Windows system health, monitoring, hacks

· Windows · #note/sink · #sys/health · #sys/winregistry · #code/batch · #code/powershell ·



Software update

REM check for all updates
winget upgrade

REM update everything
winget upgrade --

REM update particular app, use 'winget upgrade' to get the ID
winget upgrade <ID>

File System

Check system health

DISM.exe /Online /Cleanup-image /Scanhealth
DISM.exe /Online /Cleanup-image /Restorehealth
DISM.exe /online /cleanup-image /startcomponentcleanup
sfc /scannow
Chkdsk C: /f /r

Remove protected folders

takeown /F "Z:\Program Files" /A /R /D Y
icacls "Z:\Program Files" /T /grant administrators:F
rd /s /q "Z:\Program Files"


Remove service

sc delete servicename


Remove drivers

pnputil /enum-drivers
pnputil /delete-driver oemXXX.inf

Disable automatic driver updates

Using gpedit.msc as admin

  1. Browse the following path:Computer Configuration > Administrative Templates > Windows Components > Windows Update
  2. On the right side, double-click the Do not include drivers with Windows Update policy. Set to Enable. Apply

Disable specific driver updates


  1. In the hardware properties window, navigate to the “Details” tab and then select “Hardware IDs” from the drop-down menu under “Property.” Select all the listed IDs, right-click and then select the option “Copy.”
    win10-block-driver-updates-devman.png|232 win10-block-driver-updates-copy-ids.webp|350
  2. Opening the Group Policy Editor and navigate to “Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions.”
  3. Once you are here, find the “Prevent installation of devices that match any of these devices IDs” policy, and double-click on it to change its properties.
  4. In the policy properties window, select the “Enabled” radio button, and then click on the “Show” button appearing under the Options category.
    win10-block-driver-updates-select-enabled.webp|226 win10-block-driver-updates-enter-hardware-ids.webp|350

AMD chipset drivers

Amd drivers download
this seems to be more actual than one on the motherboard download page

PSP - Device (SecurityDevices) driver
SMBus - System management bus - installed by default
PCI - installed by default
GPIO - installed by default


Power plan

Get list of plans

powercfg /list 

Switch plan (current Ryzen Balanced)

powercfg /setactive 9897998c-92de-4669-853f-b7cd3ecb2790

Switch plan (current system Power Saver)

powercfg /setactive a1841308-3541-4fab-bc81-f71556f20b4a

Power trace

You can get a power trace by opening an admin CMD and doing:

powercfg /energy /trace /d c:\temp /duration 120

Replacing C:\temp with a folder of choice (must exist already) and 120 with the duration you want to trace in seconds. Keep track of the time(s) that the monitor comes on.

This will create an .etl file you can open in Windows Performance Analyzer. Look at Device Dstate around the times the monitor turned on and see if there are any D-state transitions from your display.

This will at least tell you if Windows is responsible for the screen turning on or if it's something from the hardware.

Performance Analyzer app is in MS Store.

Standby modes support

powercfg -a

Power requests

powercfg -requests

Builds nice graphs with reports of power requests during system idle

Windows Apps


Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

and maximum version

Get-appxpackage -packageType bundle |% {add-appxpackage -register -disabledevelopmentmode ($_.installlocation + "\appxmetadata\appxbundlemanifest.xml")}
$bundlefamilies = (get-appxpackage -packagetype Bundle).packagefamilyname
get-appxpackage -packagetype main |? {-not ($bundlefamilies -contains $_.packagefamilyname)} |% {add-appxpackage -register -disabledevelopmentmode ($_.installlocation + "\appxmanifest.xml")}


Remove Web Media Extensions

Get-AppxPackage Microsoft.WebmediaExtensions | Remove-AppxPackage


Bad memory

Enable memory blacklisting

bcdedit /set {badmemory} badmemoryaccess no

Event 1001 : Windows removed bad memory regions from this PC.
Bad memory found, to see what memory has been marked by the OS as bad:

bcdedit /enum {badmemory}

Alternatively, you may use the RAMMap tool from Microsoft

To clear the list of page numbers that have been blacklisted

bcdedit /deletevalue {badmemory} badmemorylist


Enable Gpedit.exe in Windows 10/11 Home edition

Using CMD as Admin

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO ( DISM /Online /NoRestart /Add-Package:"%F" )
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO ( DISM /Online /NoRestart /Add-Package:"%F" )


Video thumbnails

Disabling the reel borders on the video/image files

Treatment item:
0 = No border
1 or 2 = Shadow border (default)
3 = Video reel border

Disable Widget preload

to get rid of EdgeWebView process, that east too much VRAM

First disable Widgets and Teams from starting up
Then go to registry Computer\HKEY_USERS\S-1-5-21-3078088237-2142244905-4044066433-1002\Software\Microsoft\Windows\CurrentVersion\Dsh and set IsPrelaunchEnabled to 0

Expanded context menu in Win 11



reg.exe add -HKEY_CURRENT_USER\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 /f /ve



reg.exe delete -HKEY_CURRENT_USER\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}

System Info


List drives

Get-PhysicalDisk | Select -Prop DeviceId,FriendlyName,SerialNumber

PDO drive

Get drive info by PDO identifier like PDO name: \Device\00000086

Get-CimInstance -ClassName Win32_PnPSignedDriver | ? { $_.PDO -match '00000089' } | select *


Get windows system info using WMI

To get a brief overview of an alias

wmic <alias> list brief

Full alias overview can be displayed:

wmic <alias> list full

Get Information About Operating System

wmic OS get Caption,CSDVersion,OSArchitecture,Version

Get Information About BIOS

wmic BIOS get Manufacturer,Name,SMBIOSBIOSVersion,Version

Get Serial Numbers of Hard Drives

wmic path win32_physicalmedia get SerialNumber


winsat assesses various features, capabilities, and attributes of a computer

winsat formal

Formal - Runs a set of pre-defined assessments and saves the data in an XML file in %systemroot%/\performance/\winsat/\datastore