The concept is pretty simple – LAPS sets a Local Administrator password policy against all the computers (except domain controllers) in a domain environment.  A typical policy:

• Password is reset every X number of days
• Password meets complexity requirements
• Password meets length requirements

In my own environment I set a policy of 90 days and 24 completely randomized characters.

I found lots of resource online for getting started:

• How to install and configure Microsoft LAPS – 4sysops
• How to Configure Microsoft Local Administrator Password Solution (LAPS)

Both sites are great at detailing out the process.

The drawbacks I encountered:

1. If deploying the MSI package via GPO you do have to reboot the system for the install to happen
2. It doesn’t work for Domain-Joined systems in Azure unless you’ve planned for this in advance

When you deploy an Azure Windows VM, the ‘administrator’ account is reserved by Azure, so you’re prompted to create your own.  Out of the box configurations for LAPS utilizes the Administrator account, so unless you plan ahead and have a policy that resets the default Administrator to a different username, and incorporated the same username into your LAPS policy, your Azure Windows VMs will accept the policy but never return a password.

Truthfully I did cheat this last bit by just adding the Administrator username to the Azure VM and giving it a random password.  LAPS then did grab that account and reset the password according to policy.  This isn’t the right way to do it though, so I don’t recommend it.  Best practice would be to set your own Local Administrator username and implement across your domain, and incorporate into your LAPS policy.

Oct 18, 2024 – update

I keep hitting my head against needing to validate LAPS passwords.  Sometimes I don’t want the password, I want to know how many or which systems have a LAPS password:

Get-ADComputer -LDAPFilter “(ms-mcs-AdmPwd=*)” | select-object name

(Get-ADComputer -LDAPFilter “(ms-mcs-AdmPwd=*)”).count

Inversely to find out how many or which systems do not have a LAPS password:

Get-ADComputer -LDAPFilter “(!(ms-mcs-AdmPwd=*))” | select-object name

(Get-ADComputer -LDAPFilter “(!(ms-mcs-AdmPwd=*))”).count

The post Windows Security – LAPS appeared first on Wiredwolf Canada.

I started testing Ping Castle on my own Active Directory (mostly a lab environment) and scored way worse than I expected.  Ping Castle is like golf – the lower the score the better.  It’s scored based on findings in 4 categories, each category scored out of 100, with an overall total of 100 for all 4 categories.  I scored a 92/100.  Abysmal. 

Ping Castle shines in that it backs up all of its findings (which are extensive) with documentation to support best-practices, knowledge base articles on the subject, and recommendations.  One of those findings was the lack of good auditing configured on my AD domain.  The following list is what is recommended.  This is referenced in adsecurity.org but I couldn’t find the exact settings.  After more searching I did find it eventually on some other site, and re-running the analysis confirms my settings are now correct.  

Here are those settings for future reference:

Default Domain Controller Policy

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy

Audit account logon events: Failure
Audit account management: Success & Failure
Audit directory service access: Failure
Audit logon events: Failure
Audit policy change: Success & Failure
Audit privilege use: Success & Failure
Audit system events: Success & Failure

Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies

Account Logon

Audit Credential Validation: Success & Failure
Audit Kerberos Authentication: Service Success & Failure
Audit Kerberos Service Ticket: Operations Success & Failure

Account Management

Audit Computer Account Management: Success & Failure
Audit Other Account Management Events: Success & Failure
Audit Security Group Management: Success & Failure
Audit User Account Management: Success & Failure

Detailed Tracking

Audit DPAPI Activity Success & Failure
Audit Process Creation Success & Failure

DS Access

Audit Directory Service Access Success & Failure
Audit Directory Service Changes Success & Failure

Logon/Logoff

Audit Account Lockout Success
Audit Logoff Success
Audit Logon Success & Failure
Audit Special Logon Success & Failure

Policy Change

Audit Audit Policy Change Success & Failure
Audit Authentication Policy Change Success & Failure

System

Audit IPsec Driver Success & Failure
Audit Other System Events Success & Failure
Audit Security State Change Success & Failure
Audit Security System Extension Success & Failure
Audit System Integrity Success & Failure

I would imagine the Default Domain Policy should also be updated, or another GPO applied at the root of the domain specifically for auditing, but those settings would be more lax as we’d only be interested in logging the actual logins to the workstations as opposed to these settings which are tracking changes to security around authentication and key objects.

On the workstation these policy settings should be sufficient:

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy

Audit account logon events: Failure
Audit account management: Success & Failure
Audit directory service access: Failure
Audit logon events: Failure
Audit policy change: Success & Failure
Audit privilege use: Success & Failure
Audit system events: Success & Failure

I will write more about the Ping Castle findings later.

The post Active Directory Auditing appeared first on Wiredwolf Canada.

WSD stands for Web Services on Devices and it’s actually a port monitor.  When the device IP changes, because it was configured for DHCP for example, the API built in to the driver locates the device IP and updates the system according.  This is a convenient way to never actually set up your network properly.  It’s a crutch for poor network infrastructure management, in my not-so-humble opinion.

There are a couple of ways to find the IP of a WSD port-enabled device.

1. Look at the PROPERTIES (not Printer Properties) of the printer and look for a Web Access tab.  That should show the IP.
2. If method 1 doesn’t work, crack open the registry and navigate to:  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\DAFWSDProvider

Look through all the devices – the NAME of the device will appear, and listed within the key will also be the IP address it was last seen at.

The post Finding WSD Port for a printer appeared first on Wiredwolf Canada.

After a system restore the operating system won’t boot.  Now you’re digging through your recovery option CD’s trying to find a way to fix the operating system so it will boot.  You get your Microsoft Diagnostics and Recovery Toolset booted, attempt another system restore.  It fails.  You realize that the OS has deeper issues so you start digging and come up with running SFC /SCANNOW (hopefully an offline variation) and it fails with a message about being unable to run because “There is a system repair pending”.

I’ve come across this many times and until now have never found a way around it.  You simply cannot get there from here.  No Microsoft recovery tools will run until this pending system repair is dealt with, but you can’t deal with it because you can’t boot!

