceed normally and after the install of Win 7 Ultimate
>> on BIL's computer, we got everything running and a few programs
>> installed. Had to quit then and computer sat for about a week while
>> he was gone. When we got back to it, things acted kind of flaky. i.e,
>> Windows Explorer would connect to Google & MSN, but would not connect
>> to DuckDuckGo; the control panel was empty, etc. The more I tried
>> working with it, the worse it got until I finally decided that Windows
>> was so borked that it had to be reinstalled.
>>
>> During this install, we were able to delete both partitions and
>> install on a clean SSD. I have no idea why I couldn't delete the OS
>> partition the first time. Most likely operator error. From there on,
>> once we got all the drivers installed using Driver Easy Pro,
>> everything went smoothly (so far). We were able to transfer all the
>> data files from his old Seagate backup to the new OS successfully. We
>> still have to test the Acronis Boot Recovery disk, install
>> MalwareBytes and configure Avast AV, but since we have a good backup
>> to fall back on if needed now, we should be home free.
>>
>The only other suggestion I would offer would be to consider installing
>Macrium Reflect 7.3 Free (https://www.macrium.com/reflectfree?mo) after
>the system becomes stable. I've been using it for a couple of years to
>do Clone backups and, recently with the help from Paul and others) to
>use the multi-volume image backups instead of disk cloning. It really is
>one of the most robust system backup programs out there, imo.
>
>ymmv

Brother-in-Law's computer is now working fine with two exceptions.
First one first...Chrome keeps blocking access to various Web sites
with the message seen in these two images.
(https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)

First one shows the expanded page after clicking on "Advanced" (shown
as "Hide Advanced". On some Sites, clicking the link shown will then
let you go to the Site, but the Walmart Site shown here just gave
another error. Sorry I don't remember what it said,

Second pic shows a Site address that would allow connection.

I have checked Chrome version numbers on his computer and mine, and
they are the same. My computer has never shown any of this "Not
Private" stuff. I apologize for not doing more research on this, but I
forgot to check out Internet Explorer when I was connected to his
computer,

Can anyone tell me how to get rid of these "Privacy" warnings?

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock wrote:
> Brother-in-Law's computer is now working fine with two exceptions.
> First one first...Chrome keeps blocking access to various Web sites
> with the message seen in these two images.
> (https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)
>
> First one shows the expanded page after clicking on "Advanced" (shown
> as "Hide Advanced". On some Sites, clicking the link shown will then
> let you go to the Site, but the Walmart Site shown here just gave
> another error. Sorry I don't remember what it said,
>
> Second pic shows a Site address that would allow connection.
>
> I have checked Chrome version numbers on his computer and mine, and
> they are the same. My computer has never shown any of this "Not
> Private" stuff. I apologize for not doing more research on this, but I
> forgot to check out Internet Explorer when I was connected to his
> computer,
>
> Can anyone tell me how to get rid of these "Privacy" warnings?
>
> >>>>>>>>>>jetjock<<<<<<<<<<

https://kinsta.com/knowledgebase/neterr-cert-authority-invalid/

"6. Sync Your Computer’s Clock

One of the most common causes for the NET::ERR_CERT_AUTHORITY_INVALID
is because your computer has the wrong date or time set. To clarify,
errors with your device’s clock can interfere with your browser’s
ability to verify a website’s certificate."

That means, set the timezone to the correct value, then use
the update function in the Date control panel, to fetch the time
via NTP from a national source.

The items other than (6), look like about as much fun as you would expect.

http://woshub.com/updating-trusted-root-certificates-in-windows-10/

# The reason they mention this site as a source of a utility
# is because it's obvious that Microsoft asked archive.org to zorch
# the copy on archive.org . Not that the utility is the right one
# for the job, but it is an installer of sorts, that takes a file
# of a certain format, and adds it to the system certificate store.

http://media.kaspersky.com/utilities/CorporateUtilities/rootsupd.zip

Well, how else could I get it done ?

Without Googling any more at the moment, I would use WSUSoffline.
These people have written a methodical updating tool for even Windows 10,
which places lots of files sourced from Microsoft, in a folder for you.
Selecting the Legacy entry in the particular tool in my picture,
gives a set of files for Windows 7 (all downloaded from Microsoft
and signatures verified at runtime).

https://download.wsusoffline.net/

If I crack one of my collections open... I can see certificates
in there, and one of the scripts must be adding those to the OS.

https://i.postimg.cc/jdLVgQ0y/wsusoffline-win-glb-folder.gif [Picture]

You would do your OS updating from that program, using the client\updateinstaller.exe.
That's how you kick off updates, when you bring the 7GB folder over to
your "machine-needing-work". The UpdateGenerator.exe at the top level of the
folder, is what fills the client folder with materials, and is run on
some machine where you store such materials for the future. Given your
geographic separation, your brother can run UpdateGenerator.exe for
himself. As then the 7GB of files will be on his machine.

Test on a brand new Win7 install in virtualbox, if you don't trust
the notion. It takes around five reboots total, to do the
whole update process. Early in the process, the installer places
the infrastructure needed. This includes updating the Windows Update EXE
to a more modern version, adding the SHA2 (SHA256) signature patches
to the OS, which allows the more modern security updates to get
installed. And somewhere along the way (and hopefully early on),
you will see mention of the certificates being thrown in. Because
I would expect at some point, they'd be needed (by some Windows Update
process).

If you want me to do the test, I can do it here. I'll just spin up
a Win7 and see what stage the certs come in.

Paul

jetjock wrote:
> Brother-in-Law's computer is now working fine with two exceptions.
> First one first...Chrome keeps blocking access to various Web sites
> with the message seen in these two images.
> (https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)
>
> First one shows the expanded page after clicking on "Advanced" (shown
> as "Hide Advanced". On some Sites, clicking the link shown will then
> let you go to the Site, but the Walmart Site shown here just gave
> another error. Sorry I don't remember what it said,
>
> Second pic shows a Site address that would allow connection.
>
> I have checked Chrome version numbers on his computer and mine, and
> they are the same. My computer has never shown any of this "Not
> Private" stuff. I apologize for not doing more research on this, but I
> forgot to check out Internet Explorer when I was connected to his
> computer,
>
> Can anyone tell me how to get rid of these "Privacy" warnings?
>
> >>>>>>>>>>jetjock<<<<<<<<<<

I was not able to reproduce the problem, using a plain
Win7 SP1 install. It doesn't seem to be a certificate,
when contacting www.walmart.com .

Which leaves time zone or clock setting, being off by a
large amount.

Modern Firefox won't work on Vista SP2, and that might
be the next OS I could try it with. But it won't run there,
so there's no point. And I don't have a Win7 SP0 DVD,
so can't install that.

