Category Archives: Win10

microsoft, sysadmin, Win10, Windows

Sysinternals Utilities – Windows Sysinternals | Microsoft Docs

Sysinternals Utilities Index

Sysinternals Suite
The entire set of Sysinternals Utilities rolled up into a single download.

Sysinternals Suite for Nano Server
Sysinternals Utilities for Nano Server in a single download.

Sysinternals Suite for ARM64
Sysinternals Utilities for ARM64 in a single download.

AccessChk
v6.20 (November 19, 2017)
AccessChk is a command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more.

AccessEnum
v1.32 (November 1, 2006)
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.

AdExplorer
v1.44 (November 15, 2012)
Active Directory Explorer is an advanced Active Directory (AD) viewer and editor.

AdInsight
v1.2 (October 26, 2015)
An LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.

AdRestore
v1.1 (November 1, 2006)
Undelete Server 2003 Active Directory objects.

Autologon
v3.10 (August 29, 2016)
Bypass password screen during logon.

Autoruns
v13.98 (June 24, 2020)
See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.

BgInfo
v4.26 (October 19, 2018)
This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.

BlueScreen
v3.2 (November 1, 2006)
This screen saver not only accurately simulates Blue Screens, but simulated reboots as well (complete with CHKDSK), and works on Windows NT 4, Windows 2000, Windows XP, Server 2003 and Windows 95 and 98.

CacheSet
v1.0 (November 1, 2006)
CacheSet is a program that allows you to control the Cache Manager’s working set size using functions provided by NT. It’s compatible with all versions of NT.

ClockRes
v2.1 (July 4, 2016)
View the resolution of the system clock, which is also the maximum timer resolution.

Contig
v1.8 (July 4, 2016)
Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.

Coreinfo
v3.31 (August 18, 2014)
Coreinfo is a new command-line utility that shows you the mapping between logical processors and the physical processor, NUMA node, and socket on which they reside, as well as the cache’s assigned to each logical processor.

Ctrl2cap
v2.0 (November 1, 2006)
This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even “sees” them. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.

DebugView
v4.90 (April 23, 2019)
Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.

Desktops
v2.0 (October 17, 2012)
This new utility enables you to create up to four virtual desktops and to use a tray interface or hotkeys to preview what’s on each desktop and easily switch between them.

Disk2vhd
v2.01 (January 21, 2014)
Disk2vhd simplifies the migration of physical systems into virtual machines (p2v.md).

DiskExt
v1.2 (July 4, 2016)
Display volume disk-mappings.

Diskmon
v2.01 (November 1, 2006)
This utility captures all hard disk activity or acts like a software disk activity light in your system tray.

DiskView
v2.4 (March 25, 2010.md)
Graphical disk sector utility.

Disk Usage (DU.md)
v1.61 (February 13, 2018)
View disk usage by directory.

EFSDump
v1.02 (November 1, 2006)
View information for encrypted files.

FindLinks
v1.1 (July 4, 2016)
FindLinks reports the file index and any hard links (alternate file paths on the same volume.md) that exist for the specified file.  A file’s data remains allocated so long as at it has at least one file name referencing it.

Handle
v4.22 (June 14, 2019)
This handy command-line utility will show you what files are open by which processes, and much more.

Hex2dec
v1.1 (July 4, 2016)
Convert hex numbers to decimal and vice versa.

Junction
v1.07 (July 4, 2016)
Create Win2K NTFS symbolic links.

LDMDump
v1.02 (November 1, 2006)
Dump the contents of the Logical Disk Manager’s on-disk database, which describes the partitioning of Windows 2000 Dynamic disks.

ListDLLs
v3.2 (July 4, 2016)
List all the DLLs that are currently loaded, including where they are loaded and their version numbers.

LiveKd
v5.62 (May 16, 2017)
Use Microsoft kernel debuggers to examine a live system.

LoadOrder
v1.01 (July 4, 2016)
See the order in which devices are loaded on your WinNT/2K system.

LogonSessions
v1.4 (July 4, 2016)
List the active logon sessions on a system.

MoveFile
v1.01 (January 24, 2013)
Allows you to schedule move and delete commands for the next reboot.

