Skip to content

Windows

Jump to bottom
Dave Cox edited this page Feb 19, 2026 · 14 revisions

Keyboard Shortcuts for Screen Capture

Seemingly depends on the OS version

Win11 25H2

  • entire desktop to clipboard: PrtScn
  • entire desktop to clipboard and save to Screenshots: Win + PrtScn (display flashes dim)
  • current window to clipboard: Alt + PrtScn
  • current display: not supported
  • launch Snipping Tool: Win + Shift + S

Win11 24H2 (maybe this seems different because I'm testing over RDP; double-check with a direct logon)

  • launch snipping tool: PtrScn
    • after snapping, this saves to clipboard and screenshots folder
  • current display: Alt + PrtScn
    • maybe this is just the current window of the RDP client?

Win11 File Explorer Classic Context Menu

(by default indirected behind the "Show more options" item of the new context menu)
HKEY_CURRENT_USER\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32
(Default)=(REG_SZ)"" (blank)
https://pureinfotech.com/bring-back-classic-context-menu-windows-11
https://allthings.how/how-to-show-more-options-by-default-in-windows-11-file-explorer/

Win11 Windows Update Don't Auto Reboot

Likely have to create the key path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Update\AU
    NoAutoRebootWithLoggedOnUser = (REG_DWORD) 1

Scheduled Tasks Can Wake Computer, Even from Hibernate

See DriverGuru there

In hibernate your motherboard is still getting standby power, +5SB (as it is even when the OS is shut down). If it wasn't, your power button wouldn't work. Standby power allows the wake timers on the motherboard to wake the machine from either hibernate or sleep (the motherboard doesn't know the difference between these, and doesn't do anything different for them).

This is implemented in the motherboard's time-of-day clock, which has a feature not > unlike an alarm clock. If the OS hibernates or sleeps but has a scheduled wakeup time, the "alarm clock" is simply programmed to effectively press the power button at the appropriate time. It doesn't require the OS to be running any more than does timekeeping while the machine is hibernated.

To list current items that will wake the computer:
(as Admin:) powercfg /waketimers

Also: here there's powershell code for finding a Microsoft-Windows-Power-Troubleshooter logged event with a Wake Source property that may indicate the responsible party.

Sleep from Keyboard

(If using a keyboard without a power button, or power button is configured to do something other than sleep)

Win + X > U > S

Persistent Priority Class for Programs

https://answers.microsoft.com/en-us/windows/forum/all/how-to-permanently-set-priority-processes-using/2f9ec439-5333-4625-9577-69d322cfbc5e

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PROGRAM.EXE\PerfOptions
"CpuPriorityClass"=(REG_DWORD) <priority>

where priority:

         Low: 1
      Normal: 2
        High: 3
Below Normal: 5
Above Normal: 6

Minidump On Demand

Process Explorer can create a [mini]dump of a running process (no crash needed).
To create a dump of a 32-bit process, use 32-bit Process Explorer!

Run As SYSTEM

To execute a program with the OS’s SYSTEM access token,

  • first run Windows Terminal or cmd.exe as administrator (elevated)
  • then use psexec -s, e.g.: c:\bin\psexec.exe -s powershell.exe

To launch a new shell console window, instead of connecting the new shell’s pipes through psexec back to the originating console, use -i (interactive) and -d (don’t wait):

c:\bin\psexec.exe -s -i -d powershell.exe

See also PowerShell | run powershell as SYSTEM

JIT Debugging on Crash

Via Visual Studio (running as Administrator)
Via Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

Auto = (REG_SZ) 1

Debugger = (REG_SZ) "C:\bin\procdump.exe" -accepteula -j "C:\procdump" %ld %ld %p
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                        for example

Debugger = (REG_SZ) "C:\WINDOWS\System32\vsjitdebugger.exe -p ..."

Troubleshooting

List Terminal Services Sessions

qwinsta [/server:<hostname>]

(Note the developers called these sessions WinStations, not to be confused with Windows’s original Window Stations.)

Enable UAC-Elevated Processes to Access Mapped Network Drive Letters

Logging in as a user who can consent to elevate (to Admin privileges & High integrity level) creates two logon sessions: an elevated one, and the least-rights one. Mapped network drives are implemented as kernel object symbolic links, usually in a namespace specific to one logon session, the least-rights one, so processes running in the elevated session cannot see the drives. You can configure Windows to create those symlinks in namespaces for both sessions with a registry entry: EnableLinkedConnections

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
    EnableLinkedConnections = (REG_DWORD)1

Clone this wiki locally