Well, there IS an answer:

dism.exe /image:C:\ /cleanup-image /revertpendingactions

From a command line interface from your Windows install disk or the MS DaRT disk I referenced above, this command and a reboot will clear the pending system repair allowing you to move forward.

Good luck!

The post Windows – Broken OS and cannot run SFC appeared first on Wiredwolf Canada.

Recently I had a client contact me. Their primary application is Oracle-based and was no longer functioning.  I quickly logged into the server and discovered immediately that it was hit with a Ransomware bug. The whole server was encrypted.

I didn’t even bother trying to investigate.  I shut the server down immediately and started the process of a full recovery.  That’s when I discovered that the Ransomware had also encrypted all of the local backups – not just for this server, but all backups for all systems.

Fortunately, I always push for redundant off-site backups.  In this case Acronis Cloud to the rescue.  It took about 4 hours but the server was fully restored to a time prior to the hack.  In that four hour period I did some investigation.

1. The account that I found logged in was named “admin”.  I confirmed that this account did not exist in Active Directory, therefore it was a local account to the server.
2. The server was using a custom RDP port, but that port was open to the public because there are third party Oracle specialists who occasionally have to service this system.

I wasn’t too worried about the admin account returning (though I did check) since it was a fully recovery, but I did review the local accounts. I still am not certain how the hackers got in, but I’m suspecting it was a man-in-the-middle RDP brute-force attack.

Anyway, long story short, the custom RDP port was restricted (no more public access) along with any other open server, and the server was restored fully with no real harm done.

However, this is only part of the story.  Over the past few weeks I’ve been encountering issues with other client networks being attacked.  Users are being locked out, sometimes instantaneously after having their passwords changed.  The security logs on the DC’s showed the same thing – a roughly 15 minute period where an unknown system (usually came up as MSTSC) was attempting to brute-force the the password.

This ended up presenting a whole field of frustration.  Microsoft Security Logs do not appear to record much in the way of relevant information.  It showed the username, usually without the domain, but not always, and MSTSC as the ‘Workstation’.  Since there is no system on the network named MSTSC I could only surmise that these were RDP attempts.  But to which system?  Several workstations have custom RDP ports open to the public.

After some searching I came up with a plan.

1. I need to see where the attacks are coming from and hopefully block them.  Are the attacks from a compromised PC on the network or from the outside?  To do this, I need to see what traffic is coming in on the router.  This will be a different blog entry.  Most of my clients have SonicWALL routers and as I discovered SonicWALL routers do not log Firewall Rule Hits.  I did find a way to monitor the traffic, but it wasn’t directly obvious so I’ll blog how to get monitoring working on SonicWALL routers.
2. I need to start monitoring the DC for invalid login attempts.  That’s what this blog entry is all about.
3. I need to be notified when attacks are happening.
4. I need to start pro-actively blocking the attacks.  I’m actually still looking for a solution for this.

So, monitoring the DC turned out to be an exercise in frustration. The Security Logging cannot be adjusted or adapted to provide more information. 

TCPView

A solution that I found proposed was to run TCPview.  Which I did and found it to be less than helpful.  For one thing, TCPview, while a fantastic tool, is also a bit of a pig, like most network monitoring utilities, and the overworked DC had issues running the program.  It’s also a reactive solution – you have to know the attack is happening to know to use the tool.

RDPGuard

I tried installing RDPGuard.  This is another excellent utility (Trial for 30 days only though) but discovered that unless the attacks were directed against the server itself, it wasn’t really going to help source the attack.  The attacks were against the workstations, not the servers, so while it functioned as expected, it didn’t really help.

Microsoft Network Manager

I installed the Microsoft Network Manager 3.4 and configured it for parsing Windows TCP captures.  However, this isn’t ideal either as again, this is a reactive solution that is based around extensive network monitoring, which is also a bit of a pig, and unless you capture huge amounts of data to parse, it’s window is too small.  Capturing even 5 minutes of data can be more than 1 GB of logging.  I did manage to run a capture while an attack was happening but was unable to determine exactly what protocol I should be monitoring.  I read that I should filter using ProtocolName == “NRPC” but that showed absolutely nothing.

Logon Auditing

Logon Auditing is a good idea regardless of whether you are having issues or not.  All administrators should know if user accounts are being accessed incorrectly, even if only to know which users are having trouble logging in.  Administrators shouldn’t be waiting for accounts to get locked out to determine if there’s an issue.  An issue could be there without getting to that stage.

This is the process I use to set up auditing:

1. GPO – Default Domain Controllers Policy
   (Click on the thumbnails to get the full picture)
    
2. GPO – Default Domain Policy
   
3. Download/Install Netwrix Account Lockout Examiner
4. Configure Account Lockout Examiner
   1. File –> Settings
   2. Managed Objects – Edit – set to All DC’s
   3. Notifications – Send notifications to a monitored email address and provide the SMTP server configuration (server and port)
      – does not do authenticated SMTP
   4. Add all users you want to monitor – including Administrator and Guest
      (I just add every user – you just know it’s the one you’re not watching that’s being hacked)

That’s it.  Wait for emails to come in or check on it regularly.  It runs as a service so even if the console is not running it’s still collecting data and sending notifications.

By turning on the Password Lockout settings hackers only get 10 attempts before the account is locked out for (at least) 15 minutes.  With enforced password complexity requirements, this would make brute force attacks pretty difficult.

The post Hardening RDP Security – Logon Auditing appeared first on Wiredwolf Canada.

When I wrote the blog post below, I had not actually experienced any issues.  I already locked out access to servers I manage by using IP restrictions, and I wasn’t generally too worried about workstations because I do push my clients to adhere to good password policies.  Given that I manage 30 networks and over 600 systems, this seemed to be pretty safe.

Recently I had an issue where user accounts were getting locked out, but not by the user.  Not just one user, and not just one network, but different users on unrelated networks.  When I started digging into it, I discovered that IP’s originating from countries all over the world were actively trying to brute force passwords using RDP.

What concerned me the most was how specific the attacks were.  They were targeting workstations with custom RDP ports (Port Redirections as described below) and even monitoring for changes in the custom ports.  For one user I grew concerned that the redirect port 3344 was too low and too easy to find, so moved it up to 25698.  Without skipping a beat the attacks resumed on the new port.  In addition to the port, they were targeting a specific username – the actual user of that PC.  The only thing they were missing (most of the time) was the domain itself, and obviously the password.