NotMyFault
v4.01 (November 18, 2016)
Notmyfault is a tool that you can use to crash, hang, and cause kernel memory leaks on your Windows system.

NTFSInfo
v1.2 (July 4, 2016)
Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.

PendMoves
v1.2 (February 5, 2013)
Enumerate the list of file rename and delete commands that will be executed the next boot.

PipeList
v1.02 (July 4, 2016)
Displays the named pipes on your system, including the number of maximum instances and active instances for each pipe.

PortMon
v3.03 (January 12, 2012)
Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.

ProcDump
v10.0 (September 17, 2020)
This command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception.

Process Explorer
v16.32 (April 28, 2020)
Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.

Process Monitor
v3.60 (September 17, 2020)
Monitor file system, Registry, process, thread and DLL activity in real-time.

PsExec
v2.2 (June 29, 2016)
Execute processes on remote systems.

PsFile
v1.03 (June 29, 2016)
See what files are opened remotely.

PsGetSid
v1.45 (June 29, 2016)
Displays the SID of a computer or a user.

PsInfo
v1.78 (June 29, 2016)
Obtain information about a system.

PsKill
v1.16 (June 29, 2016)
Terminate local or remote processes.

PsPing
v2.01 (January 29, 2014)
Measure network performance.

PsList
v1.4 (June 29, 2016)
Show information about processes and threads.

PsLoggedOn
v1.35 (June 29, 2016)
Show users logged on to a system.

PsLogList
v2.8 (June 29, 2016)
Dump event log records.

PsPasswd
v1.24 (June 29, 2016)
Changes account passwords.

PsService
v2.25 (June 29, 2016)
View and control services.

PsShutdown
v2.52 (December 4, 2006)
Shuts down and optionally reboots a computer.

PsSuspend
v1.07 (June 29, 2016)
Suspend and resume processes.

PsTools
v2.45 (July 4, 2016)
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.

RAMMap
v1.51 (May 31, 2018)
An advanced physical memory usage analysis utility that presents usage information in different ways on its several different tabs.

RegDelNull
v1.11 (July 4, 2016)
Scan for and delete Registry keys that contain embedded null-characters that are otherwise undeleteable by standard Registry-editing tools.

Registry Usage (RU.md)
v1.2 (July 4, 2016)
View the registry space usage for the specified registry key.

RegJump
v1.1 (April 20, 2015)
Jump to the registry path you specify in Regedit.

SDelete
v2.01 (February 13, 2018)
Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program.

ShareEnum
v1.6 (November 1, 2006)
Scan file shares on your network and view their security settings to close security holes.

ShellRunas
v1.01 (February 28, 2008)
Launch programs as a different user via a convenient shell context-menu entry.

Sigcheck
v2.80 (June 24, 2020)
Dump file version information and verify that images on your system are digitally signed.

Streams
v1.6 (July 4, 2016)
Reveal NTFS alternate streams.

Strings
v2.53 (July 4, 2016)
Search for ANSI and UNICODE strings in binary images.

Sync
v2.2 (July 4, 2016)
Flush cached data to disk.

Sysmon
v12.0 (September 17, 2020)
Monitors and reports key system activity via the Windows event log.

TCPView
v3.05 (July 25, 2011)
Active socket command-line viewer.

VMMap
v3.26 (June 11, 2019)
VMMap is a process virtual and physical memory analysis utility.

VolumeId
v2.1 (July 4, 2016)
Set Volume ID of FAT or NTFS drives.

Whois
v1.20 (December 11, 2019)
See who owns an Internet address.

WinObj
v2.22 (February 14, 2011)
The ultimate Object Manager namespace viewer is here.

ZoomIt
v4.52 (December 11, 2019)
Presentation utility for zooming and drawing on the screen.

Source: Sysinternals Utilities – Windows Sysinternals | Microsoft Docs

Computer, sysadmin, Win10, Windows

The Ultimate Guide to Robocopy

Common Robocopy Syntax Reference

Why such a long blog post on a single utility? Just feast your eyes on the tables below. You have a lot of options to copy or move files with robocopy! You will more options in the individual sections.

These tables were built from the help syntax returned from robocopy /?. They’ve been broken up into more meaningful sections, added to over time and cleaned up to provide more useful info.

