2023年11月20日 星期一

microsoft store,base filtering enginee,windows defender防火牆異常現象


異常現象

使用者反應記事本、小畫家不能開啟。
檢查記事本時發現它說有新的程式,但也可以開舊的,因此留意到新版記事本的問題,
也留意到可能與microsoft store有關。


發現根源問題

但後來也接著發現有陸續的狀況,包括microsoft store無法打開、除了記事本小畫家,與microsoft store相關的東西都無法打開。
終端機也不行。
搜尋一些關鍵字後,我最後導向需要重新安裝microsoft store。
但在執行microsoft store的
Get-AppxPackage -allusers Microsoft.WindowsStore | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
出現了若干錯誤。
包括
Add-AppxPackage : 部署失敗,HRESULT 為: 0x80073CF6, 無法註冊套件。
錯誤 0x800706D9: 處理要求時,系統無法登錄 windows.firewall 延伸,因為發生下列錯誤: 端點對應表中無更多可用的端點。

是windows內建的defender 防火牆有問題,無法運作。
經操作確實無法開啟windows defender防火牆的服務,根據相依性去尋,發現是另一個程序
BFE, base filtering enginee
啟動相關也是灰色,無法啟動。

處理根源問題

以上有2個相依的根源問題。
1。BFE與windows defender防火牆,服務不正常。

決定性的處理:
當您在 services.msc 中發現 Windows 防火牆的依賴服務之一,即 Base Filtering Engine(BFE)服務已停止,且無法手動啟動時,這通常指示系統設置或安全策略問題。以下是一些解決方案:
解決 Base Filtering Engine 問題

    檢查系統安全策略:
        某些安全策略設置可能導致服務無法啟動。您可以通過本地安全策略編輯器檢查這些設置。
        按下 Win + R,輸入 secpol.msc,然後按 Enter 打開本地安全策略編輯器。
        在“本地策略”下的“使用者權限指派”,確保沒有策略阻止 BFE 服務。

    檢查註冊表設置:
        註冊表中的錯誤配置可能會導致這種情況。警告:在修改註冊表之前,請務必備份註冊表。
        按下 Win + R,輸入 regedit,然後按 Enter 打開註冊表編輯器。
        導航到 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE,並檢查這裡的設置是否正常。

    掃描惡意軟件和病毒:
        某些類型的惡意軟件可能會停用或損害關鍵的系統服務。請使用您信任的防病毒軟件進行全面掃描。

    使用系統還原:
        如果上述方法不奏效,您可以考慮使用系統還原點還原到問題出現之前的狀態。

    尋求專業幫助:
        如果您不確定如何操作,或者問題仍然無法解決,建議尋求專業技術支援。
----------------------------------
要判断注册表中 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE 的设置是否正常,您需要检查几个关键的注册表项。以下是一些基本的指导原则来帮助您进行判断:
注册表项检查

    启动类型:
        在 BFE 键下,找到名为 Start 的 DWORD 值。
        正常情况下,Start 的值应该是 2,表示该服务设置为自动启动。

    权限设置:
        检查 BFE 键下的 Security 子键,这个涉及到服务的安全权限设置。
        正常情况下,这部分可能比较复杂,因为它包含了安全描述符。如果您不确定如何解读这些设置,可能需要专业帮助。

    依赖服务:
        找到名为 DependOnService 的多字符串值(REG_MULTI_SZ)。
        正常情况下,这里列出了 BFE 服务所依赖的其他服务。确保没有不寻常或未知的服务被列出。

    错误控制:
        检查名为 ErrorControl 的 DWORD 值。
        正常情况下,这个值通常是 1,表示系统在遇到服务启动错误时显示警告。

    图像路径:
        找到名为 ImagePath 的字符串值(REG_EXPAND_SZ)。
        此项应该指向 BFE 服务的可执行文件。通常情况下,它的值应该是 %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork。
確認完,改完要重開機。
----------------------------------------

2。microsoft store程式不存在。重裝store這個框架的程式。

No matter which error message you receive, you can’t reinstall Windows Store using PowerShell. You need to use another method to do the job.

You need to download the Microsoft Store appx bundle/package from Microsoft and then install it on your computer.

1. Go to https://store.rg-adguard.net/.

2. Copy and paste the following URL to the URL text box: https://www.microsoft.com/en-us/p/microsoft-store/9wzdncrfjbmp.

3. Select Retail.

4. Click the Generate icon.

generate links
5. Select the .NET Framework, .NET Runtime, and VC Libs files to download. You need to download the correct version according to the bitness your computer is using. For example, I’m using 64-bit operating system, I need to choose the files for 64-bit operating system.

These are the files I choose to download:
照順序下載,然後照順序安裝。
執行這幾個檔案時,會一直提到必須關閉myasus這個程式。
我猜是因為這個程式也是microsoft store安裝來的,所以因為要重裝這個基礎,因為在這之上的myasus必須關閉。

NET.Native.Framework.1.7_1.7.27413.0_x64__8wekyb3d8bbwe.appx
NET.Native.Runtime.1.7_1.7.27422.0_x64__8wekyb3d8bbwe.appx
VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe.appx
WindowsStore_12011.1001.113.0_neutral_~_8wekyb3d8bbwe.appxbundle

Now, you need to right-click the file, select Copy link address, and paste the download link to the address bar of your web browser, and press Enter to download the files. Thank you for the suggestion from Augustus.

copy link address
6. Run each .appx file.

