forked from andreipintica/TSSV2
-
Notifications
You must be signed in to change notification settings - Fork 0
/
TSSv2_NET.psm1
6720 lines (6342 loc) · 343 KB
/
TSSv2_NET.psm1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<# File: TSSv2_NET.psm1
.SYNOPSIS
NET module for collecting ETW traces and various custom tracing functionality
.DESCRIPTION
Define ETW traces for Windows NET components
Add any custom tracing functinaliy for tracing NET components
For Developers:
1. Switch test: .\TSSv2.ps1 -Start -NET_NDIS
2. Scenario test: .\TSSv2.ps1 -start -Scenario NET_TestMe -mini -noZip -noSDP -noXray -noBasicLog
.NOTES
Dev. Lead: WalterE
Authors : WalterE; MuratK; Sergey.Akinshin; Tfairman
Requires : PowerShell V4 (Supported from Windows 8.1/Windows Server 2012 R2)
Version : see $global:TssVerDateNET
.LINK
TSSv2 https://internal.support.services.microsoft.com/en-us/help/4619187
NET https://internal.support.services.microsoft.com/en-US/help/4648588
#>
<# latest changes
ToDo: replace (Get-TimeZone).DisplayName with [System.TimeZoneInfo]::Local.DisplayName
:: 2023.05.22.0 [we] _NET: fix duplicate CollectNET_MBNLog()
:: 2023.05.19.3 [tfairman] _NET: Move SCM component to TSSv2_PRF
:: 2023.05.18.0 [tfairman] _NET: Deprecate SDN component / point user to URL in help listing
:: 2023.05.17.0 [tfairman] _NET: Remove non-important console messages (poststop / collect / helper routines), redirect to file
:: 2023.05.17.0 [we] _NET: deprecate NET_iSCSI
:: 2023.05.16.0 [tfairman] _NET: Remove non-important console messages (prestart routines), redirect to file
:: 2023.05.15.0 [we] _NET: reduce some spew (getNetcfg, getNetFiles, getNetSh-http-show-UrlAcl)
:: 2023.05.07.0 [we] _NET: fix Eventlog names for DHCP-Client/*
:: 2023.04.20.0 [we] _NET: fix NET_VPN NetshScenario for Srv2016 (scenario=VpnClient* not supported)
:: 2023.04.18.1 [we] _NET: add NET_NDIScap; modify NET_fskm
:: 2023.04.18.0 [we] _NET: move NET_PerfLib to PRF_PerfLib
:: 2023.04.17.0 [we] _NET: activate "Microsoft-Windows-DHCP Client Events/Operational"
:: 2023.04.12.0 [we] _NET: add FWgetFltMcInfo to NET_stop_common_tasks
:: 2023.04.07.0 [we] _NET: consolidate, moved NET_PnP to DND_PnP
:: 2023.04.06.0 [we] _NET: moved NET_PrintSvc into UEX_Print
:: 2023.04.03.0 [we] _FW: fix define global:FwSetMCF; _NET: NET_NPS providers: remove provider which is included in ADS_SSL
:: 2023.03.23.0 [we] _NET: fix NET_DHCPsrv Guid for Srv2012R2
:: 2023.03.16.1 [we] _NET: NET_SMBsrv: run getNetFiles() only at _start_
:: 2023.03.16.0 [we] _NET: add -Width 999 for some PS outputs
:: 2023.03.14.0 [we] _NET: mod Reg.keys UNChard1; add correlation=disabled to NET_HypHost NetSh (kb5025648)
:: 2023.03.08.1 [we] _NET: add NET_NPS provider for EapHost
:: 2023.03.08.0 [we] _NET add CAPI2 Evt to NET_VPN
:: 2023.03.07.0 [we] _NET add Reg. DefenderATP to NET_SMBsrv and NET_WorkFolders
:: 2023.03.04.0 [we] _NET enhance RunNET_SMBsrvPerm()
:: 2023.03.02.0 [we] _NET add Reg. DefenderATP to NET_SMBcli
:: 2023.02.21.0 [we] _NET WebIO add EvtLog "Microsoft-Windows-WebIO/Diagnostic"
:: 2023.02.20.0 [we] _NET removed '-Encoding ascii' for NFS commands; for file IP_Srv_Wks_Info: SMB Server/Workstation info was moved to files SMB_Server_Info/SMB_Workstation_Info; use FW functions FwGetArp,FwGetIPconfig,FwGetNetstat,FwGetSMBserverInfo,FwGetSMBwkstaInfo
:: 2023.02.15.0 [we] _NET enhance getWLANinfo() output; add NET_Wlan component, add FwGetWhoAmI() to NET_stop_common_tasks; add getNICinfo()
:: 2023.02.14.0 [we] _NET FwExportRegistry "UNC hardening" $KeysUNChard1; add Arp-table to NET_NLB
:: 2023.02.13.1 [we] _NET add Reg "SMBsrv","LSA", move "DotNETFramework" reg keys to -noRecursive
:: 2023.02.08.0 [we] _NET replaced reg "NETFramework" with "DotNETFramework"
:: 2023.02.04.0 [we] _NET robustify copyMachineUserProfiles() and copyWLANProfiles()
:: 2023.02.03.0 [we] _NET adjust NET_Auth (after _ADS: integrated Auth-start/-stop scripts (v4.7) into component/scenario ADS_Auth)
:: 2023.01.31.0 [we] _NET fix -StartAutologger NET_FireWall, NET_BFE, NET_Wfp, NET_NetProfM
:: 2023.01.19.1 [we] _NET add NET_WinNAT to NET_HypHost
:: 2023.01.18.0 [we] _NET use FwCreateFolder if folder does not exist
:: 2023.01.18.0 [we] _NET moved function setMCF() to _FW: FwSetMCF; $NET_DummyProviders = @()
:: 2023.01.17.0 [we] _NET included Srv2019 again in setMCF
:: 2023.01.13.0 [we] _NET exclude MdmDiagnosticsTool on SrvCore or PreW10
:: 2023.01.11.0 [we] _NET add Reg Multimedia\SystemProfile to KeysSMB
:: 2022.12.30.0 [we] _NET remove ServicesForNFS-ONCRPC from Net_NDFcli; add getSMBsrvBinding() for -Collect NET_SMBsrvBinding, add \scripts\Tss_SMB_Fix-SmbBindings.ps1
:: 2022.12.28.0 [we] _NET replaced ADS_GroupPolicy with ADS_GPO
2022.12.27.0 [we] _NET: remove components NET_SBSL,NET_UNChard
2022.12.24.1 [we] _NET: remove NET_AfdTcpFull from NET_WFP scen., as providers are now included in NET_WFP comp; remove NET_NetIO comp
2022.12.24.0 [we] _NET: add NET_WinInet and consolidate WinInet
2022.12.23.1 [we] _NET: Docker: check for Hyper-V to decide for NetShScenario; add getBFEregPerm(); Marcussa: add Component NET_MBN, upd MBN scenario, add IPsec scenario
2022.12.15.0 [we] _NET: add LLDP LinkLayerDiscoveryProtocol
2022.12.13.0 [we] _NET: add LLTDIO (Link-Layer Topology Discovery Mapper I/O Driver)
2022.12.12.0 [we] _NET: fix NET_WebCliTTD; re-enable NET_HTTPsys description
2022.12.09.0 [we] _NET: fix RaMgmtSvc status for setMCF(), added FwListProcsAndSvcs
2022.12.07.0 [we] _NET: add $ADS_Netlogon to -NET_Auth
2022.12.04.0 [we] _NET: mod getBCInfo; replace $OSVER3
2022.12.02.0 [we] _NET: mod PS Cmdlet for BranchCache to count *.tmp files
2022.11.28.0 [we] _NET: consolidating NET_WMI with UEX_WMI, NET_AppV with UEX_AppV
2022.11.22.1 [we] _NET: add VmsNicProxy,VmsProxyCtrlGuid to VMswitch
2022.11.22.0 [mm] _NET: replaced ssl etl traces in NET_TLS with ADS SSL module
2022.11.17.0 [we] _NET: add SmbCA (SMB Direct), mod NET_RDMA to include SmbCA + Perfmon ALL
2022.11.17.0 [we] _NET: add SmbCA (SMB Direct), mod NET_RDMA to include SmbCA + Perfmon ALL
2022.11.15.0 [we] _NET: Dis-/Enable MulticastForwarding based on Servcie status of RemoteAccess -or RaMgmtSvc
2022.11.14.0 [we] _NET: NET_BFE get BFE_Registry_permissions
2022.11.03.1 [we] _NET: fix path with possible blank characters for robocopy (i.e. $Env:LocalAppData); add -NetProfM to scenarios NCSI and Firewall
2022.10.22.0 [we] _NET: add query SMBsrv Share/NTFS permissions with '-Mode Permission'
2022.10.19.0 [we] [psSDP] DFSsrv Evt-logs/reg.keys
2022.10.14.0 [we] _NET: add "Rpc" reg collection to SMBcli
2022.10.06.0 [we] _NET: move Microsoft-Windows-Ras-NdisWanPacketCapture into NetSh packetcapture
2022.09.01.0 [we] _NET: add NET_SSTP
2022.08.31.0 [we] _NET: add NetProfM
2022.08.28.0 [we] _NET: fix CollectNet_IIS/IPAM
2022.08.20.0 [we] _NET: add SMB reg keys to SMB*scenarios
2022.08.18.0 [we] _NET: add NET_LDAPsrv
2022.08.17.0 [we] _NET: add Microsoft-Windows-EQoS to NET_QoS
2022.08.16.1 [we] _NET: add NET_Quic; adding QUIC to SMBcli and SMBsrv scenarios
2022.08.12.0 [we] _NET: add NET_NPS provider GUIDS
2022.08.11.2 [we] _NET: mod OpenSSH; add sshd_config_default; for DHCPcli: add EvtLogsDHCPcli
2022.08.10.1 [we] _NET: add "FwCopyMemoryDump -DaysBack 2" to stop_common_task
2022.08.10.0 [we] _NET: corrected typo in itatap (=isatap ), add $EvtLogsNcsiAnalytic
2022.08.08.1 [we] _NET: add OpenSSH
2022.08.03.0 [we] _NET: DNSsrv: check if DNS server is running; mod LDAPcli
2022.08.02.0 [we] _NET: mod NET_NFSsrv, add NFS commands for downlevel OS
2022.08.01.0 [we] _NET: add var $TLStestSite to make PSScriptAnalyzer happy
2022.07.28.0 [we] _NET: NET_GeoLocation
2022.07.27.0 [we] _NET: removed Get-DnsServerResourceRecord in getDNSsrvInfo()
2022.07.26.0 [we] _NET: add getWfpShow for NET_WFP; add DNS server Policy infos; add $EvtLogsQoSAnalytic to NET_QoS
2022.07.20.0 [we] _NET: add 'PowerCfg.exe /sleepstudy'
2022.07.14.0 [we] _NET: add TLS to Branchcache
2022.07.13.0 [we] _NET: removed '-Encoding ascii' for NCSI Get-NetConnectionProfile
2022.07.11.0 [we] _NET: add 'NET_Firewall' and FwGetGPresultAS to Branchcache
2022.07.07.0 [we] _NET: add output of PowerCfg /a (#662)
2022.07.05.0 [we] _NET: mod NET_VPN to include AzureVpn log files (#657)
2022.06.20.0 [we] _NET: add RASdiag to VPN
2022.06.10.0 [we] _NET: add NFScli GUIDs (#issue #646), add NDIS to LBFoProviders (#issue #636)
2022.06.08.0 [we] _NET: removing component -WebCliTTD but keeping -Scenario
2022.06.07.0 [we] _NET: add NET_SQLcheck, also added to psSDP
2022.06.06.0 [we] _NET: fix partially WebCliTTD
2022.06.03.0 [we] _NET: fix WebClient, add WebCliTTD, use GUIDs for FwAuditPolSet() calls
2022.05.31.0 [we] _NET: add NET_WLAN again; obey global:IsLiteMode
2022.05.25.0 [mk] _NET: add Afdtcpfull to NET_hyphost scenario, removed smbcli and smbsrv from NET_hyphost
2022.05.24.0 [we] _NET: add Win32_DeviceGuard to VPN/808.1x scenario
2022.05.19.2 [we] _NET: avoid NFScli for SMB/SMBcli/DFScli; fix DFScli,NFScli,RDMA,DFSsrv; add *SMBshare_Info*.txt
2022.05.13.0 [we] _NET: check for DFS-N server
2022.05.12.0 [we] _NET: mod NFScli; upd getDFSsrvInfo()
2022.05.11.0 [we] _NET: timeout for DFSnRoot; upd NFScli for NfsMappedIdentity
2022.05.09.0 [we] _NET: upd WIP fixes, upd EFS
2022.05.06.1 [we] _NET: upd NET_AppV; add WIP
2022.05.05.0 [we] _NET: add -Mode NFSperm/Permission; NPS srv check
2022.04.22.0 [we] _NET: add RunNET_DFSnDiag, getDFSsrvInfo
2022.04.13.0 [we] _NET: replace WMIC commands; add FwGetGPresultAS to SMBsrv