Source Options
Switch Explanation Default Behavior Equivalent Switch Notes
/S Copy subfolders
/E Copy subfolders including empty subfolders
/COPY:[DATSOU] Copy options /COPY:DAT D=Data, A=Attributes, T=Timestamps S=Security=NTFS ACLs, O=Owner info, U=aUditing info. File Data (D) always includes file Timestamps (T)
/SEC Copy files with SECurity /COPY:DATS
/DCOPY:T Copy directory timestamps
/COPYALL Copy ALL file info /COPY:DATSOU This will prevent dehydrating offline files and will instead copy the file’s tag (on emc VNX/Unity systems at least). This is not officially documented! If dehydration is what you need (reason i found this issue), you can’t copy the ACLs along your files. CREDIT: Monsieurx (Reddit)
/NOCOPY Copy NO file info useful with /PURGE
/A Copy only files with the Archive attribute set
/M like /A, but remove Archive attribute from source files
/LEV:n Only copy the top n LEVels of the source tree
/MAXAGE:n MAXimum file AGE – exclude files older than n days/date
/MINAGE:n MINimum file AGE – exclude files newer than n days/date If n < 1900 then n = no of days, else n = YYYYMMDD date
/FFT Assume FAT File Times 2-second date/time granularity. This replaces NTFS timestamps. Seems to be more reliable when transferring over a network.
/256 Turn off very long path (> 256 characters) support

Destination Options
Switch Explanation Default Behavior Equivalent Switch Notes
/A+:[RASHCNET] Set file attribute(s) on destination files + add
/A-:[RASHCNET] Remove file attribute(s) on destination files
/FAT Create destination files using 8.3 FAT file names only
/CREATE Create directory tree structure + zero-length files only
/DST Compensate for one-hour DST time differences

Copy Options
Switch Explanation Default Behavior Equivalent Switch Notes
/L List files only Don’t copy, timestamp or delete any files
/MOV Move files Delete from source after copying
/MOVE Move files and directories Delete from source after copying
/sl Copy file symbolic links instead of the target
/Z Copy files in restartable mode Survive a network glitch
/B Copy files in backup mode
/J Copy using unbuffered I/O Recommended for large files
/NOOFFLOAD Copy files without using the Windows copy offload mechanism https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831628(v=ws.11)
/EFSRAW Copy any encrypted files using EFS RAW mode
/TIMFIX Fix file times on all files, even skipped files
/XO Exclude older if destination file exists and is the same date or newer than the source – don’t bother to overwrite it.
/XC Exclude changed files
/XN Exclude newer files
/XX Exclude files present in destination but not source /XX
/XF file [file]… Exclude files matching given names/paths/wildcards
/XD dirs [dirs]… Exclude directories matching given names/paths. /XF and /XD can be used in combination e.g. ROBOCOPY c:\source d:\dest /XF *.doc *.xls /XD c:\unwanted /S
/IA:[RASHCNETO] Include files with any of the given attributes
/XA:[RASHCNETO] Exclude files with any of the given attributes
/IS Overwrite files even if they are already the same
/IT Include tweaked files
/XJ Exclude junction points from source /XJ
/XJD Exclude junction points from source directories
/XJF Exclude junction points from source files
/MAX:n Exclude files bigger than n bytes
/MIN:n Exclude files smaller than n bytes
/MAXLAD:n Exclude files unused since n
/MINLAD:n Exclude files used since n If n < 1900 then n = n days, else n = YYYYMMDD date
/MIR Mirror a directory tree /PURGE /E
/PURGE Delete dest files/folders that no longer exist in source
/XL Exclude files present in source but not destination
/SECFIX Robocopy /secfix fixes file security on all files, even skipped files. Specify the type of security information you want to copy by also using one of these options: /COPYALL /COPY:O /COPY:S /COPY:U /SEC
/ZB Use restartable mode; if access denied use Backup mode

Monitoring Options
Switch Explanation Default Behavior Equivalent Switch Notes
/R:n Number of retries on failed copies /R:1000000 Always try to set this option. I recommend setting this to 10-20 to not waste time retrying.
/W:n Wait time between retries /W:30 Always try to set this option to a lower number to retry more quickly. I suggest 5-10.
/REG Save /R:n and /W:n in the Windows registry as default settings
/RH:hhmm-hhmm times when new copies can be started
/TBD Wait for sharenames to be defined retry error 67
/PF Check run hours on a per file (not per pass) basis
/MON:n Run again when more than n changes seen
/MOT:m Run again in m minutes, if changed