After ramping up some security measures, enhanced router logging and reporting, and turning on some auditing policies, it became clear that this is a widespread issue that was quietly targeting almost every network I manage.  Before I knew it, one of my clients who had an old 2003 server that was unfortunately exposed to the Public interface, got hacked and encrypted with Ransomware.

The fundamental issue I found with RDP security, while it does utilize SSL encryption, is that Microsoft has not hidden or even randomized the salt used for the encryption.  The “Man in the Middle” attack can therefore insert itself into the connection and collect all kinds of data about the connection state, including last used username.

So ignore the post below where I say RDP is secure.  It’s wrong.  RDP is not secure in and of itself.  If you cannot restrict access by IP then use something else.  VPN appears to be the favored approach (client VPN to the router/gateway) or move to a third party connection broker such as TeamViewer.

I am leaving the old post as a reminder that I do not know everything, and in this case I was wrong.  The MSP was right to recommend against RDP and possibly should have even refused to do the work. 

However, since they did do the work, they should have at least inserted some measures to ensure getting in one machine did not mean being able to get into all machines.  The processes I describe in this article should be followed regardless as best practices for security. I say this because the same issue happened to one of my networks (described above) but they were not able to get any further than that one server.  The MSP in question still did crappy work, but I will give them credit for making the recommendations to not use RDP in the first place.

I had a friend contact me recently about concerns using Remote Desktop Services.  Staff at his office wanted to be able to work from home.  RDP is built in to all Professional/Business Class operating systems, and it’s free. 

Apparently the IT company they use recommended against it, declaring that Remote Desktop Protocol is highly insecure.  The company did end up getting their RDP connections but no attention to improving security was observed.

Months later, the network was hacked.  Ground Zero was a conference room PC that had an open RDP connection to the public and was somehow compromised.  The IT company used this opportunity to say, “See? We told you this would happen.”

This is my blog so I feel I am entitled to have an opinion on this.

1. RDP itself is not insecure.  It is an encrypted connection (128-bit) that requires an authenticated connection.  It has policies in place that prevent things like user accounts with no passwords from connecting.  User accounts must either be local administrators or be added to the Remote Desktop Users security group.  
2. In my opinion the IT company in question here was right to inform the client of the security risks, but instead of just setting up the RDP connections should have also taken steps to harden the network security around the workstations that were opened up for remote connectivity.  Stepping up now with “we told you so” is a dick move.  If I was a decision maker at this company, I would be deciding to find another IT company.

Common security pitfalls setting up RDP:

• All Windows PC’s have a local built-in Administrator account as well as an initial administrator-level user account that was created when the PC was set up.  Typically Administrator is disabled, but equally typically on a Windows domain network, the initial user account that was created when the PC was set up has a weak or non-existent password.  This local user account is in the local Administrators group which is by default a member of the Remote Desktop Users group. (It should be noted that the username for this account could be anything – avoid using “user” or the PC name as the username for setting up the PC so it can’t be easily guessed.)
• Default RDP port is 3389.  It is possible to override this port in the registry but typically there’s no need.  However, if you have 1 public IP address and 3 remote desktop users each wanting to connect to his or her own workstation, you have to set different ports for each workstation.  This is done on the router and it’s called Port Redirection:
  • Workstation1 – Local IP: 10.0.0.11 RDP 3389 – Public IP 206.56.98.125 Port 56896
  • Workstation2 – Local IP: 10.0.0.12 RDP 3389 – Public IP 206.56.98.125 Port 56897
  • Workstation3 – Local IP: 10.0.0.13 RDP 3389 – Public IP 206.56.98.125 Port 56898 
• Some ISP’s change the Public IP’s for their customers frequently.  This can make using RDP access difficult if the Public IP changes – the users won’t know that the IP changed and the connection will be broken.  There are two solutions for this:
  • Obtain a Static IP from your ISP and/or
  • Utilize DDNS (Dynamic Domain Naming System)DDNS allows you to register a hostname.domain that links to your Public IP, no matter what your Public IP may be today.  This is accomplished by installing an agent on the network that sends a constant heartbeat to a public service that tracks the IP changes.  Utilizing DDNS is a good idea and many commercial and even some consumer level routers support it from common DDNS providers.  It’s anywhere from reasonably cheap to completely free. 

There are a number of easy-to-do tasks that can help prevent unauthorized access.  On a Windows Domain this can done by using Group Policies but if you don’t have a Windows Domain you can still do a lot at the workstation level by getting familiar with the Local Policies.

1. Ensure all local accounts are secured with strong passwords:
   1. Start -> Programs -> Administrative Tools -> Local Security Policy -> Account Policies -> Password Policy
      
      I actually recommend a “Minimum password length” of ’10’ but the important bit is the “Password must meet complexity requirements”.  This ensures that users cannot just put in “1234567” or “password” as a password.
      Remember to reset the passwords of the local accounts, and disable the Administrator account if it’s not already.
2. Set an account lockout policy:
   1. Start -> Programs -> Administrative Tools -> Local Security Policy -> Account Policies -> Account Lockout Policy
      
      This is a solid way to prevent brute force attacks.  With complicated passwords and getting locked out 30 minutes at a time it’s next to impossible to guess a password.
3. Limit which accounts can log in using Remote Desktop:
   1. Start -> Programs -> Administrative Tools -> Local Security Policy -> Local Policies -> User Rights Assignment
      1. Open Allow log on through Remote Desktop Services
      2. Remove Administrators
   2. Add users to the Remote Desktop Services Security Group manually

If you find a user account is constantly locked due to attempts to brute-force the password, start logging the IP’s of the attackers and set up additional firewall rules to block future attempts from these sources.  Unless it’s from bots on many systems specifically attacking your systems this should put an end to the attacks pretty quick.

This is the easy stuff and if you are using a Windows Domain then using Group Policies makes it easier to apply these settings to all workstations, or if that’s too intrusive then you can separate out only the PC’s and Users who require RDS (Remote Desktop Services) and apply to only those systems.