And using the two SSLLABS commands to check website and
browser, that might not factor in a timezone problem.

For an appraisal of the timekeeping on your own machine,
you can try this. I'm currently off by 2 seconds, because
I'm using the default 7 day update interval for NTP. I did have
a GPS set up for a while, but have changed OSes and it's
not hooked up here. And I didn't have the right hardware
for it, anyway (serial port not good enough).

https://time.gov/

I don't know if that's the best tool for your BIL, to use,
as it may not diagnose what is wrong with the time settings
all that well.

I tried to screw up the clock in my VirtualBox VM, and the
Guest OS keeps putting back the correct time on me. A pisser
when you're trying to test something. I would have to install
on a hard drive (run as a Host), to gain control over it.

Paul

On Mon, 16 Aug 2021 22:10:53 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> Brother-in-Law's computer is now working fine with two exceptions.
>> First one first...Chrome keeps blocking access to various Web sites
>> with the message seen in these two images.
>> (https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)
>>
>> First one shows the expanded page after clicking on "Advanced" (shown
>> as "Hide Advanced". On some Sites, clicking the link shown will then
>> let you go to the Site, but the Walmart Site shown here just gave
>> another error. Sorry I don't remember what it said,
>>
>> Second pic shows a Site address that would allow connection.
>>
>> I have checked Chrome version numbers on his computer and mine, and
>> they are the same. My computer has never shown any of this "Not
>> Private" stuff. I apologize for not doing more research on this, but I
>> forgot to check out Internet Explorer when I was connected to his
>> computer,
>>
>> Can anyone tell me how to get rid of these "Privacy" warnings?
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>
> https://kinsta.com/knowledgebase/neterr-cert-authority-invalid/
>
> "6. Sync Your Computer’s Clock
>
> One of the most common causes for the NET::ERR_CERT_AUTHORITY_INVALID
> is because your computer has the wrong date or time set. To clarify,
> errors with your device’s clock can interfere with your browser’s
> ability to verify a website’s certificate."
>
>That means, set the timezone to the correct value, then use
>the update function in the Date control panel, to fetch the time
>via NTP from a national source.

While we were trying to find S1, S2 etc., in his BIOS, I made the
mistake of trying to talk him through the checking instead of doing a
Zoom meeting. Somehow, even though he says he hit "Ignore changes and
exit" the BIOS got borked and we could not boot into anything, nor get
into the BIOS again. I had him remove the CMOS battery to reset the
BIOS and everything worked then, except we were back to 2005! I
manually reset the clock using the Windows "Change time and date
settings" and it showed that it would do an "Internet Time" sync later
that day.

All of that explanation was leading to ask if that was sufficient to
reset everything? Do I need to do anything more?
>
>The items other than (6), look like about as much fun as you would expect.
>
>http://woshub.com/updating-trusted-root-certificates-in-windows-10/
>
> # The reason they mention this site as a source of a utility
> # is because it's obvious that Microsoft asked archive.org to zorch
> # the copy on archive.org . Not that the utility is the right one
> # for the job, but it is an installer of sorts, that takes a file
> # of a certain format, and adds it to the system certificate store.
>
> http://media.kaspersky.com/utilities/CorporateUtilities/rootsupd.zip
>
>Well, how else could I get it done ?
>
>Without Googling any more at the moment, I would use WSUSoffline.
>These people have written a methodical updating tool for even Windows 10,
>which places lots of files sourced from Microsoft, in a folder for you.
>Selecting the Legacy entry in the particular tool in my picture,
>gives a set of files for Windows 7 (all downloaded from Microsoft
>and signatures verified at runtime).
>
>https://download.wsusoffline.net/

Would you recommend installing all of the downloaded updates, or just
the ones with "Certificate" in them? Is the "Search" function that
you used to find them for your picture, in the WSUSoffline downloader,
or did you use something else to find them?

>
>If I crack one of my collections open... I can see certificates
>in there, and one of the scripts must be adding those to the OS.
>
> https://i.postimg.cc/jdLVgQ0y/wsusoffline-win-glb-folder.gif [Picture]
>
>You would do your OS updating from that program, using the client\updateinstaller.exe.
>That's how you kick off updates, when you bring the 7GB folder over to
>your "machine-needing-work". The UpdateGenerator.exe at the top level of the
>folder, is what fills the client folder with materials, and is run on
>some machine where you store such materials for the future. Given your
>geographic separation, your brother can run UpdateGenerator.exe for
>himself. As then the 7GB of files will be on his machine.
>
>Test on a brand new Win7 install in virtualbox, if you don't trust
>the notion. It takes around five reboots total, to do the
>whole update process. Early in the process, the installer places
>the infrastructure needed. This includes updating the Windows Update EXE
>to a more modern version, adding the SHA2 (SHA256) signature patches
>to the OS, which allows the more modern security updates to get
>installed. And somewhere along the way (and hopefully early on),
>you will see mention of the certificates being thrown in. Because
>I would expect at some point, they'd be needed (by some Windows Update
>process).
>
>If you want me to do the test, I can do it here. I'll just spin up
>a Win7 and see what stage the certs come in.

Thanks again for taking the time to provide me with so much help.
Let's see what the answers are to my questions above before I ask you
to do anything more.

>>>>>>>>>>jetjock<<<<<<<<<<

On Tue, 17 Aug 2021 06:07:52 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> Brother-in-Law's computer is now working fine with two exceptions.
>> First one first...Chrome keeps blocking access to various Web sites
>> with the message seen in these two images.
>> (https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)
>>
>> First one shows the expanded page after clicking on "Advanced" (shown
>> as "Hide Advanced". On some Sites, clicking the link shown will then
>> let you go to the Site, but the Walmart Site shown here just gave
>> another error. Sorry I don't remember what it said,
>>
>> Second pic shows a Site address that would allow connection.
>>
>> I have checked Chrome version numbers on his computer and mine, and
>> they are the same. My computer has never shown any of this "Not
>> Private" stuff. I apologize for not doing more research on this, but I
>> forgot to check out Internet Explorer when I was connected to his
>> computer,
>>
>> Can anyone tell me how to get rid of these "Privacy" warnings?
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>
>I was not able to reproduce the problem, using a plain
>Win7 SP1 install. It doesn't seem to be a certificate,
>when contacting www.walmart.com .
>
>Which leaves time zone or clock setting, being off by a
>large amount.
>
>Modern Firefox won't work on Vista SP2, and that might
>be the next OS I could try it with. But it won't run there,
>so there's no point. And I don't have a Win7 SP0 DVD,
>so can't install that.
>
>And using the two SSLLABS commands to check website and
>browser, that might not factor in a timezone problem.
>
>For an appraisal of the timekeeping on your own machine,
>you can try this. I'm currently off by 2 seconds, because
>I'm using the default 7 day update interval for NTP. I did have
>a GPS set up for a while, but have changed OSes and it's
>not hooked up here. And I didn't have the right hardware
>for it, anyway (serial port not good enough).
>
> https://time.gov/

