Skip to main content

Posts

Showing posts from November, 2021

Create a backup using Robocopy

Creating a backup is a must if not a necessity for a SysAdmin job. Backup doesn't need to be complex or needs a very powerful software to do a backup. At the end of the day, whether it's a good commercial software creating a backup; what it does in the background is create another copy of the file or folders that needs to be backed up. So, for that reason a simple copy command with the existing tool in Windows can do a job also for some simple backup like logs or other files. Why need to backup the logs? In a security perspective and audit purposes, logs are very important. Of course, it will also depend on the contents of the log whether it is quite detailed or important data is captured like username, IP Address, time, files and folder being accessed and other data. Problems or issues may not be detected in real-time or issues maybe notice at a later time but the action that cause the issue happened some time ago as well, in which the only witness are the logs. A simple batch...

What application is running behind svchost.exe in Windows?

Task Manager can be opened in different ways via Taskbar, pressing Ctrl + Shift + Esc or right clicking on the Windows icon and selecting Task Manager. In Task Manager window, it will show what are the processes or services running on the system. On the Details Tab of the Task Manager the details of the .exe file or the applications or services running on the system will be displayed. One noticeable thing on Task Manager is the svchost.exe, depending on how busy the system is or how many applications, browsers or other items that will need to connect to svchost.exe. The said exe file can easily be seen on Task Manager since there will be few of them.   But what is the application running behind the svchost.exe? Or what is occupying or using svchost.exe? Why there are a few of them running on the system? To get to the bottom of all the questions above, PID or Process ID will show what is behind the svchost.exe. To do this, open an elevated CMD or command prompt window....