More complex considerations are:

• Two Factor Authentication
• Signed Certificates – Password Protected
• IP restrictions (limit which public IP’s can remotely connect)*

Two Factor Authentication just means that two authentication methods must be passed successfully to connect.  In this case, the user connects to the PC, logs in successfully using the Windows credentials, but is blocked from getting a desktop until another password prompt is successfully passed.

Two Factor Authentication is not built into connecting directly to Windows workstations and is a third party application that must be purchased or subscribed to.  If security is important to you then the costs associated shouldn’t really stop you.  I did some digging and found the costs to be generally quite reasonable. (I looked at Duo)

Signed Certificates (as opposed to Self-Signed Certificates) can be used but this is far more complicated to set up (and more costly).  The idea is to limit RDP access to the host PCs by requiring a signed and authenticated certificate using pre-shared keys to be installed to the remote PCs.  Basically, both ends of the connection must have the same certificate installed or the connection is dropped, even if Windows Authentication is successful.

On a workstation level this is probably not very practical.  I’ve never tried it either so I’m not even sure it would work, but in theory it should.  It’s a good idea but really only if you are also implementing RDP Gateway technologies to add additional security layers – in which case you have other options as well.  Plus to do it properly you shouldn’t use the same certificate for each system but rather purchase individual certificates for individual systems – which is a substantial yearly cost even at $100 per workstation.

IP Restrictions is probably one of the easiest ways to secure RDP connections but it can also be a bit inconvenient.  Basically, your router firewall rules specify which IP’s are permitted to connect to which PC’s.  Anyone probing your network looking for a way in will never even see an open port because the router will drop all traffic that doesn’t come from the specified IP’s.  The downside is the remote user must always be using the same IP to connect from.  The remote user can’t take his or her notebook to the local Starbucks to use the free WiFi to remotely connect.

I had a thought about this though.  In the same way that you can use DDNS to make the host network easy to find for the end user, you may be able to use the same concept in reverse to allow users to connect from anywhere by using a DDNS client on each workstation.  The connection is still restricted by IP but the IP can now be dynamic because it’s using the remote users DDNS client to get constant updates.  As long as the router can resolve names to an IP (internal DNS) and allows you to specify a host name vs strictly IP’s, I can’t see why this wouldn’t work.  I do this with VPN connections all the time in SonicWALL routers.

Getting back to the original reason for the post – the IT company mentioned above did none of these things.  The ground-zero PC was hacked into, then used to plant malicious software that spread throughout the network.  The hackers were able to get different types of remote connectivity to the other workstations and presumably the server to further compromise the security of the network.  Even if the original door was closed (the conference computer), access was still assured by way of the other systems.  Egg cracked wide open.

In addition to hardening the security of the RDP connection, it’s critical that systems are well protected by up-to-date antivirus software.  One in particular AV suite I like is from Kaspersky.  It’s protection is first class and it has features that renders it virtually bulletproof from tampering.  Even if there is unauthorized access to the PC, the remote user can do nothing to defeat the antivirus.  Somehow the hacker got in the door but got blocked at the elevator.

The final consideration is always the big picture.  Let’s say the hacker does somehow get past all of this security and manages to get a desktop session.  At this point, how secure is your network from malicious activity?  The AV software on the PC may prevent the hacker from installing malicious software, but will that stop data theft?  This is where, on business networks with Windows domain management, I tend to push to get user data away from the workstation. Using Group Policies I redirect user data to the file servers and I lock down all the shares to prevent ‘public’ access.  Even if a hacker finds himself on a desktop without a domain account, there’s virtually no corporate data he or she can access. 

Anyway, the scope of this post is to harden RDP connectivity.  I’ll talk about how to secure internal networks in separate posts.

The post Security – Hardening RDP connections appeared first on Wiredwolf Canada.

Recently I was asked to build a “Gamer level PC” for a family member.  This turned out to be a bit of an eye-opener.  If you don’t already know what you’re looking for the selection process can be exhausting and overwhelming.

However, there are a few basics that haven’t changed:  

1. What is the PC going to be used for?
2. What is your budget?
3. What are your basic requirements for audio and video?

If the PC is just a standard office PC to run MS Office, a browser, and a small handful of typical office oriented applications, then you would build the PC with an eye on the processing power.  There’s no need for overclocking, you’re probably only going to hook up 1 or 2 monitors, and you don’t need processing power to put a man on the moon, just work on a spreadsheet or PowerPoint presentation, and collect email. 

If you are looking at it purely from the point of view of a budget, then you should be planning to spend $900 to get a good quality computer that will meet most demands and last a while.  Less than that and you are looking at pre-built PC’s from London Drugs or Staples that are being blown out for cheap and will probably only last two or three years at most – with a warranty of 1 year max.

Selecting the processor falls into 3 categories:

• basic use – typically no more than 120 processes running at any given time – Intel i3-series processor is probably fine
  • I would avoid these on general principle – i3-Series processors are usually deficient of onboard cache memory (L1/L2). This has improved somewhat in the later generations of i3-series chips but they still tend to run out of gas too quickly when the system is even slightly pushed
• moderate use – user opens dozens of web pages, may run a couple small databases (MySQL seems popular), email is always open, and maybe some light graphics-capable rendering applications – like a web developer – Intel i5-series processor (quad core)
  • for Office PC’s this is the defacto standard – idles beautifully but also still performs well when you put your foot on the gas
• heavy lifting – same criteria as a moderate use profile but add in local server/services (MS SQL as an example) where you don’t want the background processes to kill the performance of the PC, 3D rendering (CAD) software, etc. – Intel i7-series processor (quad core)
  • this is freeway performance while pulling a loaded trailer – you step on the gas and rapidly accelerate despite the load you’re pulling

Most “Business Class” workstation grade motherboards will come with enough USB hookups, onboard display features, etc., to more than meet the demands of the end user. 

We have started opting for “Tiny” systems, where everything is integrated, there are no floppy drives, no CD-DVD ROM drives, and even the HDD is an mSATA Solid State ‘drive’ (looks like a memory stick). Solid State Drives tend to be small but the need for lots of storage on a workstation is usually counter-intuitive.  On a business network you want the users to store the company data on the company servers, not the workstations.