Source: The Ultimate Guide to Robocopy

sysadmin, Win10, Windows

List of All Environment Variables in Windows 10

Windows Environment Variables List

ENVIRONMENT VARIABLE CORRESPONDING PATH
%SystemDrive% C:\ (Operating System drive)
%SystemRoot% C:\Windows
%WINDIR% C:\Windows
%HOMEDRIVE% C:\ (Operating System drive)
%HOMEPATH% C:\Users\<Username>
%USERPROFILE% C:\Users\<Username>
%APPDATA% C:\Users\<Username>\AppData\Roaming
%ALLUSERSPROFILE% C:\ProgramData
%PROGRAMFILES% C:\Program Files
%PROGRAMFILES(X86)% C:\Program Files (x86)
%PROGRAMDATA% C:\ProgramData
%TEMP% C:\Users\<Username>\AppData\Local\Temp
%LOCALAPPDATA% C:\Users\<Username>\AppData\Local
%PUBLIC% C:\Users\Public
%COMMONPROGRAMFILES% C:\Program Files\Common Files
%COMMONPROGRAMFILES(x86)% C:\Program Files (x86)\Common Files
microsoft, MicrosoftSucksAss, Software, sysadmin, Win10, Windows

How to Uninstall Edge Chromium When Windows 10 Won’t Let You

Edge Chromium is a decent web browser. I’d even go as far as to say it’s worth swapping over to from Google Chrome, given its improvements with memory usage. However, Microsoft has been incredibly annoying about stuffing Edge Chromium down everyone’s throats, and a recent Windows update locks this browser into your OS even more.

Sure, you could just set another app like Firefox or Opera as your default web browser and ignore Edge’s presence (and Windows 10’s incessant notifications to “try the new Edge”), but it’s better to remove Edge Chromium entirely if you never plan to use it.

The thing is, if you try to uninstall the browser from the Apps & Features menu in system settings, the “Uninstall” button next to Edge is now grayed out. If you’re like me, you probably hopped over to the Control Panel to uninstall it via the “Programs and Features” tab…except the update also removed Edge from the list of installed programs, so it can’t be uninstalled that way, either.

There’s a reason for this: some Microsoft apps require Edge to run properly, so Microsoft made it harder to uninstall Edge to avoid unnecessary issues that could be caused by its absence (and it just really wants you to use Edge).

This doesn’t mean Edge Chromium has to take up permanent residence on your computer—you’ll just have to get a little more creative to delete it. And no, you won’t break Windows by uninstalling Edge, though if all you intend to do is disable it and set a different browser as your default app, we’ll show you how to do that, too.

How to disable Edge and set a different default browser

Illustration for article titled How to Uninstall Edge Chromium When Windows 10 Wont Let You
Screenshot: Brendan Hesse

Given Windows 10’s bug-ridden history and the OS’s reliance on Edge, it may be safer to just switch to a new browser instead of uninstalling it completely.

  1. Open the Start Menu
  2. Click Settings and go to Apps > Default apps.
  3. Scroll down and click “Web browser.”
  4. Select the browser you want to use, which you’ll obviously need to have first installed in order to make the switch. Check our lists for the best browsers for ad-blocking and the best browsers for privacy if you need recommendations.
  5. You can also unpin Edge from your taskbar by right-clicking the taskbar icon and selecting “Unpin from taskbar.”

This will hide Edge most of the time, but Windows will still occasionally suggest using the browser, and some apps will open links in Edge even after changing the default program—but you can delete it from your PC if those behaviors bug you.

How to uninstall Edge Chromium

Despite Microsoft’s efforts to prevent users from delete Edge, you can uninstall it from Windows 10 with some simple PowerShell wizardry. We’ll cover two possible options just in case one doesn’t work for you.