2022.04.12.0 [we] _NET: fix DnsCmd outputs
2022.04.08.0 [we] _NET: upd Net_printSvc
2022.04.01.0 [we] _NET: add for Firewall: FwAuditpolSet '"Filtering Platform Packet Drop","Filtering Platform Connection"'
2022.03.31.0 [we] _NET: IPsec (#552) Enabling IPsec related Events in Security Eventlog via AuditPol.exe
2022.03.28.0 [we] _NET: dont run 'netstat -anoq' on OS<9600
2022.03.23.0 [we] _NET: add Procmon to NET_Auth
2022.03.21.0 [we] _NET: upd Miracast
2022.03.07.0 [we] _NET: fix Net_CSC
2022.03.01.0 [we] _NET: fix PktMon for _Firewall on downlevel OS
2022.02.22.0 [we] _NET: fix missing SMB analystic logs depending on OS
2022.02.17.0 [we] _NET: remove "Microsoft-Windows-WLAN-AutoConfig/Operational" on ServerSKU
2022.02.14.0 [we] _NET: fix $DirRepro variable
2022.02.11.0 [we] _NET: upd NET_NCSI provider
2022.02.10.0 [we] _NET: upd DHCPcli help
2022.02.06.0 [we] _FW: added missing NET_RDS* and DNS_Setup* descriptions
2022.02.04.0 [we] _NET: if (!Mode -eq "Basic") {VpnClient_dbg}, fix Workfolders
2022.02.03.0 [we] _FW: ignore errors for "Get-WinEvent -Oldest ..", add FwGetSrvSKU(),FwGetSrvRole(); _NET add FwGetSrvRole to Start_common
2022.02.01.0 [we] _NET: add NET_Auth,NET_Proxy as component tracing; Providers must not have '_' or '-' in name
2022.01.31.0 [we] _FW: mod. update-script
2022.01.29.2 [we] _FW: full NotMyFaultPath + /AcceptEula, mod. display of Test_* functions i.e. Test_File
2022.01.28.0 [we] _NET: add RD Licensing server providers to RdsSrv
2022.01.27.1 [we] _FW: fixed missing folder $PreviousError for -Help/-Version & $Error exists
2022.01.25.0 [we] _NET: add Container
2022.01.24.0 [we] _FW: upd ListSupportedCommands
2022.01.22.5 [we] _FW: minor cleanup and help changes; mod -LiveKd Start; swapped string "Running" with [System.ServiceProcess.ServiceControllerStatus]::Running; added helper functions ProcessBasicLog, FwTest-TCPport
2022.01.18.0 [we] _FW: add Function FwTestConnWebSite, upd tss_update-script.ps1
2022.01.16.0 [we] _FW: upd minor help lines; _NET: add RdsBrokerMan to NET_RDSsrv
2022.01.14.0 [we] fix psSDP TS_MCAlite.ps1
2022.01.13.1 [we] _NET: upd PrintSvc, add NET_UNChard,SBSL
2022.01.13.0 [we] _NET: add NET_RDScli,NET_RDSsrv
_FW: add FwGetEnv(), FwQwinsta()
2022.01.12.0 [we] _NET: add "Microsoft-Windows-VPN-Client" to VPN, add IPsec to VPN/WFP scenario
2022.01.10.0 [we] _NET: add NET_Netsetup,NET_Netlogon; moved Start/Stop_Netlogon to NET_Netlogon
2022.01.07.0 [we] _FW: ren Fw functions CreateLogFolder,EvtLogDetails,ExecWMIQuery,ExportRegistry,ExportRegToOneFile,IsElevated,IsSupportedOSVersion,ResolveDesktopPath to Fw*
2022.01.06.0 [we] _FW: add ListSupportedNoOptions, sort CONTROLS aphabetically, fix global:FwGetCertsInfo
2022.01.05.0 [we] _FW: fix typos; fix ProcmonPreStart/ProcmonPostStop; FwGetCertsInfo(); upd -Help with SDP; _NET: fix WebClient
2022.01.04.2 [we] _FW: moving more helper functions of general interest from _NET to _FW: global: FwClearCaches, FwCopyWindirTracing, FwDoCrash, FwGetGPresultAS, FwGetKlist, FwGetMsInfo32, FwGetNltestDomInfo, FwGetPoolmon, FwGetProxyInfo, FwGetRegHives, FwRestartInOwnSvc, FwGetSVC, FwGetSVCactive, FwGetSysInfo, FwGetTaskList, FwGetWhoAmI
2022.01.04.0 [we] _FW: for MiniBasicLogs Folder=BasicLogs_Mini; fix Issue#405: add App/Sys Evtlogs in CSV,TXT format; add WireShark ex); add FwGetHandle()
2022.01.03.0 [we] _NET: re-add NET_HypHost/HypVM, _FW: revoked preliminary changes for Issue#396, fixed typos
2021.12.31.1 [we] _FW: add FwAddRegItem/FwGetRegList and FwAddEvtLog/FwGetEvtLogList as FW functions; sorted no* options
moved NET_ components to ADS: GPedit GPmgmt GPsvc GroupPolicy Profile
_NET: moved Poolmon to FW; renamed addReg -> FwAddRegItem, addEvtLog -> FwAddEvtLog
_NET: moved NET_ components to SHA: HypHost, HypVM, ShieldedVM; made some $EvtLogs to global:EvtLogs*; moved FwGetNetAdapter and FwGetVMNetAdapter to FW
_NET: moved NET_ '_WinUpd' to _DND
2021.12.31.1 [we] _FW: rename FwEventLogExport rename to FwExportSingleEventLog (#327)
2021.12.31.0 [we] _FW: fix typos, extend -Help, add -ListSupportedCommands, sorting items alphabetically, replace " " with <Tab>,..
2021.12.30.0 [we] _NET: add FwGetCertsInfo to SMBcli
2021.12.29.0 [we] _FW: fix '-PerfMon ALL' for Srv2022 & Win11 (Issue#383); fix Get-TimeZone (Issue#381); Issue#380 -PktMon is only supported on RS5+; fixing (partly?) PktMon output
2021.12.27.0 [we] _NET: fix doTCPrundown(),CollectNET_VPNLog; _FW: mod. Procdump helpmsg
2021.12.18.0 [rh] _FW: change variable name to $global:StartAutologger from $global:SetAutoLogger to refect the change happened in FW
[we] mod tss_update-script, Help on Syntax
2021.12.17.1 [we] _FW: cosmetic changes; report Get-Culture and Get-UICulture in info log
2021.12.17.0 [we] _SHA: fix SHA_SDDC based on RobertVi; _NET: fix NET_Capture
2021.12.16.2 [we] _NET: workaround for #362
_FW added help: -WaitEvent Evt:<EventID>:<Eventlog Name>[:<CheckIntInSec>:<StopWaitTimeInSec>:<StopEventData>:<EvtDataPartial>:<OR|AND>]
add Function FwRunAdminCheck, fix #355; change "Reproduce the issue and enter 'Y' key .." to avoid stopping immediatelly when user entered Y<RETURN> for PSR/Video
replaced some Read-Host with CHOICE
upd \BIN\sysmon,procmon
bail out on outdated version > 30days
2021.12.15.0 [we] _NET: cosmetic upd
_FW: cosmetic upd; tbd: issues #354, #355
2021.12.14.0 [we] _FW: add Repro output + Recording declined, psSDP -skipQEdit
_NET: add SMB/SMBcli/SMBsrv/SMBcluster component tracing; fix NET_SMB function
2021.12.13.1 [we] _NET: re. Localized OS: replaced "-eq 'Running'" with "-eq [System.ServiceProcess.ServiceControllerStatus]::Running" (find TypeName: functionName | Get-Member)
2021.12.13.0 [we] _FW: correction on PS command syntax, fix typos, homogenized Lower-/Upper-Case parameters/functions
_NET: moved Dedup/DdpFlt to _SHA, marked some NET components for SHA_/ADS_
2021.12.12.1 [rh] _FW: add -NetshMaxSize and more no* switches
2021.12.10.0 [we] _FW: global replaced #LogError$ErrorMessage -> LogError $ErrorMessage, fix Netsh AutoLoggerStartOption
2021.12.09.1 [we] _SHA: fix SHA_SDDC; _FW: don't run AutoUpdate, $Xray = $True => always run xray unless -noXray
2021.12.08.0 [we] #_# _UEX: add collect -UEX_PrintEx -> change later to UEX_Print, once SME's decide to remove current UEX_Print component
2021.12.07.0 [we] _FW: updated -Help messages; fixed HKEY_CLASS_ROOT -> HKEY_CLASSES_ROOT; add $TssPhase to distinguish _Start/_Stop appendices for filenames;
avoid UpdateTSS if online check fUpToDate=True; added -Help 0 Common: Help on unexpected PowerShell errors
_NET: fix WebClient -Mode Advanced
2021.12.05.0 [we] _SHA: add SHA_SMS: _FW: cleanup, granular reusable FwBasicLog functions
2021.12.01.0 [we] _NET: add NET_Auth scenario
2021.11.29.0 [we] _NET: add RAS -Mode Hang
_FW: add option -Mode Hang, add check $noUpdate for online check; add switches -noPerfMon, -noNetsh, -noXperf, -noWPR (could be necessary avoiding PerfMon issues on localized OS); adding PerfMon '\Process V2' counters for Win11
moving NET_ADcore, NET_ADsam, NET_BadPwd, NET_DFSR, NET_LDAPsrv, NET_LockOut to ADS
moving NET_CSVspace, NET_MPIO, NET_msDSM to SHA
2021.11.25.2 [we] _FW: automated public online version checking
2021.11.25.0 [we] _NET move FwResetEventLog into Collect function, add 'CollectComponentLog' to scenarios
_FW: fix typos
2021.11.24.0 [we] _NET run 'TCP rundown' at PreStop, correct NET -Help; add CollectComponentLog to all scenarios
_FW: fix WireShark (#294)
2021.11.23.1 [we] _FW: fix Wireshark #294; _NET: add CollectComponentLog to Scenario(s) WebClient; fix $global:WS_TraceBufferSizeInMB
2021.11.22.1 [we] _NET add RASdialer,MediaManager,VPNplugin GUIDs to RasMan; upd Webclient -Mode Adv;
_FW: add global:FwNew-TemporaryFolder(), fix typos; upd Tss_config; replace global:GetProductTypeFromReg with global:FwGetProductTypeFromReg
2021.11.17.0 [we] _NET add Workfolders -Mode Advanced
_FW: cleanup + typos
2021.11.15.0 [we] _NET preparing for -Scenario NET_WebClient -Mode Advanced
_FW: add -Mode Restart, fix typos
2021.11.10.0 [we] _FW: replaced gwmi/Get-WmiObject with Get-CimInstance to be compatible with PS v7
2021.11.08.0 [we] _NET: mod Print, TLS; FW: mod -noUpdate
2021.11.03.0 [we] _NET: mod RAmgmt, mod Workfolders
TSSv2.ps1: fix ProcessListSupportedNetshScenario(), add HyperVCounters, replaced \MSDATA with \MS_DATA, replace switch -Perf with -PerfMon in .ps*, renamed *Netsh.etl to *Netsh_packetcapture.etl
2021.10.30.0 [we] upd SysMon, _NET: mod DNSsrv Miracast, add MFAext MDM; fix PrefixT; $Global:StartAutologger in .psm1
TSSv2.ps1: replaced New-Variable with Set-Variable for global no-switches
2021.10.26.0 [we] _NET add noEvtSec; add SHA_SDDC, SHA_MSCluster
[we] _SHA add MSCluster; add CollectSHA_SDDCLog by calling external psSDP scripts
2021.10.22.0 [we] FW: introduced Close_Transcript(); sorted UEX switches alphabetically; fixed ProcDump path; for UEX: call external \scripts\*-collect.ps1 for UEX_DSC, UEX_Evt, UEX_TSched
2021.10.20.0 [we] fix for #259: moving Netview collection to \psSDP\Diag\global\*Netview.*
2021.10.18.0 [we] moving \BIN86\ProcMon to \BIN, removing \BIN64\ProcMon
2021.10.13.0 [we] fixing $SMB*OptEventlogs for Win2012*
TSSv2.ps1 : fix for Win2012* version check; [Beta-Phase] for Win7, adjusted Netsh tracing for +Win7
2021.10.11.0 [we] fixing some typos in FW and modules
2021.10.08.0 [we] _NET fix NLTEST for not-domain-joined systems
2021.10.06.0 [we] _NET adjusted FwSetEventLog calls
2021.10.05.0 [we] _NET
TSSv2.ps1 : better Help descr.
