Tag: Windows 8

Upcoming change (March 2020) – Microsoft to disable use of unsigned LDAP port 389

In March 2020, Microsoft is going to release a update which will essentially disable the use of unsigned LDAP which will be the default. This means that you can no longer use bindings or services which binds to domain controllers over unsigned ldap on port 389. You can either use LDAPS over port 636 or using StartTLS on port 389 but it still requires that you addd a certificate to your domain controllers. This hardening can be done manually until the release of the security update that will enable these settings by default.

How to add signed LDAPS to your domain controllers

You can read more about the specific change here –> https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows you can also read more here –> https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-update-now/ba-p/921536

After the change the following features will be supported against Active Directory.

clipboard_image_0.png

How will this affect my enviroment?

Clients that rely on unsigned SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds or on LDAP simple binds over a non-SSL/TLS connection stop working after you make this configuration change. This also applies for 3.party solutions which rely on LDAP such as Citrix NetScaler/ADC or other Network appliances, Vault and or authentication mechanisms also rely on LDAP. If you haven’t fixed this it will stop working. This update will apply for all versions.

Windows Server 2008 SP2,
Windows 7 SP1,
Windows Server 2008 R2 SP1,
Windows Server 2012,
Windows 8.1,
Windows Server 2012 R2,
Windows 10 1507,
Windows Server 2016,
Windows 10 1607,
Windows 10 1703,
Windows 10 1709,
Windows 10 1803,
Windows 10 1809,
Windows Server 2019,
Windows 10 1903,
Windows 10 1909

How to check if something is using unsigned LDAP?

If the directory server is configured to reject unsigned SASL LDAP binds or LDAP simple binds over a non-SSL/TLS connection, the directory server will log a summary under eventid 2888 one time every 24 hours when such bind attempts occur. Microsoft advises administrators to enable LDAP channel binding and LDAP signing as soon as possible before March 2020 to find and fix any operating systems, applications or intermediate device compatibility issues in their environment.

You can also use this article to troubleshoot https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs

Credits: https://msandbu.org/upcoming-change-microsoft-to-disable-use-of-unsigned-ldap-port-389/

Install VMware PowerCli

1. Install the Powershell Get Module

Installing items from the Gallery requires the latest version of the PowerShellGet module, which is available in Windows 10, in Windows Management Framework (WMF) 5.0, or in the MSI-based installer (for PowerShell 3 and 4).

With the latest PowerShellGet module, you can:

Supported Operating Systems

The PowerShellGet module requires PowerShell 3.0 or newer.

Therefore, PowerShellGet requires one of the following operating systems:

  • Windows 10
  • Windows 8.1 Pro
  • Windows 8.1 Enterprise
  • Windows 7 SP1
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2008 R2 SP1

PowerShellGet also requires .NET Framework 4.5 or above. You can install .NET Framework 4.5 or above from here.

2. Find-Module -Name VMware.PowerCLI

3. Install-Module -Name VMware.PowerCLI -Scope CurrentUser

4. When you start Powershell VMware.Powershell is automatically loaded

CPU usage is high when you use RPC over HTTP protocol in Windows 8.1 or Windows Server 2012 R2

Consider the following scenario that takes Microsoft Exchange Server 2013 as an example:

  • The Mailbox server role is enabled in Exchange Server 2013.
  • Exchange mailboxes use extended MAPI to communicate with the Exchange Server.
  • The extended MAPI uses Microsoft RPC over HTTP (remote procedure call over HTTP) protocol.
  • Many clients (such as mobile devices) are dropping connections to the Exchange Server.

In this scenario, the CPU usage on the Exchange server may reach 100 percent.\

Hotfix: https://support.microsoft.com/en-us/hotfix/kbhotfix?kbnum=3041832&kbln=en-US

WMI Filters for OS version

DESKTOPS

ANY WINDOWS DESKTOP OS

  • Any Windows Desktop OS – 32-bit
    select * from Win32_OperatingSystem WHERE ProductType = “1” AND NOT OSArchitecture = “64-bit”
  • Any Windows Desktop OS – 64-bit
    select * from Win32_OperatingSystem WHERE ProductType = “1” AND OSArchitecture = “64-bit”

WINDOWS 7

  • Windows 7
    select * from Win32_OperatingSystem WHERE Version like “6.1%” AND ProductType=”1″
  • Windows 7 – 32-bit
    select * from Win32_OperatingSystem WHERE Version like “6.1%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 7 – 64-bit
    select * from Win32_OperatingSystem WHERE Version like “6.1%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 8.1

  • Windows 8.1
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″
  • Windows 8.1 – 32-bit
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 8.1 – 64-bit
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 8.1

  • Windows 8.1
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″
  • Windows 8.1 – 32-bit
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 8.1 – 64-bit
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 10