Method one:

Illustration for article titled How to Uninstall Edge Chromium When Windows 10 Wont Let You
Screenshot: Brendan Hesse
  1. Open Windows File Explorer
  2. Type “C:\Program Files (x86)\Microsoft\Edge\Application” into the address bar and hit Enter. This should open the Edge installation folder—if not, try navigating to the folder manually, or search for “Edge” in File Explorer.
  3. There should be a folder with a numerical name. The name is the same as the current version of Edge installed on your PC. For example, at the time of writing, the folder on my machine is “83.0.478.58.” Open that folder.
  4. Find and open the “Installer” folder.
  5. In this folder, click the “File” tab in the upper-left of the File Explorer window, then go to File > Open Windows PowerShell > Open Windows PowerShell as administrator.
  6. Click “Yes” when prompted to allow the program to make changes to your system.
  7. Type.\setup.exe -uninstall -system-level -verbose-logging -force-uninstall into PowerShell and press Enter to run the command and let it run.

Assuming everything went according to plan, Edge should now be uninstalled. However, if this method doesn’t work for you, there’s another option you can try.

Method 2:

Illustration for article titled How to Uninstall Edge Chromium When Windows 10 Wont Let You
Screenshot: Brendan Hesse
  1. Search for “PowerShell” from the taskbar or Windows Start menu.
  2. Right-click “Windows PowerShell” from the search results and select “Run as an administrator.”
  3. Select “Yes” when asked if the program is allowed to make changes to your system.
  4. In the PowerShell window, type get-appxpackage *edge* and press Enter.
  5. Several lines of information will show up. Look for “PackageFullName” and copy the text in the column.
  6. Type remove-appxpackage into PowerShell and paste the text you copied from the PackafeFullName column.
  7. Press Enter to run the command. Edge should now be removed from your system.

This story was updated to add more information on why Microsoft is preventing the browser from being removed, plus two additional methods for removing/disabling the browser.

Source: How to Uninstall Edge Chromium When Windows 10 Won’t Let You

PowerShell, sysadmin, Win10, Windows

Deep scriptblock logging: Record PowerShell commands in the event log

As a powerful tool, PowerShell is not only of interest for admins but also for hackers. To detect suspicious activities, it is helpful to have all executed commands recorded. In addition to recording the history in a text file, PowerShell has also supported logging in the event log since version 5.

Source: Deep scriptblock logging: Record PowerShell commands in the event log

Win10, Windows

Recognized Environment Variables (Windows 10) – Windows Deployment | Microsoft Docs

Variables that are processed for the operating system and in the context of each user

You can use these variables within sections in the .xml files with context=UserAndSystem, context=User, and context=System.

Variable Explanation
ALLUSERSAPPDATA Same as CSIDL_COMMON_APPDATA.
ALLUSERSPROFILE Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.
COMMONPROGRAMFILES Same as CSIDL_PROGRAM_FILES_COMMON.
COMMONPROGRAMFILES(X86) Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.
CSIDL_COMMON_ADMINTOOLS Version 10.0. The file-system directory that contains administrative tools for all users of the computer.
CSIDL_COMMON_ALTSTARTUP The file-system directory that corresponds to the non-localized Startup program group for all users.
CSIDL_COMMON_APPDATA The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.
CSIDL_COMMON_DESKTOPDIRECTORY The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.
CSIDL_COMMON_DOCUMENTS The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.
CSIDL_COMMON_FAVORITES The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.
CSIDL_COMMON_MUSIC The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.
CSIDL_COMMON_PICTURES The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.
CSIDL_COMMON_PROGRAMS The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.
CSIDL_COMMON_STARTMENU The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.
CSIDL_COMMON_STARTUP The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.
CSIDL_COMMON_TEMPLATES The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.
CSIDL_COMMON_VIDEO The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.
CSIDL_DEFAULT_APPDATA Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_LOCAL_APPDATA Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_COOKIES Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_CONTACTS Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_DESKTOP Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_DOWNLOADS Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_FAVORITES Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_HISTORY Refers to the History folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_INTERNET_CACHE Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_PERSONAL Refers to the Personal folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_MYDOCUMENTS Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_MYPICTURES Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_MYMUSIC Refers to the My Music folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_MYVIDEO Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_RECENT Refers to the Recent folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_SENDTO Refers to the Send To folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_STARTMENU Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_PROGRAMS Refers to the Programs folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_STARTUP Refers to the Startup folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_TEMPLATES Refers to the Templates folder inside %DEFAULTUSERPROFILE%.
CSIDL_DEFAULT_QUICKLAUNCH Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.
CSIDL_FONTS A virtual folder containing fonts. A typical path is C:\Windows\Fonts.
CSIDL_PROGRAM_FILESX86 The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).
CSIDL_PROGRAM_FILES_COMMONX86 A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.
CSIDL_PROGRAM_FILES The Program Files folder. A typical path is C:\Program Files.
CSIDL_PROGRAM_FILES_COMMON A folder for components that are shared across applications. A typical path is C:\Program Files\Common.
CSIDL_RESOURCES The file-system directory that contains resource data. A typical path is C:\Windows\Resources.
CSIDL_SYSTEM The Windows System folder. A typical path is C:\Windows\System32.
CSIDL_WINDOWS The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.
DEFAULTUSERPROFILE Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].
PROFILESFOLDER Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].
PROGRAMFILES Same as CSIDL_PROGRAM_FILES.
PROGRAMFILES(X86) Refers to the C:\Program Files (x86) folder on 64-bit systems.
SYSTEM Refers to %WINDIR%\system32.
SYSTEM16 Refers to %WINDIR%\system.
SYSTEM32 Refers to %WINDIR%\system32.
SYSTEMPROFILE Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].
SYSTEMROOT Refers to the root of the system drive.
WINDIR Refers to the Windows folder located on the system drive.