For the home user I would still push for the business class products as they tend to have better support and much better warranty, and are capable of handling most things.  Cheap is as cheap does – you get what you pay for.  Going cheap, unless you are a very occasional PC user with almost no ambition or little interest and/or skill with the PC, will leave you frustrated with your PC in the long run.

Once you’ve worked out the processor, you match it to a motherboard:  

• at least 4 USB ports but more is better with good mix between USB2 and USB3
• minimum of 4 GB memory – recommend 8 for moderate use or better
• 1 GB memory allocation for video

Gaming PC’s require a bit more thought.  How many monitors am I hooking up?  What is the resolution of those monitors?  What is the size/space I’m putting in a tower?  What peripherals will be hooked up?  Headphone/headset? AC3 or 7.1 digital Dolby Surround Sound? Gaming controllers?  

If the PC is used for gaming, or hosting virtual machines, the i7-series processor may still be sufficient but there is also the option to move into the i9-series where you have more cores than you know what to do with.  

At this point it’s a given that you need a powerful processor.  What you need to decide on is the motherboard.  This is where the selection of equipment becomes mind-boggling.  Every motherboard manufacturer makes probably 8 gamer boards for every entry level and business class motherboard.  However, the actual differences between gamer boards appears to be more to do with the requirements or preferences of the end user – such as front USB support, the number of ports provided, the number of PCIE slots provided, etc.  Side by Side comparisons between a lot of gamer boards doesn’t differentiate a lot with performance but rather with options.

At the time of writing this the 8th generation i-Series processors are out and they are pretty different from the previous generations.  Because of this only current operating systems (such as Windows 10) will even run on these boards.  This has to be a factor in your thinking – if the game or software you already have is legacy and isn’t already ported to the most current operating system – you may not want to go with the bleeding edge to get the best possible performance.

So for gamers, it’s less about the processor and more about the motherboard.  

• Chipset – Z-series is preferred for gaming
• Video – CPU and Video is closely intertwined so if you already have your favorite gamer video card you need to make sure it’s compatible – or if you are staying with onboard video it needs to match your monitor and gaming requirements
• Audio – depends on the space (good luck with 7.1 Dolby Surround or AC3 using headphones)
• Peripheral hookups – DisplayPort, HDMI, DVI, USB 2, 3, (and sub-versions), SATA, etc.

The supplementary equipment potential is also staggering.  Do I go with Intel Optane?  Should I invest in Solid State Drives?  What do I get if I need a lot of storage? If I overclock the system, don’t I need to also keep it running cool? Should I move to water-cooling systems? 

Honestly, unless you are a nerdy dork and you like to constantly tweak your PC, a standard setup is usually good enough when it comes to cooling.  Think about it – are you ripping the case off your X-Box Live so you can add water-cooling because you hacked the GS BIOS to overclock the processor?  If the answer is no, then you probably don’t need to worry about it too much for your gamer PC either.  Motherboards come with thermal controls and can alert you when you’re approaching temperature limits.  There are lots of gamer cases available (and I recommend getting one) that will allow you to expand your cooling requirements as needed.  I have always felt that overclocking a system is largely unnecessary.  Of course, I’m not a gamer trying to squeeze every ounce of performance out of my PC, so perhaps I’m biased.  I invest a lot in my PC, I don’t want to risk burning it out faster – I’d rather just pay more and get the performance I need without the risk.

Going SSD is just smart, at least for a system drive. They have no moving parts, generate very little heat, and are considerably faster than their mechanical counterparts.  If the budget is a concern, which it would be if you need multiple TB’s of space, a 7200 RPM server class SATA drive will do the trick, but do add at least a small SSD for your swap/cache.  This will give you a good boost in performance.

The PC I ended up building for my family member didn’t need to be bleeding edge.  While the preference was for a gaming class system, it’s not going to be used for gaming.  So I considered the hefty budget I was given ($5000) and decided these items were what I wanted to build a super-system that would last for at least the next 5 years and still be considered ‘fast’.

ASUS Prime H270-PRO motherboard

7th Generation i7 SkyLake 6700 processor – 3.4 GHz quad core
16 GB Kingston DDR4 memory
32 GB .M2 Optane

ASUS 27″ HD monitor

Seagate 2TB Barracuda “Pro” SATA3 drive

ASUS BluRay writer

fractal design Define R5 case

550 Watt “Gold” Thermaltake power supply with flat ribbon cables

Windows 10 Pro x64 OEM

This ran about $2200.  I would put this as a moderate to lower end gaming system.  A reasonable budget for a gaming system doesn’t really exist – there are too many options – but I’d say a pretty good one would run you around $4000.

Since the end user knows nothing about Windows 10 and has to be dragged kicking and screaming to use a more current operating system, but support for older operating systems (I think she’s still using Windows XP) is pretty much completely gone, I elected to build a system that would be fast enough to run VMware Player, allowing me to migrate her old PC over to the virtual realm, without breaking a sweat.  This option, I felt, gives the end user the best of both realms.  The performance of the XP system, even in the Player, will be far better than the 12 year old PC she’s been using, and she’ll be exposed to the newer (and supported) Windows environment, allowing her to become acclimated to Windows 10 at her own pace while still comfortably and with familiarity using her ‘old’ computer.

The time consuming part for me in selecting this particular board over others was price vs features.  I didn’t find a board that was 8th Generation i-Series that would be backwards compatible with previous generations.  Windows 10 Pro x64 allows for some ridiculous amount of memory (4 TB I think) but the motherboards are limited.  This motherboard was limited to 64 GB.  I couldn’t ever see the user needing more than 16 GB.  The board is feature rich, not bleeding edge, and very reasonably under $200.

If this had been a PC for me and I had the same budget I may have spent a bit more by going to the 8th generation, getting a moderately faster CPU, adding another 16 GB of memory, going completely Solid State, and adding a 4K capable video card.  Ballpark, add another $1000-$1500.  