  • Windows 10
    select * from Win32_OperatingSystem WHERE ‘Version like ‘10.0.%’ AND ProductType=”1″
  • Windows 10 – 32-bit
    select * from Win32_OperatingSystem WHERE Version like “10.0.% AND ProductType=”1” AND NOT OSArchitecture = “64-bit”
  • Windows 10 – 64-bit
    select * from Win32_OperatingSystem WHERE Version like “10.0.%””6.3%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

SERVERS

ANY WINDOWS SERVER OS

  • Any Windows Server OS
    select * from Win32_OperatingSystem where (ProductType = “2”) OR (ProductType = “3”)
  • Any Windows Server OS – 32-bit
    select * from Win32_OperatingSystem where (ProductType = “2”) OR (ProductType = “3”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server OS – 64-bit
    select * from Win32_OperatingSystem where (ProductType = “2”) OR (ProductType = “3”) AND OSArchitecture = “64-bit”
  • Any Windows Server – Domain Controller
    select * from Win32_OperatingSystem where (ProductType = “2”)
  • Any Windows Server – Domain Controller – 32-bit
    select * from Win32_OperatingSystem where (ProductType = “2”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server – Domain Controller – 64-bit
    select * from Win32_OperatingSystem where (ProductType = “2”) AND OSArchitecture = “64-bit”
  • Any Windows Server – Non-Domain Controller
    select * from Win32_OperatingSystem where (ProductType = “3”)
  • Any Windows Server – Non- Domain Controller – 32-bit
    select * from Win32_OperatingSystem where (ProductType = “3”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server – Non-Domain Controller – 64-bit
    select * from Win32_OperatingSystem where (ProductType = “3”) AND OSArchitecture = “64-bit”

WINDOWS SERVER 2008 R2

  • Windows Server 2008 R2 – 64-bit – DC
    select * from Win32_OperatingSystem WHERE Version like “6.1%” AND ProductType=”2″
  • Windows Server 2008 R2 – 64-bit – non-DC
    select * from Win32_OperatingSystem WHERE Version like “6.1%” AND ProductType=”3″

WINDOWS SERVER 2012 R2

  • Windows Server 2012 R2 – 64-bit – DC
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”2″
  • Windows Server 2012 R2 – 64-bit – non-DC
    select * from Win32_OperatingSystem WHERE Version like “6.3%” AND ProductType=”3″

WINDOWS SERVER 2016

Announcing Open Live Writer – An Open Source Fork of Windows Live Writer

Today is the day. An independent group of volunteers within Microsoft has successfully open sourced and forked Windows Live Writer. The fork is called Open Live Writer (also known as OLW) and it is part of the .NET Foundationand managed by this group of volunteers. Read the fantastic announcement at the .NET Foundation Blog! Download Open Live Writer now!

Windows Live Writer 2012 was the last version Microsoft released and can still be downloaded from http://www.windowslivewriter.com. If you’re not comfortable using Open Source Software, I recommend you stick with classic WLW.

If you’re willing to put up with some bugs, then join us in this brave new world, you can download Open Live Writer from http://www.openlivewriter.org. We’re calling today’s release version 0.5.

Here’s some of the added features, the removed features, the stuff that doesn’t work, and our plans for the future:

  • REMOVED: Spell Checking. The implementation was super old and used a 3rd party spell checker we didn’t have a license to include an open source release. Going forward we will add Spell Check using the built-in spell checker that was added in Windows 8. Open Live Writer on Windows 7 probably won’t have spell check.
  • REMOVED: The Blog This API. It was a plugin to Internet Explorer and Firefox and was a mess of old COM stuff.
  • REMOVED: The “Albums” feature. It uploaded photos to OneDrive but depended on a library that was packaged with Windows Live Mail and Live Messenger and we couldn’t easily get permission to distribute it in an open source project.
  • ADDING VERY SOON: Google runs the excellent Blogger blog service. We’ve worked with the Blogger Team within Google on this project, and they’ve been kind enough to keep an older authentication endpoint running for many months while we work on Open Live Writer. Soon, Google and Blogger will finally shut down this older authentication system. Blogger will use the more modern OAuth 2 and Open Live Writer will be updated to support OAuth 2. Windows Live Writer will never support this new OAuth 2 authentication system, so if you use Blogger, you’ll need to use Open Live Writer.
  • BROKEN/KNOWN ISSUES: We are actively working on supporting Plugins. We have an plan in place and we are looking for your feedback on the most popular plugins that you want brought over from the Windows Live Writer ecosystem.

Our roadmap for the future is published here on GitHub.

