
{/* banner prompt: A clean isometric technical illustration of a Windows laptop caught between two tall cloud-office towers in different colors. A jammed identity turnstile made of key cards and token rings blocks the direct path from the laptop to the second tower. A confident blue mail bird carrying a sealed envelope flies around the turnstile through a separate glowing OAuth gateway. Light gray background, restrained blue, teal and amber palette, crisp editorial infographic style, no company logos, no readable text, no error-code typography. */}

The mailbox was healthy. Outlook on the web worked. The same account worked on other computers. Only one Windows PC refused to add it — and that PC happened to be Microsoft Entra joined to a *different* tenant.

That distinction sent us through three separate identity systems wearing one Outlook-shaped trench coat: Windows Web Account Manager (WAM), Microsoft 365 desktop licensing, and Outlook's own profile state. We cleared caches, counted accounts, reset applications, tested both Outlook clients, and captured the exact broker errors. Each step explained a symptom. None produced a dependable mailbox.

Our final answer was not another registry key. It was **use Thunderbird instead**.

This is what we learned, including how to configure Thunderbird without falling back to the basic-authentication password prompt that Microsoft 365 has already retired.

## The setup that triggered it

The Windows user signed in with an account from Tenant A. The device was fully Entra joined to Tenant A and held a Primary Refresh Token (PRT) for that identity. The user also needed a normal Exchange Online mailbox from Tenant B.

The Tenant B mailbox was not broken:

- Outlook on the web worked.
- The credentials and MFA worked.
- The mailbox worked on computers that were not joined to Tenant A.
- Autodiscover and Exchange Online were reachable.

That left the local identity context as the meaningful difference.

## Four errors, four different layers

The failure changed as we removed stale state. That was useful: each new message exposed the next layer underneath.

<Table data={
    {
        headers: ['Client or test', 'Visible symptom', 'What it actually told us'],
        rows: [
            ['New and classic Outlook', 'Add account operation is blocked because account limit is reached', 'Windows WAM believed the user had exhausted its Entra account slots'],
            ['New Outlook after reset', 'Your account is not supported', 'The mailbox could not license new Outlook as its first account'],
            ['Classic Outlook', 'An unexpected error occurred, tag 7anyj', 'The Windows identity broker could not match Outlook\'s login hint to a cached WebAccount'],
            ['Manual IMAP in Outlook', 'A plain username and password prompt', 'Outlook had selected basic authentication, which Exchange Online no longer accepts'],
        ]
    }
} />

Treating all four as "Outlook cannot sign in" would have produced an endless loop of reinstalls. They came from different components and needed different evidence.

## The account-limit detour

Windows 10 and 11 limit a user session to three Microsoft Entra accounts. Microsoft documents the exact resulting message: *"Add account operation is blocked because account limit is reached."* The limit exists to control token-request size and keep single sign-on reliable. See the [Microsoft Entra device management FAQ](https://learn.microsoft.com/en-ca/entra/identity/devices/faq).

The important words are **user session**. Our remote management shell ran as `SYSTEM`, so this command initially inspected the wrong profile:

```powershell
dsregcmd /listaccounts
```

The giveaway was immediate:

```text
USERPROFILE=C:\Windows\System32\config\systemprofile
```

WAM is per-user state. An elevated shell, service, RMM agent, or SSH daemon commonly runs under a service account and can return an empty list or a meaningless error even while the interactive user has a broken account store.

We used a temporary scheduled task with `LogonType=Interactive` to execute `dsregcmd /listaccounts` inside the signed-in user's session. After backing up and rebuilding the TokenBroker account directory, the real result was clean:

```text
User accounts: 1
Application accounts: 0
Default account: tenant-a-user@example.com
```

The count was no longer the blocker. Outlook still failed.

## The silent cleanup script trap

Microsoft provides `signoutofwamaccounts.ps1` for removing Office-associated WAM tokens on managed devices. It is a legitimate tool, but it has two operational surprises:

1. It is deliberately silent. Its asynchronous results are piped to `Out-Null`, so no output can mean success, failure before useful work, or simply no matching Office accounts.
2. It works on the current user's WAM store. Running it from an RMM shell as `SYSTEM`, or as a different administrator, does not clean the affected desktop user's account store.

Microsoft's [activation reset guidance](https://learn.microsoft.com/en-us/previous-versions/troubleshoot/microsoft-365/microsoft-365-apps/activation/reset-office-365-proplus-activation-state) correctly says the script removes Office tokens without unjoining an Entra-joined device. What it cannot do is make a service-context PowerShell session become the interactive user.

The reusable rule is simple: when troubleshooting WAM, always record `whoami`, `$env:USERPROFILE`, and the session ID beside every result.

## New Outlook exposed a licensing problem

Resetting the new Outlook package did not clear all of its data. Its packaged `LocalState` and `LocalCache` were empty, while `%LOCALAPPDATA%\Microsoft\Olk` still contained the account state. Renaming `Olk` to a timestamped backup finally produced a genuine first-run experience.

The next message was *"Your account is not supported."*

That was progress, not regression. New Outlook reads the licence attached to its accounts. Microsoft says a work or school account needs a plan that includes desktop applications to license Outlook as the initial account. Once a qualifying account is present, Business Basic or E1 mailboxes can be added as secondary accounts. The details are in [Microsoft's new Outlook licensing guide](https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/get-started/licensing-options).

In this case the second tenant's mailbox was not a suitable first account. Adding the Tenant A account first was theoretically valid, but it pulled us straight back into the cross-tenant WAM path we were trying to escape.

## Classic Outlook gave us the decisive evidence

Classic Outlook replaced the licensing message with a generic page:

```text
Message: An unexpected error occurred.
Tag: 7anyj
Code:
```

The page itself was nearly useless. The timestamp was not.

We queried `Microsoft-Windows-AAD/Operational` for the surrounding twelve minutes. At the same second as the Outlook error, Windows logged an application-specific account warning. Before and after it, Event ID 1098 repeated this error:

```text
0xCAA100D8
A login hint was sent that doesn't match any WebAccount in the system.
```

That closed the loop. Outlook was asking WAM silently for Tenant B, but WAM contained only Tenant A. The browser credentials were fine. The Exchange mailbox was fine. The tenant was fine. The local broker could not map the requested identity to an account in its store.

We tried seeding the second Office identity through another desktop Office application. That also failed. At that point we could keep editing identity stores and registry associations, or we could choose a mail client that did not inherit the Windows session's PRT and Office WAM state.

## Why guest accounts and cross-tenant settings were not the first fix

Inviting the user as a guest into Tenant B sounds attractive, but a B2B guest object does not turn an existing mailbox login into a healthy Outlook desktop identity. Cross-tenant access settings can control trust, MFA claims, device claims, and inbound or outbound B2B access. They do not repair a local WAM account mapping.

Those settings matter when the Tenant B sign-in logs show a Conditional Access or cross-tenant policy denial. Our evidence stopped earlier: Windows could not even match the login hint to a local WebAccount.

Fix the layer that failed. Do not redesign tenant trust because a local token broker returned `0xCAA100D8`.

## Why Thunderbird was the practical answer

Thunderbird runs its own Microsoft OAuth flow and maintains its own account state. It does not need Outlook to reconcile Tenant A's Windows PRT with Tenant B's mailbox identity. That makes it a clean isolation boundary: the user signs directly into the mailbox's home tenant, completes MFA, and Thunderbird stores the resulting OAuth tokens in its own profile.

As of Thunderbird 153, native Exchange email over EWS is available without an add-on. Mozilla's [Thunderbird and Exchange guide](https://support.mozilla.org/en-US/kb/thunderbird-and-exchange) recommends version 145 or later and explains the Microsoft-hosted OAuth prompt. Thunderbird 153 made that support prominent in the new Account Hub; see the [Thunderbird 153 release announcement](https://blog.thunderbird.net/2026/07/thunderbird-153-meadow-is-out-now/).

For this kind of case, the immediate setup is:

1. Install Thunderbird 153 or newer.
2. Select **New Account → Email**.
3. Enter the Tenant B mailbox address.
4. Let Account Hub detect Exchange, or select **Manual Configuration → EWS**.
5. Complete the branded Microsoft OAuth and MFA flow for Tenant B.

Do not type the mailbox password into a "Normal password" IMAP configuration. Microsoft removed basic authentication from Exchange Online. OAuth is the difference between "IMAP is obsolete" and "IMAP works securely with Microsoft 365."

If EWS is unavailable, use IMAP and SMTP with OAuth2:

<Table data={
    {
        headers: ['Purpose', 'Server', 'Port and transport', 'Authentication'],
        rows: [
            ['Incoming mail', 'outlook.office365.com', '993, SSL/TLS', 'OAuth2'],
            ['Outgoing mail', 'smtp.office365.com', '587, STARTTLS', 'OAuth2'],
        ]
    }
} />

Microsoft explicitly lists Thunderbird as an Exchange Online IMAP client in its [POP3 and IMAP4 documentation](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4). Mozilla's [Microsoft OAuth guide for Thunderbird](https://support.mozilla.org/en-US/kb/microsoft-oauth-authentication-and-thunderbird-202) also notes two tenant-side caveats: an administrator may need to approve Thunderbird once, and SMTP AUTH may need to be enabled for sending.