A friend has also recently asked for advice on rebuilding her current PC.  A while ago she went to the store and requested “a monitor that she wouldn’t have to replace in 5 years”.  What she ended up with was a 4K monitor that completely outclassed her system.  Now it only runs at I think 24Hz (super choppy) and a lower than ideal resolution (or it would be even choppier).  She’s asking me for help on how to bring her PC up to match the monitor so she can game properly.

In the end I recommended a 4K capable video card from newegg.com.  The class of her PC (2nd generation i5-Series processor) is still in question, but despite the age of the system the Z-series chipset and bus speeds make it still a reasonably good computer.  Perhaps not ideal for recently released games, but with the right video card she can probably squeeze at least a couple more years out of the PC.

The reason I bring this up is because along with all the changes in processors, everything else has changed as well.  Buying the right video card also now depends on the processor you’re running and whether that processor will support the features of the video card.  Integration between components is only increasing, so it’s now critical that you do your homework to find the right components for your system, or you could end up like my friend – with a high end monitor that causes the PC to tank because it’s not well supported.  Whoever sold her that monitor should have been shot – a higher end 2K monitor would have done the job much better and caused a lot less stress for my friend who just wants it to work.

The post Building a PC – finding the groove appeared first on Wiredwolf Canada.

One thoroughly frustrating items is hiding/removing the Network icon from Windows Explorer.  I found plenty of references online on how to do this, but they weren’t user specific.  You modify a COMPUTER policy which means ALL users are affected, not just the user account you want to lock down.  As soon as the new policy is applied (triggered by the restricted user logging in) the Registry key is applied to the HKEY_LOCAL_MACHINE.  This works to limit the restricted user, but it then completely limits every other unrestricted user who logs into a shared PC.

I did some testing and found this key will work to hide the Network icon from Windows Explorer:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
REG_DWORD Value 0x1

When manually applied (a reboot is required) the user this is applied to will no longer see the Network icon in Windows Explorer.  You have to create the \NonEnum key and populate the key with the {F02C1A0D-BE21-4350-88B0-7367FC96EF3C} DWORD entry.  It’s not there by default.

Trying to get this to apply with a Group Policy seems to be very difficult.

I’m still working on getting this to work for a client.  When I have it finalized I’ll document the process here so anyone who finds this blog won’t experience the same frustrations I did.

— UPDATE —

I completed the GPO and confirmed that everything is working.  

COMPUTER CONFIGURATION

Policies

Windows Settings

Security Settings

System Services

Computer Browser (Startup Mode: Disabled)
Permissions – No permissions specified
Auditing – No Auditing specified

Registry

USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies
Configure this key then: Propagate inheritable permissions to all subkeys
ADD –> Allow BUILTIN\Users – Full Control to This key and subkeys

Administrative Templates

Network/Network Connections

Policy – Do not show the “local access only” network icon – Enabled

Network/Offline Files

Policy – Allow or Disallow use of the Offline Files Feature – Disabled
Policy – At logoff, delete local copy of the users’s offline files – Enabled
Policy – Enable file synchronization on costed networks – Disabled
Policy – Enable Transparent Caching – Enabled (leave default settings)
Policy – Prevent use of Offline Files folder – Enabled
Policy – Prohibit user configuration of Offline Files – Enabled
Policy – Remove “Make Available Offline” command – Enabled
Policy – Remove “Work Offline” command – Enabled
Policy – Synchronize all offline files before logging off – Disabled
Policy – Synchronize all offline files when logging on – Disabled
Policy – Synchronize offline files before suspend – Disabled
Policy – Turn off reminder balloons – Enabled

User Configuration

Policies

Windows Settings

Folder Redirection – for brevity will consolidate listed settings as they are all exactly the same for each redirected folder

AppData (Roaming)
Contacts
Desktop
Documents
Downloads
Favorites
Links
Music
Pictures
Saved Games
Searches
Start Menu
Videos

On my networks I create two user shares – \\servername\user_data and \\servername\profile_data$ (hidden share).  I put all the Documents and related folders in the user_data folder and put all the other profile folders in the profile_data$ hidden share. 
I never give exclusive access to any user folder to the user
I always set Policy Removal Behavior to Restore Contents (helpful if you ever want to change the path to these redirected folders to another server)

Administrative Templates

Control Panel

Policy – Prohibit access to Control Panel and PC Settings – Enabled

Control Panel/Personalization

Policy – Enable Screen Saver – Enabled
Policy – Force a specific visual style file or force Windows Classic (if you don’t specify anything it defaults to Windows Classic)
Policy – Password protect the screen saver – Enabled
Policy – Prevent changing screen saver – Enabled
Policy – Screen saver timeout – Enabled (set to 900 seconds)

Desktop

Policy – Do not add shares of recently opened documents to Network locations – Enabled
Policy – Do not save settings at exit – Enabled
Policy – Hide Internet Explorer icon on desktop – Disabled
Policy – Hide Network Locations on desktop – Enabled
Policy – Prevent adding, dragging, dropping, and closing the Taskbar’s toolbars – Enabled 
Policy – Prohibit adjusting desktop toolbars – Enabled 
Policy – Prohibit User from manually redirecting Profile Folders – Enabled
Policy – Remove Computer icon on the desktop – Enabled
Policy – Remove My Documents icon on the desktop – Enabled
Policy – Remove Properties from the Computer icon context menu – Enabled
Policy – Remove Properties from the Documents icon context menu – Enabled
Policy – Remove Properties from the Recycle Bin context menu – Enabled
Policy – Remove Recycle Bin icon from desktop – Enabled
Policy – Remove the Desktop Cleanup Wizard – Enabled

Desktop/Desktop

Policy – Disable Active Desktop – Enabled
Policy – Enable Active Desktop – Disabled

Network/Network Connections

Policy – Ability to Enable/Disable a LAN connection – Disabled
Policy – Prohibit access to properties of a LAN connection – Enabled
Policy – Prohibit access to properties of components of a LAN Connection – Enabled
Policy – Prohibit access to the Advanced Settings item on the Advanced menu – Enabled
Policy – Prohibit access to New Connection Wizard – Enabled
Policy – Prohibit Enabling/Disabling components of a LAN connection
Policy – Prohibit TCP/IP advanced configuration

