Windows / C# / COM engineering notes from KomuraSoft LLC. https://comcomponent.com/en/feed.xml 2026-08-06T00:00:00+00:00 © 2026 KomuraSoft LLC Jekyll 小村 豪 https://comcomponent.com/en/profile/go-komura/ https://comcomponent.com/en/blog/sc-exam-r6s-pm-q1-api-security/ 2026-08-06T10:00:00+00:00 2026-08-06T00:00:00+00:00

Using the Registered Information Security Specialist Examination's Spring 2024 (Reiwa 6) PM Q1 as a case study, this article explains JWT's alg=none, API authorization, Mass Assignment, brute-forcing a four-digit authentication code, and interim mitigation with a WAF.

Go Komura https://comcomponent.com/en/blog/windows-memory-usage-working-set-commit/ 2026-08-04T01:00:00+00:00 2026-08-04T00:00:00+00:00

Task Manager's Memory, Working Set, Private Bytes, and Commit are not the same figure. This article explains the relationship between Windows virtual and physical memory, the role of the page file, and which metrics to watch when investigating memory pressure or leaks.

Go Komura https://comcomponent.com/en/blog/multithreading-best-practices-java/ 2026-08-02T01:30:00+00:00 2026-08-02T00:00:00+00:00

In Java, the established practice for multithreading is never to create threads directly but to build on ExecutorService and virtual threads. This article sets out the practical principles: choosing between synchronized and ReentrantLock, cooperative stopping via interruption, atomic operations on ConcurrentHashMap, and Swing's EDT.

Go Komura https://comcomponent.com/en/blog/multithreading-best-practices-c/ 2026-08-02T01:20:00+00:00 2026-08-02T00:00:00+00:00

The established approach to multithreading in C with Win32 is thread creation via _beginthreadex, SRW locks and condition variables, Interlocked functions, and a stop design built on a stop event plus WaitForMultipleObjects. This article also covers the dangers of TerminateThread and the constraints of DllMain.

Go Komura https://comcomponent.com/en/blog/multithreading-best-practices-cpp/ 2026-08-02T01:10:00+00:00 2026-08-02T00:00:00+00:00

In C++, multithreading is a world where a data race is undefined behaviour. This article works through the std::thread destructor trap, designing stop mechanisms with jthread and stop_token, deadlock avoidance with scoped_lock, the correct role of atomic, and how to choose between the standard library and the Win32 synchronization APIs.

Go Komura https://comcomponent.com/en/blog/multithreading-best-practices-dotnet/ 2026-08-02T01:00:00+00:00 2026-08-02T00:00:00+00:00

A practical rundown of the design rules that keep multithreaded .NET/C# code from occasionally crashing or hanging: ride on Task instead of creating threads yourself, cut shared mutable state, keep locking disciplined, design how to stop with CancellationToken, and handle the UI thread correctly.

Go Komura https://comcomponent.com/en/blog/sc-exam-r5a-pm-q2-security-review/ 2026-08-01T03:00:00+00:00 2026-08-01T00:00:00+00:00

Using Question 2 of the afternoon session of the Autumn 2023 (Reiwa 5) Registered Information Security Specialist exam, this article explains how a company that had already blocked USB drives still ends up with files walking out over its guest Wi-Fi. It works through server certificate validation and HSTS, the limits of MAC address filtering, and countermeasures built on EAP-TLS and the TPM.

Go Komura https://comcomponent.com/en/blog/vss-volume-shadow-copy-guide/ 2026-08-01T01:00:00+00:00 2026-08-01T00:00:00+00:00

Files that are in use can't normally be copied because of sharing violations — so how does backup software manage it? This article explains the roles of the Volume Shadow Copy Service (VSS) requester, writer, and provider, how copy-on-write works, day-to-day vssadmin operations, and the pitfalls of the diff area.

Go Komura https://comcomponent.com/en/blog/wmi-cim-practical-guide/ 2026-08-01T01:00:00+00:00 2026-08-01T00:00:00+00:00

WMI/CIM is the standard way to get a PC's serial number, monitor free disk space, and detect process launches. This article covers how to use CIM cmdlets such as Get-CimInstance, migration from the old Get-WmiObject, when to use System.Management versus the CIM API in C#, plus practical recipes and pitfalls.