## The EWS warning in August 2026

Native EWS is a good immediate bridge, not a forever architecture for Exchange Online. Microsoft begins phased EWS disablement on October 1, 2026 and plans full retirement on April 1, 2027. Administrators can temporarily allow approved EWS applications during the transition. Microsoft's current timeline is in [Deprecation of Exchange Web Services in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online).

Thunderbird's Graph implementation was approaching feature parity in June 2026, but Thunderbird 153 still shipped it behind a preference while the project completed the work. For a deployment made today:

- Use native EWS if it works and the tenant is prepared to allow it during the transition.
- Use IMAP/SMTP with OAuth2 for basic mail when EWS is blocked.
- Track Thunderbird's Graph rollout for the long-term Exchange path.
- Expect email first; Exchange calendar and address-book parity is still catching up.

## What we would do first next time

1. **Prove the mailbox independently.** Test OWA and a non-joined device before touching the tenant.
2. **Map the identity contexts.** Record Windows sign-in tenant, device join tenant, mailbox tenant, Office licensing account, and the user context of every shell.
3. **Run WAM diagnostics as the interactive user.** Never trust `dsregcmd /listaccounts` from `SYSTEM` for a desktop-user problem.
4. **Use the error timestamp as a join key.** A generic Outlook page becomes actionable when matched to `Microsoft-Windows-AAD/Operational`.
5. **Separate authentication from licensing.** "Account not supported" in new Outlook can be a licence decision even when OAuth and Exchange are healthy.
6. **Stop when the architecture is fighting the requirement.** A second mail client is cheaper and safer than repeatedly rewriting a joined user's identity stores.

The technical lesson is not that Outlook is bad or Thunderbird is magic. It is that coupling matters. Outlook integrates deeply with Windows and Microsoft 365, which is excellent when the device, user, licence, and mailbox all belong to one identity story. In a two-tenant edge case, the integration itself can become the failure domain.

Thunderbird gave the second mailbox its own OAuth boundary. That was the feature we actually needed.


4844464e14928bc7b275c5c79bd20562e419f1cd106f8afd18ab6a9a5920034c

A practical investigation of cross-tenant Outlook failures on an Entra-joined Windows PC, including WAM diagnostics, misleading fixes, and the Thunderbird alternative.

A Microsoft Entra-joined PC could open a second tenant's mailbox everywhere except Outlook. WAM limits, PRT routing, licensing checks, and a silent cleanup script eventually pointed us to the simpler answer: Thunderbird with OAuth.

Two Microsoft 365 Tenants, One Windows Session: Why We Chose Thunderbird


{/* banner prompt: A vivid isometric infographic scene of a small friendly robot (an AI agent) reaching toward a laptop with a wrench in one hand, while a large shield-shaped antivirus icon looms over it, its glowing eye watching. Three of the robot's tools (a floppy disk, a gear, and a key) are shown mid-air, each caught in a translucent red "quarantined" bubble launched from the shield. Clean light-gray background, sharp isometric perspective, muted blue-and-red palette, technical but approachable, no readable text or logos. */}

We gave an AI agent real hands on a Windows machine: reach it over the network, install itself, register a background service, and get to work unattended. Straightforward, we thought — until the machine had Bitdefender GravityZone on it, and the agent could see the machine perfectly well but couldn't actually *do* anything to it. Not because of a bug in our code. Because an endpoint protection product was quietly erasing our binary and blocking Windows' own service-management APIs, without a single visible error pointing at the real cause.

This is the anatomy of that block, three layers deep, and the exact GravityZone settings that let an automated agent actually operate on a managed endpoint.

## Layer 1: the binary just disappears

The first symptom looked like a download bug. Our install step used a plain `WebClient.DownloadFile` to fetch the agent binary, and it failed with a generic wrapper exception: *"An exception occurred during a WebClient request."* No useful detail.

The real cause was buried in `.Exception.InnerException`, only visible with `Format-List * -Force`:

```
System.UnauthorizedAccessException: Access to the path
'...\agent.exe' is denied.
```

Access denied, on a fresh download, to a brand-new file, in a folder we owned. Ruling out the obvious suspects — TLS, proxy, file locks, ACLs — took a while, because every one of them came back clean. What finally confirmed it: a pure local `Rename-Item` on the same filename, no network involved at all, threw the identical `UnauthorizedAccessException`. That ruled out anything related to how the file arrived (download provenance, Mark-of-the-Web, whatever) and pointed at one thing: **something was reacting to the filename itself, the instant it appeared on disk.**

`Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct` gave the answer: Bitdefender Endpoint Security Tools, centrally managed through GravityZone. It was quarantining the binary on write, silently, with no local error dialog and no entry in the Windows Application or System event logs — Bitdefender logs to its own console, not to Windows, so `Get-WinEvent` finds nothing. From the process's point of view it just looks like the filesystem refused to cooperate.

## Layer 2: even SYSTEM can't create a service

Once we worked around the file-quarantine (more on the fix below), the same binary would download and sit on disk just fine. Installing it as a Windows service was the next wall:

```
Error: install service (run as Administrator if not elevated): Access is denied.
```

Our first assumption was a permissions problem in our own service-install code. To rule that out, we dropped straight to the raw OS tool, running as `nt authority\system`:

```
sc.exe create myagent binPath= "C:\Path\To\agent.exe" start= auto
[SC] CreateService FAILED 5:
Access is denied.
```

`SYSTEM` failing `CreateService` with error 5 is not a permissions problem — SYSTEM has unrestricted access to the Service Control Manager by definition. Something was intercepting the call itself. That's a signature of behavioral/EDR monitoring, not access control: GravityZone's **Advanced Threat Control** module watches for exactly this pattern — a process registering itself as a persistent Windows service — and treats it as a textbook malware-persistence technique, regardless of whether the binary passed the earlier file scan.

## Layer 3: the registry write underneath it

`CreateService` isn't a single atomic action from Windows' perspective — it writes a new key under `HKLM\SYSTEM\CurrentControlSet\Services`. That key path falls under GravityZone's **Sensitive Registry Protection**, a separate sub-feature of Advanced Threat Control that specifically guards persistence-related registry locations and can kill the offending process outright. Two independent enforcement layers were converging on the same operation for two different reasons: one watching "is this process trying to persist," the other watching "is this process touching a sensitive registry key." Either one alone is enough to block a legitimate service install.

## Where "just add an exclusion" falls short

The standard advice for AV false positives is an exclusion: GravityZone's **Antimalware → Exclusions** tab lets you add a Folder, File, Process, or Extension exclusion, and pick which scanning **Modules** it applies to (on-access, on-demand, and — separately — **ATC/IDS**, GravityZone's label for Advanced Threat Control and its Intrusion Detection System). We added both a folder and a process exclusion with all modules selected, including ATC/IDS.

It stopped Layer 1. It did **not** stop Layer 2 or Layer 3. Sensitive Registry Protection turned out to be its own gate, evaluated independently of the Exclusions list — an exclusion tells the scanner to skip a file or process, but it doesn't override a behavioral rule that's watching a system resource (the registry key) rather than the process that's touching it.

## The actual fix

Two policy settings, both under **Antimalware → On-Execute → Advanced Threat Control** in the GravityZone policy:

<Table data={
    {
        headers: ['Setting', 'Default', 'Changed to'],
        rows: [
            ['Action for infected applications', 'Block / Kill process', 'Report only'],
            ['Sensitive Registry Protection', 'Block / Kill process', 'Report only'],
        ]
    }
} />

"Report only" keeps GravityZone watching and logging — you still get visibility into what the agent is doing on the endpoint — but stops it from silently killing the process or deleting the file before the operation can complete. We kept the folder and process exclusions from earlier too, as a belt-and-suspenders measure for the plain file-scan layer, but the two "Report only" toggles are what actually unblocked service installation and registry writes.

This is a real trade-off, not a free lunch. Loosening ATC's response mode on a managed endpoint reduces the odds it auto-remediates a genuine compromise on that box. The right scope for this change is narrow: apply it via a dedicated policy assigned only to endpoints that are supposed to run this kind of automation, not your default fleet-wide policy — and keep "Report only" instead of disabling the module outright, so you still see every detection GravityZone would otherwise have acted on.

## What to check if your automation is being silently eaten

If a process on a GravityZone-managed Windows box can create files but can't seem to keep them, or can enumerate/read everything but can't write to the service registry or call `CreateService`, even running as SYSTEM:

1. **Get past the wrapper exception.** .NET's `WebClient`/`HttpClient` errors and generic "Access is denied" messages hide the real exception. Always drill into `.Exception.InnerException` (`Format-List * -Force` in PowerShell) before concluding it's your own code.
2. **Rule out provenance with a pure local operation.** If `Rename-Item` on the same destination filename also fails with no network involved, the block is about the file/process identity, not how it arrived.
3. **Identify the real AV product**, don't assume it's Windows Defender. `Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct` tells you what's actually active — often a third-party product has silently superseded Defender, and Defender's own cmdlets (`Get-MpPreference`) will fail with a generic COM error when that's the case.
4. **Test service creation with the raw OS tool**, not your own code. `sc.exe create` failing under SYSTEM isolates the problem to the platform/EDR layer, not your service-install logic.
5. **Don't stop at Exclusions.** A file/process exclusion silences on-access scanning, but a dedicated behavioral rule — like registry-key protection — can still be watching the *resource* rather than the *process*, and needs its own toggle.