My computer clock off by +0.008 secs. :-)
>
>I don't know if that's the best tool for your BIL, to use,
>as it may not diagnose what is wrong with the time settings
>all that well.
>
>I tried to screw up the clock in my VirtualBox VM, and the
>Guest OS keeps putting back the correct time on me. A pisser
>when you're trying to test something. I would have to install
>on a hard drive (run as a Host), to gain control over it.
>
> Paul
>
>

>>>>>>>>>>jetjock<<<<<<<<<<

On Tue, 17 Aug 2021 09:50:32 -0500, jetjock <jetjock@unkown.com>
wrote:

>On Mon, 16 Aug 2021 22:10:53 -0400, Paul <nospam@needed.invalid>
>wrote:
>
>>jetjock wrote:
>>> Brother-in-Law's computer is now working fine with two exceptions.
>>> First one first...Chrome keeps blocking access to various Web sites
>>> with the message seen in these two images.
>>> (https://www.sendspace.com/filegroup/2xjqPmJIejEzdGnfyTvatw)
>>>
>>> First one shows the expanded page after clicking on "Advanced" (shown
>>> as "Hide Advanced". On some Sites, clicking the link shown will then
>>> let you go to the Site, but the Walmart Site shown here just gave
>>> another error. Sorry I don't remember what it said,
>>>
>>> Second pic shows a Site address that would allow connection.
>>>
>>> I have checked Chrome version numbers on his computer and mine, and
>>> they are the same. My computer has never shown any of this "Not
>>> Private" stuff. I apologize for not doing more research on this, but I
>>> forgot to check out Internet Explorer when I was connected to his
>>> computer,
>>>
>>> Can anyone tell me how to get rid of these "Privacy" warnings?
>>>
>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>
>> https://kinsta.com/knowledgebase/neterr-cert-authority-invalid/
>>
>> "6. Sync Your Computer’s Clock
>>
>> One of the most common causes for the NET::ERR_CERT_AUTHORITY_INVALID
>> is because your computer has the wrong date or time set. To clarify,
>> errors with your device’s clock can interfere with your browser’s
>> ability to verify a website’s certificate."
>>
>>That means, set the timezone to the correct value, then use
>>the update function in the Date control panel, to fetch the time
>>via NTP from a national source.
>
While we were trying to find S1, S2 etc., in his BIOS, I made the
mistake of trying to talk him through the checking instead of doing a
Zoom meeting. Somehow, even though he says he hit "Ignore changes and
exit" the BIOS got borked and we could not boot into anything, nor get
into the BIOS again. I had him remove the CMOS battery to reset the
BIOS and everything worked then, except we were back to 2005! I
manually reset the clock using the Windows "Change time and date
settings" and it showed that it would do an "Internet Time" sync later
that day.

All of that explanation was leading to ask if that was sufficient to
reset everything? Do I need to do anything more?
>>
>>The items other than (6), look like about as much fun as you would expect.
>>
>>http://woshub.com/updating-trusted-root-certificates-in-windows-10/
>>
>> # The reason they mention this site as a source of a utility
>> # is because it's obvious that Microsoft asked archive.org to zorch
>> # the copy on archive.org . Not that the utility is the right one
>> # for the job, but it is an installer of sorts, that takes a file
>> # of a certain format, and adds it to the system certificate store.
>>
>> http://media.kaspersky.com/utilities/CorporateUtilities/rootsupd.zip
>>
>>Well, how else could I get it done ?
>>
>>Without Googling any more at the moment, I would use WSUSoffline.
>>These people have written a methodical updating tool for even Windows 10,
>>which places lots of files sourced from Microsoft, in a folder for you.
>>Selecting the Legacy entry in the particular tool in my picture,
>>gives a set of files for Windows 7 (all downloaded from Microsoft
>>and signatures verified at runtime).
>>
>>https://download.wsusoffline.net/
>
Would you recommend installing all of the downloaded updates, or just
the ones with "Certificate" in them? Is the "Search" function that
you used to find them for your picture, in the WSUSoffline downloader,
or did you use something else to find them?

>>
>>If I crack one of my collections open... I can see certificates
>>in there, and one of the scripts must be adding those to the OS.
>>
>> https://i.postimg.cc/jdLVgQ0y/wsusoffline-win-glb-folder.gif [Picture]
>>
>>You would do your OS updating from that program, using the client\updateinstaller.exe.
>>That's how you kick off updates, when you bring the 7GB folder over to
>>your "machine-needing-work". The UpdateGenerator.exe at the top level of the
>>folder, is what fills the client folder with materials, and is run on
>>some machine where you store such materials for the future. Given your
>>geographic separation, your brother can run UpdateGenerator.exe for
>>himself. As then the 7GB of files will be on his machine.
>>
>>Test on a brand new Win7 install in virtualbox, if you don't trust
>>the notion. It takes around five reboots total, to do the
>>whole update process. Early in the process, the installer places
>>the infrastructure needed. This includes updating the Windows Update EXE
>>to a more modern version, adding the SHA2 (SHA256) signature patches
>>to the OS, which allows the more modern security updates to get
>>installed. And somewhere along the way (and hopefully early on),
>>you will see mention of the certificates being thrown in. Because
>>I would expect at some point, they'd be needed (by some Windows Update
>>process).
>>
>>If you want me to do the test, I can do it here. I'll just spin up
>>a Win7 and see what stage the certs come in.
>
Thanks again for taking the time to provide me with so much help.
Let's see what the answers are to my questions above before I ask you
to do anything more.
>
> >>>>>>>>>>jetjock<<<<<<<<<<

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock wrote:
> On Tue, 17 Aug 2021 09:50:32 -0500, jetjock <jetjock@unkown.com>
> wrote:

> While we were trying to find S1, S2 etc., in his BIOS, I made the
> mistake of trying to talk him through the checking instead of doing a
> Zoom meeting. Somehow, even though he says he hit "Ignore changes and
> exit" the BIOS got borked and we could not boot into anything, nor get
> into the BIOS again. I had him remove the CMOS battery to reset the
> BIOS and everything worked then, except we were back to 2005! I
> manually reset the clock using the Windows "Change time and date
> settings" and it showed that it would do an "Internet Time" sync later
> that day.
>
> All of that explanation was leading to ask if that was sufficient to
> reset everything? Do I need to do anything more?

The Change time and date should be enough to set the software
clock for the session. Then, a certificate check should work again.
If the date was the certificate problem, that should have resolved it.
You could set the timezone in that Windows control panel (the OS may
default to Pacific and need changing if you're on the other coast).