2021.10.01.0 [we] upd COM,Workfolders,NFSsrv,NPS,GPedit,Profile,LDAPcli
2021.09.20.1 [rh] Moved list of scenario trace descriptions to pod module(i.e. $NET_ScenarioTraceList was added in this modue).
2021.09.19.0 [we] NA
TSSv2.ps1 : -Update -UdpMode Quick|Full|Force; add noUpdate, changed 'ver' to 'version', changed $script:FwEvtxLogSize to global, added tss_config.cfg parameters
2021.09.16.0 [we] SdnNC; Capturetype=both for Docker/Container,HypHost,SdnNC,WNV
TSSv2.ps1 : -Update feature
2021.09.13.1 [we] moved PerfCounter into main, 802Dot1x/WLAN,Miracast,MPIO,msDSM,SQLtrace,Winsock,WorkFolders; fix 'Perf SQL'
2021.09.12.1 [we] _NET SCM,SDDC,ShieldedVM,Tapi,TaskSch,Winlogon,WmbClass,WWAN; disableEvtLog->FwResetEventLog
TSSv2.ps1 renamed -sample to \Config\tss_config.cfg; add $Mode [Basic|Advanced|Full]
2021.09.09.1 [we] _NET SCM part #1
2021.09.09.0 [we] _NET re-adding Proxy, fix FwAddEvtLog, add -beta switch in TSSv2 for a kind of KIR/Feature-preTesting
TSSv2.ps1 #_# moved ----- begin _Stop_common_task block down after: data collection function for scenario. #161
2021.09.08.1 [we] _NET: Proxy, fix FwAddEvtLog, replaced enableEvtLog with FwSetEventLog
TSSv2.ps1:
- add -beta switch in TSSv2 for a kind of KIR/preTesting
- add -Beta , # hidden switch = Testing/newFeature mode
2021.09.07.1 [we] _NET: adopt enhanced FW functions like FwSetEventLog;
2021.09.06.0 [we] _NET: WebClient, most NET scenarios have 'CommonTask NET' = $True
TSSv2.ps1/tss-clock.ps1 change for #154
2021.09.03.0 [we] _NET: GPresult, NFC,NFScli,NFSsrv,NLB,NPS,PCI,RDMA,RPC,SCCM,SNMP
2021.09.02.0 [we] _NET: IPAM,MUX,LDAPsrv,LockOut,MBAM,MBN,NetworkUX,WCM,VPN
2021.09.01.1 [we] _NET: add NTFS,PerfLib,PnP,PortProxy,PowerShell,WinRM,WSMan, PrintSvc,Profile,Proxy,Winsock,QoS,RadioManager,RAS,RasMan; IPsec,KernelIO; ICS,IIS
2021.08.30.0 [we] _NET: DFScli,DFSsrv
2021.08.29.0 [we] _NET: HypVmBus,HypVmms,HypVmWp,VMM,VmConfig,HypVM
2021.08.28.0 [we] _NET: ADcore,ADsam,AppLocker,AppV,BadPwd,Crash,CsvSpace,DFSmgmt,DHCPsrv,Firewall,FltMgr,FSRM,FWmgr,GPedit,GPmgmt,GPsvc,GroupPolicy,Handle,HttpSys - TSSv2 updating Sysinterals tools
2021.08.26.0 [we] _NET: add DFSr,EFS
2021.08.23.0 [we] _NET: add CSC,Docker/Container,HNS,WinNAT,WNV,NCHA,DAcli,NCA,TLS,WMI,DAsrv,Netlogon,LDAPcli,RAmgmt,Dedup
TSSv2.ps1: fix noXray, start PSR minimized
2021.08.13.0 [we] _NET: upd SQL Perfcounter, add Bluetooth,BranchCache, SCCM
2021.08.10.0 [we] _NET: add 'xray' and 'SDP NET' to all scenarios; add BITS
2021.07.21.0 [we] _NET: add WFP,BFE, fixed disableEvtLog
2021.07.20.0 [we] _NET: add DNScli,DNSsrv; moved NET_start_common_tasks into *ScenarioPostStart"
2021.06.23.0 [we] _NET: add NDISwan, RNDIS, VMswitch, Perf definitions
2021.06.22.0 [we] _NET: add NCSI, added TestMe trace/scenario
TSSv2.ps1
- fix handling space in EvtLog in function FwExportEventLog
2021.06.20.0 [we] _NET: modified SMB* scenarios, add DCLocator, DHCPcli, NET_IPhlpSvc, add more Helper-functions
TSSv2.ps1
- added -noZip,
- fixed typos, filed #70, #71, #72, #73
- replaced all LogMessage $LogLevel.Info with LogInfo (same for Debug)
- added optional parameter $BootRequired to function global:FwAddRegValue
- commented in global:FwResetEventLog: #we# Remove-Item -Path "HKLM:\Software\Microsoft\TSSv2" -ErrorAction SilentlyContinue | Out-Null #we# in order to keep EulaAccepted
- grouped FW Event and Registry functions in sequential order
2021.06.18.1 [mk] _NET: add NET_WebIO switch; add NET_WebIO scenario
2021.06.18.0 [we] _NET: add FwGetWhoAmI, FwGetGPresultAS; add NET_SMB* (cli/srv), NFSsrv; changed order in all Trace providers to: '{GUID}' # 'Name of provider' - as name may not exist on system / client OS - resulting in Logman (Error=0x80070490), also makes -FindGUID work
2021.06.17.0 [we] add more TssV1 HelperFunctions, add NET_LBFO, iSCSI, BGP, (partly: COM, HTTP, NFS)
2021.06.15.0 [we] TSSv2: fixed regressions from #62 (changed to $global:ProcArch); _NET.psm1: moved #NET_stop_common_tasks into Collect<scenarioName>ScenarioLog, add NET HelperFunctions FwAddRegItem/global:FwGetRegList + FwAddEvtLog/FwGetEvtLogList
2021.06.14.0 [we] changed $global:ProcArch, moved #NET_stop_common_tasks into Collect<scenarioName>ScenarioLog, add HelperFunctions FwAddRegItem + add Evt
2021.06.13.0 [we] add normal NetSh scenarios to $SupportedScenarios list; change for speeaking zipNames, replaced NetSH names to packetcapture for LogRaker consumption, fixed duplicate $Env:PATH entries, added InfoLogFileOnly, minor typo corrections, changes some $LogSuffix to $LogPrefix, initialize global parameters, place and lookup all config files in \config folder; find all external/supporting scripts in \scripts folder, add folders \config and \scripts with defaults/samples for TSSv2,ProcMon,Sysmon
2021.06.12.0 [we] Added NET Capture & NetView scenario, added -Ver and -Mini switch in Tssv2 script
2021.06.11.0 [we] add Helper-functions, renamed NET_Scn_NETIO to NET_NETIO, add NET_General scenario, added BIN folders - TSSv2 will skip if folder does not exist
### ToDO's
see all #ToDo:
- change files names for _Evtx_ and corresponding .txt files
- # analytical/debug/diagnostic event channels can not be captured live, if any are encountered (not normal), disable them temporarily for export (see sddc*.ps1) => OK, done
- substitute some 'writeTesting' messages to 'LogDebug'
### @Dev: FYI: some TSSv1 translations to TSSv2:
TSSv1 <module>_start and <module>_stop actions need to be executend in TssV2 <switch/trace> Pre/Post/Collect functions (not in senarioPre/Post!)