The broader lesson: modern EDR products don't have one enforcement point, they have several, stacked on different signals — file content, process behavior, and resource access — and each one can independently veto the same operation for a different reason. Debugging "access denied" on a managed endpoint means finding out which layer is actually talking, not just the first one you can reproduce.

c7a32d8904e2b087f20b4cdaf8ed027394a9e954e6a0c239b6c3116bdc9a7043

How Bitdefender GravityZone silently blocked an AI agent's own binary, service installation, and registry writes on Windows, and the exact policy settings that fixed it.

Our AI ops agent could reach a Windows box over the network but couldn't install itself, start its own service, or even keep its own binary on disk. The culprit: Bitdefender GravityZone silently eating it, one enforcement layer at a time.

When Your Antivirus Fights Your AI Agent: A Bitdefender GravityZone War Story

{/* banner prompt: Of course! Here are three creative and engaging prompts for a banner image, each with a different artistic focus but all reflecting the core idea of the blog post.

---

### Option 1 (Metaphorical & Cinematic)

This prompt focuses on the idea of an AI breaking free from its digital confines to take direct control of a system.

**Prompt:**
> A cinematic digital art masterpiece. On the left side of the frame, a brilliant, glowing AI neural network is trapped inside a transparent, sandboxed cube representing a browser. A powerful, focused beam of light, composed of streaming green `bash` and blue `PowerShell` command-line text, shatters the cube's wall. This beam, representing the Cygwin SSH connection, extends to the right side of the frame, where it elegantly manipulates a complex, holographic 3D model of the Windows operating system. The beam is precisely deleting registry hives, stopping service gears, and cleaning up file system clutter, transforming chaos into order. The overall aesthetic is dark, futuristic, and infused with glowing neon data streams. --ar 16:9

---

### Option 2 (Direct & Illustrative)

This prompt visualizes the conversational aspect and the direct cause-and-effect of the user's request.

**Prompt:**
> A futuristic command center interface. In the foreground, a sleek, floating chat window displays a human's request: `"Uninstall all bloatware and clean the registry."` An AI responds: `"On it. Establishing SSH connection..."`. In the background, a massive, dynamic data visualization of the Windows OS shows the command in action. Streams of code flow from a central SSH terminal icon, targeting and dissolving icons for unwanted programs, while a 3D representation of the Windows Registry is being methodically scanned and cleaned by glowing green cursors. The style is clean, high-tech, and focuses on UI/UX design, with a dark theme and vibrant blue and green highlights. --ar 16:9

---

### Option 3 (Symbolic & Abstract)

This prompt uses symbolism to represent the fusion of two different tech worlds: the open, command-line world and the Windows GUI world.

**Prompt:**
> An abstract digital painting. A stylized, glowing Tux penguin (representing Linux/Cygwin) and a serene, blue AI entity (representing Claude) are working together as one. They are extending their hands, which are made of pure command-line code, through a shimmering portal shaped like the Windows logo. On the other side of the portal, their code-hands are masterfully deconstructing and reassembling Windows components like services, registry keys, and startup items, represented as intricate, glowing geometric shapes. The background is a dark, digital void, emphasizing the powerful and precise nature of the remote management. The lighting is dramatic and symbolic. --ar 16:9

Additional instructions: An AI maid */}

## The Problem with Browser-Based AI Assistants

If you've ever tried to get an AI assistant to help you actually *do* something on your Windows computer — not just tell you *how* to do it — you've probably hit a wall like this:

> *"I don't have direct access to your Windows system settings, so I can't check or change remote connection settings on your behalf."*

> *"I appreciate you asking, but there are a couple of important limitations here: I can't install software on your Windows computer. I have access to a sandboxed Linux environment for running code, but that's separate from your actual Windows system. I have no way to download or install applications like Cygwin or Python onto your PC directly."*

These are real responses from browser-based AI tools like "Claude Cowork" (Claude.ai in a chat window). They're not wrong in this context, but the limitation is narrower than "can only give advice": Claude Cowork can work with local files you expose to it and automate tasks that live inside the Chrome browser. What it still can't do is directly administer your Windows machine end-to-end the way an SSH-connected agent can.

But what if Claude could actually *do* it?

That's exactly what **Claude Code, Codex, Gemini, or any smart agent** with SSH access enables. Once your Windows machine is reachable over SSH, the agent — running on another machine on your network — can log in, run commands, read files, edit the registry, and manage your system end-to-end. No GUI required. No copy-pasting commands. You just ask.

---

## Part 1: The Hard Part — Making Windows SSH-Accessible

The one-time setup requires physical or RDP access to the Windows machine. After that, you'll never need it again.

### Step 1: Install Cygwin with OpenSSH

Download the Cygwin installer from [cygwin.com](https://www.cygwin.com) and install it. During package selection, make sure to include:

- `openssh` — the SSH server and client
- `cygrunsrv` — used to register Cygwin services as Windows services (will be included in standard installation)
- `bash`, `coreutils`, `grep`, `sed`, `awk`, `findutils` — standard Unix tools (often included in standard installation)
- `git` — useful for cloning repositories and working with source code

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2026/04/managing-windows-made-easy-with-cygwin-and-claude/2026-04-15-20-08-42.png)

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2026/04/managing-windows-made-easy-with-cygwin-and-claude/2026-04-15-20-14-53.png)

The default install path is `C:\cygwin64`.

### Step 2: Clone the Setup Scripts

The scripts are available on GitHub. Open a Cygwin terminal (not PowerShell yet) and clone the repo:

```bash
git clone https://github.com/e-tang/installcygwinsshd
cd installcygwinsshd
```

The repo contains two scripts:
- **`installsshd.ps1`** — installs and configures the Cygwin SSHD service
- **`verify.ps1`** — verifies the installation is working correctly

Basically, to install / enable the sshd service:
```bash
ssh-host-config --yes --cygwin 'ntsec' --name 'sshd' --port 22 --user 'cyg_server'
```

### Step 3: Run the Install Script

Open PowerShell **as Administrator** and run:

```powershell
cd C:\path\to\installcygwinsshd
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\installsshd.ps1
```

What the script does:
- Runs `ssh-host-config` inside Cygwin to generate host keys and create a `cyg_server` service account
- Sets the `CYGWIN=ntsec` environment variable (required for proper permissions)
- Opens port 22 in Windows Firewall
- Sets the `sshd` service to start automatically and starts it immediately

### Step 4: Verify the Setup

Still in the Administrator PowerShell, run:

```powershell
.\verify.ps1
```

### Step 4: Set Up SSH Key Authentication

From your Linux/Mac machine (or another machine running a smart agent: e.g. Claude Code), copy your SSH public key to the Windows machine so you don't need a password every time:

```bash
ssh-copy-id username@a-win-machine
```

You'll be prompted for the Windows user password once. After that, all SSH connections use your key. If `ssh-copy-id` isn't available, do it manually:

```bash
# On the client machine, copy your public key
cat ~/.ssh/id_ed25519.pub

# Then on the Windows machine (via password SSH), paste it into:
# C:\cygwin64\home\username\.ssh\authorized_keys
```

Also add the host to your known_hosts to avoid interactive prompts:

```bash
ssh-keyscan a-win-machine >> ~/.ssh/known_hosts
```

Once this is done, you can SSH in silently:

```bash
ssh a-win-machine "uname -a"
# CYGWIN_NT-10.0-19045 a-win-machine 3.6.7-1.x86_64 ...
```

That's it. **The hard part is over.** From this point on, you manage the machine through Claude Code — just by asking in plain English.

---

## Part 2: The Easy Part — Let Claude Do the Work

### Real Example: Removing Riot Games Completely

Here's a real session. I simply told Claude Code:

> *"I need you to remove / delete 'Riot Games' for me"*

Claude SSHed in, found the installation, confirmed before deleting, removed the directories, then I asked it to clean the registry too. Here's exactly what it did — autonomously:

**1. Locate the installation:**
```bash
ssh a-win-machine "find /cygdrive/c -maxdepth 2 -iname '*riot*' -type d 2>/dev/null"
# /cygdrive/c/ProgramData/Riot Games
# /cygdrive/c/Riot Games
# /cygdrive/c/Riot Games/Riot Client
```

**2. Check for running processes before deleting:**
```bash
ssh a-win-machine "tasklist.exe | grep -i riot"
# (nothing running — safe to proceed)
```

**3. Delete the directories:**
```bash
ssh a-win-machine "rm -rf '/cygdrive/c/Riot Games' '/cygdrive/c/ProgramData/Riot Games'"
```

**4. Search the registry for leftover keys:**
```bash
ssh a-win-machine "reg.exe query 'HKLM\\SOFTWARE' /f 'Riot' /k"
ssh a-win-machine "reg.exe query 'HKCU\\SOFTWARE' /f 'Riot' /k"
```

**5. When I mentioned "but it started when the computer starts"**, Claude found it immediately:
```bash
ssh a-win-machine "reg.exe query 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'"
# RiotClient  REG_SZ  C:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode
```

**6. Deleted the startup entry:**
```bash
ssh a-win-machine "reg.exe delete 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' /v RiotClient /f"
```

Total time: a few minutes of conversation. No GUI. No digging through Add/Remove Programs. No regedit hunting. Just asking.