As for removing the CMOS battery, the "Load BIOS Defaults" function
the BIOS uses, doesn't always choose the best settings. My Win7 laptop
does a good job. One of the older machines, I have to go BIOS page
by BIOS page, correcting stuff. Some of my machines here, it is a pain
to remember how the settings are to be set. On the Pentium 3 machine,
it's the old way of doing things that takes time when correcting
the settings. On the Pentium 4 machine, it is just the sheer amount
of bad choices made. I used to hate resetting the BIOS on that pig,
knowing what I had to put back.

Some machines now, have a "BIOS profile" kind of page, and it
can memorize two different sets of BIOS settings. The Test Machine
has two profiles loaded in it, for two different sets of RAM I've used,
and any time the CMOS contents are upset, just "Load Profile 1" is
enough to get back my custom timing settings for RAM (since XMP
doesn't work). These profiles are likely to be stored in BIOS flash,
and if I change a BIOS setting, that is not "remembered". The Profile 1
stays unaltered, unless I choose "Save Profile 1" and then whatever
is in the BIOS at the time, overwrites the previous set.

>>> https://download.wsusoffline.net/

> Would you recommend installing all of the downloaded updates, or just
> the ones with "Certificate" in them? Is the "Search" function that
> you used to find them for your picture, in the WSUSoffline downloader,
> or did you use something else to find them?

When I propose using WSUSOffline, this would handle cases where a
machine is airgapped on purpose and can't pull its own certs.
It would also cover unknown cases, like where whatever pulls certs
isn't turned on. And I haven't a clue what service that would be,
other than Windows Update itself.

So when I propose using WSUSOffline, I'm making a lot of assumptions
about "brokenness". If the install had gone at all well, this method
should not be necessary. But, it's available. And doing the updates
and ticking the "Security Only" box, is "clean enough for the paranoid" :-)
That's why the IT guy who wrote the scripts, included the tick box.

*******

I'm using Agent Ransack on the unpacked archive I prepared. It
can do a text search, but you point it at a particular folder
and don't try a text search on an entire disk drive. On WinXP,
I'd use the text search in the Windows Search thing successfully.
Later OSes aren't good enough for this using their built-in, which
is why Agent Ransack is used instead for the job.

I unpacked my zipped-up WSUSOffline archive and did a quick check
trying to find a folder with certificates. A little more searching...

OK, in "DoUpdate.cmd" 78KB script, there is this chunk...

rem *** Install Trusted Root Certificates and Certificate revocation lists ***
if "%UPDATE_RCERTS%" NEQ "/updatercerts" goto SkipTRCertsInst
echo Installing Trusted Root Certificates...
for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crt') do (
if exist %SystemRoot%\Sysnative\certutil.exe (
%SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
) else (
%SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
)
call :Log "Info: Installed ..\win\glb\%%i"
)
echo Installing Certificate revocation lists...
for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crl') do (
if exist %SystemRoot%\Sysnative\certutil.exe (
%SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
) else (
%SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
)
call :Log "Info: Installed ..\win\glb\%%i"
)
:SkipTRCertsInst

so that is how it uses the contents of the \win\glb directory.
There is really supposed to be automation in the OS itself,
to be fetching newer versions of those files.

In the "UpdateInstaller.ini" file

[Installation]
updatecpp=Enabled
instmssl=Disabled
instdotnet35=Disabled
updatercerts=Enabled <=== there is no tick box, so it must always Enable this...
instdotnet4=Disabled
...

The file "StaticDownloadLinks-win-glb.txt" contains hard-coded files to be fetched
and loaded into that particular glb\ folder. These are four examples out of the list.

http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt

It looks like it adds those, as part of general OS maintenance,
rather than as a dependency for getting the updates into the
machine. Normally, there are some things you have to do first,
to prepare the machine for updating, and those would be the
"critical steps" as it were. And that chunk of code is a bit later
in "DoUpdate.cmd". That step should occur before any .NET updates.

>>> If I crack one of my collections open... I can see certificates
>>> in there, and one of the scripts must be adding those to the OS.
>>>
>>> https://i.postimg.cc/jdLVgQ0y/wsusoffline-win-glb-folder.gif [Picture]

According to this, the OS checks once a week for new cert files.
You can add one of the installs here, to speed that up.

https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5

Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d

Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6

and the links on that page crank up the update rate, to
checking once per day for revocation of certs. By that logic,
even if you newly installed the OS, it should have pulled
the files no more than a week later.

One way this idea gets in trouble, is some Windows 7 machines
are not connected to the Internet (air gap) and then if the
poor dope operating the machine wants to install .NET4 to get
some work done, the .NET4 installer can't pull the certificate
necessary to install .NET. Embarrassing for Microsoft when things like
this happen. As long as your BIL machine can reach the Internet,
the cert store for the OS should be loaded by now. It probably
attempted to load at install time, but... whatever.

Firefox has checking for revocation via OCSP, but the certs
we're talking about in this case, are Windows OS certs and so
Windows has its own check. The Firefox check is in real time
(on demand), so is practically instantaneous (check a well-known
OCSP server on the net for the info). Whereas Microsoft decided their
revocation check was "A little too lazy", happening once a week,
so they cranked it. This may be related to an incident where
they wanted a revocation in a hurry, then realizes the machines
might not get it for a week or two (because the revocations
are pulled via a polling mechanism and not pushed).

Summary: You can try "support-for-urgent" above, which would likely
be an optional update in the Windows Update window. That
pulls .crl or .crt on a more frequent basis.

The "WSUSOffline collector then installer", is a belt and
suspenders approach to updating Windows. If I need to
patch up a VM for test, I use my 8GB cache for the job.
By using the "security only" tick box, that should avoid
the "telemetry files" the paranoid avoid. And it can bring
Windows 7, reasonably close to fully patched. Close enough
at least, that a further trip to Windows Update afterwards,
only needs a few minutes to finish the job.