Network/Offline Files

Policy – Error logging level (set to 3)
Policy – Prevent use of Offline Files Folder – Enabled
Policy – Prohibit user configuration of Offline Files – Enabled
Policy – Remove “Make Available Offline” command – Enabled
Policy – Specify administratively assigned Offline Files – set to the same location you set your folder redirections (\\server\user_data \\server\profile_data$)
Policy – Synchronize all offline files before logging off – Enabled
Policy – Synchronize all offline files when logging on – Enabled
Policy – Turn off reminder balloons – Enabled

Shared Folders

Policy – Allow DFS roots to be published – Disabled
Policy – Allow shared folders to be published – Disabled

Start Menu and Taskbar (This is a big one)

Policy – Add “Run in Separate Memory Space” check box to Run dialog box – Enabled
Policy – Add Logoff to the Start Menu – Enabled
Policy – Add Search Internet link to Start Menu – Disabled
Policy – Add the Run command to the Start Menu – Disabled
Policy – Change Start Menu power button – Enabled (Choose one of the following actions – Log off)
Policy – Clear history of recently opened documents on exit – Enabled
Policy – Clear history of tile notifications on exit – Enabled
Policy – Clear the recent programs list for new users – Enabled
Policy – Do not allow pinning items in Jump Lists – Enabled
Policy – Do not allow pinning programs to the Taskbar – Enabled
Policy – Do not allow pinning Store app to the Taskbar – Enabled
Policy – Do not allow taskbars on more than one display – Enabled
Policy – Do not display any custom toolbars in the taskbar – Enabled
Policy – Do not display or track items in Jump Lists from remote locations – Enabled
Policy – Do not keep history of recently opened documents – Enabled
Policy – Do not search communications – Enabled
Policy – Do not search for files – Enabled
Policy – Do not search Internet – Enabled
Policy – Do not search programs and Control Panel items – Enabled
Policy – Do not use the search-based method when resolving shell shortcuts – Enabled
Policy – Do not use the tracking-based method when resolving shell shortcuts – Enabled
Policy – Go to the desktop instead of Start when signing in – Enabled
Policy – Gray unavailable Windows Installer programs Start Menu shortcuts – Enabled
Policy – Hide the notification area – Disabled
Policy – Lock all taskbar settings – Enabled
Policy – Lock the Taskbar – Enabled
Policy – Prevent changes to Taskbar and Start Menu Settings – Enabled
Policy – Prevent users from adding or removing toolbars – Enabled
Policy – Prevent users from customizing their Start Screen – Enabled
Policy – Prevent users from moving taskbar to another screen dock location – Enabled
Policy – Prevent users from rearranging toolbars – Enabled
Policy – Prevent users from resizing the taskbar – Enabled
Policy – Prevent users from uninstalling applications from Start – Enabled
Policy – Remove access to the context menus for the taskbar – Enabled
Policy – Remove All Programs list from the Start menu – Disabled
Policy – Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands – Enabled
Policy – Remove Balloon Tips on Start Menu items – Enabled
Policy – Remove Clock from the system notification area – Disabled
Policy – Remove common program groups from Start Menu – Disabled
Policy – Remove Default Programs link from the Start menu. – Enabled
Policy – Remove Downloads link from Start Menu – Enabled
Policy – Remove frequent programs list from the Start Menu – Enabled
Policy – Remove Games link from Start Menu – Enabled
Policy – Remove Help menu from Start Menu – Enabled
Policy – Remove Homegroup link from Start Menu – Enabled
Policy – Remove links and access to Windows Update – Enabled
Policy – Remove Logoff on the Start Menu – Disabled
Policy – Remove Music icon from Start Menu – Enabled
Policy – Remove Network Connections from Start Menu – Enabled
Policy – Remove Network icon from Start Menu – Enabled
Policy – Remove pinned programs from the Taskbar – Disabled
Policy – Remove programs on Settings menu – Enabled
Policy – Remove Recent Items menu from Start Menu – Enabled
Policy – Remove Recorded TV link from Start Menu – Enabled
Policy – Remove Run menu from Start Menu – Enabled
Policy – Remove Search Computer link – Enabled
Policy – Remove Search link from Start Menu – Enabled
Policy – Remove See More Results / Search Everywhere link – Enabled
Policy – Remove the “Undock PC” button from the Start Menu – Enabled
Policy – Remove the Action Center icon – Enabled
Policy – Remove the battery meter – Enabled
Policy – Remove the networking icon – Enabled
Policy – Search just apps from the Apps view – Disabled
Policy – Show “Run as different user” command on Start – Disabled
Policy – Turn off all balloon notifications – Enabled
Policy – Turn off automatic promotion of notification icons to the taskbar – Enabled
Policy – Turn off feature advertisement balloon notifications – Enabled
Policy – Turn off notification area cleanup – Enabled
Policy – Turn off personalized menus – Enabled
Policy – Turn off user tracking – Enabled

System

Policy – Don’t run specified Windows applications – Enabled – specify “powershell.exe”
Policy – Prevent access to registry editing tools – Enabled
Policy – Prevent access to the command prompt – Enabled
Policy – Restrict these programs from being launched from Help – Enabled – specify “powershell.exe”

Windows Components/Desktop Gadgets

Policy – Turn off desktop gadgets – Enabled
Policy – Turn off user-installed desktop gadgets – Enabled

Windows Components/File Explorer

Policy – Do not request alternate credentials – Enabled
Policy – No Computers Near Me in Network Locations – Enabled
Policy – No Entire Network in Network Locations – Enabled
Policy – Remove “Map Network drive” and “Disconnect Network Drive” – Enabled

Windows Components/Internet Explorer/Browser menus

Policy – Tools menu: Disable Internet Options… menu options – Enabled

Windows Components/Internet Explorer/Internet Control Panel/Security Page

Policy – Turn on automatic detection of intranet – Enabled

Windows Components/Internet Explorer/Internet Settings/Advanced settings/Internet Connection Wizard Settings

Policy – Start the Internet Connection Wizard automatically – Disabled

Windows Components/Network Sharing

Policy – Prevent users from sharing within their profile – Enabled

Preferences

Windows Settings

Registry

{F02C1A0D-BE21-4350-88B0-7367FC96EF3C} (Order 1)