!_OSVER3! = $OSVER3
!_DirRepro! = $DirRepro = $global:LogFolder
!_DirScript! = $DirScript = $global:ScriptFolder
!_PrefixT! = $PrefixTime` = $global:LogFolder\$($LogPrefix)
!_Prefix! = $PrefixCn` = $global:LogFolder + "\" + $Env:Computername + "_"
call :logNoTimeItem = LogInfoFile "Your message"
call :logOnlyItem = LogInfoFile "Your message"
call :addReg = FwAddRegItem $AddToRegKeyModules -- example: FwAddRegItem @("Tcp", "Rpc") _Stop_
call :FwAddEvtLog = ($EvtLogsDNScli, "Microsoft-Windows-CAPI2/Operational") | ForEach-Object { FwAddEvtLog $_ _Stop_}
call :DoRegPreRequSet [RegLoc RegKeyName RegValue BootRequired] = FwAddRegValue "$RegistryKey" "$RegistryValue" "$RegistryValueType" "$RegistryValueData" $True (if boot is required)
ADD REG = FwAddRegValue
call :DoRegDelete [RegLoc RegKeyName] = FwDeleteRegValue "$RegistryKey" "$RegistryValue"
call :enableEvtLog -> FwSetEventLog in NET_<switch>PreStart function, add corresponding 'disableEvtLog' in NET_<switch>PostStop (or collect*Log)
call :addEvtAndDisable -> invoke a) DisableEvtLog, b) FwAddEvtLog
call :logShowItem = LogInfo "[$($MyInvocation.MyCommand.Name)] <infoText>"
call :logitem = LogInfo "[$($MyInvocation.MyCommand.Name)] .."
call :Stop_SysInfo = FwGetMsInfo32
call :doCmd ... =
if output should be saved in file:
$outFile = $PrefixT + "WhoAmI" + $TssPhase + ".txt"
$Commands = @(
"... | Out-File -Append $outFile"
)
RunCommands $LogPrefix $Commands -ThrowException:$False -ShowMessage:$False
else:
$Commands = @(
"..."
)
RunCommands $LogPrefix $Commands -ThrowException:$False -ShowMessage:$False
call :InitTxtFile filename !mode! = $outFile = $PrefixT + "filename" + $TssPhase + ".txt"
call :logCmd !_filenameFile! = $Commands = @( ... see above
call :PSrunCommand <file> "ps-command" = "ps-command |Outfile <file>"
call :PSrunScriptBlock OutName PScommand =: $outFile = $PrefixT + "OutName.txt"
PScommand | Out-File -Append $outFile
call :PSrunScriptBlckFL OutName PScommand =: $outFile = $PrefixT + "OutName.txt"
PScommand | fl * |Out-file -Append $outFile -Encoding ascii -Width 500
call :enableEvtLog %%i /ms:!_EvtxLogSize! = FwSetEventLog $xxxEvtLogs -EvtxLogSize $global:EvtxLogSize
- when you use the FwSetEventLog in pre-start function, please don't forget to call FwResetEventLog that restores previous settings of the event log in post-stop function.
call :DoRegPreRequCheck = ...
call #NET_start_common_tasks in all <ScenarioName>ScenarioPostStart # 2021.09.06.0 [we] add 'CommonTask NET'
call #NET_stop_common_tasks in all Collect<scenarioName>ScenarioLog
- if switch and scenario have same name, prefer/consider doing collect*log in scenario ?
#_# - if a tssv1 switch Start_xxx has no ETL provider (issue #70), start a Dummy: $NET_xxxProviders = $NET_DummyProviders
### Order of FW function calls, see https://microsoft.githubenterprise.com/css-windows/WindowsCSSToolsDevRep/wiki/Order-of-FrameWork-function-calls
Note: Scenario PreStart functions are called before switch functions
Note: Scenario PostStop functions are called after switch functions
1. ScenarioPreStart function for Scenario
[PSR] starting
2. Pre-Start function for trace components
[ETW] LogMan start
[WPR] starting
[Perf] starting
[RASdiag]
[NetSh] starting
[PktMon]
[WFPdiag]
[Procmon] starting
3a. PostStart function for ETW trace
3b. ScenarioPostStart function for Scenario
-repro- ---
[PSR] stopping
[ETW] Logman stop
4. Post-Stop function for trace components -> long-lasting call should be better in Collect function
[WPR] stopping
[Perf] stopping
[WFPdiag]
[NetSh] stopping
[PktMon]
[RASdiag]
[Procmon] stopping
5. ScenarioPostStop function for Scenario
6. Collect function for trace components
7. Run Diag function for trace components
8. Collect function for Scenarios
9. Run Diag function for Scenarios
10. xray
#>
#region --- Define local NET Variables
#[switch]$beta = $True # hidden switch; set to $False = normal Production mode, $True =Testing/newFeature mode, will also output writeTesting messages // in TSSv2.ps1
$global:TssVerDateNET = "2023.05.22.0"
#$OSVER3 = $global:OSVersion.Build
$DirRepro = $global:LogFolder
$BinArch = "\Bin" + $global:ProcArch
$cscDBdumpPath = $global:ScriptFolder + $BinArch + "\cscDBdump.exe"
#$ovsdbPath = $global:ScriptFolder + $BinArch + "\ovsdb-client.exe"
#$TLStestSite = "www.ssllabs.com" #
#_# more parameters are defined in \config\tss_config.cfg
#endregion --- Define local NET Variables
#region --- init NET Variables
#endregion --- init NET Variables
#region --- ETW component trace Providers ---
# Type#1 switch (single ETL)
$NET_DummyProviders = @( #for components without a tracing GUID
#'{eb004a05-9b1a-11d4-9123-0050047759bc}' # Dummy tcp for switches without tracing GUID (issue #70)
)
$NET_AccessChkProviders = $NET_DummyProviders
$NET_ContainerProviders = $NET_DummyProviders
$NET_CSCProviders = $NET_DummyProviders
$NET_DFSmgmtProviders = $NET_DummyProviders
$NET_IISProviders = $NET_DummyProviders
$NET_MDMProviders = $NET_DummyProviders
$NET_OutlookProviders = $NET_DummyProviders
$NET_PCIProviders = $NET_DummyProviders
$NET_SCCMProviders = $NET_DummyProviders
#$NET_SBSLProviders = $NET_DummyProviders
#$NET_UNChardProviders = $NET_DummyProviders
$NET_TestMeProviders = $NET_DummyProviders
$NET_WlanProviders = @(
'{1AC55562-D4FF-4BC5-8EF3-A18E07C4668E}' # Wlan AutoConfig
'{36DFF693-C097-438B-B3CA-62E80D15D227}' # LanSettingsGuid
'{8A3CF0B5-E0BC-450B-AE4B-61728FFA1D58}' # WlanGPClientGuid
'{E2EB5B52-08B1-4391-B670-F58317376247}' # IHVServiceFrameworkCtlGuid
'{F860141E-94E0-418E-A8A6-2321623C3018}' # VlibGuid
'{D905AC1D-65E7-4242-99EA-FE66A8355DF8}' # Native WIFI MSM Trace
'{0C5A3172-2248-44FD-B9A6-8389CB1DC56A}' # WLAN AutoConfig Trace
'{6DA4DDCA-0901-4BAE-9AD4-7E6030BAB531}' # WLanDiagCtlGuid
'{2E8D9EC5-A712-48C4-8CE0-631EB0C1CD65}' # DiagL2SecCtlGuid
'{637A0F36-DFF5-4B2F-83DD-B106C1C725E2}' # WDiagCoreCtlGuid
'{253F4CD1-9475-4642-88E0-6790D7A86CDE}' # Layer 2 Authentication Utilities
'{20644520-D1C2-4024-B6F6-311F99AA51ED}' # MSMSecCtlGuid
'{ED092A80-0125-4403-92AC-4C06632420F8}' # WlanUtilCtlGuid
'{1BF7FE18-A798-4FF3-A054-4A31A959D381}' # KeyExtCtlGuid
'{D905AC1C-65E7-4242-99EA-FE66A8355DF8}' # NwfDrvCtlGuid
'{4CEAB604-4A19-48C9-B9FD-43A7465AAAC7}' # Wlan Wdiag
'{520319A9-B932-4EC7-943C-61E560939101}' # WlanDlgTraceGuid
'{1F6C35EE-9294-4721-9413-FB3394247DAC}' # ConverterGuid
'{F96AFBA0-22D3-4EB7-9E3D-53A79C0135C4}' # WLAN Mediamanager
)
$NET_AfdTcpFullProviders = @(
'{E53C6823-7BB8-44BB-90DC-3F86090D48A6}' # Microsoft-Windows-Winsock-AFD
'{2F07E2EE-15DB-40F1-90EF-9D7BA282188A}' # Microsoft-Windows-TCPIP
'{EB004A05-9B1A-11D4-9123-0050047759BC}' # NETIO
'{D5C25F9A-4D47-493E-9184-40DD397A004D}' # Microsoft-Windows-Winsock-WS2HELP
'{B40AEF77-892A-46F9-9109-438E399BB894}' # AFD Trace
'{64F77AD3-710C-4C2C-ABCB-A7B682D07B81}' # AfdWppGuid
)
# Type#2 switch (multi ETL)
$NET_AfdTcpBasicProviders = @(
'{E53C6823-7BB8-44BB-90DC-3F86090D48A6}!Afd!0x800000000000003f' # 'Microsoft-Windows-Winsock-AFD'
'{B40AEF77-892A-46F9-9109-438E399BB894}!Afd!0x800000000000003f' # AFD Trace
'{64F77AD3-710C-4C2C-ABCB-A7B682D07B81}!Afd!0x800000000000003f' # AfdWppGuid