---

## Part 3: What Else Can You Do?

Once Claude Code has SSH access to your Windows machine, the possibilities are broad. Here are examples of tasks you can just *ask* for:

### Software Management

```
"Install Python 3.12 silently"
"Check what version of Node.js is installed"
"Uninstall all Adobe products"
"List all installed programs and their versions"
```

Claude can use `winget`, `choco`, or direct installers:
```bash
ssh a-win-machine "winget.exe install Python.Python.3.12 --silent"
ssh a-win-machine "winget.exe list | grep -i node"
```

### Windows Services

```
"Stop and disable the Windows Search indexing service — it's slowing down the disk"
"Restart the print spooler"
"Show me all services that are set to auto-start but are currently stopped"
```

```bash
ssh a-win-machine "sc.exe stop WSearch && sc.exe config WSearch start= disabled"
ssh a-win-machine "sc.exe query type= all state= all | grep -B1 'STOPPED' | grep 'SERVICE_NAME'"
```

### Startup and Scheduled Tasks

```
"Show me everything that runs at startup"
"Remove that suspicious MLWapp startup entry"
"Create a scheduled task to run a backup every night at 2am"
```

```bash
ssh a-win-machine "reg.exe query 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'"
ssh a-win-machine "schtasks.exe /create /tn 'NightlyBackup' /tr 'C:\\backup.bat' /sc daily /st 02:00"
```

### Disk and File Management

```
"Find the 20 largest files on C: drive"
"Delete all .tmp files in AppData"
"How much space is left on each drive?"
```

```bash
ssh a-win-machine "df -h /cygdrive/c /cygdrive/d"
ssh a-win-machine "find /cygdrive/c/Users/dev/AppData -name '*.tmp' -delete"
ssh a-win-machine "du -sh /cygdrive/c/* 2>/dev/null | sort -rh | head -20"
```

### Registry Management

```
"Disable Cortana telemetry in the registry"
"Find all registry keys pointing to a deleted program path"
"Back up the HKCU Software hive before I make changes"
```

```bash
ssh a-win-machine "reg.exe export HKCU\\SOFTWARE C:\\backup\\hkcu_software.reg"
ssh a-win-machine "reg.exe add 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search' /v AllowCortana /t REG_DWORD /d 0 /f"
```

### Network and Firewall

```
"Show me all open ports and what's listening on them"
"Block port 8080 in the firewall"
"What's my current IP address and DNS servers?"
```

```bash
ssh a-win-machine "netstat.exe -ano | grep LISTENING"
ssh a-win-machine "New-NetFirewallRule -DisplayName 'Block 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Block" 
ssh a-win-machine "ipconfig.exe /all"
```

### System Health and Monitoring

```
"What processes are using the most CPU right now?"
"How long has this machine been running?"
"Show me the last 20 error events from the System event log"
```

```bash
ssh a-win-machine "tasklist.exe /fo csv | sort -t',' -k5 -rn | head -10"
ssh a-win-machine "wmic.exe os get LastBootUpTime"
ssh a-win-machine "powershell.exe -Command \"Get-EventLog -LogName System -EntryType Error -Newest 20 | Format-List TimeGenerated,Message\""
```

### Windows Updates

```
"Check if there are pending Windows updates"
"Install all available updates and tell me when it's done"
```

```bash
ssh a-win-machine "powershell.exe -Command \"Get-WindowsUpdate\"" 
ssh a-win-machine "powershell.exe -Command \"Install-WindowsUpdate -AcceptAll -AutoReboot\""
```

---

## Why This Beats Browser-Based AI

<Table data={{
    headers: ["Capability", "Browser AI (Claude Cowork)", "Claude Code + Cygwin SSH"],
    rows: [
        ["Read files on your PC", "Yes", "Yes"],
        ["Delete files or programs", "Yes", "Yes"],
        ["Edit the registry", "No", "Yes"],
        ["Manage Windows services", "No", "Yes"],
        ["Run PowerShell commands", "No", "Yes"],
        ["Set up scheduled tasks", "No", "Yes"],
        ["Monitor processes", "No", "Yes"],
        ["Install software", "No", "Yes (via winget/choco)"],
        ["Fix startup items", "No", "Yes"],
        ["Works without GUI", "No", "Yes"],
    ],
}}
/>

The browser-based assistant can mostly *advise*. Claude Code with SSH access can *act*. The gap is enormous.

---

## Tips for Day-to-Day Use

**Give your Windows machine a stable local hostname.** Whether via your router's DHCP reservation or `C:\Windows\System32\drivers\etc\hosts` on the client, `ssh a-win-machine` is much nicer than an IP address `ssh 192.168.X.X`.

**Keep SSH keys, not passwords.** Run `ssh-copy-id` once. After that, Claude Code can SSH in without any credential prompts — fully automated.

**Cygwin gives you Unix tools on Windows.** `grep`, `find`, `awk`, `sed`, `curl` all work inside your SSH session. You're not limited to `cmd.exe` syntax. Mix PowerShell (`powershell.exe -Command "..."`) with Unix tools freely.

**Combine with Claude Code's file editing.** Claude Code can read and edit config files directly over SSH, not just run commands. Got a broken `sshd_config`? Claude can fix it in place.

**It's auditable.** Every command Claude runs goes through the SSH session you can see. Unlike opaque agent frameworks, you can watch exactly what's happening.

---

## Conclusion

The one-time setup — installing Cygwin, running two PowerShell scripts, copying your SSH key — unlocks something genuinely powerful: a Windows machine you can manage entirely through conversation.

No more digging through nested menus. No more manually hunting for registry keys. No more wondering which startup entry belongs to which program. You describe what you want, Claude figures out how to do it, and it's done.

Browser-based AI tools will tell you to "open regedit and navigate to...". Claude Code with SSH will just do it.


2b98dc65befd9b586cd6103472ab7a81c42cf32a8530ee698f7048c5066dd26a

A practical guide to setting up Cygwin SSHD on Windows and using Claude Code to manage it remotely — far beyond what browser-based AI assistants can do.

Stop fighting with Windows GUIs. With Cygwin, an SSH daemon, and Claude Code, you can manage any Windows machine from the command line — uninstalling software, cleaning the registry, killing startup entries — just by asking.

Managing Windows Made Easy with Cygwin and Claude


{/* banner prompt: Of course! Here are three creative and engaging prompts for a banner image, each with a different artistic direction but all reflecting the core theme of the blog post.

---

### Prompt 1: The Beacon in the Void

This prompt uses a dramatic, cinematic approach to visualize the problem and solution as a source of light in darkness.

**Prompt:**
```
A cinematic, photorealistic image of a vast, dark, digital abyss representing a system failure. In the center, a single computer monitor floats, its screen pitch black except for the faintly glowing, ominous text "Please Wait...". From the top right corner, a powerful, clean beam of light, symbolizing a Windows update, descends and strikes the monitor. Where the light hits, the black screen begins to dissolve, revealing a vibrant, fully-loaded Windows desktop underneath. The light is composed of tiny, flowing data particles and the iconic circular update arrows. Moody, dramatic lighting, deep shadows, and a strong contrast between the dark void and the bright, hopeful light. --ar 16:9
```
**Why it works:** This prompt creates a powerful metaphor. The "black screen" is an empty void, and the "Windows Update" is a literal beacon of hope and functionality, cutting through the darkness to restore the system. It's visually striking and tells the story of the blog post in a single image.

---

### Prompt 2: The Digital Locksmith

This prompt takes a more conceptual, cyberpunk-inspired approach, framing the problem as a lock and the solution as the key.

**Prompt:**
```
A sleek, futuristic digital art piece. An IT professional is seen from behind, facing a massive, impenetrable digital wall that glows with a faint grid pattern. The wall has a single line of text embedded in it: "Please Wait". In the professional's hand is a glowing, holographic key forged from the Windows logo and circuitry patterns. They are about to insert this "update key" into a barely visible keyhole on the wall, causing cracks of bright blue light to emanate from the insertion point, ready to shatter the barrier and reveal the bright, working remote desktop behind it. Cyberpunk aesthetic with neon blues, blacks, and whites. --ar 16:9
```
**Why it works:** This prompt personifies the solution. The update isn't just a process; it's the "key" that the IT professional uses to unlock the problem. It highlights the user's frustration (the impenetrable wall) and the simple, elegant power of the solution (the key).

---

### Prompt 3: The System Corruption and Repair

This prompt visualizes the issue from a high-tech, schematic point of view, perfect for a more technical audience.

**Prompt:**
```
A high-tech, holographic schematic of a computer's system architecture, rendered in glowing blue and green lines against a dark background. A critical section labeled "RDP Service" is shown as dark, corrupted, and glitching, with a red "Please Wait" error message flickering nearby. From a main system node labeled "Windows Update Core," a clean, flowing stream of pristine data particles travels along the circuits to the corrupted RDP section. As the data arrives, it purges the corruption, turning the dark, glitching lines back to a healthy, vibrant blue, fixing the error in real-time. Style of an advanced UI display, sharp focus, depth of field. --ar 16:9
```
**Why it works:** This prompt appeals directly to a technical understanding of the problem. It visualizes the "pending update" as a form of system corruption or inconsistency that the update process actively "repairs." It’s a clean, modern, and intelligent way to represent the blog post's main idea. */}

If you've ever tried to connect to a Windows machine via RDP only to be greeted by an endless black screen displaying "Please Wait," you know how frustrating this can be. The good news? It could be an easy fix.

