v0.10.0

WinMedic v0.10.0

First, do no harm. WinMedic no longer switches off Windows' own scheduled
tasks, no longer takes a program on a mapped drive for a leftover, and no
longer blames a blue screen on whichever driver happens to be loaded. A repair
that changes nothing says so instead of reporting a success, and findings that
came back on every scan with nothing wrong are gone. New: after a series of
crashes, WinMedic names the restore point from before the first one.

If an earlier version switched off scheduled tasks, the last section says how
to find them and switch them back on.

---

New

• The restore point from before the crashes: after two or more crashes,
  the crash timeline names the newest restore point from before the first
  one, with its date, and how to go back to it in System Restore. That takes
  back the programs, drivers and updates installed since and keeps your
  personal files.

Safer

• Windows' own scheduled tasks are never switched off. Up to 0.9.0 the
  only repair for a task that failed or pointed at a missing program was to
  switch it off, Windows' own included: SynchronizeTime, StorageSense or
  Secure-Boot-Update, which stops Secure Boot updates. For Windows' tasks
  that is advice now, and SynchronizeTime no longer counts as failing for
  the 0x420 it ends with when the time service is already running.
• Office's scheduled tasks that fail are advice too: Office switches them
  back on with each update.
• Programs on a mapped drive, a USB disk or a network share are no longer
  taken for leftovers. WinMedic runs as administrator and does not see the
  drive letters you mapped, so it deleted such autostart entries and switched
  off such scheduled tasks, a backup for example. Only a program missing from
  a fixed disk of this PC counts now.
• CBS.log and CbsPersist_*.log are no longer deleted with the setup
  logs. System Integrity reads them, and its findings vanished with them.
• Apps on a drive that is not connected, such as a game on an external
  disk, are advice ("Connect drive E: again") instead of damage that every
  repair failed to register again.
• A repair that waits for the restart keeps waiting through a scan before
  the restart. The file system check was scheduled a second time, and other
  repairs dropped off the list while nothing asked for the restart any more.

Repairs that are honest now

• WinSxS cleanup: DISM never removes some packages, such as the 24H2
  checkpoint update. Every scan raised them, and every cleanup reported a
  success. A cleanup that removes nothing fails now, and the finding returns
  only when DISM reports a different number.
• PCIe power saving and Explorer add-ons: once ASPM is off, or an add-on
  is blocked or uninstalled, the finding no longer comes back for days or
  weeks with a repair that "succeeds" without changing anything.
• The memory test is not offered again once it passed. The finding stays
  as advice, since the test misses faults that come and go.
• "Every change can be undone" was not true for deleted files. The window
  now says what a restore point undoes and, with a cleanup ticked, that
  deleted files do not come back.
• A simulation shows "Last simulation: 3 planned" instead of "Last
  repair: 3 repaired", and promises no restore point and no restart.
• Reports mark a repair that waits for the restart "RESTART" instead of
  "OPEN".

Findings that are right now

• Blue screens no longer name a culprit from the dump's list of loaded
  drivers, which holds the same drivers on every crash. On a PC with an AMD
  graphics card most blue screens read "BSOD caused by driver
  amdkmdag.sys", with advice to roll back the graphics driver. Crashes are
  told apart by their stop code now, and the steps point to WinDbg, which
  names the module a crash happened in.
• Unexpected shutdowns are the ones Windows logged without a stop code. A
  blue screen days ago no longer hides a power loss today.
• WHEA event 1 does not say which component failed. It was blamed on
  storage; the steps now cover the BIOS settings, temperatures and the power
  supply.
• Storage errors: past the 20 that are read, the count says "20 or
  more", and a bad block behind a burst of controller resets still makes the
  finding Critical.
• "Windows is waiting for a restart to finish its updates." no longer
  comes back after every restart for file operations an installer left
  behind, and a restart settles the advice to restart.
• System file damage found by SFC stays reported until SFC runs again,
  and "Windows component store is corrupted" no longer returns for
  missing backup copies once CBS.log is archived, which meant a RestoreHealth
  of ten minutes or more each time.
• Policies: "Remove access to use all Windows Update features" only hides
  "Check for updates" and is an Info finding now, not the Critical "Windows
  Update is blocked by policy". The Store policies are reported only on
  Enterprise and Education, the editions that read them.

Fixed

• Six services a tuning tool switched off can be switched back on: DNS
  Client, Base Filtering Engine, Windows Defender Firewall, Windows
  Installer, AppX Deployment Service and Client License Service. Windows does
  not let administrators change them with sc config, so the repair failed
  every time. WinMedic now sets their start type in the registry after a
  backup, which takes effect with the next restart.
• When DISM needs an ISO, WinMedic asks for the current one instead of this
  PC's own release, which Microsoft's download page does not offer.
• "Show log" after a repair opens the repair output, not the scan log.
• Settings shows restore point times as dates.
• Stuck print jobs and deleted items in the Recycle Bin are counted once.
• The DNS repair says what ipconfig /registerdns does.

If an earlier version switched off a task

This release keeps WinMedic from switching off Windows' tasks, but what 0.9.0
and earlier switched off stays off. WinMedic's log names every task it
switched off. In PowerShell:

Select-String "$env:APPDATA\WinMedic\logs\audit*.log" -Pattern "Scheduled task '([^']+)' disabled\." |
  ForEach-Object { $_.Matches[0].Groups[1].Value } | Sort-Object -Unique

Switch those under \Microsoft\Windows\ back on, Secure-Boot-Update first,
and any other you miss, such as a backup on a mapped drive. In Task Scheduler,
or in PowerShell as administrator:

Enable-ScheduledTask -TaskPath '\Microsoft\Windows\PI\' -TaskName 'Secure-Boot-Update'

An autostart entry an earlier version deleted can be put back from Settings →
Registry backups.

---

Full changelog: v0.9.0...v0.10.0