Install Windows 2019 from USB

 https://www.thomasmaurer.ch/2018/07/create-a-usb-drive-for-windows-server-2019-installation/

# Define Path to the Windows Server 2019 ISO $ISOFile = "C:\Temp\WindowsServer2019.iso"   # Get the USB Drive you want to use, copy the friendly name Get-Disk | Where BusType -eq "USB"   # Get the right USB Drive (You will need to change the FriendlyName) $USBDrive = Get-Disk | Where FriendlyName -eq "Kingston DT Workspace"   # Replace the Friendly Name to clean the USB Drive (THIS WILL REMOVE EVERYTHING) $USBDrive | Clear-Disk -RemoveData -Confirm:$true -PassThru   # Convert Disk to GPT $USBDrive | Set-Disk -PartitionStyle GPT   # Create partition primary and format to FAT32 $Volume = $USBDrive | New-Partition -UseMaximumSize -AssignDriveLetter | Format-Volume -FileSystem FAT32 -NewFileSystemLabel WS2019   # Mount iso $ISOMounted = Mount-DiskImage -ImagePath $ISOFile -StorageType ISO -PassThru   # Driver letter $ISODriveLetter = ($ISOMounted | Get-Volume).DriveLetter   # Copy Files to USB Copy-Item -Path ($ISODriveLetter +":\*") -Destination ($Volume.DriveLetter + ":\") -Recurse   # Dismount ISO Dismount-DiskImage -ImagePath $ISOFile

How to change Windows password in RDP or Citrix remote session

 Start "osk"  - On Screen Keyboard - then press CTRL-ALT and with mouse DEL on the osk.

script to for TLS hardening in Windows servers

https://www.hass.de/content/setup-microsoft-windows-or-iis-ssl-perfect-forward-secrecy-and-tls-12

LDAP changes in Windows

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-march-2020/ba-p/921536#

https://support.microsoft.com/en-us/help/4546509/frequently-asked-questions-about-changes-to-ldap

https://www.msxfaq.de/windows/sicherheit/ldapenforcechannelbinding.htm

https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs

Windows Hello on HP Probook 470 G0

If you are looking for fingerprint sensor drivers for Windows Hello, try to get it from here:

https://h30434.www3.hp.com/t5/Notebook-Hardware-and-Upgrade-Questions/Biometric-Validity-

Sensor-Driver-Windows-10/td-p/6703491 

I have WH bio-metric sensor successfully running on this platform.

D.

Script to Clear Credman

https://blogs.technet.microsoft.com/rmilne/2019/01/11/script-to-clear-credman/

Disk C space issue? use mklink /j

mkdir D:\ProgramData
robocopy /XJ /MIR "C:\ProgramData" "D:\ProgramData"
mklink /J "C:\ProgramData" "D:\ProgramData"

Windows 2019 server activation error

With a correct key, we can not activate Windows 2019 server:

"We can’t activate Windows on this device as we can’t connect to your organization’s activation server. Make sure that you’re connected to your organization’s network and try again."

The workaround is to do with command line - run as administrator:

slmgr.vbs /ipk   key-key-..

PGP for Widows

https://www.gpg4win.de/thanks-for-download.html

Verify certificate with command line certutil.exe

The command to verify a certificate:

certutil -f -urlfetch -verify C:\temp\www.google.de.crt

https://www.admin-enclave.com/en/articles/windows/57-how-to-verify-the-certificate-chain-via-windows.html

ADFS 2016 auditing

https://blog.dacimm.com/audit-adfs-extranet-lockout-protection-81620ec055df

ICMP redirect

In the middle of migration from one firewall to another you may discover that you need to point a specific migrated IP to new firewall, while default gateway remains as old firewall.


Then in the old firewall you will specify a route to forward to new firewall.

When a user will ping that IP, the old firewall as default route will respond with ICMP redirect message.  This message will most problably be ingored by your user PC.

Check if the registry Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect   is 1

and that Firewall allows ICMP Redirect messages (the best is to enable a custom Windows firewall rules to let this to be accepted in trusted networks, but not in public as example.


Then when you ping you will see ICMP redirect message in Wireshark, then after a while that your PC starts sending it to new Firewall.


Note that "route print" will not show this new route.

Direct Access on Windows 10 does not send troubleshooting logs

http://itcalls.blogspot.com/2018/08/windows-10-directaccess-collect-logs.html

Disable DH 2014

https://www.admin-enclave.com/en/articles/windows/396-security-hardening-upgrade-diffie-hellman-prime-to-2048bit-on-windows-server.html

SFB certificates check

https://blogs.technet.microsoft.com/uclobby/2015/07/21/script-lync-sfb-server-certificate-store-validation/

Select Windows 2016 with GUI right from the begining

Do not forget to select Windows 2016 with Desktop experience, unless you want to have server core flavour.  You can not convert from core to GUI. You have to reinstall.

Windows 2008 R2 TLS Poodle vulnerability

Install KB2655992 and reboot server

How to kill remote RDP session

https://rodolfovaraujo.wordpress.com/2012/03/06/how-to-kill-rdp-sessions-remotely-if-exceeded/


query session /server:servername

reset session ID /server:servername

Powershell module for DNS of Windows 2008R2

Here is a module that you can use on legacy servers http://dnsshell.codeplex.com/, once instaled you can run as example get-dnsrecord

But if you have Windows 2012 R2 you do not need external module anymore, use build-in Get-DnsServerResourceRecord and enjoy.

DPM 2012R2 - An unexpected error occurred while the job was running. (ID 104 Details: Internal error code: 0x809909FF)

If you see this error, try to allign all DPM agents versions in your HyperV cluster and reboot each node.