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2026/02/rdp-please-wait-black-screen-a-simple-fix/please-wait.png)

In my case the target Windows machine has pending system updates that require installation or a restart to complete. Windows Update can interfere with the RDP service's ability to properly initialize the desktop environment, leaving users stranded at the "Please Wait" screen.

## The Simple Solution: Windows Updates

No matter how much we don't want to, but we have to: **update Windows**.

### Step-by-Step Fix

#### Option 1: Physical or Local Access

If you have physical access to the machine:

1. **Log in locally** to the Windows machine experiencing the RDP issue
2. **Check for Windows Updates**:
   - Press `Windows + I` to open Settings
   - Navigate to "Update & Security"
   - Click "Check for updates"
3. **Install all available updates**
4. **Restart the machine** when prompted
5. **Test RDP connection** after the restart completes

#### Option 2: Command Line Approach

If you have limited access but can run commands:

```shell
# Check for updates using PowerShell
Get-WindowsUpdate

# Install updates (requires PSWindowsUpdate module)
Install-WindowsUpdate -AcceptAll -AutoReboot

# Alternative: Use Windows Update command line
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
```

#### Option 3: Group Policy Method

For domain environments:

```shell
# Force Group Policy update
gpupdate /force

# Trigger Windows Update check
wuauclt /detectnow /updatenow
```

### Verification Steps

After applying updates and restarting:

1. **Test RDP connectivity**:
   ```shell
   # Test RDP port connectivity
   telnet target-machine-ip 3389
   ```

2. **Check RDP service status**:
   ```powershell
   # Verify Remote Desktop Services are running
   Get-Service -Name "TermService"
   Get-Service -Name "UmRdpService"
   ```

3. **Verify Windows Update status**:
   ```powershell
   # Check for pending updates
   Get-WindowsUpdate
   
   # Check update history
   Get-WUHistory | Select-Object Date, Title, Result
   ```



ecffff53591c09630c07f788ef84776284aa661e70b9677eb3926f6a94b51868

Struggling with RDP showing a black 'Please Wait' screen? Learn how pending Windows updates cause this issue and get the simple fix.

Fix RDP black screen with 'Please Wait' message by updating Windows - a simple solution that works.

RDP 'Please Wait' Black Screen? A Simple Fix

{/* banner prompt: Of course! Here are three creative and engaging prompts for a banner image, each with a different artistic direction, based on the provided blog post.

### Prompt 1: The Holographic Shield (Futuristic & Dynamic)

**Prompt:**
A futuristic, technology-themed image of a user interacting with a holographic interface. A large, semi-transparent security shield with a glowing yellow warning icon is blocking the view of a PDF document icon. The user's hand is adjusting a digital slider on the interface from a red "Blocked" zone to a green "Trusted" zone, causing the shield to dissolve into light particles and the document preview to become sharp and clear. The background is a dark, abstract network of data streams and server nodes. Cinematic lighting, sharp focus, cyberpunk aesthetic, 16:9 aspect ratio.

**Why it works:**
*   **Metaphorical:** The "shield" visually represents the Windows security feature, and "dissolving" it represents the fix.
*   **Action-Oriented:** It shows a user actively solving the problem, which is empowering and engaging.
*   **Technology-Themed:** The holographic UI, data streams, and cyberpunk aesthetic are modern and align perfectly with a tech blog.

---

### Prompt 2: The Digital Bridge (Conceptual & Clean)

**Prompt:**
A conceptual digital art piece depicting a solid, glowing green bridge of light being built to connect a user's modern desktop icon to a network server icon across a digital chasm. The remnants of a broken, glitching red bridge with a "Preview Blocked" warning sign are crumbling below. The style is minimalist and clean, with a dark blue background featuring subtle circuit board patterns. The focus is on the secure connection being established. Digital illustration, high-tech, problem and solution concept, 16:9 aspect ratio.

**Why it works:**
*   **Clear Storytelling:** It instantly communicates the core idea of the post: fixing a broken connection (preview) to a network resource.
*   **Symbolic:** The bridge is a powerful symbol for creating a "trusted" path, which is the main solution in the blog post (Trusted Sites).
*   **Visually Appealing:** The contrast between the broken red bridge and the solid green one creates a strong visual narrative of "before and after."

---

### Prompt 3: The Code & The Lock (Technical & Abstract)

**Prompt:**
A stylized, abstract image where a glowing digital lock, representing a blocked file, is at the center. Lines of code, inspired by the PowerShell commands in the article (e.g., `Set-ItemProperty`, `Unblock-File`), are flowing like streams of light from the left side of the frame towards the lock. As the code reaches the lock, it changes from red to a secure blue, and the keyhole begins to glow, symbolizing that the file is now accessible. The background is a dark, textured grid. Macro detail on the glowing code and lock mechanism, tech-noir aesthetic, 16:9 aspect ratio.

**Why it works:**
*   **Reflects the Content:** This prompt directly visualizes the technical solutions (PowerShell scripts and registry edits) mentioned in the blog post.
*   **Engages a Technical Audience:** The "code as a key" metaphor will resonate with IT professionals and power users who are the target audience.
*   **Intriguing and Modern:** The abstract, macro-focused style is visually sophisticated and creates a sense of unlocking a complex problem. */}

If you've recently updated Windows and suddenly can't preview PDF files in File Explorer, you're not alone. The frustrating message `The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents` has been plaguing users across various Windows versions, particularly affecting files stored on network drives or downloaded from the internet.

{/* ![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/could-harm.jpg) */}

This comprehensive guide will walk you through multiple solutions to restore your file preview functionality while maintaining system security.

## Understanding the Root Cause

The preview blocking issue stems from Microsoft's enhanced security measures implemented in recent Windows updates. The operating system now treats files from "unknown" or "untrusted" sources with increased caution, which includes:

- Documents downloaded from the internet or that haven't been explicitly marked as safe
- Files stored on network drives and shared folders

While this enhanced security is well-intentioned, it significantly impacts productivity for users who regularly work with files from network shares or legitimate internet sources.

## Common Scenarios Where This Error Occurs

### Downloaded Files

Files downloaded from the internet often carry a "Mark of the Web" (MotW) attribute that triggers Windows' security mechanisms, preventing preview functionality even for legitimate documents.

For example, downloading a PDF from a website may result in the preview error:

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/could-harm.jpg)

Because Windows flags the file as potentially unsafe, the preview pane is disabled.

So in order to preview the file, we need to ask the operating system to unblock it. After unblocking the file, the preview works as expected:

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/unblocked.jpg)

#### Detailed Steps to Unblock Downloaded Files

For files downloaded from the internet, Windows applies a security attribute that can be removed manually.

##### Manual Unblocking Process

1. **Right-click** the problematic file
2. Select **Properties** from the context menu
3. In the **General** tab, look for the **Security** section at the bottom
4. Check the **Unblock** checkbox if present
   ![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/need-unblocking.png)
5. Click **OK** to apply changes

##### Bulk Unblocking with PowerShell

No way we need to manually unblock each file one by one. You can use PowerShell to automate this process.

To unblock multiple files simultaneously:

```powershell
# Unblock all files in a specific directory
Get-ChildItem "C:\Downloads\*.pdf" | Unblock-File

# Unblock files recursively in subdirectories
Get-ChildItem "C:\Downloads" -Recurse | Unblock-File

# Unblock specific file types
Get-ChildItem "C:\Downloads" -Recurse -Include "*.pdf", "*.docx", "*.xlsx" | Unblock-File
```

##### Group Policy for Files Unblocking

Still too much trouble to run the script every time? You can configure Group Policy to unblock files forever.

Group Policy Editor is only available in Windows Pro, Enterprise, and Education editions.

To configure Group Policy for file unblocking:

1. Press `Windows + R`, type `gpedit.msc`, and press Enter.
2. Navigate to **User Configuration** > **Administrative Templates** > **Windows Components** > **Attachment Manager**.
3. Locate the policy named **"Do not preserve zone information in file attachments"**.
4. Set this policy to **Enabled**.

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/gpedit.jpg)

For those using Windows Home edition, you can achieve the same effect by modifying the registry:

```
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments]
"SaveZoneInformation"=dword:00000001
```

If that still doesn't work, you can try the following PowerShell (Run As Administrator) script:

```powershell
# ===========================================
# Enable "Do not preserve zone information in file attachments"
# ===========================================

# Requires running as Administrator
if (-not ([bool](net session 2>$null))) {
    Write-Host "❌ Please run this script as Administrator!" -ForegroundColor Red
    exit
}

# Registry path for Attachment Manager policy
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments"

# Ensure key exists
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

# Set "SaveZoneInformation" to 1 (Do not preserve)
# Value meanings:
# 1 = Do not preserve zone information (Enabled)
# 2 = Preserve zone information (Disabled)
Set-ItemProperty -Path $regPath -Name "SaveZoneInformation" -Value 1 -Type DWord -Force

Write-Host "✅ 'Do not preserve zone information in file attachments' is now ENABLED (zone info will NOT be preserved)."
```

### Network Drive Files

This scenario is especially common in professional or corporate environments, where teams often organize their daily workflows around shared network drives. These shared folders serve as central repositories for documents, project files, and resources, allowing multiple employees to access, collaborate, and update information in real time.