 

Variables that are recognized only in the user context

You can use these variables in the .xml files within sections with context=User and context=UserAndSystem.

Variable Explanation
APPDATA Same as CSIDL_APPDATA.
CSIDL_ADMINTOOLS The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.
CSIDL_ALTSTARTUP The file-system directory that corresponds to the user’s non-localized Startup program group.
CSIDL_APPDATA The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.
CSIDL_BITBUCKET The virtual folder that contains the objects in the user’s Recycle Bin.
CSIDL_CDBURN_AREA The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.
CSIDL_CONNECTIONS The virtual folder representing Network Connections that contains network and dial-up connections.
CSIDL_CONTACTS This refers to the Contacts folder in %CSIDL_PROFILE%.
CSIDL_CONTROLS The virtual folder that contains icons for the Control Panel items.
CSIDL_COOKIES The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.
CSIDL_DESKTOP The virtual folder representing the Windows desktop.
CSIDL_DESKTOPDIRECTORY The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.
CSIDL_DRIVES The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.
CSIDL_FAVORITES The file-system directory that serves as a common repository for the user’s favorites. A typical path is C:\Users\Username\Favorites.
CSIDL_HISTORY The file-system directory that serves as a common repository for Internet history items.
CSIDL_INTERNET A virtual folder for Internet Explorer.
CSIDL_INTERNET_CACHE The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files
CSIDL_LOCAL_APPDATA The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.
CSIDL_MYDOCUMENTS The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.
CSIDL_MYMUSIC The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.
CSIDL_MYPICTURES The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.
CSIDL_MYVIDEO The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.
CSIDL_NETHOOD A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.
CSIDL_NETWORK A virtual folder representing My Network Places, the root of the network namespace hierarchy.
CSIDL_PERSONAL The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

A typical path is C:\Documents and Settings\username\My Documents.
CSIDL_PLAYLISTS The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.
CSIDL_PRINTERS The virtual folder that contains installed printers.
CSIDL_PRINTHOOD The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.
CSIDL_PROFILE The user’s profile folder. A typical path is C:\Users\Username.
CSIDL_PROGRAMS The file-system directory that contains the user’s program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.
CSIDL_RECENT The file-system directory that contains shortcuts to the user’s most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.
CSIDL_SENDTO The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.
CSIDL_STARTMENU The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.
CSIDL_STARTUP The file-system directory that corresponds to the user’s Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.
CSIDL_TEMPLATES The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.
HOMEPATH Same as the standard environment variable.
TEMP The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.
TMP The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.
USERPROFILE Same as CSIDL_PROFILE.
USERSID Represents the current user-account security identifier (SID). For example,

S-1-5-21-1714567821-1326601894-715345443-1026.

Source: Recognized Environment Variables (Windows 10) – Windows Deployment | Microsoft Docs