Go Komura https://comcomponent.com/en/blog/group-policy-practical-guide/ 2026-08-01T01:00:00+00:00 2026-08-01T00:00:00+00:00

Are you working in an AD environment without really knowing what "distributed via GPO" means? This article explains, from a practical standpoint, how Group Policy works and the LSDOU order of application, confirming that changes have taken effect with gpupdate and gpresult, choosing between GPO and Intune, and the pitfall of a customer's GPO silently changing how your app behaves.

Go Komura https://comcomponent.com/en/blog/windows-security-audit-policy-guide/ 2026-08-01T01:00:00+00:00 2026-08-01T00:00:00+00:00

A practical guide for answering "please look into the failed sign-in logs." It covers the relationship between basic and advanced audit policy, the subcategories you should enable at minimum, how to read event IDs 4624/4625/4688, Security log capacity design, and extraction with Get-WinEvent.

Go Komura https://comcomponent.com/en/blog/windows-laps-guide/ 2026-08-01T01:00:00+00:00 2026-08-01T00:00:00+00:00

A shared local administrator password across every PC is fertile ground for Pass-the-Hash attacks, where the compromise of one machine spreads to all of them. This article explains automatic rotation with Windows LAPS — now a built-in OS feature — how to configure storage in Active Directory or Entra ID, and the operational pitfalls to watch for.

Go Komura https://comcomponent.com/en/blog/windows-certificate-store-guide/ 2026-08-01T00:00:00+00:00 2026-08-01T00:00:00+00:00

Should a client certificate go in the user store or the computer store? This practical guide works systematically through the classic certificate mistakes — the difference between certmgr.msc and certlm.msc, granting private-key permissions, and taking an expiry inventory with PowerShell.

Go Komura https://comcomponent.com/en/blog/windows-firewall-business-apps/ 2026-08-01T00:00:00+00:00 2026-08-01T00:00:00+00:00

"It works on the dev machine but the client can't connect" almost always traces back to the Windows Firewall. This article covers the default-block-inbound behaviour and profiles, why you cannot leave production to the security warning dialog, and how to register inbound rules from the installer and triage connection failures.

Go Komura https://comcomponent.com/en/blog/wsus-deprecation-windows-update-management/ 2026-08-01T00:00:00+00:00 2026-08-01T00:00:00+00:00

Microsoft announced the deprecation of WSUS in September 2024. It is not stopping immediately, but new feature development has ended. This article lays out four options — continuing WSUS, Windows Update for Business, Autopatch, and Intune — in a decision table that accounts for licensing and closed-network conditions.

Go Komura https://comcomponent.com/en/blog/bitlocker-practical-guide/ 2026-08-01T00:00:00+00:00 2026-08-01T00:00:00+00:00

From Windows 11 24H2 onward, clean installs enable device encryption by default, and "suddenly finding out it's encrypted" incidents are now happening in practice. Centred on a decision table for where to store the recovery key, this article covers the underlying mechanism, organisational operation, incident response, and disposal.

Go Komura https://comcomponent.com/en/blog/passkey-why-secure/ 2026-07-29T07:00:00+00:00 2026-07-29T00:00:00+00:00

An illustrated explanation of why passkeys are secure: the public-key cryptography that keeps the private key off the server and off the wire, why phishing cannot structurally succeed, the safety of synced passkeys, what to think about when a phone is lost, and the essentials of implementing WebAuthn.

Go Komura https://comcomponent.com/en/blog/windows-minifilter-filter-drivers/ 2026-07-29T06:00:00+00:00 2026-07-29T00:00:00+00:00

The final instalment of a series illustrating Windows filter drivers and minifilters. It covers the Filter Manager and altitudes, pre/post callbacks, how Procmon and antivirus software can inspect every I/O operation, and the investigation procedure for "why is this one environment slow".

Go Komura https://comcomponent.com/en/blog/ntfs-internals-mft-structure/ 2026-07-29T05:00:00+00:00 2026-07-29T00:00:00+00:00

Part 5 of a series explaining NTFS internals with diagrams. Covers the MFT and file records, multiple data streams (Zone.Identifier), hard links and 8.3 names, reparse points, the two journals, and sparse files and compression — all organised from a developer's point of view.

Go Komura https://comcomponent.com/en/blog/windows-cache-manager-writefile-disk/ 2026-07-29T04:00:00+00:00 2026-07-29T00:00:00+00:00

Part 4 of an illustrated series on the Windows cache manager. It covers the cache implemented as a file mapping, read-ahead and lazy writing, how to choose between FlushFileBuffers and FILE_FLAG_NO_BUFFERING, and the conditions under which data is lost on power loss.