However, the changes from above on your Windows may not be enough for you to prevent this issue for files stored on network drives. This is because Windows classifies network locations differently in its security zones.

The most common scenario involves accessing PDF files stored on:
- Company file servers (`//fileserver`, `//dataserver`)
- IP-based network shares (`//10.0.0.3`, `//192.168.1.100`)

## Solution: Add Network Locations to Trusted Sites

This is the most effective solution for network drive files and addresses the core security zone configuration issue.

### Step-by-Step Process

1. **Open Internet Options**
   - Press `Windows + R` to open the Run dialog
   - Type `inetcpl.cpl` and press Enter
   - Alternatively, search for "Internet Options" in the Start menu

2. **Access Security Settings**
   - Navigate to the **Security** tab
   - Select **Trusted sites** from the zone list
   - Click the **Sites** button

3. **Configure Trusted Sites**
   - **Important**: First, uncheck "Require server verification (https:) for all sites in this zone"
   - Add your network locations using these formats:

```
file:\\fileserver
file:\\dataserver  
file:\\10.0.0.3
file:\\192.168.1.100
```

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/fix-the-could-harm-your-computer-file-preview-error/trusted-sites.jpg)

4. **Apply Changes**
   - Click **Add** for each network location
   - Click **Close** and then **OK** to save changes
   - Restart File Explorer or reboot your computer

### PowerShell Automation Script

Aternatively, for IT administrators managing multiple machines, here's a PowerShell script to automate the trusted sites configuration (for the current logged-in user):

```powershell
# ===========================================
# Add multiple network paths to Trusted Sites zone (Zone 2)
# and disable "Require server verification (https:)" checkbox
# ===========================================

# List of network paths
$sharedPaths = @(
    "file:\\fileserver",
    "file:\\dataserver", 
    "file:\\10.0.0.3"
)

# --------------------------
# Disable "Require server verification (https:)"
# --------------------------
$zoneKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\$zone"
$flagsValue = (Get-ItemProperty -Path $zoneKey -Name "Flags" -ErrorAction SilentlyContinue).Flags

if ($null -eq $flagsValue) { $flagsValue = 0 }

# Bit 0 (0x1) = Require server verification (https:)
# Clear this bit
$newFlags = $flagsValue -band (-bnot 0x1)
Set-ItemProperty -Path $zoneKey -Name "Flags" -Value $newFlags -Force

Write-Host "`n🔓 Disabled 'Require server verification (https:)' for $zoneName zone."

# Trusted Sites zone number
$zone = 2
$zoneName = "Trusted Sites"

# Registry base path
$regBase = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"

foreach ($path in $sharedPaths) {
    # Extract domain or hostname
    if ($path -match "\\\\([\w\.-]+)") {
        $domain = $matches[1]
    } elseif ($path -match "file://([\w\.-]+)") {
        $domain = $matches[1]
    } else {
        Write-Host "⚠️ Skipped invalid path format: $path" -ForegroundColor Yellow
        continue
    }

    # Create registry key for the domain
    $domainKey = Join-Path $regBase $domain
    if (-not (Test-Path $domainKey)) {
        New-Item -Path $domainKey -Force | Out-Null
    }

    # Assign zone 2 (Trusted Sites)
    New-ItemProperty -Path $domainKey -Name "*" -Value $zone -PropertyType DWord -Force | Out-Null

    Write-Host "✅ Added $domain to $zoneName zone."
}

Write-Host "🎯 Completed successfully!"
```

For All Users:
```powershell
# ===========================================
# Add multiple network paths to Trusted Sites zone (Zone 2) for all users
# and disable "Require server verification (https:)" checkbox
# ===========================================

# Requires running as Administrator
if (-not ([bool](net session 2>$null))) {
    Write-Host "❌ Please run this script as Administrator!" -ForegroundColor Red
    exit
}

# List of network paths
$sharedPaths = @(
    "file:\\fileserver",
    "file:\\dataserver", 
    "file:\\10.0.0.3"
)

# Trusted Sites zone number
$zone = 2
$zoneName = "Trusted Sites"

# Registry base path for all users (HKLM)
$regBase = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"

foreach ($path in $sharedPaths) {
    # Extract domain or hostname
    if ($path -match "\\\\([\w\.-]+)") {
        $domain = $matches[1]
    } elseif ($path -match "file://([\w\.-]+)") {
        $domain = $matches[1]
    } else {
        Write-Host "⚠️ Skipped invalid path format: $path" -ForegroundColor Yellow
        continue
    }

    # Create registry key for the domain
    $domainKey = Join-Path $regBase $domain
    if (-not (Test-Path $domainKey)) {
        New-Item -Path $domainKey -Force | Out-Null
    }

    # Assign zone 2 (Trusted Sites)
    New-ItemProperty -Path $domainKey -Name "*" -Value $zone -PropertyType DWord -Force | Out-Null

    Write-Host "✅ Added $domain to $zoneName zone for all users."
}

# --------------------------
# Disable "Require server verification (https:)"
# --------------------------
$zoneKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\$zone"
$flagsValue = (Get-ItemProperty -Path $zoneKey -Name "Flags" -ErrorAction SilentlyContinue).Flags

if ($null -eq $flagsValue) { $flagsValue = 0 }

# Bit 0 (0x1) = Require server verification (https:)
# Clear this bit
$newFlags = $flagsValue -band (-bnot 0x1)
Set-ItemProperty -Path $zoneKey -Name "Flags" -Value $newFlags -Force

Write-Host "`n🔓 Disabled 'Require server verification (https:)' for $zoneName zone (all users)."
Write-Host "🎯 Completed successfully!"
```

### What Can We Do if None of Above Works?

Alright, let's explore alternative PDF handlers, because maybe you have some PDF viewer issues.

### Microsoft Edge as PDF Handler

1. Right-click any PDF file
2. Select **Open with** > **Choose another app**
3. Select **Microsoft Edge**
4. Check **Always use this app to open .pdf files**
5. Test file preview functionality

### Adobe Acrobat Reader Configuration

If you prefer Adobe Acrobat Reader:

1. Open Adobe Acrobat Reader
2. Go to **Edit** > **Preferences**
3. Select **General** from the left panel
4. Check **Enable PDF thumbnail previews in Windows Explorer**
5. Restart File Explorer

### Registry Modifications

**Warning**: Always backup your registry before making changes.

To reset preview handlers:

```
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PreviewHandlers]
```

Delete problematic preview handler entries and restart the system.


## Final Thoughts

The "could harm your computer" preview error, while frustrating, reflects Microsoft's commitment to system security. The solutions outlined above provide multiple approaches to restore preview functionality while maintaining appropriate security levels.

For most users working with network drives, adding trusted sites is the most effective long-term solution. Downloaded files can be handled through the unblock process, either manually or via PowerShell scripts.

Remember that these configurations balance convenience with security. Always ensure you trust the sources and files you're working with, and consider implementing additional security measures in enterprise environments.

By following this guide, you should be able to restore PDF preview functionality in Windows File Explorer while maintaining awareness of the security implications involved.

a31a05a3b57b8f94396f6b553bdf0caa22415380b5c36b8afc28035eb8e861ee

Complete guide to fixing the 'could harm your computer' preview error in Windows File Explorer for PDFs from network drives and internet sources.

Resolve Windows File Explorer preview errors for PDF files from network shares and internet downloads.

Fix the 'Could Harm Your Computer' File Preview Error

{/* banner prompt: Here is a creative and engaging prompt for a banner image, based on the provided blog post:

---

A symbolic digital art masterpiece in a sleek, futuristic style. In the center, a translucent glass cube, faintly etched with the Windows logo, struggles to contain a luminous, powerful core of energy shaped like a stylized Linux penguin. From this core, brilliant, intricate pipelines of light representing powerful command-line tools (`grep`, `sed`, `ssh`) burst outwards, flowing cleanly and efficiently towards glowing server and cloud icons in the background. A subtle, shimmering neural network pattern overlays the pipelines, symbolizing AI effortlessly orchestrating this powerful workflow. The overall mood is one of breaking free, showcasing undeniable power and efficiency that cannot be contained. --ar 16:9

Additional instructions: try to make it like a battle between Linux warrior and Windows warrior

Additional instructions: Dont try to Linux looks like a villain and Windows an ironman, try to make them look neutral */}

{/* > A dynamic digital art scene of a developer collaborating with a luminous AI entity. On a holographic interface floating between them, tangled, broken lines of red code representing bugs are being methodically repaired and woven into clean, flowing green code by the AI's energy. In the background, abstract cloud and DNS icons glow softly, symbolizing the Cloudflare API being fixed. The overall mood is one of breakthrough and efficiency, with a sleek, futuristic aesthetic. --ar 16:9 */}

I recently came across an article on MakeUseOf titled "[I Ditched Linux for Windows, and You Might Want To](https://www.makeuseof.com/ditched-linux-for-windows-you-might-want/)" and I have to say, as a software developer, I found the reasoning deeply flawed and indicative of a fundamental misunderstanding of both Linux capabilities and proper development workflows. The article discusses development tools and workflows, so I'm addressing it from a developer's perspective. Let me address the claims one by one.


