Jean-Pierre Paradis's Blog

All post

Although Microsoft provides Windows Defender as an integrated part of Windows 10 they do not mandate that as your only option.

Once you install your favorite third party anti-virus/malware solution Windows Defender gets out of the way and is turned off so it does not cause any conflicts with your scanning/protection software of choice.

In the recently released Windows 10 Anniversary Update there is a new option for those of you using third party security software that allows you to take advantage of the years worth of research Microsoft has invested into protecting systems from viruses and malware.

Source : SuperSite for Windows

This article covers the differences between the PowerShell versions.

Source : 4sysops

So as many of you may know, yesterday Microsoft released a security hotfix that changed the behavior of Group Policy. Put simply if you have a security group filtered User Group Policy Object and you also removed the “Authenticated Users” group from the policy it will no longer apply after you install MS16-072.

Source : Group Policy Central

Today, I will introduce to my favorite PowerShell ISE add-ons: Script Browser, Module Browser, and ISE Geek. At the end of the post, I'll leave you with a hand-selected list of some other ISE add-ins.

Source : 4sysops

To build fast sites, developers need powerful tools to analyze the performance of their sites and debug issues. In-browser tools like the F12 Developer Tools are a great start and the primary tools for analyzing what’s happening behind the scenes when a page slows down. However, some scenarios require measuring performance characteristics in the context of other applications and the operating system itself. For these scenarios, we use the Windows Performance Toolkit.

Source : Microsoft Edge Dev Blog

IIS is a mature technology with a large amount of configuration available. Historically the configuration of IIS has been done through WMI, Appcmd, PowerShell, and graphically through IIS Manager. All of these technologies have continued to serve their purpose, allowing users to configure the web server to meet their needs. Recently the IIS team has been working on a project to open up IIS configuration even more by creating a REST API that exposes the configuration system. This API is not meant to replace any of the existing configuration access mechanisms, but stand beside them and offer an open method for interacting with IIS. The REST API communicates with HTTPS making it accessible from any device that knows how to send a web request. This allows IIS to be configured more freely and opens the door for configuration clients that were not possible before, such as mobile applications.
Today we want to not only let everyone know that we are working on a REST API for IIS, we also want to let you see it. The API that we have created has a built in tool called the API Explorer that allows those with access to the API to browse the entire API surface. This means once you have a link to the root URL of the API you can navigate to this tool and browse all of the API that is available. Here is a picture of the API Explorer in action displaying an application pool resource.

Source : blogs.iis.net

A set of functions to dump OUs, Users, Groups and GPOs from one Active Directory and mirror them to another, test Active Directory. Perfect for creating a test environment.

Source : gallery.technet.microsoft.com

I’ve lost count of the number of Wi-Fi routers I’ve been through over the last ten years, most ranging from just OK to the plain terrible. When I started experiencing problems with WI-FI connectivity a few months ago, I decided once again it was time to replace my router, and after lots of research, I picked the Asus RT-AC66U.

SOurce : Petri

A new update is available for Windows Server 2012 and 2012 R2. This update requires manual steps in order to complete the installation. While the KB itself covers those steps, this post provides additional details on the release.

Source : WSUS Product Team Blog

If its happen that you like to run your honeypot on a Windows system then Honeyport is something worth to try.
Honeyports is a powershell script that will Creates a job that listens on TCP Ports specified and when a connection is established, it can either simply log or add a local firewall rule to block the host from further connections.
The script is written by John Hoyt, Carlos Perez and Greg Foss and it’s available on https://github.com/Pwdrkeg/honeyport/

Source InfoSec Handlers Diary Blog

Hi all, Herbert Mauerer here. In this post we’re back to talk about the built-in AD Diagnostics Data collector set available for Active Directory Performance (ADPERF) issues and how to ensure a useful report is generated when your DCs are under heavy load.

Source : Ask the Directory Services Team

One of the most noticeable things about Windows 10, as compared to previous iterations of the Microsoft operating system, is the amount of time it takes for the first logon—that is, the logon time when a user doesn’t have a profile on the local machine.