General
  Action = Replace
  Hive = HKEY_CURRENT_USER
  Key path = SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum
  Value name = {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  Value type = REG_DWORD
  Value data = 0x1 (1)
Common
  Stop processing items on this extension if an error occurs on this item = No
  Run in logged-on users’s security context (user policy option) = No
  Remove this item when it is no longer applied = Yes
  Apply once and do not reapply = No

{F02C1A0D-BE21-4350-88B0-7367FC96EF3C} (Order 2)

General
  Action = Create
  Hive = HKEY_CURRENT_USER
  Key path = SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum
  Value name = {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  Value type = REG_DWORD
  Value data = 0x1 (1)
Common
  Stop processing items on this extension if an error occurs on this item = No
  Run in logged-on users’s security context (user policy option) = No
  Remove this item when it is no longer applied = Yes
  Apply once and do not reapply = No

Control Panel Settings

Internet Settings

Internet Explorer 10: Internet Explorer 10 (Order 1)  – there’s a lot of options – leave them alone and attack the Proxy Configuration (set to 127.0.0.1)
–  remember to bypass Proxy for local connections and set “Do not use proxy servers for addresses beginning with” to your local LAN IPs and domain(s)

Repeat this configuration and it’s variations for all versions of Internet Explorer listed.
Also, what’s not mentioned is that Internet Explorer 10 is for version 10 and above (including Microsoft Edge)

Woah that’s a lot!  However, this configuration will give the restricted local user access to any applications installed to the PC, any printers installed to the PC, and any user generated data.  This will prohibit access to all local drives (including C:\ Drive, DVD-ROM drives, USB drives), Network locations (other PC’s or servers on the network) and network drives except those specifically assigned to this user.  I didn’t see the point in mapping the user home folder because with the folder redirection all the data (re)locations are completely transparent to the end user.  They don’t know that their Desktop folder is not physically located on this workstation.

If you actually read the whole post and reviewed every setting you may see there is some ambiguity.  I realized as I wrote this that the Computer policy prohibits use of Offline Files and Folders while the User policy turns it on.  Typically the Computer policy will override the User policy so the User policy settings turning on Offline Files and Folders is redundant.  I should probably fix that.

When it comes to Offline Files and Folders, on a local PC to the LAN it’s probably better to keep it all turned off.  If, however, the shared unit is a notebook/laptop, it’s better to turn them on.

Using the redirected folders makes it easier for an administrator to then add items to the user desktop, documents (pictures, music, videos), and start menu by accessing the home folder on the server share, and to make that share accessible to other management users.

Finally, one additional setting can be set to lock the system down even further – Start Menu and Taskbar – remove access to All Programs.  This restricts the user to whatever desktop shortcuts to local applications you want the user to have access to.  Since this is probably a domain-joined and therefore shared computer, it may have applications installed that you don’t want the restricted user to have access to.

The post Securely Lock Down a Windows Workstation appeared first on Wiredwolf Canada.

There’s no way to send the notebooks back after they’ve been opened and setup has been run.  The only solution – upgrade to Windows 10 Pro.  And that’s where the fun begins. 

First off, it’s extremely irritating that with the Digital Entitlement it’s IMPOSSIBLE to see what license has been assigned to a notebook visually.  I had to run through the setups of all 3 notebooks, installing additional software and prepping for the client, before I even realized that I didn’t have a Professional operating system. 

Once I realized it I informed the powers that be who then ordered 3 copies of Windows 10 Professional OEM. The cost for Windows 10 OEM is 2/3 what it is to purchase the upgrade.  Since they were never supposed to be Home Edition in the first place, that’s just throwing money away, on top of the time now wasted setting up the wrong OS.

But that’s where the fun really begins.  Armed with my 3 copies of Windows 10 OEM I re-ran the setup on each system, booting from the Windows 10 Pro media.  Instead of wiping the partitions I just overwrote the Windows partition.  I completed the install, answered all of Cortana’s questions, and when I got to a desktop – Windows 10 Home Edition.

WHAT??!?

Ok, I check the media – nope it’s right.  Huh.  What the hell?

I ran the setup again, this time wiping out all of the partitions.  Fresh, clean install of Windows 10 Pro on a pristine drive.  No system partition, no recovery partition, just like a new PC.  Again, completed the setup, answered all of Cortana’s questions, and at the desktop… Windows 10 Home.

DOUBLE WHAT??

When I launched the setup again, the third time, I noticed that all of the partitions I thought were wiped were now back.  How is that possible?

Well, with HP notebooks, and probably others, the Security features (Secure Boot) and such, pretty much tells the notebook to ignore anything you do, run through the process as though you are actually doing something effective, then defeat you in the end. Even after disabling all of that in the BIOS and issuing new Secure Boot keys, the setup remained exactly the same.  Windows 10 Home is here to stay.

The solution I found that finally resolve this issue – use this Windows 10 Pro Upgrade Key to upgrade the OS to an non-activated Windows 10 Pro system:

VK7JG-NPHTM-C97JM-9MPGT-3V66T

After using this key, I was able to boot to Windows 10 Pro, and apply the keys we’d purchased.

I just want to say that while I understand and agree to some extent to defeat the efforts of the people who pirate software – the approaches taken to secure the licensing really only serve to frustrate the legitimate user.  This does little to protect the end user and clearly that was never the intention.  This is Microsoft ‘protecting their investment’.  The pirates are still going to find ways to defeat the security.

Microsoft and others need to find better ways to protect themselves.  Especially in the case of Microsoft where the licensing model changes multiple times on a yearly basis.  How does it make any kind of sense that an upgrade license costs more than an OEM license?  Presumably the OS being upgraded was OEM to begin with, so if the machine fails, the Upgrade License would fail with it.  Running out and purchasing another system with the downgraded license a second time is not logical.

The post Windows 10 Upgrade Home to Pro appeared first on Wiredwolf Canada.

netsh advfirewall profile disableall

Add a user to a local group:

net localgroup groupname username /add

For example:  net localgroup administrators domain\user /add

The post Microsoft Workstation – common net & netsh commands appeared first on Wiredwolf Canada.