## The "Dual Boot Pain" Fallacy

The author's primary complaint revolves around needing to dual-boot to use Photoshop and Illustrator. Here's the thing: **this problem was solved over a decade ago with virtualization**.

### The VirtualBox Solution Nobody Mentioned

The article completely ignores the existence of **seamless mode** in VirtualBox (and similar features in VMware). When you run Windows in seamless mode:

- Windows applications appear as native applications on your Linux desktop
- There's no "switching between systems" - Windows apps run alongside Linux apps
- You get the **exact Windows experience** for those applications
- No rebooting required, ever

For someone discussing development workflows, not knowing about seamless mode is a significant oversight. It's been a standard feature since VirtualBox 1.5 (released in 2007).

```bash
# Start VirtualBox in seamless mode
VBoxManage controlvm "Windows10" setvideomodehint 1920 1080 32
VBoxManage startvm "Windows10" --type seamless
```

Before we go any further, just to be clear that I want you to know that this is not a battle between a "good" operating system and a "bad" one. This is about personal preference, software availability, and work requirements.

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/11/why-that-i-ditched-linux-for-windows-article-misses-the-point-entirely/banner3.png)

### The Real Question: Why Run Photoshop at All?

But let's address the elephant in the room: if you're focused on **software development**, why are you using Photoshop and Illustrator so frequently that it's your primary concern? These are design tools, not development tools.

For the occasional image editing that developers actually need:
- **GIMP** handles 95% of what developers need from Photoshop
- **Inkscape** is more than capable for vector graphics
- **Krita** is excellent for digital painting

If you're doing so much design work that you need Adobe's suite daily, you're probably a designer, not primarily a developer. And if Adobe Creative Suite is truly mission-critical for your workflow, perhaps you should just use a Mac instead of complaining about Linux not supporting proprietary software that even Windows users have to pay for.

## The WSL2 Misunderstanding

The author praises WSL2 as if it's some revolutionary feature. Let me be blunt: **WSL2 is Microsoft admitting that Linux is better for development**.

### What WSL2 Actually Is

WSL2 is literally running a Linux kernel in a virtual machine. You're running Linux on Windows, with all the overhead and limitations that entails. The author is essentially saying:

> "I switched from Linux to Windows so I could run Linux inside Windows."

The irony is palpable.

### The Performance Reality

While exact numbers vary by hardware and workload, WSL2's architecture introduces measurable overhead. The virtualization layer and file system translation (especially when accessing Windows files from WSL2) can significantly impact I/O performance. Multiple benchmarks have shown:

- Native Linux typically performs best for disk I/O
- WSL2 has notable overhead, particularly for cross-filesystem operations
- The performance gap is most apparent in I/O-heavy tasks like building large projects

You're taking a **performance hit** to run Linux tools through an abstraction layer. Why not just... run Linux natively?

## Missing the Point: Linux's True Power

Here's what really bothers me about this article: while discussing development workflows, it completely misses what makes Linux powerful for development.

### The Command-Line Pipeline Philosophy

Linux (and Unix-like systems including macOS) shine because of their philosophy of small, composable tools. Let me give you real examples:

#### Example 1: Log Analysis

```bash
# Find all failed login attempts from the last hour
grep "Failed password" /var/log/auth.log | \
  grep "$(date -d '1 hour ago' '+%b %d %H')" | \
  awk '{print $11}' | \
  sort | uniq -c | sort -nr

# On Windows? Good luck with that.
# "But what about Cygwin?" - Sure, you could use Cygwin...
# but that's just Unix-ism on Windows. At that point, why not just use Unix?
```

#### Example 2: Text Processing Pipeline

```bash
# Extract all email addresses from files, deduplicate, and sort
find . -type f -name "*.txt" | \
  xargs grep -oE '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b' | \
  tr '[:upper:]' '[:lower:]' | \
  sort -u > emails.txt
```

Try doing that elegantly in PowerShell. I'll wait.

#### Example 3: Remote Server Management

```bash
# SSH into a server and check disk usage on all mounted drives
ssh user@server 'df -h | grep "^/dev" | awk "{print \$5, \$6}"' | \
  sed 's/%//' | \
  awk '$1 > 80 {print "WARNING: "$2" is at "$1"%"}'

# Instant insight across your infrastructure
```

### The Grep, Sed, Tr Trinity

These tools form the backbone of Unix text processing:

**grep** - Pattern matching
```bash
# Find all TODO comments in your codebase with context
grep -rn "TODO" --include="*.js" --include="*.py" -A 2 -B 1
```

**sed** - Stream editing
```bash
# Replace API URLs in all config files
find . -name "*.config" -exec sed -i 's/http:/https:/g' {} \;
```

**tr** - Character transformation
```bash
# Convert Windows line endings to Unix
cat windows_file.txt | tr -d '\r' > unix_file.txt
```

### SSH: The Developer's Superpower

The article doesn't even mention SSH, which tells you everything about the author's workflow. Real developers live in SSH:

```bash
# Copy your SSH key to a remote server
ssh-copy-id user@server

# Run a command on multiple servers simultaneously
for server in web{1..5}.example.com; do
  ssh $server "systemctl status nginx" &
done
wait

# Tunnel database access through SSH
ssh -L 3306:localhost:3306 db-server

# Mount remote filesystem locally
sshfs user@server:/var/www /mnt/remote
```

Can you do this on Windows? Sure, with WSL2... which is Linux. See the circular logic?

### Not a Fan of Command Lines? AI Can Be Your Savior

Now, I can hear some of you thinking: "All these command-line tools—`grep`, `sed`, `awk`, `tr`, `lsof`, `ip addr`, `ssh`, `cfcli`—they're overwhelming! Maybe that's why I don't like Linux?"

Here's the game-changer the original article completely missed: **You don't need to master these tools anymore. AI can do it for you.**

And here's something even better: **the command line is where AI development tools thrive**. Tools like Claude Code, Codex, Gemini, GitHub Copilot CLI, and other AI-powered development assistants work best in terminal environments where they can interact with your entire development pipeline. These AI agents understand the Unix philosophy—they can analyze your codebase, suggest command pipelines, automate repetitive tasks, and integrate seamlessly with git, ssh, and build tools. On Windows? You're back to WSL2 (running Linux) to get the full power of these tools. The irony continues.

#### Real Example: DNS Management Made Trivial

Recently, I needed to update DNS records for a domain. I [had multiple A, AAAA, and CNAME records to add](/blog/2025/10/04-empowering-open-source-development-with-ai-my-experience-fixing-cfcli/). Instead of clicking through a web dashboard for 15+ minutes, I simply told Claude Code:

> "For my domain example.com with command `cfcli`, please update them with: A 216.239.32.21, A 216.239.34.21, A 216.239.36.21, A 216.239.38.21, AAAA 2001:4860:4802:32::15..."

Claude Code automatically:
1. Understood my natural language request
2. Constructed the proper commands
3. Executed them in sequence
4. Verified the results

**Total time: 10 seconds**. No need to know the syntax of `cfcli`, no need to write bash loops, no need to remember command flags.

#### The Copy-Paste Revolution

Even better—you don't need to know traditional Unix tools anymore. Just copy-paste your data, describe what you want in plain English, and AI figures out the pipeline:

- **Want to extract email addresses from a CSV?** Just paste it and say "extract all emails"
- **Need to transform log formats?** Copy, paste, describe the output format you want
- **Want to find all TODO comments in your codebase?** Just ask

The AI constructs the `grep | sed | tr | awk` pipeline you would have spent 30 minutes googling how to write. It picks the right tool for the job—whether that's `sed`, `awk`, `jq`, `cut`, or a combination of all of them.

This is the future of command-line work: **you provide the intent, AI provides the execution**. And it only works seamlessly on Unix-like systems where these composable tools exist.

## The UI Argument: A Red Herring

Some users claim Linux's UI isn't "appealing." Let's be honest:

1. **Modern Linux DEs are gorgeous**: GNOME 40+, KDE Plasma 5, and Elementary OS rival macOS in aesthetics
2. **Customization is unmatched**: Don't like something? Change it. Can't do that on Windows or macOS.
3. **For developers, the terminal is the UI**: A beautiful terminal is more important than window decorations

```bash
# My terminal setup: Alacritty + Zsh + Starship
# Renders in <10ms, supports true color, GPU-accelerated
# Windows Terminal? Still playing catch-up.
```

## The Shared Core Truth

It's worth noting that macOS shares Unix's core with Linux. This is absolutely correct, and it's **why macOS is popular with developers**. But here's the kicker:

- macOS: Unix-like + expensive hardware + locked ecosystem
- Linux: Unix-like + any hardware + open ecosystem
- Windows: Neither Unix-like + requires WSL to pretend + middle ground on cost

If you acknowledge that Unix-like systems are better (by praising macOS), why go to Windows and run Linux in a VM (WSL2) instead of just... using Linux?

## The Real Issues (That Weren't Mentioned)

Look, Linux isn't perfect. Here are the **actual** challenges:

### 1. Hardware Compatibility
Some cutting-edge hardware lacks Linux drivers. **This is a real issue**.

### 2. Proprietary Software
Adobe's refusal to support Linux is frustrating. But this is Adobe's choice, not Linux's fault.