Source : 4sysops

Hello, Ryan Ries here again with some juicy new Active Directory hotness. Windows Server 2016 is right around the corner, and it’s bringing a ton of new features and improvements with it. Today we’re going to talk about one of the new things you’ll be seeing in Active Directory, which you might see referred to as “expiring links,” or what I like to call “temporary group memberships.”
One of the challenges that every security-conscious Active Directory administrator has faced is how to deal with contractors, vendors, temporary employees and anyone else who needs temporary access to resources within your Active Directory environment. Let’s pretend that your Information Security team wants to perform an automated vulnerability scan of all the devices on your network, and to do this, they will need a service account with Domain Administrator privileges for 5 business days. Because you are a wise AD administrator, you don’t like the idea of this service account that will be authenticating against every device on the network having Domain Administrator privileges, but the CTO of the company says that you have to give the InfoSec team what they want.
(Trust me, this stuff really happens.)

Source : Ask the Directory Services Team

Hi all, Ned here again with a quick chat about mixing Continuous Availability and Offline Files. As you know, we have severalpublic docs recommending against combining CA and Client Side Caching (aka CSC aka Offline Files) because when users attempt to go offline, it will take up to six minutes. This usually leads to unhappy humans and applications. Today I’ll explain more and give you some options.

Source : Server Storage at Microsoft

We are happy to announce that an Android app for Work Folders has been released into the Google PlayStore® and is available as a free download.

Source : Server Storage at Microsoft

The proper way to remove a DC server in an Active Directory infrastructure is to run DCPROMO and remove it. The following video provides an example of these steps...

Source : Canadian IT Professionals

In the previous post, we installed Ubuntu in a VirtualBox VM. Now it’s time to install SAMBA and configure the domain controller.

Source : 4sysops

Another day, another sensational report from Forbes. Oh my goodness, is Windows 10 really "phoning home" thousands of times a day? Nope. in fact, anyone who has even a basic understanding of how networks work should cringe at this shoddy report.

Source : ZDNet

First things first, do not panic.

This article will guide you through the process of cleaning a hacked WordPress website. The process is documented in an easy to follow step by step format; identifying the source of the hack, identifying the infection, cleaning the code, regaining control of your WordPress website or blog and removing the Google malware alert. This guide will help you recover from the typical WordPress hacks such as backdoors, malware, spam and other similar types of infections.

Source : wpwhitesecurity

In the last post of this series, I described how to prepare your VirtualBox environment. In today’s post, I’ll show you how to install the Ubuntu server with the help of the netboot.xyz iPXE .iso.

Source : 4sysops

Fast startup was introduced in Windows 8 and uses session 0 hibernation to save the kernel state to disk. Reading the kernel state from disk is 30 to 70 percent faster than a full system initialization on most systems.

While fast startup should be beneficial in most cases, especially in combination with UEFI, it can also be problematic. For example, I’ve come across systems that refuse to connect to wireless networks without a cold boot, assumedly due to a problem with the reinitialized driver. But if an updated driver doesn’t solve the problem, you might want to disable fast startup.

Source : Petri

If you want to run a domain controller on your network but don’t have access to a Windows Server license, you can use SAMBA, the free open-source software, and VirtualBox, the free virtualization software. We’ll describe the procedure for setting up a virtual server using VirtualBox and netboot.xyz iPXE and move on to setting up your domain controller with SAMBA.

Source : 4sysops

After months of complaints, Microsoft has finally opened a Windows 10 Update History web site that will document the changes it makes to its flagship OS.

Source : Thurrott.com

A new preview release model for the PowerShell ISE

The biggest news is that we've developed a new strategy to ship a separate preview edition of the PowerShell ISE. This enables us to add new features and release them to all of you much faster than before. Previously you had to wait for new Windows or WMF releases before you would get an updated ISE. Thanks to the PowerShell Gallery, we can now ship the Windows PowerShell ISE Preview as often as we like!

Source : Windows PowerShell Blog

If you have ever used the search feature in Windows 10, and there is a good chance you have, there is a new way to filter search results that should help you find what you are looking for, faster. It looks like this feature was added in a recent update and if you haven’t tried it yet, here’s how it works ...

Source : Thurrott.com

Early on in many penetration test or security assessment, you will often find yourself wading through what seems like hundreds or thousands of text files, each seemingly hundreds or thousands of pages long (likely because they are). One key to success in these situations is to automate the analysis of these files as much as possible – you want to get the “drudgery” job done and move on to subsequent tasks that need real eyes on the screen and hands on the keyboard.
Let’s look at NMAP for instance. It’s a valuable tool, we all use it. But if you are scanning a /16 or a /8 network (or even lots of /24’s), the volume of output can be .. daunting? .. significant? .. collosal ?