'{2F07E2EE-15DB-40F1-90EF-9D7BA282188A}!TcpIp!0x80007fff000000ff' # Microsoft-Windows-TCPIP
'{EB004A05-9B1A-11D4-9123-0050047759BC}!NetIoBasic!0x800000000003ffff' # NETIO
)
$NET_AppLockerProviders = @(
'{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}' # Microsoft-Windows-AppLocker
'{77FE4532-3F5C-5786-632B-FB3201BCE29B}' # Microsoft.Windows.Security.AppIdLogger
'{1C15C3C7-20B4-446C-8D5E-3BBEC6461664}' # AppIDLog
'{3CB2A168-FE19-4A4E-BDAD-DCF422F13473}' # "Microsoft-Windows-AppID"
'{D02A9C27-79B8-40D6-9B97-CF3F8B7B5D60}' # "Microsoft-Windows-AppIDServiceTrigger"
'{CF84DA43-F447-42DE-AD48-4FEEEA03247D}' # Microsoft.Windows.Security.EDPPolicyMgrApplockerTask
'{63665931-A4EE-47B3-874D-5155A5CFB415}' # AuthzTraceProvider
'{B997E40D-0880-4ED6-B7DF-84DF3305FE2B}' #
'{76df1e7b-74d9-547f-1f87-affa9542809a}' #
'{5AF61464-71AD-4419-A92A-7766E9A5ABC3}' # Microsoft-Windows-AppID-AppRep
)
#$NET_AppVProviders = @( # = UEX_AppV
$NET_BFEProviders = @(
'{106B464A-8043-46B1-8CB8-E92A0CD7A560}!BFE!0xffffffff!0xff' # BaseFirewallEngine # 0xffffffff for -StartAutologger
'{D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85}!BFE!0xffffffff!0xff' # Microsoft-Windows-Windows Firewall With Advanced Security
)
$NET_BGPProviders = @(
'{2E67FCF3-C48E-4B2D-A689-A91D07EDB910}' # 'Microsoft-Windows-RasRoutingProtocols-BGP'
'{9FD2B528-8D3D-42D0-8FDF-5B1998004278}' # 'Microsoft.Windows.Networking.RAS.Routing.BGP'
'{9B322459-4AD9-4F81-8EEA-DC77CDD18CA6}' # 'nathlp CtlGuid'
'{EB171376-3B90-4169-BD76-2FB821C4F6FB}' # 'BGPProvider'
)
$NET_BITsProviders = @(
'{C07ED46C-F60B-479A-8DF9-AC892A6CFC70}!BITSlog' # 'Microsoft-Windows-Bits-CompactServer'
'{38398B57-93F3-4C42-AC26-DB3F5998745B}!BITSlog' # BITS Server Extensions
'{1965FED6-D154-46B7-BCFA-E7A1D16BAD29}!BITSlog' # BitsPerfGuid
'{EF1CC15B-46C1-414E-BB95-E76B077BD51E}!BITSlog!0x18DF!0xff' # 'Microsoft-Windows-Bits-Client'
'{4A8AAA94-CFC4-46A7-8E4E-17BC45608F0A}!BITSlog!0x18DF!0xff' # Drizzle QmgrLib
'{599071ED-D475-497C-9E40-FC7283A1249B}!BITSlog!0x18DF!0xff' # Drizzle LightWeight
)
$NET_BluetoothProviders = @(
'{D88ACE07-CAC0-11D8-A4C6-000D560BCBA5}' # bthport
'{FF9D953D-86CD-4A4F-B8DF-B7236CB640A8}' # bthusb
'{F0CB5D88-0C28-475A-8AE9-D3331ED861DE}' # bthmini
'{F1CD3858-7EE7-43C4-B86A-DCD1BC873269}' # BthEnumTraceGuid
'{1a973eb5-9862-46f0-a54b-ad8a6221654e}' #
'{F1B0EC6A-87CB-4EAA-BFBA-82770400A80B}' #
'{1C5221CB-C1F6-4999-8136-501C2023E4CD}' #
'{8bbe74b4-d9fc-4052-905e-92d01579e3f1}' # DAFBTH
'{CA95AC21-E6FD-4A1B-81BE-ACF16FCFC0FC}' #
'{EB3B6950-120C-4575-AF39-2F713248E8A3}' # BTHPRINT
'{8E1871AF-671E-43A2-907A-8ADF4BF687EE}' #
'{71b7bd28-4894-4eaa-8399-a7944423936c}' #
'{a5ac3157-27d5-4418-8510-c8f0dc1fe098}' #
'{7fc34c90-0657-4fdf-960b-702abb741e24}' #
'{c872ff32-5a0c-4736-bdf2-334c9b8d429f}' #
'{07699FF6-D2C0-4323-B927-2C53442ED29B}' #
'{0107cf95-313a-473e-9078-e73cd932f2fe}' #
'{47c779cd-4efd-49d7-9b10-9f16e5c25d06}' #
'{8a1f9517-3a8c-4a9e-a018-4f17a200f277}' #
'{9EBD1710-E5B9-4213-A8F3-9B015FD615C1}' #
'{DFE2ECB4-536B-44AE-8011-67A8E2C3CA96}' #
'{BF94D329-C5F9-4deb-AD29-2C6682D485F0}' #
'{B79B9C1F-2626-4d0c-9574-5CFCE4E793E6}' #
'{a8e3e135-780c-4e4a-8410-f4da062e5981}' #
'{565D84DC-23F7-400a-B2FA-23580731F09F}' #
'{DDB6DA39-08A7-4579-8D0C-68011146E205}' #
'{75509D47-E67D-48B4-A346-6FEAB02E51BD}' #
'{5C836296-6C1A-48F4-90E2-28CC25423518}' #
'{842B43E3-F833-40B3-958A-5535B3251EE3}' #
'{F2A442CB-6CDE-44D0-ACEF-2B01CEB56A30}' #
'{5acbeb5b-fd8c-45d4-83f1-c8ce2303763c}' #
'{797E4878-22CF-452A-86FF-3872D880F93B}' #
'{fd35e984-9dee-4011-9eae-5c135b050261}' #
'{d2440861-bf3e-4f20-9fdc-e94e88dbe1f6}' #
'{e8109b99-3a2c-4961-aa83-d1a7a148ada8}' # SEBWPP
'{AE4BD3BE-F36F-45b6-8D21-BDD6FB832853}' #
'{e27950eb-1768-451f-96ac-cc4e14f6d3d0}' #
'{9502CBC6-AA74-4eff-BA91-D9329BCCE758}' #
'{A6A00EFD-21F2-4A99-807E-9B3BF1D90285}' #
'{71E0AC1E-CFA2-447C-91C7-4F307030F2FC}' #
'{6F34C0F0-D9F6-40D3-A94C-419B50FD8407}' #
'{1B42986F-288F-4DD7-B7F9-120297715C1E}' # DeviceEnumeration WPP
'{9c1d5e55-2ff9-41a5-9402-40bd9e6f812b}' #
'{ac23ebce-f06e-4a75-b07b-7cc1defa2388}' #
'{56297848-CA78-4AA1-A2C2-29015EC7E498}' #
'{6ae9ebb4-66cf-4598-9abd-8d223d187301}' #
'{FCEB1377-EEAF-4A4F-A26A-1E5E0D4C53A4}' #
'{FE440530-3881-4354-A8FF-BCEC2C488533}' #
'{9E470B06-C3EB-496C-9CD2-24ACC293DC9A}' #
'{E71924CF-117B-427C-9E22-BD72021F06BA}' #
'{378B1AED-30D9-4C8B-92C6-A093D44F0AAB}' #
'{C01D7B34-43D0-439D-95AC-975645E4535F}' #
'{D951CB3F-2CBA-4A1C-9436-6CF2E904DDE8}' #
'{ad8fe36a-0581-4571-a143-5a3f93e30160}' #
'{9f30c07c-57ce-5ec3-bb5e-476dd25c2742}' #
'{82CAD26A-2DC1-4020-A4F2-0897AA48ED5A}' #
)
$NET_BranchCacheProviders = @(
'{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}' # Microsoft-Windows-BranchCache
'{1F8B121D-45B3-4022-A9FB-3857177A65C1}' # Torino
'{28FCAB19-3975-45CD-9E8C-5BE612D60007}' # BranchCacheDiag
'{4A933674-FB3D-4E8D-B01D-17EE14E91A3E}' # Microsoft-Windows-BranchCacheSMB
'{DD85457F-4E2D-44A5-A7A7-6253362E34DC}' # Microsoft-Windows-BranchCacheEventProvider
'{E837619C-A2A8-4689-833F-47B48EBD2442}' # Microsoft-Windows-BranchCacheClientEventProvider
'{A2F55524-8EBC-45FD-88E4-A1B39F169E08}' # Microsoft-Windows-BranchCacheMonitoring
)
$NET_CAPIProviders = @(
'{5BBCA4A8-B209-48DC-A8C7-B23D3E5216FB}' # Microsoft-Windows-CAPI2
'{B8A3BF0D-21C1-48CD-855B-92C4AE6CCB11}' # ControlGuid
'{52BF9EC6-69F5-49E6-9ECC-D3B994C40142}' # NTCryto KeyRoam2 Storage WinCred CAPI
'{E80E62CA-B2A0-4D95-822D-D4E8D27A2857}' # NTCryto KeyRoam2 Storage WinCred CNG
'{F01B7774-7ED7-401E-8088-B576793D7841}' # NTCrypto DIMS Job
'{9C61B35B-A7F4-4C25-83AA-2F452582A1F5}' # NTCryto KeyRoam2 Storage WinCred DPAPI
)
#--- COM/DCOM/WinRT/RPC PROVIDERS ---#
$NET_COMProviders = @( #from UEX / ToDo:
'{9474a749-a98d-4f52-9f45-5b20247e4f01}' # DCOMSCM
'{bda92ae8-9f11-4d49-ba1d-a4c2abca692e}' # OLE32(combase.dll)
'{d4263c98-310c-4d97-ba39-b55354f08584}' # Microsoft-Windows-COM(advapi32.dll)
'{0f177893-4a9c-4709-b921-f432d67f43d5}' # Microsoft-Windows-Complus(comres.dll)
'{1B562E86-B7AA-4131-BADC-B6F3A001407E}' # Microsoft-Windows-DistributedCOM(combase.dll)
'{B46FA1AD-B22D-4362-B072-9F5BA07B046D}' # COMSVCS(COM+)
'{A0C4702B-51F7-4ea9-9C74-E39952C694B8}' # COMADMIN(COM+)
'{1AFF6089-E863-4D36-BDFD-3581F07440BE}' # CombaseTraceLoggingProvider
'{6AD52B32-D609-4BE9-AE07-CE8DAE937E39}' # Microsoft-Windows-RPC(rpcrt4.dll)
'{F4AED7C7-A898-4627-B053-44A7CAA12FCD}' # Microsoft-Windows-RPC-Events(rpcrt4.dll)
'{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}' # Microsoft-Windows-RPCSS(RpcEpMap.dll)
'{097d1686-4038-46be-b551-10fda0387165}' # CLBCATQ
'{A86F8471-C31D-4FBC-A035-665D06047B03}' # Microsoft-Windows-WinRT-Error
'{bf406804-6afa-46e7-8a48-6c357e1d6d61}' # Microsoft-Windows-COMRuntime
'{7913ac64-a5cd-40cd-b096-4e8c4028eaab}' # Microsoft-Windows-WinTypes-Perf
'{f0558438-f56a-5987-47da-040ca757ef05}' # Microsoft.Windows.WinRtClassActivation
'{53201895-60E8-4fb0-9643-3F80762D658F}' # COM+ Services
'{272A979B-34B5-48EC-94F5-7225A59C85A0}' # Microsoft-Windows-RPC-Proxy-LBS
'{879b2576-39d1-4c0f-80a4-cc086e02548c}' # Microsoft-Windows-RPC-Proxy
'{536caa1f-798d-4cdb-a987-05f79a9f457e}' # Microsoft-Windows-RPC-LBS