 

image

Windows 8.1 with Hyper-V external switch – 802.1x will not work

I have Windows 8.1 with installed Hyper-V and virtual machines connected via Hyper-V Switch – External. 802.1x wired authentication is not working in host or in guest machine (computer is not responding to switch requests).
If I will change switch mode to Internal/Private it will start working.

Windows 8.1 with a Hyper-V external switch with 802.1x will not work!!!

From https://social.technet.microsoft.com/forums/windows/en-US/341cbe70-3fa7-4991-a7e4-4f1af63df4d0/windows-8-hyperv-8021x-eapol-request-missing i read that “official” statement from Microsoft is that 802.1x with Hyper-V on Windows 8.1 is not working by design. #Fail Microsoft.

Windows 10 build 10240 has released to the Fast Ring… Release To Manufacturing (RTM) build???

Windows 10 build 10240 has been released to the Fast Ring. That’s what I’m running on my laptop now. There were heavy rumors yesterday that this is the to Release To Manufacturing (RTM) build and is the one to be publically available on July 29th. But there is no hard confirmation on this by Microsoft yet Build 10240 now available for Windows Insiders in Fast and Slow rings.

“Over the past few days we’ve been preparing our release pipelines and processes, and this build is one step closer to what customers will start to receive on 7/29 …

On Monday we announced that builds from here on will only be available through Windows Update, so to get this one you can either wait and it will be installed automatically.”

Here’s how you prepare to roll it out in your company.

In a previous blog post I wrote about the update you needed for your KMS server to be able to activate Windows 10 clients. Read about that in KB3058168: Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows

Meanwhile Microsoft has also published the Windows 10 client KMS activation which keys can be found here Appendix A: KMS Client Setup Keys

Windows 10

Operating system edition
KMS Client Setup Key

Windows 10 Professional: W269N-WFGWX-YVC9B-4J6C9-T83GX
Windows 10 Professional N: MH37W-N47XK-V7XM9-C7227-GCQG9
Windows 10 Enterprise: N: NPPR9-FWDCX-D2C8J-H872K-2YT43
Windows 10 Enterprise N: DPH2V-TTNVB-4X9Q3-TJR4H-KHJW4
Windows 10 Education: NW6C2-QMPVW-D7KKK-3GKT6-VCFB2
Windows 10 Education N: 2WH4N-8QGBV-H22JP-CT43Q-MDWW
Windows 10 Enterprise 2015 LTSB: WNMTR-4C88C-JK8YV-HQ7T2-76DF9
Windows 10 Enterprise 2015 LTSB N: 2F77B-TNFGY-69QQF-B8YKP-D69TJ

Do note this is the key you use when you activate the Windows 10 Client against a KMS server. It is not the KMS license server key. That one you’ll need to obtain from your valid Microsoft licenses.

Update that enables Windows 8.1, Windows Server 2012 R2, Windows 8, and Windows Server 2012 Key Management Service (KMS) hosts to activate a later version of Windows.

Windows 10 will be available on July 29th 2015. Microsoft has prepared for this by already making an Update(KB3058168) that enables Windows 8.1, Windows Server 2012 R2, Windows 8, and Windows Server 2012 Key Management Service (KMS) hosts to activate a “later version of Windows”. This must means Windows 10. I do not know if this means that is even for Windows Server 2016. Windows 10 will be activated by a KMS server running this update but it might.

Select the version you need for the KMS server or servers you use and install them.

image

How to add a driver to the DriverStore

All drivers are stored in the so called DriverStore, which is located under %SYSTEMDRIVE%\Windows\System32\DriverStore.

With the built-in command line tool pnputil you can add or remove drivers.

How does it work?

  1. Start an elevated command prompt (Start, type CMD, hit Ctrl+Shift+Enter)
  2. Adding a driver:
    • Pnputil.exe -a c:\LOCATION_OF_DRIVER\DRIVER_NAME.inf
      The location can be either local or remote
    • Pnputil.exe -a C:\LOCATION_OF_DRIVER\*.inf
      Copy all drivers from that folder
  3. Deleting a driver:
    • Pnputil.exe -d DRIVER_NAME.inf

How to setup a remote PowerShell-session with Exchange 2013

Now I want to manage my Exchange 2013 environment from the Windows 8 workstation, no Exchange tools are installed on the Windows 8 laptop. In a few simple steps you can open a remote PowerShell session to one of the Exchange Servers.

Logon to the Windows 8 machine and start the ‘Windows PowerShell ISE

 

$RemoteEx2013Session = New-PSSession -ConfigurationName Microsoft.Exchange `
                                     -ConnectionUri http://servername/PowerShell/ `
                                     -Authentication Kerberos -Credential (Get-credential)
Import-PSSession $RemoteEx2013Session

Save this to Remote Exchange 2013 Powershell.ps1

Don’t forget setting your Powershell to unrestricted with: set-executionpolicy unrestricted

Translate »