Source : InfoSec Handlers Diary Blog

A new hotfix is available that enables Windows Server Update Services (WSUS) on a Windows Server 2012 or Windows Server 2012 R2 to sync and distribute feature upgrades for Windows 10. Note that this hotfix is not required to enable WSUS to sync and distribute servicing updates for Windows 10. This hotfix also addresses an issue where Windows 10 computers are displayed as Windows Vista.

Source : Microsoft WSUS and Software Update Team Blog

Building on our last conversation about HTTPS and Powershell, let’s look at another common thing you’d do with HTTPS in a system administrator, or in a security assessment or penetration test – let’s assess the HTTPS certificates themselves.

Source InfoSec Handlers Diary Blog

As indicated in a previous post, we are making changes to WSUS 4.0 and later that will provide a smoother Windows 10 servicing experience. Because WSUS 3.0 SP2 is already in extended support (receiving no support at all after July 2017), and we are not shipping these improvements further down-level, it is a good idea to start planning your WSUS migration now. Here is some guidance on how to respond to the recent changes based on your current situation, with the assumption that you intend to deploy Windows 10 in your environment.

Source : WSUS Product Team Blog

Microsoft is please to announce the final release of the security configuration baseline settings for Windows 10 version 1511, also known as "November Update," "Build 10586," "Threshold 2," or "TH2." The downloadable attachment to this blog post includes importable GPOs, tools for applying the GPOs to local GPO, custom ADMX files for Group Policy settings, and all the settings in spreadsheet form. We will also be publishing SCM .CAB files for this Windows 10 baseline shortly, and will announce their availability on the Security Guidance blog. (Note that we will not be providing updated SCM .CAB files for the IE11 guidance. For that content, see the attachment on this blog post.)

Source : Microsoft Security Guidance

Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet.

Source : Microsoft Security Guidance

One of the great additions to PowerShell 5.0 is the new information stream. You can use this stream as a logging mechanism in your scripts and functions, which is something I want to demonstrate today.

Source : Petri

In the first article of this series, I taught you how to install and configure the Git version control system (VCS) to help you manage your Windows PowerShell scripts. Today, you'll learn how to sync your PowerShell scripts between your computers.

Source : 4sysops

Software as a service (or SaaS) is a relatively new model of how a lot of software companies are conducting their business today – often to great success. So it comes as no surprise that malware writers and cyber crooks are attempting to adopt this model for their own nefarious purposes. In the past year a whole bunch of these “Ransomware as a Service” campaigns appeared, like for example Tox, Fakben or Radamant. Today we want to spotlight the newest of these campaigns.

Source : Meet Ransom32: The first JavaScript ransomware

PowerSploit is an offensive security framework for penetration testers and reverse engineers. It was born out of the realization that PowerShell was the ideal post-exploitation utility in Windows due to its ability to perform a wide range of administrative and low-level tasks all without the need to drop malicious executables to disk, thus, evading antivirus products with ease.

Source : PowerShell Magazine

Below I will show few methods which can prevent WPScan scan.

Source : security.szurek.pl

Hello everyone, this is Ayesha Mascarenhas on the Remote Desktop team. We released the Remote Desktop client preview for Mac in August this year. Over the last few months many of you have shared feedback and feature suggestions. Today, I’m sharing with you some of the updates we have made to the Remote Desktop client preview app for Mac since it was first released.

Source : Remote Desktop Services (Terminal Services) Team Blog

In the second week of this month, Microsoft had alerted Windows Live Mail 2012 users that some chnages are coming to users of Microsoft accounts like Outlook, Live, Hotmail, MSN accounts that may prevent mails being delivered to Windows Live Mail 2012. And it said, in order to continue using this Mail client, you need to install this update.(Update for Windows Live Essentials Mail 2012 (KB3093594) )

Source : meraTechPort

You’ve adopted an Android smart phone, but your contacts, email, and calendaring information are tied up in your Outlook.com or Office 365 account. No worries, you can access it all from Android, and even make sure that your phone calls and text messages correctly identify who’s reaching out to you.

The best news? You can make this work no matter which apps you choose to use to manage your contacts, email and calendar.

Source : Thurrott.com

When using WPScan you can scan your WordPress website for known vulnerabilities within the core version, plugins, and themes. You can also find out if any weak passwords, users, and security configuration issues are present. The database atwpvulndb.com is used to check for vulnerable software and the WPScan team maintains the ever-growing list of vulnerabilities.

Last time, we taught you how to install WPScan on Mac and Linux.

This time we are going to dive into how to use WPScan with the most basic commands.

Source : Sucuri Blog

NirSoft released the free MMCSnapInsView tool that allows you to view and launch all MMC snap-ins that are installed on a Windows computer.