On Wed, 18 Aug 2021 15:07:31 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> On Tue, 17 Aug 2021 09:50:32 -0500, jetjock <jetjock@unkown.com>
>> wrote:
>
>> While we were trying to find S1, S2 etc., in his BIOS, I made the
>> mistake of trying to talk him through the checking instead of doing a
>> Zoom meeting. Somehow, even though he says he hit "Ignore changes and
>> exit" the BIOS got borked and we could not boot into anything, nor get
>> into the BIOS again. I had him remove the CMOS battery to reset the
>> BIOS and everything worked then, except we were back to 2005! I
>> manually reset the clock using the Windows "Change time and date
>> settings" and it showed that it would do an "Internet Time" sync later
>> that day.
>>
>> All of that explanation was leading to ask if that was sufficient to
>> reset everything? Do I need to do anything more?
>
>The Change time and date should be enough to set the software
>clock for the session. Then, a certificate check should work again.
>If the date was the certificate problem, that should have resolved it.
>You could set the timezone in that Windows control panel (the OS may
>default to Pacific and need changing if you're on the other coast).
>
>As for removing the CMOS battery, the "Load BIOS Defaults" function
>the BIOS uses, doesn't always choose the best settings. My Win7 laptop
>does a good job. One of the older machines, I have to go BIOS page
>by BIOS page, correcting stuff. Some of my machines here, it is a pain
>to remember how the settings are to be set. On the Pentium 3 machine,
>it's the old way of doing things that takes time when correcting
>the settings. On the Pentium 4 machine, it is just the sheer amount
>of bad choices made. I used to hate resetting the BIOS on that pig,
>knowing what I had to put back.
>
>Some machines now, have a "BIOS profile" kind of page, and it
>can memorize two different sets of BIOS settings. The Test Machine
>has two profiles loaded in it, for two different sets of RAM I've used,
>and any time the CMOS contents are upset, just "Load Profile 1" is
>enough to get back my custom timing settings for RAM (since XMP
>doesn't work). These profiles are likely to be stored in BIOS flash,
>and if I change a BIOS setting, that is not "remembered". The Profile 1
>stays unaltered, unless I choose "Save Profile 1" and then whatever
>is in the BIOS at the time, overwrites the previous set.
>
>>>> https://download.wsusoffline.net/
>
>> Would you recommend installing all of the downloaded updates, or just
>> the ones with "Certificate" in them? Is the "Search" function that
>> you used to find them for your picture, in the WSUSoffline downloader,
>> or did you use something else to find them?
>
>When I propose using WSUSOffline, this would handle cases where a
>machine is airgapped on purpose and can't pull its own certs.
>It would also cover unknown cases, like where whatever pulls certs
>isn't turned on. And I haven't a clue what service that would be,
>other than Windows Update itself.
>
>So when I propose using WSUSOffline, I'm making a lot of assumptions
>about "brokenness". If the install had gone at all well, this method
>should not be necessary. But, it's available. And doing the updates
>and ticking the "Security Only" box, is "clean enough for the paranoid" :-)
>That's why the IT guy who wrote the scripts, included the tick box.

If I understand all this right, since his machine is connected to the
Internet I should just run Windows Update and download and install a
small number at a time? WSUSoffline is not required?
>
>*******
>
>I'm using Agent Ransack on the unpacked archive I prepared. It
>can do a text search, but you point it at a particular folder
>and don't try a text search on an entire disk drive. On WinXP,
>I'd use the text search in the Windows Search thing successfully.
>Later OSes aren't good enough for this using their built-in, which
>is why Agent Ransack is used instead for the job.
>
>I unpacked my zipped-up WSUSOffline archive and did a quick check
>trying to find a folder with certificates. A little more searching...
>
>OK, in "DoUpdate.cmd" 78KB script, there is this chunk...
>
> rem *** Install Trusted Root Certificates and Certificate revocation lists ***
> if "%UPDATE_RCERTS%" NEQ "/updatercerts" goto SkipTRCertsInst
> echo Installing Trusted Root Certificates...
> for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crt') do (
> if exist %SystemRoot%\Sysnative\certutil.exe (
> %SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
> ) else (
> %SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
> )
> call :Log "Info: Installed ..\win\glb\%%i"
> )
> echo Installing Certificate revocation lists...
> for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crl') do (
> if exist %SystemRoot%\Sysnative\certutil.exe (
> %SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
> ) else (
> %SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
> )
> call :Log "Info: Installed ..\win\glb\%%i"
> )
> :SkipTRCertsInst
>
>so that is how it uses the contents of the \win\glb directory.
>There is really supposed to be automation in the OS itself,
>to be fetching newer versions of those files.
>
>In the "UpdateInstaller.ini" file
>
> [Installation]
> updatecpp=Enabled
> instmssl=Disabled
> instdotnet35=Disabled
> updatercerts=Enabled <=== there is no tick box, so it must always Enable this...
> instdotnet4=Disabled
> ...
>
>The file "StaticDownloadLinks-win-glb.txt" contains hard-coded files to be fetched
>and loaded into that particular glb\ folder. These are four examples out of the list.
>
> http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
> http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
> http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
> http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
>
>It looks like it adds those, as part of general OS maintenance,
>rather than as a dependency for getting the updates into the
>machine. Normally, there are some things you have to do first,
>to prepare the machine for updating, and those would be the
>"critical steps" as it were. And that chunk of code is a bit later
>in "DoUpdate.cmd". That step should occur before any .NET updates.
>
>>>> If I crack one of my collections open... I can see certificates
>>>> in there, and one of the scripts must be adding those to the OS.
>>>>
>>>> https://i.postimg.cc/jdLVgQ0y/wsusoffline-win-glb-folder.gif [Picture]
>
>According to this, the OS checks once a week for new cert files.
>You can add one of the installs here, to speed that up.
>
>https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5
>
> Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d
>
> Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6

Should I use the above x64 link to do the Windows updates?
>
>and the links on that page crank up the update rate, to
>checking once per day for revocation of certs. By that logic,
>even if you newly installed the OS, it should have pulled
>the files no more than a week later.
>
>One way this idea gets in trouble, is some Windows 7 machines
>are not connected to the Internet (air gap) and then if the
>poor dope operating the machine wants to install .NET4 to get
>some work done, the .NET4 installer can't pull the certificate
>necessary to install .NET. Embarrassing for Microsoft when things like
>this happen. As long as your BIL machine can reach the Internet,
>the cert store for the OS should be loaded by now. It probably
>attempted to load at install time, but... whatever.
>
>Firefox has checking for revocation via OCSP, but the certs
>we're talking about in this case, are Windows OS certs and so
>Windows has its own check. The Firefox check is in real time
>(on demand), so is practically instantaneous (check a well-known
>OCSP server on the net for the info). Whereas Microsoft decided their
>revocation check was "A little too lazy", happening once a week,
>so they cranked it. This may be related to an incident where
>they wanted a revocation in a hurry, then realizes the machines
>might not get it for a week or two (because the revocations
>are pulled via a polling mechanism and not pushed).
>
>Summary: You can try "support-for-urgent" above, which would likely
> be an optional update in the Windows Update window. That
> pulls .crl or .crt on a more frequent basis.
>
> The "WSUSOffline collector then installer", is a belt and
> suspenders approach to updating Windows. If I need to
> patch up a VM for test, I use my 8GB cache for the job.
> By using the "security only" tick box, that should avoid
> the "telemetry files" the paranoid avoid. And it can bring
> Windows 7, reasonably close to fully patched. Close enough
> at least, that a further trip to Windows Update afterwards,
> only needs a few minutes to finish the job.
>
> WSUSOffline doesn't have to do all 150 every time. If the
> machine is already patched up, the runtime of the thing will
> be relatively short.
>
> No matter how you patch up Windows 7, if you allow it
> to do 150 update files in a row, this is very hard on RAM. And
> to me, it seems you can never have enough RAM on the machine
> to do all 150 in one shot. Windows Update is too stupid to
> do garbage collection between internal invocations. The updating
> process slows down measurably, when RAM is full. Does this
> design make Paul angry ? Ohhh yes. Swear jar angry.

jetjock wrote:
> On Wed, 18 Aug 2021 15:07:31 -0400, Paul <nospam@needed.invalid>
> wrote:

>> https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5
>>
>> Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d
>>
>> Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
>
> Should I use the above x64 link to do the Windows updates?