Go Komura https://comcomponent.com/en/blog/windows-iocp-dotnet-threadpool/ 2026-07-29T03:00:00+00:00 2026-07-29T00:00:00+00:00

Part 3 of a series that explains I/O Completion Ports (IOCP) with diagrams. Covers the design that unifies the completion queue with thread-count control, the concurrency value and LIFO thread release, and works through to the .NET thread pool and which thread an async/await continuation runs on.

Go Komura https://comcomponent.com/en/blog/msmq-migration-decision-guide/ 2026-07-29T02:00:00+00:00 2026-07-29T00:00:00+00:00

MSMQ does not appear on Microsoft's official deprecated-features lists, yet System.Messaging exists only in .NET Framework and blocks migration to .NET. This article sorts fact from rumour about MSMQ's status, then sets out the criteria for deciding whether to keep using it or migrate, and how to choose a migration target.

Go Komura https://comcomponent.com/en/blog/windows-io-sync-async-overlapped/ 2026-07-29T02:00:00+00:00 2026-07-29T00:00:00+00:00

Part 2 of a series explaining Windows synchronous and asynchronous I/O (overlapped I/O) with diagrams. It covers what FILE_FLAG_OVERLAPPED means, the four ways completion is reported, the conditions under which supposedly-asynchronous I/O completes synchronously, how to cancel properly, and how it all maps onto .NET.

Go Komura https://comcomponent.com/en/blog/sc-exam-r5a-pm-q1-stored-xss/ 2026-07-29T02:00:00+00:00 2026-07-29T00:00:00+00:00

Using Question 1 from the afternoon session of the Autumn 2023 (Reiwa 5) Registered Information Security Specialist Examination as the case study, this article walks through how a stored XSS attack unfolded. It explains why the character limit was defeated by splitting the payload across multiple posts, the route by which the session ID was exfiltrated as an image without any external communication, and which countermeasures actually worked.

Go Komura https://comcomponent.com/en/blog/applocker-wdac-business-app-distribution/ 2026-07-29T01:00:00+00:00 2026-07-29T00:00:00+00:00

Explains the differences between AppLocker, App Control for Business (formerly WDAC), and Smart App Control, and sets out what developers and distributors can do so that in-house business apps are not blocked by application control in customer environments. Also covers how to read the event logs when a block occurs.

Go Komura https://comcomponent.com/en/blog/windows-io-internals-architecture-irp/ 2026-07-29T01:00:00+00:00 2026-07-29T00:00:00+00:00

Part 1 of a series that explains the Windows I/O system from the ground up. We map out the Object Manager namespace, the three kinds of objects (driver, device, file), the lifecycle of an IRP, and what really happens behind CloseHandle, all with diagrams.

Go Komura https://comcomponent.com/en/blog/smb-signing-ldap-channel-binding/ 2026-07-29T00:00:00+00:00 2026-07-29T00:00:00+00:00

SMB signing and LDAP signing/channel binding are the defences that limit the damage from relay attacks while you work towards retiring NTLM. This article lays out the per-OS default values, how to read the audit events, the steps for moving to enforcement, and how to fix business applications and devices, from a practical standpoint.

Go Komura https://comcomponent.com/en/blog/ntlm-kerberos-explained/ 2026-07-26T02:00:00+00:00 2026-07-26T00:00:00+00:00

An illustrated comparison of NTLM and Kerberos: challenge/response, TGTs and service tickets, the conditions under which Negotiate falls back to NTLM when an SPN cannot be resolved, why relay attacks and Pass-the-Hash work, and the removal of NTLMv1 — all backed by the official documentation.

Go Komura https://comcomponent.com/en/blog/openharmony-embedded-os-selection/ 2026-07-26T01:30:00+00:00 2026-07-26T00:00:00+00:00

Does OpenHarmony belong in the OS shortlist for industrial equipment? We compare Windows IoT Enterprise LTSC, embedded Linux and OpenHarmony on maintenance windows, memory requirements, development environment and procurement using primary sources, and set out in a decision table the conditions under which you may adopt it and the conditions under which you should pass.

Go Komura https://comcomponent.com/en/blog/ntlm-deprecation-audit-migration/ 2026-07-26T01:00:00+00:00 2026-07-26T00:00:00+00:00

A practical procedure for finding out where your Windows environment and business applications depend on NTLM ahead of its retirement: audit policies, following events 8001 to 8004 in the NTLM/Operational log, the typical patterns that fall back to NTLM and how to fix them, and NTLM blocking on SMB.

Go Komura