Source : MMCSnapInsView – MMC snap-in launcher

Concurrent Remote Desktop allows you (the administrator) to simultaneously use a client computer while a standard user is still interactively using it. For IT, this is huge! Imagine never having to kick a person off of their computer because you need to work on it. Concurrent Remote Desktop (CRDP) makes this possible. This guide will cover CRDP setup for Windows 10.

Source : DeployHappiness

About 4 months ago we decided to deliver what the community clearly needs: A WordPress Security Learning Center. We all put our noses to the grindstone and worked as quickly and effectively as we could. We brought in video producers, designers, copywriters and security experts from around the community.
Today we are ready to announce the completion and official launch of our WordPress Security Learning Center.

Source : Wordfence

Microsoft released KB 3095113 to enable future Windows 10 feature upgrades. Whether you will deploy upgrades or not, you need to know what this hotfix does and how not applying it can break WSUS.

Source : 4sysops

Well today's news gives WLW a fresh lease on life as open source software. That means the opportunity is once again available to build a robust community around the software and see it thrive.

Source : SuperSite for Windows

A must read article by 4sysops on how to active the administrator account or change the password of any account without logging in !
Offline activate the built-in administrator on Windows 10 without signing in - 4sysops

If you tried out the previews of Windows 10, you may have seen the experimental options in the command prompt. Now that it's released, the Experimental tab in the Properties dialog is gone, but the key features are still there – just slotted into the other tabs.

To see what's available, right-click on the title bar of a command prompt window and choose Properties if you want to only change the current command window, or Defaults if you want to change every command window you open.

Source : www.techradar.com

Windows 10 Enterprise comes with quite a few interesting features that Windows 10 Pro lacks. In this post, I summarize these additional features and link to further information.

Source : 4sysops

I don’t know about you, but I’m sick and tired of reading these sensational headlines: “Windows 10 is Stealing Your Bandwidth!” and “Windows 10 is Costing You Extra Money!” and so forth. By the end of this article, you’ll understand a thing or two about Windows Update Delivery Optimization (WUDO), how to control its behavior, and what you can do to minimize the likelihood of running over your ISP account’s bandwidth limit.

Source : 4sysops

If you have the task of performing an Active Directory migration from Windows Server 2003 to Windows Server 2012 R2, there are a number of steps that you must complete for a smooth transition.

Source : 4sysops

Using the CreateFromDirectory and ExtractToDirectory methods, it is possible to compress and extract files. In this tip I will show different constructors that can be used to either compress or extract files using this class. The following example will compress the files stored in the c:\testing folder:

Source : PowerShell Magazine

Excellent article that explain in details my the new Outlook app (Android and iOS) should not be used in enterprises.

Microsoft has released their iOS app “Outlook” today. And it will break your companies security for mobile PIM access in multiple ways! No matter if you’re a Microsoft Exchange or IBM Notes Traveler customer. I cannot believe that Microsoft has done what they’ve done. Even as a non-Microsoft guy I would have expected that they obey the rules of common company security rules.

Read it : {rene.winkelmeyer}
Also look at the follow up post : Updates on the latest Outlook iOS App issues

Microsoft has quietly added Office Remote—previously a Windows Phone exclusive—to the Google Play Store, allowing users of that platform to remotely control PowerPoint 2013 presentations on a Windows PC. There’s no official announcement about the app yet, so it’s possible that an iOS version of the app is coming as well, perhaps as soon as today.

Source : Office Remote Comes to Android - Thurrott.com

While studying up on Windows 10, I came across a technique that has been shown to reduce the time it takes to apply an OS WIM to disk by 20 – 50%*. That’s a fairly significant savings in time and the implementation of this technique is relatively easy and does not require you to change how you deploy Windows. Believe it or not, the savings come from adjusting the OS power management settings during a deployment. While there are multiple ways to implement these power management settings, below I’ve outlined what I consider the most non-intrusive to existing deployment methods.

Source : Reducing Windows Deployment time using Power Management - The Deployment Guys

In its drive to integrate OneDrive deeply with all of its core products, Microsoft has made the open and save operations in Office 2013 a bit ponderous. If you’re already syncing your OneDrive content to the PC—or if you intend to only use local folders regardless—you can configure various Office applications to open and save files more efficiently. Here’s how.