> See my above question please. I really do appreciate all the info you
> provide, but since my knowledge is miniscule compared to yours, I can
> really get lost deciphering it all sometimes! :-) My best guess as
> to what I should do for him tomorrow is try Windows Update first. If
> that doesn't fix the problem, try Win7 x64
> http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6,
> and if none of that works, try the WSUSoffline. Am I close? Hate to
> keep bugging you but preventing mistakes is much easier than
> correcting them!
>
> >>>>>>>>>>jetjock<<<<<<<<<<

The Win x64 one is for your 64-bit OS.

At a minimum, it increases the frequency of automatic
checks for certificates to a once-a-day check.

And at this point, we don't know if the certificate subsystem
is fully healthy, and like you, certificates are a mystery to me.

I would install that update, just so it's well equipped for
handling certificates.

*******

The WsusOffline has the links to the Microsoft certificate files.
The funny part being, the files stop at 2018 or so.
And that's the static list of items, WsusOffline wants to install.
The list does not seem to be dynamically generated from a
master list - like all good things the WsusOffline team does,
they assemble some of those lists from disparate sources.
For example, their detection of what it takes to tip Vista upright,
is first-class.

Version 11.8 of WsusOffline, the Legacy OS tab, might be the
last version of WsusOffline supporting Windows 7.

If your Windows 7 in system control panel says that SP1 is
already installed "Win 7 SP1", then you don't need to include
that tick box in a Wsusoffline collection run. And you only
absolutely need to select the x64 option, if working on a
x64 setup. Those can help reduce the collection time.

*******

You can use the "to test a website line" from the following re-post.
Now, I don't know if any of the website certificates are checked
against the chain of trust on the machine or not. The web browser
certificates might be used for that. But your browser was just
installed...

To test a website:

https://www.ssllabs.com/ssltest/analyze.html?d=walmart.com <===

To determine the feature set of the browser:

https://www.ssllabs.com/ssltest/viewMyClient.html

This is an example of a browser armed for mid-sized bears.

Protocols [of my client browser]
TLS 1.3 No <=== web sites using *only* this, are a problem
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
SSL 3 No \___ User should disable these in the browser, and
SSL 2 No / browser may have done this at the source end already

Cipher Suites (in order of preference)

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13) Forward Secrecy 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128

Still, I don't know of too many "consumer-oriented utilities"
in this domain. Lots of chuckleheads to "help you check *OUR* certificate is there".
But nobody interested in vetting the entire store for correctness.
I don't know how to do that. I rely on the above two web pages,
to provide hints, such as they are.

Paul

On Wed, 18 Aug 2021 19:42:24 -0400, Paul <nospam@needed.invalid>
wrote:

>jetjock wrote:
>> On Wed, 18 Aug 2021 15:07:31 -0400, Paul <nospam@needed.invalid>
>> wrote:
>
>>> https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5
>>>
>>> Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d
>>>
>>> Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
>>
>> Should I use the above x64 link to do the Windows updates?
>
>> See my above question please. I really do appreciate all the info you
>> provide, but since my knowledge is miniscule compared to yours, I can
>> really get lost deciphering it all sometimes! :-) My best guess as
>> to what I should do for him tomorrow is try Windows Update first. If
>> that doesn't fix the problem, try Win7 x64
>> http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6,
>> and if none of that works, try the WSUSoffline. Am I close? Hate to
>> keep bugging you but preventing mistakes is much easier than
>> correcting them!
>>
>> >>>>>>>>>>jetjock<<<<<<<<<<
>
>The Win x64 one is for your 64-bit OS.
>
>At a minimum, it increases the frequency of automatic
>checks for certificates to a once-a-day check.
>
>And at this point, we don't know if the certificate subsystem
>is fully healthy, and like you, certificates are a mystery to me.
>
>I would install that update, just so it's well equipped for
>handling certificates.
>
>*******
Ok, so it looks like run the Microsoft Win x64 first.
>
>The WsusOffline has the links to the Microsoft certificate files.
>The funny part being, the files stop at 2018 or so.
>And that's the static list of items, WsusOffline wants to install.
>The list does not seem to be dynamically generated from a
>master list - like all good things the WsusOffline team does,
>they assemble some of those lists from disparate sources.
>For example, their detection of what it takes to tip Vista upright,
>is first-class.
>
>Version 11.8 of WsusOffline, the Legacy OS tab, might be the
>last version of WsusOffline supporting Windows 7.
>
>If your Windows 7 in system control panel says that SP1 is
>already installed "Win 7 SP1", then you don't need to include
>that tick box in a Wsusoffline collection run. And you only
>absolutely need to select the x64 option, if working on a
>x64 setup. Those can help reduce the collection time.
>
>*******

If that doesn't work, then run WUSAOffline. If that doesn't work, I
just won't pay your bill! :-)
>
>You can use the "to test a website line" from the following re-post.
>Now, I don't know if any of the website certificates are checked
>against the chain of trust on the machine or not. The web browser
>certificates might be used for that. But your browser was just
>installed...
>
>To test a website:
>
> https://www.ssllabs.com/ssltest/analyze.html?d=walmart.com <===
>
>To determine the feature set of the browser:
>
> https://www.ssllabs.com/ssltest/viewMyClient.html
>
>This is an example of a browser armed for mid-sized bears.
>
> Protocols [of my client browser]
> TLS 1.3 No <=== web sites using *only* this, are a problem
> TLS 1.2 Yes
> TLS 1.1 Yes
> TLS 1.0 Yes
> SSL 3 No \___ User should disable these in the browser, and
> SSL 2 No / browser may have done this at the source end already
>
> Cipher Suites (in order of preference)
>
> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
> OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13) Forward Secrecy 256
> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
>
>Still, I don't know of too many "consumer-oriented utilities"
>in this domain. Lots of chuckleheads to "help you check *OUR* certificate is there".
>But nobody interested in vetting the entire store for correctness.
>I don't know how to do that. I rely on the above two web pages,
>to provide hints, such as they are.