)
<# in TssV1
DCOM {9474A749-A98D-4F52-9F45-5B20247E4F01} {C44219D0-F344-11DF-A5E2-B307DFD72085} {B46FA1AD-B22D-4362-B072-9F5BA07B046D} {BDA92AE8-9F11-4D49-BA1D-A4C2ABCA692E} {A0C4702B-51F7-4EA9-9C74-E39952C694B8 }
OLE32 {BDA92AE8-9F11-4D49-BA1D-A4C2ABCA692E}
RPC "Microsoft-Windows-RPC", "Microsoft-Windows-RPCSS", "Microsoft-Windows-RPC-Events", "Microsoft-Windows-RPC-LBS", "Microsoft-Windows-RPC-Proxy", "Microsoft-Windows-RPC-Proxy-LBS" {F997CD11-0FC9-4AB4-ACBA-BC742A4C0DD3} "Microsoft-Windows-RPC-FirewallManager", "Microsoft-Windows-EndpointTriggerProvider", "Microsoft-Windows-ServiceTriggerPerfEventProvider"
#>
$NET_DAcliProviders = @(
'{66A5C15C-4F8E-4044-BF6E-71D896038977}' # Microsoft-Windows-Iphlpsvc
'{6600E712-C3B6-44A2-8A48-935C511F28C8}' # Microsoft-Windows-Iphlpsvc-Trace
)
$NET_DAsrvProviders = @(
'{214609E4-72CC-4E0E-95F8-1D503FC4AD7F}' # Microsoft-Windows-RemoteAccess-RemoteAccessServer
'{0C478C5B-0351-41B1-8C58-4A6737DA32E3}' # Microsoft-Windows-WFP
'{4EDBE902-9ED3-4CF0-93E8-B8B5FA920299}' # Microsoft-Windows-TunnelDriver
'{A67075C2-3E39-4109-B6CD-6D750058A732}' # Microsoft-Windows-IPNAT
'{B0261971-F607-458E-8D89-02FE7E846129}' # Microsoft-Windows-RemoteAccess-MgmtClient
)
$NET_DAmgmtProviders = @(
'{c4163695-ce82-4486-89ac-2d05b6e35e77}' #
'{D6126663-A055-45A1-B0E9-7C68B74DB252}' # Microsoft-Windows-RemoteAccess
'{8ADF1EAB-B733-48D6-918D-AAC9933BF85F}' # Microsoft-Windows-RaMgmtSvcEvt
)
$NET_DCLocatorProviders = @(
'{CFAA5446-C6C4-4F5C-866F-31C9B55B962D}' # Microsoft-Windows-DCLocator
'{CA030134-54CD-4130-9177-DAE76A3C5791}' # NETLOGON/ NETLIB
)
$NET_DFSsrvProviders = @(
'{B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01}' # Microsoft-Windows-DFSN-Server
'{5407BAEA-A563-4E56-819F-7DEAA72807CE}' # Microsoft-Windows-DFSN-ServerFilter
'{8F74445D-84F4-426D-9BE1-25AAC1A2B959}' # Microsoft Dfs V5
'{27246E9D-B4DF-4F20-B969-736FA49FF6FF}' # DfsFilter # see NET_DFSn
'{7DA4FE0E-FD42-4708-9AA5-89B77A224885}' # Microsoft-Windows-DfsSvc
)
$NET_DHCPcliProviders = @(
'{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}' # Microsoft-Windows-Dhcp-Client
'{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}' # Microsoft-Windows-DHCPv6-Client
'{F6DA35CE-D312-41C8-9828-5A2E173C91B6}' # Microsoft-Windows-Dhcp-Nap-Enforcement-Client
'{CC3DF8E3-4111-48D0-9B21-7631021F7CA6}' # v4 CtlGuid
'{07A29C3D-26A4-41E2-856A-095B3EB8B6EF}' # v6 CtlGuid
'{F230B1D5-7DFD-4DA7-A3A3-7E87B4B00EBF}' # DNS Resolver
'{5855625E-4BD7-4B85-B3A7-9307BAB0B813}' # traceIdentifier
'{55404E71-4DB9-4DEB-A5F5-8F86E46DDE56}' # Microsoft-Windows-Winsock-NameResolution
)
$NET_DHCPsrvProviders = @(
'{6D64F02C-A125-4DAC-9A01-F0555B41CA84}!DHCPsrv' # Microsoft-Windows-DHCP-Server
'{BA405734-9379-42CD-B447-40C249D354A2}!DHCPsrv' # CtlGuid
'{15A7A4F8-0072-4EAB-ABAB-F98A4D666AED}!DHCPsrv' # Microsoft.Windows.Networking.DHCP
'{6FCDF39A-EF67-483D-A661-76D715C6B008}!DHCPsrv' # CtlGuid
'{9B1DD39A-2779-40A0-AA7D-C4427208626E}!DHCPsrv' # Extensible Storage Engine
)
if ($global:OSVersion.Build -ge 9600) { #fix bug#348
$NET_DHCPsrvProviders += @(
'{91EFB500-642D-42A5-9822-F15C73064FBF}!DHCPsrv!0xFF7FFFFF!0xff' # DhcpServerTrace
)
}
$NET_DNScliProviders = @(
'{1C95126E-7EEA-49A9-A3FE-A378B03DDB4D}' # Microsoft-Windows-DNS-Client
'{1540FF4C-3FD7-4BBA-9938-1D1BF31573A7}' # DNS Trace
'{9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0}' # Microsoft.Windows.Networking.DNS
'{609151DD-04F5-4DA7-974C-FC6947EAA323}' # DNSAPI Dnslib
'{563A50D8-3536-4C8A-A361-B37AF04094EC}' # CtlGuid
'{76325CAB-83BD-449E-AD45-A6D35F26BFAE}' # CtlGuid
'{F230B1D5-7DFD-4DA7-A3A3-7E87B4B00EBF}' # DNS Resolver
'{A7B8B859-D00E-45CC-85B8-89EA5D015C62}' # CtlGuid
)
$NET_DNSsrvProviders = @(
'{71A551F5-C893-4849-886B-B5EC8502641E}!DNSsrv' # Microsoft-Windows-DNS-Server-Service
'{EB79061A-A566-4698-9119-3ED2807060E7}!DNSsrv' # Microsoft-Windows-DNSServer
'{57840C25-FA99-4F0D-928D-D81D1851E3DD}!DNSsrv' # DNS Server Trace Provider
'{9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0}!DNSsrv' # Microsoft.Windows.Networking.DNS
'{609151DD-04F5-4DA7-974C-FC6947EAA323}!DNSsrv' # DNSAPI Dnslib
'{501DD790-B342-479D-A20D-5E8518D365E4}!DNSsrv' # DnsValidator
'{FA01E324-3485-4533-BDBC-68D36832AC23}!DNSsrv' # DnsServerPSProvider
'{367B7A5F-319C-4E40-A9F8-8856095389C7}!DNSsrv' # Dnscmd
)
if ($global:Mode -iMatch "Verbose") {
$NET_DNSsrvProviders += @(
'{406F31B6-E81C-457A-B5C3-62C1BE5778C1}!DNSsrv' # DnsServer
'{282895CD-F507-4B3A-9E1D-93B514F8DD86}!DNSsrv' # DnsServerWmiProvider
)
} else {
$NET_DNSsrvProviders += @(
'{406F31B6-E81C-457A-B5C3-62C1BE5778C1}!DNSsrv!0x3FFE57!0xff' # DnsServer -- if /i "%_DNSSpec%" -ne "verbose"
)
}
$NET_DockerProviders = @(
'{662abf07-6dda-5b25-c2c5-345236dbb2d2}' #
'{564368D6-577B-4af5-AD84-1C54464848E6}' #
'{0BACF1D2-FB51-549A-6119-04DAA7180DC8}' #
'{9D911DDB-D45F-41C3-B766-D566D2655C4A}' # Microsoft-Windows-Guest-Network-Service
)
$NET_EFSProviders = $ADS_EFSProviders
<#@(
'{3663A992-84BE-40EA-BBA9-90C7ED544222}' # Microsoft-Windows-EFS
'{6863E644-DD5D-43A2-A8B5-7A81B46672E6}' # Microsoft-Windows-EFSTriggerProvider
'{318BBC33-CDFD-42C0-B5E5-57ED92E8935F}' # Microsoft.Windows.Security.EFS.EfsWrt
'{2CD58181-0BB6-463E-828A-056FF837F966}' # Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
'{82B5AD62-B453-481A-B838-CA1EEAE6E472}' # Microsoft.Windows.Security.EFS.EfsCore
'{7A688F0E-F39B-4A7A-BBBB-066E2C1FCB04}' # Microsoft.Windows.Security.EFS.EfsLib
'{4E04241F-30F8-5111-A04E-DF3C9C867433}' # Microsoft.Windows.Security.EFS
'{7B3B9D0A-AC64-4CBD-B658-E1EC8B4CB416}' # Microsoft.Windows.EFS.EFSRPC
'{C755EF4D-DE1C-4E7D-A10D-B8D1E26F5035}' # EFSWRT_WPP
'{B2FC00C4-2941-4D11-983B-B16E8AA4E25D}' # NtfsLog
'{287D59B6-79BA-4741-A08B-2FEDEEDE6435}' # Microsoft-Windows-EDP-Audit-TCB
'{50F99B2D-96D2-421F-BE4C-222C4140DA9F}' # Microsoft-Windows-EDP-Audit-Regular
'{9803DAA0-81BA-483A-986C-F0E395B9F8D1}' # Microsoft-Windows-EDP-AppLearning
'{0C017B8D-7629-4AD6-A268-578A14E9DD65}' # Microsoft-Windows-Security-EFS-EDPAudit
'{6F14D881-64EA-449D-96D7-34E9C966082B}' # Microsoft-Windows-Security-EFS-EDPAudit-ApplicationLearning
'{225D7337-6538-4C12-9418-B37C558C50F2}' # Microsoft-Windows-Security-EFS-EDPAudit-ApplicationGenerated
'{6AF820A5-6E4F-4558-8D7D-F7D6A2ED7195}' # Microsoft-Windows-Security-EFS-EDPAudit-CopyData
)
#>
$NET_FirewallProviders = @(
'{0C478C5B-0351-41B1-8C58-4A6737DA32E3}!Firewall!0xffffffff!0xff' # Microsoft-Windows-WFP # 0xffffffff for -StartAutologger
'{106B464A-8043-46B1-8CB8-E92A0CD7A560}!Firewall!0xffffffff!0xff' # BaseFirewallEngine KernelFilterDriver # = NET_BFE
'{4E7A902B-5E4E-5209-668D-86090D23E202}!Firewall!0xffffffff!0xff' # Microsoft.Windows.Networking.WFP
'{E595F735-B42A-494B-AFCD-B68666945CD3}!Firewall!0xffffffff!0xff' # Microsoft-Windows-Firewall
'{10B149A5-436F-4799-A2AF-BE5268F8DBF1}!Firewall!0xffffffff!0xff' # MPSSVCUI
'{95910355-64B6-4A73-AB64-F32C868B9BA8}!Firewall!0xffffffff!0xff' # MpssvcNLAv2
'{D5E09122-D0B2-4235-ADC1-C89FAAAF1069}!Firewall!0xffffffff!0xff' # MpsDrvTrace
'{D8FA2E77-A77C-4494-9297-ACE3C12907F6}!Firewall!0xffffffff!0xff' # FwPolicyIoMgr