Source : Office 2013 Tip: Skip the Cloud Integration - Thurrott.com

DFS Replication Initial Sync in Windows Server 2012 R2: Attack of the Clones NedPyle [MSFT] 21 Aug 2013 5:18 PM 9 Hi folks, Ned here again. By now, you know that DFS Replication has some major new features in Windows Server 2012 R2. Today I talk about one of the most radical: DFSR database cloning. Prepare for a long post, this has a walkthrough…

Source : DFS Replication Initial Sync in Windows Server 2012 R2: Attack of the Clones - The Storage Team at Microsoft - File Cabinet Blog - Site Home - TechNet Blogs

Today we are releasing MS15-011 & MS15-014 which harden group policy and address network access vulnerabilities that can be used to achieve remote code execution (RCE) in domain networks. The MS15-014 update addresses an issue in Group Policy update which can be used to disable client-side global SMB Signing requirements, bypassing an existing security feature built into the product. MS15-011 adds new functionality, hardening network file access to block access to untrusted, attacker controlled shares when Group Policy refreshes on client machines. These two updates are important improvements that will help safeguard your domain network.

Source : MS15-011 & MS15-014: Hardening Group Policy - Security Research & Defense - Site Home - TechNet Blogs

Today, we announced the release of Outlook for iOS and a preview of Outlook for Android. If you have an iPhone, iPad, Android phone or Android tablet, chances are that you’re using the built-in email and calendaring capabilities of your device. Why use the new Outlook app instead? We’re glad you asked!

Source : A deeper look at Outlook for iOS and Android - Office Blogs

Last week, I wrote on the arrival of Microsoft’s security bulletin MS14-066, containing a security update addressing several vulnerabilities in the Secure Channel. Yesterday, Microsoft issued an updated version of the update.

Source : The things that are better left unspoken | Update on MS14-066
References : It’s time to update your Secure Channel (MS14-066, CVE-2014-6321)

LAN Speed Test Lite is a very simple network performance test utility that doesn’t have to be installed. You can simply launch it from your USB stick and then measure the upload and download speed for a network share of your choice. After you click Start Test, you can configure the size of the file you want to use for the test.

Source : FREE: Network performance test – LAN Speed Test Lite - 4sysops

JavaScript Object Notation (JSON) is quickly becoming the most used data-interchange format. XML enjoyed the top spot for a long time but slowly people have been moving towards JSON. JSON is a first-class citizen in Windows PowerShell. With many automation frameworks and software products adopting JSON, it is important for system administrators to understand what is JSON and how to use it. This article is a JSON primer to give you an overview of this data-interchange format and how to use it.

Source : PowerShell Magazine » A JSON primer for administrators

Anyone who is familiar with RDCMan will be thrilled to hear that there is an updated version available! For those of you who are new to RDCMan – it is a tool that allows you to easily manage multiple remote desktop sessions:

Source : Update for RDCMan - Ben Armstrong - Site Home - MSDN Blogs

Onetastic is a free multi-purpose addin for Microsoft OneNote 2010 and 2013.

Includes OneCalendar

Source : Onetastic for OneNote

ABC-Update is a free command-line tool that allows you to install Windows updates. It is easy to use and gives you the flexibility of deploying only specific updates in your scripts.

Source : FREE: ABC-Update – Install Windows updates at the command prompt - 4sysops

NEW YORK — Nov. 12, 2014 — On Wednesday, Microsoft Corp. reinforced its commitment to cross-platform developer experiences by open sourcing the full server-side .NET stack and expanding .NET to run on the Linux and Mac OS platforms. Microsoft also released Visual Studio Community 2013, a new free edition of Visual Studio that provides easy access to the Visual Studio core toolset. The announcements kicked off Microsoft’s Connect (); event, where the company released Visual Studio 2015 Preview and .NET 2015 Preview.

Source : Microsoft takes .NET open source and cross-platform, adds new development capabilities with Visual Studio 2015, .NET 2015 and Visual Studio Online | News Center

I think that I will start this Diary with the following statement: If you use an open source CMS, and you do not update it frequently, there is a very high chance that your website if not only compromised but also part of a botnet.

"You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is 7 hours after the announcement"

Source : InfoSec Handlers Diary Blog - The Wonderful World of CMS strikes again

If you have read some of my previous blog posts and IIS.NET articles about WebDAV, you will see that I often use the WebDAV Redirector that is built-in to Windows in order to connect to various WebDAV websites. This allows me to access my files via a mapped drive letter, which also enables me to use WebDAV with applications that do not have native WebDAV support. (Like Visual Studio.) I'm also a big fan of OneDrive, but sometimes I'm on a legacy system where I don't have OneDrive installed. With that in mind, I thought that I would put together a quick blog series to show you how to map a drive letter to your OneDrive files.