Will do, and again, many thanks!

>>>>>>>>>>jetjock<<<<<<<<<<

On Wed, 18 Aug 2021 21:15:03 -0500, jetjock <jetjock@unkown.com>
wrote:

>On Wed, 18 Aug 2021 19:42:24 -0400, Paul <nospam@needed.invalid>
>wrote:
>
>>jetjock wrote:
>>> On Wed, 18 Aug 2021 15:07:31 -0400, Paul <nospam@needed.invalid>
>>> wrote:
>>
>>>> https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5
>>>>
>>>> Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d
>>>>
>>>> Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
>>>
>>> Should I use the above x64 link to do the Windows updates?
>>
>>> See my above question please. I really do appreciate all the info you
>>> provide, but since my knowledge is miniscule compared to yours, I can
>>> really get lost deciphering it all sometimes! :-) My best guess as
>>> to what I should do for him tomorrow is try Windows Update first. If
>>> that doesn't fix the problem, try Win7 x64
>>> http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6,
>>> and if none of that works, try the WSUSoffline. Am I close? Hate to
>>> keep bugging you but preventing mistakes is much easier than
>>> correcting them!
>>>
>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>
>>The Win x64 one is for your 64-bit OS.
>>
>>At a minimum, it increases the frequency of automatic
>>checks for certificates to a once-a-day check.
>>
>>And at this point, we don't know if the certificate subsystem
>>is fully healthy, and like you, certificates are a mystery to me.
>>
>>I would install that update, just so it's well equipped for
>>handling certificates.
>>
>>*******
>Ok, so it looks like run the Microsoft Win x64 first.
>>
>>The WsusOffline has the links to the Microsoft certificate files.
>>The funny part being, the files stop at 2018 or so.
>>And that's the static list of items, WsusOffline wants to install.
>>The list does not seem to be dynamically generated from a
>>master list - like all good things the WsusOffline team does,
>>they assemble some of those lists from disparate sources.
>>For example, their detection of what it takes to tip Vista upright,
>>is first-class.
>>
>>Version 11.8 of WsusOffline, the Legacy OS tab, might be the
>>last version of WsusOffline supporting Windows 7.
>>
>>If your Windows 7 in system control panel says that SP1 is
>>already installed "Win 7 SP1", then you don't need to include
>>that tick box in a Wsusoffline collection run. And you only
>>absolutely need to select the x64 option, if working on a
>>x64 setup. Those can help reduce the collection time.
>>
>>*******
>
>If that doesn't work, then run WUSAOffline. If that doesn't work, I
>just won't pay your bill! :-)
>>
>>You can use the "to test a website line" from the following re-post.
>>Now, I don't know if any of the website certificates are checked
>>against the chain of trust on the machine or not. The web browser
>>certificates might be used for that. But your browser was just
>>installed...
>>
>>To test a website:
>>
>> https://www.ssllabs.com/ssltest/analyze.html?d=walmart.com <===
>>
>>To determine the feature set of the browser:
>>
>> https://www.ssllabs.com/ssltest/viewMyClient.html
>>
>>This is an example of a browser armed for mid-sized bears.
>>
>> Protocols [of my client browser]
>> TLS 1.3 No <=== web sites using *only* this, are a problem
>> TLS 1.2 Yes
>> TLS 1.1 Yes
>> TLS 1.0 Yes
>> SSL 3 No \___ User should disable these in the browser, and
>> SSL 2 No / browser may have done this at the source end already
>>
>> Cipher Suites (in order of preference)
>>
>> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
>> OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13) Forward Secrecy 256
>> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
>>
>>Still, I don't know of too many "consumer-oriented utilities"
>>in this domain. Lots of chuckleheads to "help you check *OUR* certificate is there".
>>But nobody interested in vetting the entire store for correctness.
>>I don't know how to do that. I rely on the above two web pages,
>>to provide hints, such as they are.
>
>Will do, and again, many thanks!

Houston, we have a problem!! :-)

First of all I tried just running Windows Update from his computer
and got an error message (see the third photo). I checked the update
history and saw that one update had been successfully installed (see
second photo). I then ran the WSUSoffline updater and it failed the
verification check (see first photo).
https://www.sendspace.com/filegroup/1a%2BuZPuNWXgcmTOjM1kJtdm39qYjXblk.

I then ran the
http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
for x64 and it installed KB 3004394. If Windows will not update on
it's own though, enabling it to check for updates more often isn't
going to help much I don't think.

I don't know what I would have done if WSUSoffline had passed
verification as I have absolutely no clue as to where it downloaded
the updates to. Can you give me a hint please? Then, if I found
them, does it tell me how to install them? Or, is it obvious by the
file extension?

It appears that something is seriously messed up in Windows if it
won't even do it's own updates. I clicked on "Get help with this
error" on the Windows Update page, but all I got was help for a bunch
of other errors. Maybe you'll have better luck deciphering it than I
did.

Speaking of luck, the Intel Graphics driver did the trick to enable
"Sleep" mode for him. So, at least something worked!

Any more suggestions will be gratefully accepted.