7. Run the appxbundle file. If you need to select a program to run this file, this means the bundle file is not downloaded correctly. You need to download it again.

8. After these steps, Microsoft Store will be reinstalled on your computer. You can go to Microsoft Store > Settings to check the version you are using.


_____________________________________________________________________

Abnormal Phenomenon 

Users report that Notepad and Paint cannot be opened. Upon checking Notepad, it was found that there was a message about a new program being available, but there was also an option to open the old version. This indicates a potential issue with the new version of Notepad. It was also noted that the issue might be related to the Microsoft Store.

Identifying the Root Cause However, subsequent discoveries included a series of issues, such as the inability to open Microsoft Store. In addition to Notepad and Paint, anything related to Microsoft Store also couldn't be opened, including the Terminal. After searching with some keywords, I was led to the conclusion that Microsoft Store needed to be reinstalled. However, while executing the command for Microsoft Store: Get-AppxPackage -allusers Microsoft.WindowsStore | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"} several errors occurred, including: Add-AppxPackage: Deployment failed, HRESULT: 0x80073CF6, Package registration failed. Error 0x800706D9: While processing the request, the system could not log the windows.firewall extension because the following error occurred: No more endpoints available from the endpoint mapper.

It seems there was an issue with the built-in Windows Defender Firewall, which was not functioning. Indeed, upon attempting to operate, the Windows Defender Firewall service could not be started. Upon checking the dependencies, it was found that another process, BFE, Base Filtering Engine, was involved. The option to start related services was also greyed out and could not be initiated.

Addressing the Root Cause There are two dependent root issues identified.

  1. Abnormality in BFE and Windows Defender Firewall services. Decisive actions include:

    • Checking System Security Policies: Some security policy settings might prevent the service from starting. You can check these settings through the Local Security Policy Editor. Press Win + R, type secpol.msc, and then press Enter to open the Local Security Policy Editor. Under "Local Policies" in "User Rights Assignment," ensure no policy is blocking the BFE service.

    • Checking Registry Settings: Incorrect configurations in the registry can cause this issue. Warning: Make sure to back up the registry before making changes. Press Win + R, type regedit, and then press Enter to open the Registry Editor. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE and check if the settings here are normal.

    • Scanning for Malware and Viruses: Some types of malware may disable or damage critical system services. Perform a comprehensive scan with your trusted antivirus software.

    • Using System Restore: If the above methods do not work, consider using a system restore point to revert to a state before the issue occurred.

    • Seeking Professional Help: If you are unsure how to proceed or if the issue remains unresolved, it's recommended to seek professional technical support.

    • Judging the Normalcy of Registry Settings at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE: Check several key registry entries. Here are some basic guidelines to assist you in this evaluation:

      • Start Type: Under the BFE key, find the DWORD value named Start. Normally, the Start value should be 2, indicating that the service is set to start automatically.

      • Permission Settings: Check the Security subkey under the BFE key, involving the service's security permission settings. Normally, this part is complex as it includes security descriptors. If unsure how to interpret these settings, professional help may be required.

      • Dependent Services: Find the multi-string value (REG_MULTI_SZ) named DependOnService. Normally, this lists other services that BFE depends on. Ensure no unusual or unknown services are listed.

      • Error Control: Check the DWORD value named ErrorControl. Normally, this value is usually 1, indicating that the system will display a warning when encountering a service start error.

      • Image Path: Find the string value (REG_EXPAND_SZ) named ImagePath. This should point to the executable file of the BFE service. Normally, its value should be %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork. After confirming and making changes, a reboot is required.

  2. 2. Microsoft Store Program Absent: Reinstalling the Store Framework Decisive actions for resolution:

    • Reinstalling Microsoft Store: According to MiniTool's Guide on How to Reinstall Microsoft Store, regardless of the error message received, PowerShell cannot be used to reinstall Windows Store. Another method is required.

    • Downloading and Installing Files:

      • Download the files in the following order and then install them in the same sequence:
        1. NET.Native.Framework.1.7_1.7.27413.0_x64__8wekyb3d8bbwe.appx
        2. NET.Native.Runtime.1.7_1.7.27422.0_x64__8wekyb3d8bbwe.appx
        3. VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe.appx
        4. WindowsStore_12011.1001.113.0_neutral_~_8wekyb3d8bbwe.appxbundle
      • During the execution of these files, you may be prompted to close the 'myasus' program, possibly because it is also installed from Microsoft Store, requiring its closure for the reinstallation.
    • Downloading Process:

      • Right-click the file, select 'Copy link address', and paste the download link into the address bar of your web browser. Press Enter to start the download.
    • Running the Files:

      • Run each .appx file.
      • Run the appxbundle file. If a program selection is prompted for this file, it means the bundle file has not been downloaded correctly and needs to be downloaded again.
    • Finalizing the Installation:

      • After completing these steps, Microsoft Store will be reinstalled on your computer. You can check the version in Microsoft Store > Settings.

讀書心得:數值化之鬼

 問題:在工作上如何做到將工作量化,侑翰說不只如此,推薦了這本書。 動機:在 cne 運作中的回顧,討論到工作量還有工作時間,討論到了如何將工作數值化呈現,讓主管們知道cne需要專門專業,要如何產生數值化出來被看見。 讀書心得與結論如下: 心得: 作者給的五大步:增加行動...