Using the WebDAV Redirector with OneDrive Part 1 - Standard Security

Using the WebDAV Redirector with OneDrive Part 2 - Two-Step Verification

Source : http://blogs.iis.net/

The other day I was troubleshooting 100% CPU utilization on a SQL Server 2008 database server. The server had 100 or so databases of varying sizes however none were larger than a few hundred MB and each database had a corresponding web site on a separate web server. Since the server hosted quite a few databases the high CPU needed to be resolved quickly because it was causing issues for everyone. High CPU on a database server can often be symptomatic of a issues occurring outside the server. In this case the real issue was in fact being caused by a SQL Injection attack on a web server.

Source : Solving SQL Server High CPU with IIS Request Filtering | Peter Viola

Another one of the great built-in features of IIS 8 is Dynamic IP Restrictions (DIPR). With a few simple configuration steps you can quickly set limits for blocking IP addresses based on the number of concurrent requests or frequency of requests over a period time. With these parameters in place IIS will take over blocking requests unattended thereby making your server more secure.

Source : Preventing Automated Attacks with IIS Dynamic IP Restrictions | Peter Viola

Microsoft is pleased to announce the final release of security baseline settings for Windows 8.1, Windows Server 2012 R2 and Internet Explorer 11. Some of the highlights of the new security baselines (many of which we intend to backport to older versions of Windows and IE):

Use of new and existing settings to help block some Pass the Hash attack vectors;
Recommendations to control the storage of plaintext-equivalent passphrases;
Blocking the use of web browsers on domain controllers;
Incorporation of the Enhanced Mitigation Experience Toolkit (EMET) into the standard baselines;
Removal of the recommendation to enable "FIPS mode" (this is discussed in greater detail in this blog post: Why We’re Not Recommending “FIPS Mode” Anymore);
Removal of almost all service startup settings, and all server role baselines that contain only service startup settings.

Source : Microsoft Security Guidance

We have made a small number of changes in the baseline security guidance for Windows 8.1, Windows Server 2012 R2 and Internet Explorer 11 since we released the beta version of our guidance last April. This blog post discusses those changes and the reasons for them.

Source : blogs.technet.com/b/secguide

Microsoft released the new Sysinternals tools, Sysmon, which allows you to monitor Windows process creations, file creation time changes, and network connections in the Windows Event Log.

Source : 4sysops.com

Many online articles suggests using the MakeCert.exe tool available in the Windows SDK for creating a self-signed certificate, but now there is an easier approach available.

New-SelfSignedCertificate-DnsNametest.powershellmagazine.com-CertStoreLocationcert:\LocalMachine\My

Source : PowerShell Magazine » #PSTip Generating a self-signed certificate

Kansa, a free, open source, PowerShell-based incident response framework hosted at https://github.com/davehull/Kansa.
Kansa is modular. It features a core script, dozens of collector modules and analysis scripts to help make sense of the data collected. Kansa takes advantage of Windows Remote Management and PowerShell remoting. It uses PowerShell’s default non-delegated Kerberos network logons, not CredSSP and therefore does not expose credentials to harvesting.

Source : PowerShell Magazine

FREE Microsoft eBooks! Who doesn’t love FREE Microsoft eBooks? Well, for the past few years, I’ve provided posts containing almost 150 FREE Microsoft eBooks and my readers, new and existing, have loved these posts so much that they downloaded over 3.5 Million free eBooks as of last June, including over 1,000,000 in a single week last year (and many, many more since then).

Source : Eric Ligman, Microsoft Senior Sales Excellence Manager, Blog

Microsoft this week detailed an obscure command line tool for Connected Standby (now InstantGo)-based PCs and devices that will help identify which applications are causing battery drain while the machine is sleeping. Dubbed Sleep Study, the tool is part of the powercfg.exe utility in Windows 8.1/RT 8.1 and will tell you how well the system slept and how much activity it experienced during that time.

Source : Paul Thurrott's SuperSite for Windows

With Internet Explorer 11, we’ve done work to make signing into sites faster and more reliable as well as give users more control when saving credentials. In addition, IE11 will now roam credentials to IE11 on Windows Phone 8.1!

We are giving control back to the user when deciding to save passwords on a given site. IE11 will now prompt the user to save passwords even if the autocomplete=off attribute is set on login forms.