>>>>>>>>>>jetjock<<<<<<<<<<

jetjock wrote:
> On Wed, 18 Aug 2021 21:15:03 -0500, jetjock <jetjock@unkown.com>
> wrote:
>
>> On Wed, 18 Aug 2021 19:42:24 -0400, Paul <nospam@needed.invalid>
>> wrote:
>>
>>> jetjock wrote:
>>>> On Wed, 18 Aug 2021 15:07:31 -0400, Paul <nospam@needed.invalid>
>>>> wrote:
>>>>> https://support.microsoft.com/en-us/topic/support-for-urgent-trusted-root-updates-for-windows-root-certificate-program-in-windows-a4ac4d6c-7c62-3b6e-dfd2-377982bf3ea5
>>>>>
>>>>> Win7 x86 http://www.microsoft.com/download/details.aspx?familyid=a588e9e4-f1b4-4c4d-991b-d423da4c9f7d
>>>>>
>>>>> Win7 x64 http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
>>>> Should I use the above x64 link to do the Windows updates?
>>>> See my above question please. I really do appreciate all the info you
>>>> provide, but since my knowledge is miniscule compared to yours, I can
>>>> really get lost deciphering it all sometimes! :-) My best guess as
>>>> to what I should do for him tomorrow is try Windows Update first. If
>>>> that doesn't fix the problem, try Win7 x64
>>>> http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6,
>>>> and if none of that works, try the WSUSoffline. Am I close? Hate to
>>>> keep bugging you but preventing mistakes is much easier than
>>>> correcting them!
>>>>
>>>> >>>>>>>>>>jetjock<<<<<<<<<<
>>> The Win x64 one is for your 64-bit OS.
>>>
>>> At a minimum, it increases the frequency of automatic
>>> checks for certificates to a once-a-day check.
>>>
>>> And at this point, we don't know if the certificate subsystem
>>> is fully healthy, and like you, certificates are a mystery to me.
>>>
>>> I would install that update, just so it's well equipped for
>>> handling certificates.
>>>
>>> *******
>> Ok, so it looks like run the Microsoft Win x64 first.
>>> The WsusOffline has the links to the Microsoft certificate files.
>>> The funny part being, the files stop at 2018 or so.
>>> And that's the static list of items, WsusOffline wants to install.
>>> The list does not seem to be dynamically generated from a
>>> master list - like all good things the WsusOffline team does,
>>> they assemble some of those lists from disparate sources.
>>> For example, their detection of what it takes to tip Vista upright,
>>> is first-class.
>>>
>>> Version 11.8 of WsusOffline, the Legacy OS tab, might be the
>>> last version of WsusOffline supporting Windows 7.
>>>
>>> If your Windows 7 in system control panel says that SP1 is
>>> already installed "Win 7 SP1", then you don't need to include
>>> that tick box in a Wsusoffline collection run. And you only
>>> absolutely need to select the x64 option, if working on a
>>> x64 setup. Those can help reduce the collection time.
>>>
>>> *******
>> If that doesn't work, then run WUSAOffline. If that doesn't work, I
>> just won't pay your bill! :-)
>>> You can use the "to test a website line" from the following re-post.
>>> Now, I don't know if any of the website certificates are checked
>>> against the chain of trust on the machine or not. The web browser
>>> certificates might be used for that. But your browser was just
>>> installed...
>>>
>>> To test a website:
>>>
>>> https://www.ssllabs.com/ssltest/analyze.html?d=walmart.com <===
>>>
>>> To determine the feature set of the browser:
>>>
>>> https://www.ssllabs.com/ssltest/viewMyClient.html
>>>
>>> This is an example of a browser armed for mid-sized bears.
>>>
>>> Protocols [of my client browser]
>>> TLS 1.3 No <=== web sites using *only* this, are a problem
>>> TLS 1.2 Yes
>>> TLS 1.1 Yes
>>> TLS 1.0 Yes
>>> SSL 3 No \___ User should disable these in the browser, and
>>> SSL 2 No / browser may have done this at the source end already
>>>
>>> Cipher Suites (in order of preference)
>>>
>>> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
>>> OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13) Forward Secrecy 256
>>> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
>>>
>>> Still, I don't know of too many "consumer-oriented utilities"
>>> in this domain. Lots of chuckleheads to "help you check *OUR* certificate is there".
>>> But nobody interested in vetting the entire store for correctness.
>>> I don't know how to do that. I rely on the above two web pages,
>>> to provide hints, such as they are.
>> Will do, and again, many thanks!
>
> Houston, we have a problem!! :-)
>
> First of all I tried just running Windows Update from his computer
> and got an error message (see the third photo). I checked the update
> history and saw that one update had been successfully installed (see
> second photo). I then ran the WSUSoffline updater and it failed the
> verification check (see first photo).
> https://www.sendspace.com/filegroup/1a%2BuZPuNWXgcmTOjM1kJtdm39qYjXblk.
>
> I then ran the
> http://www.microsoft.com/download/details.aspx?familyid=d3f212e9-2c49-4cd6-bd2f-51cf8a712ba6
> for x64 and it installed KB 3004394. If Windows will not update on
> it's own though, enabling it to check for updates more often isn't
> going to help much I don't think.
>
> I don't know what I would have done if WSUSoffline had passed
> verification as I have absolutely no clue as to where it downloaded
> the updates to. Can you give me a hint please? Then, if I found
> them, does it tell me how to install them? Or, is it obvious by the
> file extension?
>
> It appears that something is seriously messed up in Windows if it
> won't even do it's own updates. I clicked on "Get help with this
> error" on the Windows Update page, but all I got was help for a bunch
> of other errors. Maybe you'll have better luck deciphering it than I
> did.
>
> Speaking of luck, the Intel Graphics driver did the trick to enable
> "Sleep" mode for him. So, at least something worked!
>
> Any more suggestions will be gratefully accepted.

Logically, the target machine has a certificate problem.
Windows Updates needs a certificate.
WSUSOffline needs to be able to do SHA2.

This means that preparatory steps may have to be done
on a "healthy" machine.

*******

WSUSOffline has some tick boxes to "prepare media", but
we'll ignore those for the moment.

WSUSOffline folder
client folder
preparatory materials
downloader materials

The downloads are accumulated in the WSUSOffline folder.
The WSUSOffline folder will grow in size, to as much as
8GB if you tick too many boxes. It doesn't take much
"excess" to overdo it.

The "Download" button is relatively small, gray, and near the top
on Pastebin. This directory listing is 128KB or so long. A text file.

This is a "dir /S" listing of the folder I've got here. I could
probably cut it down to 4GB without too much trouble. The contents
are already compressed by Microsoft, so 7ZIP would not perform
miracles on the content.

https://pastebin.com/XHqXVfh4

UpdateGenerator.exe is what collects the downloads (the GUI).
client\UpdateInstaller.exe is what installs at the target machine

You run UpdateGenerator on the healthy technician machine
and build a "kit".

The "kit" is sent to the recipient, and they run UpdateInstaller.exe
on the order of five times. There is a reboot after each
partial install. The early stages ensure the support structure
is there for things to work. The last step loads in 150 or so
Windows Updates, one after another.

*******

The bare minimum you could do, is to use the chunk of code that
installs certificates and revokes, and give it a folder to work on.

"DoUpdate.cmd" 78KB script, there is this chunk...

rem *** Install Trusted Root Certificates and Certificate revocation lists ***
if "%UPDATE_RCERTS%" NEQ "/updatercerts" goto SkipTRCertsInst
echo Installing Trusted Root Certificates...
for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crt') do (
if exist %SystemRoot%\Sysnative\certutil.exe (
%SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
) else (
%SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
)
call :Log "Info: Installed ..\win\glb\%%i"
)
echo Installing Certificate revocation lists...
for /F "tokens=*" %%i in ('dir /B ..\win\glb\*.crl') do (
if exist %SystemRoot%\Sysnative\certutil.exe (
%SystemRoot%\Sysnative\certutil.exe -f -addstore Root "..\win\glb\%%i"
) else (
%SystemRoot%\System32\certutil.exe -f -addstore Root "..\win\glb\%%i"
)
call :Log "Info: Installed ..\win\glb\%%i"
)
:SkipTRCertsInst