### 3. Gaming Anti-Cheat
Kernel-level anti-cheat is problematic on Linux. **This is a legitimate concern for gamers**.

### 4. Corporate Software
If your company mandates specific Windows-only tools, you might be stuck. **This is real**.

But notice what's missing from this list? "Dual-booting is hard" and "I can't figure out VirtualBox's seamless mode."

## The Conclusion

The original article reads like someone who:

1. Never explored virtualization options beyond basic dual-booting
2. Doesn't understand the Unix philosophy of composable tools
3. Hasn't leveraged SSH and remote workflows
4. Is more focused on design work than development
5. Lacks deep Linux knowledge despite discussing development workflows

### When You Should Use Windows

To be fair, use Windows if:
- You're a gamer and need anti-cheat support
- Your job requires Windows-specific corporate software
- You're heavily invested in the Microsoft ecosystem
- You genuinely prefer it after trying alternatives

But don't claim it's because Linux can't run Photoshop when seamless virtualization has existed for 15+ years.

### The Developer's Choice

As a software developer, your OS should be chosen for:

1. **Development efficiency**: Command-line tools, package managers, SSH workflows
2. **Production parity**: If your servers run Linux (they do), develop on Linux
3. **Resource efficiency**: Native performance beats virtualized environments
4. **Customizability**: Ability to configure every aspect of your workflow

Linux wins on all four counts.

## Final Thoughts

The MakeUseOf article is a textbook example of someone making technology choices based on incomplete information and then justifying it post-hoc. That's fine for personal use, but presenting it as advice for other developers does a disservice to people trying to make informed decisions.

If you want to use Windows, use Windows. But don't pretend it's the superior choice for software development when you're literally running Linux inside it (WSL2) to get actual work done.

```bash
# The best OS for development?
echo "The one where you're most productive."

# But if you find yourself running Linux inside Windows to be productive...
# Maybe you should just run Linux?
```

**Update**: For those wondering, I write this article on Linux, deploy to servers running Linux, and when I need Windows for testing, I run it in... you guessed it, a seamless VirtualBox VM. It works beautifully.

<ContactFooter />

---

*What's your take? Are you a developer using Windows natively, or do you rely on WSL? Let me know in the comments below.*

1202f2dac997c68863289859e315fd9635f988d804a9c2060c561c782b1b2160

A detailed rebuttal to the MakeUseOf article about switching from Linux to Windows, explaining why the author's reasoning reveals fundamental misunderstandings about Linux capabilities

A software developer's response to common misconceptions about Linux, addressing claims about dual-booting, virtual machines, and the real power of Unix-like systems

Why That 'I Ditched Linux for Windows' Article Misses the Point Entirely


I run a custom trading gateway on a Windows 10 machine, primarily because it needs to interface with MetaTrader 5. I rely on MetaTrader to access market data and place orders for specific symbols and exchanges, like the ASX, that aren't available through my other tools. This setup is usually reliable, with the gateway using an SMB-based shared drive for data storage. However, that stability broke after I upgraded the machine to Windows 11, a necessary move with Windows 10 support ending. The first challenge I hit was the gateway losing access to its SMB share, which means I could no longer save the market data to the shared drive where my other pieces of trading software read the data from.

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/10/fix-cannot-connect-to-smb-share-on-windows-11/windows-no-access.jpg)

After some investigation, I found that Windows 11 had tightened its security around SMB guest authentication, which was causing the connection issues. The data server hosting the SMB share only supported guest access without authentication, and with the new security measures in place, Windows 11 was blocking the connection.

## Quick sanity checks

Before diving into configuration changes, I ran through a checklist to rule out common issues:

- Verified the NAS was still reachable by IP using `ping` and `Test-NetConnection`.
- Confirmed other machines on the LAN could mount the share, isolating the failure to the trading PC.
- Cleared cached credentials with `cmdkey /list` and `net use * /delete`.
- Rebooted after installing the latest cumulative Windows updates in case a patch hardened SMB defaults.


> ⚠️ **Security note:** Insecure guest logons remove authentication from SMB connections. Only use this on a machine you control, on a trusted network, and keep it firewalled from the public internet. Disable the setting again once you retire legacy storage.

## The fix: allow guest logons again

A simple way to allow guest logons again is to enable the "insecure guest logons" setting via Group Policy as follows.

1. **Enable Insecure Guest Logins via Group Policy:**

   - Press **Win + R**, type `gpedit.msc`, and press Enter to open the Group Policy Editor.
   - Navigate to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation**.
   - Double-click **Enable insecure guest logons** and set it to **Enabled**.
   - Apply the changes and restart your computer.

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/2025/10/fix-cannot-connect-to-smb-share-on-windows-11/gpedit.png)

However, if you are using Windows 11 Home, you will need to use the Registry Editor method, as Group Policy Editor is not available.

2. **Enable Insecure Guest Logins via Registry Editor:**

   - Press **Win + R**, type `regedit`, and press Enter to open the Registry Editor.
   - Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters`.
   - If the `AllowInsecureGuestAuth` entry does not exist, right-click and select **New** > **DWORD (32-bit) Value**, and name it `AllowInsecureGuestAuth`.
   - Set the value of `AllowInsecureGuestAuth` to `1`.
   - Close the Registry Editor and restart your computer.


After making the group policy change, you may still not be able to connect to the SMB share. The difference is that you probably don't have to wait for a few minutes for that error to come up. If you try to connect to the SMB share via `net use`, you may see an error like this:

```
C:\> net use Z: \\data-server\share
System error 3227320323 has occurred.
```

Try running the following command via PowerShell:

```powershell
Set-SmbClientConfiguration -RequireSecuritySignature $false
```

The above command is a PowerShell cmdlet that controls the SMB client "RequireSecuritySignature" setting. Running it sets whether the SMB client requires SMB packet signing for connections (our instance sets `RequireSecuritySignature` to `$false`). The `error 3227320323` indicates that the SMB client is requiring security signatures, but the server does not support it. So when set to true (the default), connections to servers that do not support signing will fail.

Restart your computer after running the command. After that, you should be able to connect to the SMB share again.

## Conclusion

After upgrading to Windows 11, I encountered SMB share connectivity issues due to Windows 11's stricter security policies around guest authentication. By enabling insecure guest logons through Group Policy (or the Registry Editor for Windows 11 Home) and disabling the security signature requirement with PowerShell, I was able to restore access to my legacy SMB share. This allowed my MetaTrader 5 gateway to resume saving market data to the shared drive.

Remember that these changes reduce security, so only apply them on trusted networks and on machines you control. Keep your firewall enabled and consider upgrading your storage solution to support modern authentication methods when possible.

2bcf2f01dea26dfa4c1a354137a47432623e072b57ca54cdc6a9cdb041fb777d

Troubleshooting checklist and final registry and group policy changes to let a MetaTrader 5 gateway reconnect to a legacy SMB share on Windows 11.

Steps I used to restore MetaTrader 5 access to an SMB share after Windows 11 hardened guest authentication.

Fix: Cannot Connect to SMB Share on Windows 11


# Fixing incorrect username or password when mapping shared drive on Windows

Recently my client had an issue mapping a shared drive on Windows. The error message was "Incorrect username or password". And the username and password were definitely correct. All computers using Windows 10 or 11 had this error.

The user login dialog:

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/incorrect-passwords/2024-05-13-13-00-29.png)

After entering the correct username and password, the error message would pop up:


![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/incorrect-passwords/2024-05-13-13-00-56.png)


Even after I ran the command in the command prompt:

```bash
net use h: \\demoserver\data /user:demouser RRWfsddr2r2
```

The error message was still the same:

```bash
System error 86 has occurred.

The specified network password is not correct.
```

![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/incorrect-passwords/2024-05-13-12-43-12.png)

The client uses a Synology NAS as the file server. The NAS has a shared folder that is accessible by all users. The shared folder is set up with a username and password. The client has been using this setup for years without any issues. The issue started happening only very recently and could be from after a Windows update.

There had been some dicussions on the internet about this issue. Some suggested to change the group policy settings, such as:

```
Run> Secpol.msc

Set Local Policies > Security Options > Network Security: LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'
```
This method may work for some people but didn't work for me even I changed the setting to others such as 'Send LM & NTLM - use NTLMv2 session security if negotiated'.

Basically none of the solutions on the internet worked for me. 

And it turned out the Synology NAS has a "Protection" setting with an option of "Auto block". This option is to block the IP address if there are too many failed login attempts. The client had tried to map the shared drive with the wrong password too many times. The IP address was blocked by the NAS.


![](https://storage.googleapis.com/www-tyolab-com-blog-assets/images/blog/incorrect-passwords/2024-05-13-13-48-24.png)

After disable the "Auto block" option, the issue was resolved. The client was able to map the shared drive without any issues. As the client has other security measures in place, the "Auto block" option was not necessary.


## Credits
Photo by <a href="https://unsplash.com/@johnyvino?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash">Johnyvino</a> on <a href="https://unsplash.com/photos/flat-screen-computer-monitor-turned-on-R54V69BN0MI?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash">Unsplash</a>
  

2cc9e323734f1ff53cf16f1aef65d9fa165b949778c90ee56f393edc467bed19

Many may encounter the incorrect username or password error when mapping shared drive on Windows but sometimes it is because of the Synology NAS 'Auto block' setting. Here is how to fix it.

Fixing incorrect username or password when mapping shared drive on Windows because of the Synology NAS 'Auto block' setting

Tag: Windows