Source : IEBlog

Excellent post with a step-by-step procedure to create a an inbox for all your accounts in Outlook 2013.

Ref : TinkerTry

We are removing FRS from Windows Server Today I’ll talk about what this means and how to get ready. We want this to be as easy as possible and I welcome any conversations that help you move forward with migrating to DFSR for SYSVOL replication.

Source : The Storage Team at Microsoft

You may have heard about InstantGo in Windows 8.1 (known as Connected Standby in Windows 8 and Windows RT), and how it has replaced the traditional sleep or standby function in many Windows 8.1 and Windows RT 8.1 systems. What you might not know is how fundamentally different—and better—it is, and why.

Source : InstantGo: a better way to sleep

Today we’re excited to announce the release of the Internet Explorer Developer Channel, a fully functioning browser designed to give Web developers and early adopters a sneak peek at the Web platform features we’re working on. The Developer Channel is available for download today for both Windows 8.1 and Windows 7 SP1 customers running Internet Explorer 11.
IE Developer Channel can run alongside and independently of IE11, and has all of the browser features that you love in IE11, as well as the latest platform features we’re working on. As you test drive these features, make sure to give us feedback through @IEDevChat or Connect.

Source : IEBlog

Installing Android on VirtualBox is a bit more complicated than with Windows. I’ll give you a few tips on how to install and configure a virtual machine for your Android lab.

Source : 4sysops

The name of the free tool Bulk Password Control is perhaps a bit misleading because the free tool enables you to automate all kinds of bulk modifications on Active Directory user objects with a fast to use GUI.

You know this popular picture of the GUI admin who clicks all day to reset user passwords after a security breach. Bulk Password Control is a nice example that proves that such tasks can be quickly done with a GUI tool without much click-click.

Source : 4sysops.com, www.wisesoft.co.uk

To reuse script samples on the Internet, the following steps seem quite familiar to IT Pros: wandering through different script galleries, forums and blogs, switching back and forth between webpages and scripting environment, and countless download, copy and paste operations. But all of these will drive one as dizzy as a goose. Need a simpler way of searching and reusing scripts? Try out the new Script Browser add-in for PowerShell ISE!

Source : Windows powershell Blog

There is a known issue which causes some PCs updated with the Windows 8.1 Update (KB 2919355) to stop scanning against Windows Server Update Services 3.0 Service Pack 2 (WSUS 3.0 SP2 or WSUS 3.2) servers which are configured to use SSL and have not enabled TLS 1.2.

Microsoft plans to issue an update as soon as possible that will correct the issue and restore the proper behavior for Windows 8.1 Update KB 2919355 scanning against all supported WSUS configurations. Until that time, we are temporarily suspending the distribution of the Windows 8.1 Update KB 2919355 to WSUS servers.

Source : blogs.technet.com/b/wsus/

Microsoft is taking an important step towards helping businesses stay up to date with the latest software, services, and devices. Enterprise Mode for Internet Explorer 11, announced today as an update for Windows 7 and Windows 8.1, provides better compatibility for older versions of Internet Explorer and tools to manage which Web apps use it.

Source : IEBlog

Security Compliance Manager (SCM) is a great free tool for helping with deployments and environment hardening. This article explains what’s new in version 3.0 and describes how you can use SCM in your deployment process to secure builds.

Source : 4sysops.com

So, let me kick off this series in which I’ll be sharing what it feels like to virtualize and clone Active Directory Domain Controllers safely on both platforms, with a blogpost on finding out whether your virtual Domain Controllers may benefit from the VM-GenerationID on the VMware-based hypervisors and, thus, may be safely virtualized and cloned.

Source : The things that are better left unspoken

The rumors are true: Microsoft confirmed today that it is making a version of OneNote available for free on every major desktop and mobile computing platform, including even the Mac. Additionally, the firm has announced some new OneNote tools, OneNote Clipper and Office Lens, as well as new partner services and a new extensibility model that will make it possible for any cloud service to integrate with this amazing note-taking and thought organization solution.

You can download OneNote 2013 for Windows from OneNote.com

You can get OneNote for Mac from the Mac App Store

Source : Paul Thurrott's SuperSite for Windows

Check out UptimeRobot. This is a free external monitoring tool that will check your site every five minutes and send you an email, text message, twitter notification, and more. What’s even better is that it will allow you to specify up to 50 monitors in total.