'{B6A0EFDB-2676-4355-A626-A2618B2BA031}!Firewall!0xffffffff!0xff' # WindowsFirewallWMI
'{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}!Firewall!0xffffffffffffffff!0xff' # Mpssvc
'{5444519F-2484-45A2-991E-953E4B54C8E0}!Firewall!0xffffffff!0xff' # Microsoft-Windows-MPS-SRV
'{50BD1BFD-936B-4DB3-86BE-E25B96C25898}!Firewall!0xffffffff!0xff' # Microsoft-Windows-MPS-DRV
'{37945DC2-899B-44D1-B79C-DD4A9E57FF98}!Firewall!0xffffffff!0xff' # Microsoft-Windows-MPS-CLNT
'{546549BE-9D63-46AA-9154-4F6EB9526378}!Firewall!0xffffffff!0xff' # Microsoft-Windows-Firewall-CPL
'{3CE641BB-155B-451D-A23A-D59CE0A2E9C9}!Firewall!0xffffffff!0xff' # FIREWALL_CPL
'{28C9F48F-D244-45A8-842F-DC9FBC9B6E92}!Firewall!0xffffffff!0xff' # FirewallAPI
'{F997CD11-0FC9-4AB4-ACBA-BC742A4C0DD3}!Firewall!0xffffffff!0xff' # Microsoft-Windows-RPC-FirewallManager
'{147E266B-7154-4163-9D20-2F386237831F}!Firewall!0xffffffff!0xff' # SCW_FIREWALL_EXTENSION #Win7/Win 8 only
'{0EFF663F-8B6E-4E6D-8182-087A8EAA29CB}!Firewall!0xffffffff!0xff' # WFAPIGP
'{C293005F-6705-449E-B0F3-A3AE121ED3A8}!Firewall!0xffffffff!0xff' # ICFUPGD_DLL
'{B83F20C9-622B-49B2-97C4-FEFE7B1F3FCA}!Firewall!0xffffffff!0xff' # SCW_REGISTRY_EXTENSION #Win7/Win 8 only
'{098F2470-BAE0-11CD-B579-08002B30BFEB}!Firewall!0xffffffff!0xff' # Microsoft-Windows-Security-Configuration-Wizard #Win7/Win 8 only
'{28C9F48F-D244-45A8-842F-DC9FBC9B6E94}!Firewall!0xffffffff!0xff' # WFMGR
'{5AD8DAF3-405C-4FD8-BCC5-5ABE20B3EDD6}!Firewall!0xffffffff!0xff' # FW
'{D76203C4-8C1B-4E53-AFAB-C22865594F3F}!Firewall!0xffffffff!0xff' # Microsoft.Windows.Firewall
'{D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85}!Firewall!0xffffffff!0xff' # Microsoft-Windows-Windows Firewall With Advanced Security # = NET_BFE
'{935F4AE6-845D-41C6-97FA-380DAD429B72}!Firewall!0xffffffff!0xff' # AUTHFWCFG
'{E90CB4C0-C7B6-4F18-A53A-187934AD4B55}!Firewall!0xffffffff!0xff' # Microsoft.Windows.Firewall.PolicyIoManager
'{702BB771-F6F6-4B08-ADAF-42ABE09B4FD1}!Firewall!0xffffffff!0xff' # Microsoft.Windows.Firewall.Aggregate
'{0998DFB7-59D7-4E82-92CE-8A83E7C0BB3E}!Firewall!0xffffffff!0xff' # Microsoft.Windows.Firewall.API
#'{EA2E4E95-2B14-462D-BB78-DEE94170804F}!Firewall!0xffffffff!0xff' # Microsoft-Windows-NetworkController-FirewallService # that is for virtualization
'{FFDB0CFD-833C-4F16-AD3F-EC4BE3CC1AF5}!Firewall!0xffffffff!0xff' # Microsoft.Windows.EnterpriseManagement.PolicyManager
'{76FA08A3-6807-48DB-855D-2C12702630EF}!Firewall!0xffffffff!0xff' # Microsoft.Windows.EnterpriseManagement.ConfigManagerHook
'{F058515F-DBB8-4C0D-9E21-A6BC2C422EAB}!Firewall!0xffffffff!0xff' # Microsoft.Windows.DeviceManagement.SecurityPolicyCsp
)
$NET_FirewallProviders += $ADS_GPOProviders
$NET_FltMgrProviders = @(
'{4F5D14A2-97BB-454B-B848-6F3CE0DF80F1}!FltMgr!$global:FltMgrFlags!0x4' # FltMgr - $global:FltMgrFlags="0x08810800" in tss_config.cfg
)
$NET_FSRMProviders = @(
'{3201C659-D580-4833-B17D-1ADAF643C64C}' # FSRM Tracing Provider
'{1214600F-DF79-4A03-94F5-65D7CAB4FD16}' # Quota
'{1C7BC728-8199-48BE-BD4D-406A63303C8D}' # Cbafilt
'{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}' # Microsoft-Windows-FilterManager
)
$NET_FWmgrProviders = @(
'{28C9F48F-D244-45A8-842F-DC9FBC9B6494}' # WFMGR
'{A8351B7A-57BE-4388-8843-08DE1E321B7F}' # FwPolicyIoMgr
'{A487F25A-2C11-43B7-9050-527F0D6117F2}' # FWUtil NcaUtilAdhUtil VpnUtil
'{95910355-64B6-4A73-AB64-F32C868B9BA8}' # MpssvcNLAv2
'{0D78C116-50F4-416C-AC97-589EB943DF49}' # FW_PLUMBER
'{94335EB3-79EA-44D5-8EA9-306F49B3A040}' # MpsIpsecPolicyAgent
'{E4FF10D8-8A88-4FC6-82C8-8C23E9462FE5}' # NSHIPSEC
)
$NET_GeoLocationProviders = @(
'{BCCE86FC-FEBD-4F2D-8E42-E277BA2B524C}' # TzautoupdateProvider
'{89DFBDE8-86E8-489B-9867-EEFDC5E8879B}' # LOCATION_TRACE_ID
'{6F111213-BEF8-415D-8AB5-C0FD27687118}' # LocationRuntimeTraceControl
'{3E06F325-C807-4A4B-B2BC-C6A7C0C010E5}' # GeofenceMonitor
'{FF7B0CAD-42BB-4657-A578-64CD6CB2819B}' # LocationApi
'{C3511D74-0E47-4341-9F10-DF76F6823E06}' # Microsoft-Windows-LocationService
'{CB671458-AD15-40E8-A65A-753EA62D853A}' # Microsoft.Geolocation.Api
'{0CB61430-077E-4E88-AD37-F88A4687B44D}' # LocationApiTraceControl
'{4D13548F-C7B8-4174-BB7A-D7F64BF22D29}' # Microsoft-WindowsPhone-LocationServiceProvider
)
$NET_HNSProviders = @(
'{0c885e0d-6eb6-476c-a048-2457eed3a5c1}' # Microsoft-Windows-Host-Network-Service
'{80CE50DE-D264-4581-950D-ABADEEE0D340}' #
'{D0E4BC17-34C7-43fc-9A72-D89A59D6979A}' #
'{93f693dc-9163-4dee-af64-d855218af242}' # Microsoft-Windows-Host-Network-Management
)
$NET_WinInetProviders = @( # !Caution! list this first, before any reference to it, i.e. $NET_HTTPProviders += $NET_WinInetProviders
'{1a211ee8-52db-4af0-bb66-fb8c9f20b0e2}' # Microsoft.OSG.Web.WinInet
'{43D1A55C-76D6-4f7e-995C-64C711E5CAFE}' # Microsoft-Windows-WinINet
'{4E749B6A-667D-4c72-80EF-373EE3246B08}' # WinInet
'{5402E5EA-1BDD-4390-82BE-E108F1E634F5}' # Microsoft-Windows-WinINet-Config
'{A70FF94F-570B-4979-BA5C-E59C9FEAB61B}' # Microsoft-Windows-WinINet-Capture
)
$NET_HTTPProviders = @( #from UEX / ToDo: consolidate with HttpSys
'{7D44233D-3055-4B9C-BA64-0D47CA40A232}' # Microsoft-Windows-WinHttp
'{1070f044-721c-504b-c01c-671dadcbc77d}' # WinHTTP(Tracelogging)
'{B3A7698A-0C45-44DA-B73D-E181C9B5C8E6}' # WinHttp(WPP)
)
$NET_HTTPProviders += $NET_WinInetProviders
$NET_HttpSysProviders = @(
'{7D44233D-3055-4B9C-BA64-0D47CA40A232}' # Microsoft-Windows-WinHttp
'{DD5EF90A-6398-47A4-AD34-4DCECDEF795F}' # Microsoft-Windows-HttpService
'{72B18662-744E-4A68-B816-8D562289A850}' # Windows HTTP Services
'{20F61733-57F1-4127-9F48-4AB7A9308AE2}' # HttpSysGuid
'{C42A2738-2333-40A5-A32F-6ACC36449DCC}' # Microsoft-Windows-HttpLog
'{7B6BC78C-898B-4170-BBF8-1A469EA43FC5}' # Microsoft-Windows-HttpEvent
'{F5344219-87A4-4399-B14A-E59CD118ABB8}' # Microsoft-Windows-Http-SQM-Provider
'{B1945E15-4933-460F-8103-AA611DDB663A}' # HttpSysProvider
)
$NET_HttpSysProviders += $NET_WinInetProviders
$NET_HypVMProviders = @(
'{0A18FF18-5362-4739-9671-78023D747B70}' # Microsoft-Windows-Hyper-V-Network
'{152FBE4B-C7AD-4F68-BADA-A4FCC1464F6C}' # Microsoft-Windows-Hyper-V-Netvsc
#'{064F02D0-A6C4-4924-841A-F3BADC2675F6}' # NDIS Trace Provider
'{DA2473F4-3E39-4565-A6D0-BA8F0D1D7D61}' # NdisVirtualBusWPPGuid
'{C29C4FB7-B60E-4FFF-9AF9-CF21F9B09A34}' # Microsoft-Windows-Hyper-V-SynthNic
'{CD079D47-329D-4DC5-881C-CB28BB80A9A0}' # NetworkVsc
)
$NET_ICSProviders = @(
'{A6F32731-9A38-4159-A220-3D9B7FC5FE5D}' # Microsoft-Windows-SharedAccess_NAT
'{8F3C64A5-69C2-4CDA-93CB-B1031E362B8F}' # Microsoft.Windows.Networking.SharedAccess
)
$NET_IPAMProviders = @(
'{AB636BAA-DFF3-4CB0-ABF0-56E192DAC2B3}' # Microsoft-Windows-IPAM
)
$NET_IPhlpSvcProviders = @(
'{6600E712-C3B6-44A2-8A48-935C511F28C8}' # Microsoft-Windows-Iphlpsvc-Trace
'{66A5C15C-4F8E-4044-BF6E-71D896038977}' # Microsoft-Windows-Iphlpsvc
'{3EB875EB-8F4A-4800-A00B-E484C97D7551}' # Microsoft-Windows-Network-Connection-Broker
'{70F18147-06E6-497B-BBC4-58D60B4760E2}' # Microsoft.Windows.Networking.Teredo
'{4EDBE902-9ED3-4CF0-93E8-B8B5FA920299}' # Microsoft-Windows-TunnelDriver
'{4214DCD2-7C33-4F74-9898-719CCCEEC20F}' # Microsoft-Windows-TunnelDriver-SQM-Provider