Source : life as a sysadmin

Good reading from Microsoft Malware Protection Center : Malicious Proxy Auto-Config redirection

Reading view is a new feature in Internet Explorer 11 for Windows 8.1 that helps you focus on the main content of the Web page you want to read. Reading view is a way to experience just the article or blog post you want to read, without the distractions of related (or unrelated) content surrounding the story. Find an article you want to read, switch to reading view, and settle into a great reading experience. When you’re done, just exit reading view to continue browsing on the site.

Source : IEBlog

Have you ever heard about IE Enhanced Protected Mode or Mark-of-the-Web (MOTW) ?

Well, if you encounter one of those problems you should :

Opening IIS Failed Request Logs files (XML+XSL) from you local machine with IE result in a text page without formatting.
Trying to access your local web server with the 127.0.0.1 ip (not localhost) or the real local ip of your computer with IE results in an error page.

You have to blame the IE Enhanced Protected Mode for those ‘problems’. Here’s two solutions :

1) Disable the Enhanced Protected Mode

Open Internet Options
click on the Advanced tab
Unselect ‘Enable Enhanced Protected Mode’ in the Security Section
Restart IE

2) Add you site to the Intranet Zone

Open Internet Option
Click on the Security tab
Select the Intranet zone
Click on the Sites button
Click on the Advanced button
Add the following address :

http://127.0.0.1 To allow access to your local web site

about:internet To allow access to file with a MOTW (ex: IIS Failed Request Logs)

Personally I prefer option 2.

References :

KitKat is the latest Android release from Google with a lot of attractive changes both inside and outside. Before it hits every Android phone out there, you certainly have a new way to experience it with a very simple set up in VMware Workstation 10.

Source : VMware Workstation Zealot

A couple of weeks ago, I delivered a presentation on Work Folders deployments, and there was a slide on how Work Folders interoperates with other file server technologies. It occurred to me that it is worth writing a blog post about it.

File classification infrastructure (FCI)

RMS encryption

Quotas and File screen

DFS Replication

Failover Clustering

SMB

Dynamic Access Control (DAC)

Source : The Storage Team at Microsoft - File Cabinet Blog

In Silicon Valley (and in media satellites that take the NoCal mindset to New York and beyond), everyone has an iPhone, a MacBook Pro, and a Gmail account. Microsoft products and services might as well be from Mars. So be skeptical when you read analyses or predictions of what's coming next from Redmond.

“The Nokia acquisition is a colossal mistake”

“Microsoft hates Open Source”

“Everyone hates Microsoft Office”

“Internet Explorer is a buggy, incompatible mess”

“Bing is a money-losing flop”

“Windows is fundamentally insecure and unreliable”

“Xbox should be spun off into a separate business”

“The ‘One Microsoft’ reorg is just rearranging deck chairs on the Titanic”

“Windows Phone is a failed experiment”

“Windows RT is dead”

Read the full article at The Ed Bott Report

Hello everyone, I am Palash Acharyya, Support Escalation Engineer with the Microsoft Platforms Core team. In the past decade, we have come a long way from Windows Server 2003 to all the way to Windows Server 2012R2. There has been a sea-change in the overall Operating System as a whole, and we have added/modified a lot of features. One of these is Disk Defragmentation and I am going to talk about it today.

Source : blogs.technet.com/b/askcore

Must read article about WinSXS folder and what’s new in Windows 8.1/2012 R2

Component Store Analysis Tool
Component Store Cleanup

Ref : blogs.technet.com/b/askcore

Apple's solidly built PCs have developed a cult following over the years, but they never made a dent in the enterprise. Why did the Mac fail to crack the enterprise code? I've found six reasons.

Source : The Ed Boot Report

No matter the application, I’ve always had three issues with MSIs. First,editing the MSI is a pain. Orca makes this a little less painful but the tool is starting to show some age. Second, distributing drivers with the original MSI is nearly impossible! Most of the time, the solution is using a mixture of DEVCON/PNPUTIL or a deployment share. Finally, custom actions (such as activations or follow-up procedures) have to be manually ran or deployed with Group Policy. There isn’t a simple way to embed these into an MSI.
There is one easy free solution to all of these issues. Today, we are going to use Scalable’s Smart Packager to make your MSI maintenance simple.

Source : DeployHappiness

Jean-Pierre Paradis's Blog

1) Disable the Enhanced Protected Mode

2) Add you site to the Intranet Zone

References :

About

Techno Bla Bla

Popular Posts

Label Cloud

Blog Archive

http://127.0.0.1	To allow access to your local web site
about:internet	To allow access to file with a MOTW (ex: IIS Failed Request Logs)