'{444943B7-3A0F-45C9-B7CB-D2A2DE9EB852}' # Microsoft.Windows.Networking.Tunnel
'{B80A3EE8-4ECE-4DF5-9BBB-B26B60AC983D}' # NcaApi AdhApi VpnApi
'{8FC438F1-00EF-4F07-B68E-08A9A9B55ADB}' # NcaApiServer AdhApiServer VpnProtoEngApiServer VpnWinRTSrc
'{29F60C6B-8C09-449F-9979-082591D09318}' # NcaSvc AdhSvc
'{A487F25A-2C11-43B7-9050-527F0D6117F2}' # FWUtil Ncatil AdhUtil VpnUtil
'{794FE1C3-CDC4-45D4-AF07-120A69B1B6B6}' # KAProvider
'{A14CAFA7-A31F-4993-AD02-279F410A19D7}' # NCBSVC
'{2AB7ABE2-FD6B-49DD-931E-D3339832676A}' # NcbService
)
$NET_IPsecProviders = @(
'{C91EF675-842F-4FCF-A5C9-6EA93F2E4F8B}' # Microsoft-Windows-IPSEC-SRV
'{94335EB3-79EA-44D5-8EA9-306F49B3A040}' # MpsIpsecPolicyAgent
'{94335EB3-79EA-44D5-8EA9-306F4FFFA070}' # IpsecPAStore
'{94335EB3-79EA-44D5-8EA9-306F49B3A070}' # IpsecPolStore
'{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}' # Microsoft-Windows-GroupPolicy
'{2588030D-920F-4AD6-ACC0-8AA2CD761DDC}' # IPsecGWWPPGuid
'{12D06DF7-58EB-4642-9FB2-6D50D008900C}' # RRAS IpSecFirewall #Win7/Win 8 only
'{E4FF10D8-8A88-4FC6-82C8-8C23E9462FE5}' # NSHIPSEC
'{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}' # Mpssvc
'{94335EB3-79EA-44D5-8EA9-306F49B3A041}' # MpsIpsecClient
'{3BEEDE59-FC7D-5057-CE28-BABAD0B27181}' # HCSRVEXT # NAP- Win7/Win 8 only
'{2BEEDE59-EC7D-4057-BE28-C9EAD0B27180}' # NAPIPSEC # NAP- Win7/Win 8 only
'{8115579E-2BEA-4C9E-9AB1-821CC2C98AB0}' # Microsoft-Windows-NAPIPSecEnf # NAP- Win7/Win 8 only
#'{3AD15A04-74F1-4DCA-B226-AFF89085A05A}' # Microsoft-Windows-Wnv
'{D8FA2E77-A77C-4494-9297-ACE3C12907F6}' # FwPolicyIoMgr
#'{49D6AD7B-52C4-4F79-A164-4DCD908391E4}' # NisDrvWFP Provider #WFP only - not related to IPsec
'{5AD8DAF3-405C-4FD8-BCC5-5ABE20B3EDD6}' # FW
#'{B40AEF77-892A-46F9-9109-438E399BB894}' # AFD Trace
'{106B464D-8043-46B1-8CB8-E92A0CD7A560}' # KernelFilterDriver # IKEEXT
'{7B702970-90BC-4584-8B20-C0799086EE5A}' # Microsoft-Windows-NetworkSecurity
)
$NET_iSCSIProviders = @(
'{1babefb4-59cb-49e5-9698-fd38ac830a91}' # iScsi
'{13953C6E-C594-414E-8BA7-DEB4BA1878E3}' # Microsoft-Windows-iSCSITarget-Service
'{07ABD211-DA70-4F8F-B3EF-BF825FD7B189}' # Microsoft-Windows-iSCSITarget-VSSProvider
'{82FB2F8C-A21C-453B-ACBD-7EF49493D727}' # WinTargetWPP
'{7D758B3E-E29E-43DA-8683-9860A1C19362}' # Microsoft-Windows-iSCSITarget-VDSProvider
'{BBF8051F-1F47-44CA-AC73-92658CD4E4F8}' # WTLmDrvCtrlGuid
'{B5E70289-982D-4109-BC5E-BF554BAD08F5}' # WTSmisProviderWPP
'{81C84CFA-C80B-47A1-BECE-5CA0F1851FEB}' # WTVssProviderWPP
)
$NET_KernelIOProviders = @(
'{A103CABD-8242-4A93-8DF5-1CDF3B3F26A6}' # Microsoft-Windows-Kernel-IoTrace
'{ABF1F586-2E50-4BA8-928D-49044E6F0DB7}' # Microsoft-Windows-Kernel-IO
)
$NET_LBFoProviders = @(
'{B72C6994-9FE0-45AD-83B3-8F5885F20E0E}!LBFO' #'Microsoft-Windows-MsLbfoEventProvider' # - may not exist on client OS
'{387ED463-8B1B-42C9-9EF0-803FDFD5D94E}!LBFO' # Microsoft-Windows-MsLbfoSysEvtProvider # - may not exist on client OS
'{11C5D8AD-756A-42C2-8087-EB1B4A72A846}!LBFO' # Microsoft-Windows-NdisImPlatformEventProvider
'{62DE9E48-90C6-4755-8813-6A7D655B0802}!LBFO' # Microsoft-Windows-NdisImPlatformSysEvtProvider
'{A781472C-CFC9-42CB-BCEA-A00B916AD1BE}!LBFO' # NDISIMPLAT
'{B1809D25-B84D-4E40-8D1B-C9978D8946AB}!LBFO' # LBFOProviderGUID
'{9B5CB64B-6166-4369-98CA-986AE578E216}!LBFO' # NdisImPlatformWPPGuid
'{41E8E8F3-7B6D-488E-B350-F696DD24AFB6}!LBFO' # NETCFG
# '{6CC2405D-817F-4886-886F-D5D1643210F0}!ndis!0xFFFFFFFFFFFFFFFF!0x5' # NDISWMI
)
$NET_LBFoProviders += @(
'{064F02D0-A6C4-4924-841A-F3BADC2675F6}!LBFO' # NDIS Trace Provider
'{CDEAD503-17F5-4A3E-B7AE-DF8CC2902EB9}!LBFO!0xFFFFFFFFFFFFFFFF!0x5' # Microsoft-Windows-NDIS - Added flags 0x5
'{DD7A21E6-A651-46D4-B7C2-66543067B869}!LBFO!0xFFFFFFFFFFFFFFFF!0x5' # NDISTraceGuid
'{6CC2405D-817F-4886-886F-D5D1643210F0}!LBFO!0xFFFFFFFFFFFFFFFF!0x5' # NDISWMI
) #issue #636
$NET_LDAPcliProviders = @(
'{099614A5-5DD7-4788-8BC9-E29F43DB28FC}!LDAPcli!$global:LDAPcliFlags!0xff' # Microsoft-Windows-LDAP-Client - $global:LDAPcliFlags="0x1a59afa3" in tss_config.cfg
)
$NET_LDAPsrvProviders = @(
'{90717974-98DB-4E28-8100-E84200E22B3F}!LDAPsrv!0xFFFFFFFFFFFFFFFF!0xff' # NTDSA
'{3e7da688-9a79-4dd5-81c9-54d74c456890}!LDAPsrv!0xFFFFFFFFFFFFFFFF!0xff' # NTDSA_PROV2
)
$NET_LLTDIOProviders = @(
'{0741C7BE-DAAC-4A5B-B00A-4BD9A2D89D0E}' # Microsoft-Windows-LLTD-MapperIO
'{E159FC63-02FE-42F3-A234-028B9B8561CB}' # RSPNDR
'{CCC64809-6B5F-4C1B-AB39-336904DA9B3B}' # LLTDSVC
)
$NET_LLDPProviders = @(
'{DCBFB8F0-CD19-4F1C-A27D-23AC706DED72}' # Microsoft-Windows-LinkLayerDiscoveryProtocol
'{4C5CD317-6946-A09F-9F5C-C31B1281D5F0}' # LLDPWMI
'{DCBFB8F7-CD19-4F1C-A27D-23AC706DED72}' # MSDCN
)
$NET_MBAMProviders = @(
'{632F767E-0EC3-47B9-BA1C-A0E62A74728A}' # Microsoft-Windows-BitLocker-DrivePreparationTool
'{5D674230-CA9F-11DA-A94D-0800200C9A66}' # Microsoft-Windows-BitLocker-API
'{651DF93B-5053-4D1E-94C5-F6E6D25908D0}' # Microsoft-Windows-BitLocker-Driver
'{1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}' # Microsoft-Windows-BitLocker-Driver-Performance
'{7140345F-B491-497C-98DE-0072D12D0FE1}' # FveCtlGuid
)
$NET_MBNProviders = @(
'{3A07E1BA-3A6B-49BF-8056-C105B54DD7FB}' # WwanControlGuid
'{3CB40AAA-1145-4FB8-B27B-7E30F0454316}' # Microsoft-Windows-WWAN-SVC-EVENTS
'{7839BB2A-2EA3-4ECA-A00F-B558BA678BEC}' # Microsoft-Windows-WWAN-MM-EVENTS
'{78168022-ECA5-41E8-9E17-E8C7FD77AAE1}' # Microsoft-Windows-WWAN-UI-EVENTS
'{D086235D-48B9-4E49-ADED-5304BF8F636D}' # WwanProtoControlGuid
'{71C993B8-1E28-4543-9886-FB219B63FDB3}' # Microsoft-Windows-WWAN-CFE
'{F4C9BE26-414F-42D7-B540-8BFF965E6D32}' # Microsoft-Windows-WWAN-MediaManager
'{2DD11DE3-FDDE-4DA9-B57A-AF6585F74233}' # WlanRadioManager
'{0255BB48-E574-488A-8348-AE2C7652AFC5}' # microsoft-windows-wwan-hlk
'{681E3481-7510-4053-8C87-A6305EAFC4FA}' # Microsoft-WindowsPhone-Connectivity-WwanExt
'{B3EEE223-D0A9-40CD-ADFC-50F1888138AB}' # Microsoft-Windows-WWAN-NDISUIO-EVENTS
'{D58C1268-B309-11D1-969E-0000F875A532}' # CommonWppTrace
'{F3F14AC7-64BC-4A44-A190-807189ED2918}' # Microsoft-WindowsPhone-Net-CellCore-WwanFilter
'{9A6615A6-902A-4705-804B-57B8813089B8}' # Microsoft-WindowsPhone-Net-Cellcore-CellManager
)
$NET_MFAextProviders = @(
'{7237ED00-E119-430B-AB0F-C63360C8EE81}' #
'{EC2E6D3A-C958-4C76-8EA4-0262520886FF}' #
)
$NET_MiracastProviders = @(
'{802EC45B-1E99-4B83-9920-87C98277BA9D}' # MiracastWppControlGuid
'{1F930301-F484-4E01-A8A7-264354C4B8E3}' # Microsoft.Windows.Cast.Miracast
'{1F930302-F484-4E01-A8A7-264354C4B8E3}' # Microsoft.Windows.Cast.MiracastLogging
'{569A031F-3540-46E0-96D4-FB94164A99C7}' # Microsoft.Windows.Cast.MiracastReceiver
'{802EC45A-1E99-4B83-9920-87C98277BA9D}' # Microsoft-Windows-DxgKrnl
)
$NET_MUXProviders = @(
'{6C2350F8-F827-4B74-AD0C-714A92E22576}' # Microsoft-Windows-SlbMux
'{645B8679-5451-4C36-9857-A90E7DBF97BC}' # Microsoft-Windows-SlbMuxDriver
)
$NET_NCAProviders = @(
'{126DED58-A28D-4113-8E7A-59D7444B2AF1}' # Microsoft-Windows-Ncasvc
'{29F60C6B-8C09-449F-9979-082591D09318}' # NcaSvc
'{A487F25A-2C11-43B7-9050-527F0D6117F2}' # NcaUtil
'{63AC12D9-F21B-402D-BD67-8E415AA896AA}' # Microsoft.Windows.Networking.NCA
)