The concept is pretty simple – LAPS sets a Local Administrator password policy against all the computers (except domain controllers) in a domain environment.  A typical policy:

• Password is reset every X number of days
• Password meets complexity requirements
• Password meets length requirements

In my own environment I set a policy of 90 days and 24 completely randomized characters.

I found lots of resource online for getting started:

• How to install and configure Microsoft LAPS – 4sysops
• How to Configure Microsoft Local Administrator Password Solution (LAPS)

Both sites are great at detailing out the process.

The drawbacks I encountered:

1. If deploying the MSI package via GPO you do have to reboot the system for the install to happen
2. It doesn’t work for Domain-Joined systems in Azure unless you’ve planned for this in advance

When you deploy an Azure Windows VM, the ‘administrator’ account is reserved by Azure, so you’re prompted to create your own.  Out of the box configurations for LAPS utilizes the Administrator account, so unless you plan ahead and have a policy that resets the default Administrator to a different username, and incorporated the same username into your LAPS policy, your Azure Windows VMs will accept the policy but never return a password.

Truthfully I did cheat this last bit by just adding the Administrator username to the Azure VM and giving it a random password.  LAPS then did grab that account and reset the password according to policy.  This isn’t the right way to do it though, so I don’t recommend it.  Best practice would be to set your own Local Administrator username and implement across your domain, and incorporate into your LAPS policy.

Oct 18, 2024 – update

I keep hitting my head against needing to validate LAPS passwords.  Sometimes I don’t want the password, I want to know how many or which systems have a LAPS password:

Get-ADComputer -LDAPFilter “(ms-mcs-AdmPwd=*)” | select-object name

(Get-ADComputer -LDAPFilter “(ms-mcs-AdmPwd=*)”).count

Inversely to find out how many or which systems do not have a LAPS password:

Get-ADComputer -LDAPFilter “(!(ms-mcs-AdmPwd=*))” | select-object name

(Get-ADComputer -LDAPFilter “(!(ms-mcs-AdmPwd=*))”).count

The post Windows Security – LAPS appeared first on Wiredwolf Canada.

Recently I was asked to build a “Gamer level PC” for a family member.  This turned out to be a bit of an eye-opener.  If you don’t already know what you’re looking for the selection process can be exhausting and overwhelming.

However, there are a few basics that haven’t changed:  

1. What is the PC going to be used for?
2. What is your budget?
3. What are your basic requirements for audio and video?

If the PC is just a standard office PC to run MS Office, a browser, and a small handful of typical office oriented applications, then you would build the PC with an eye on the processing power.  There’s no need for overclocking, you’re probably only going to hook up 1 or 2 monitors, and you don’t need processing power to put a man on the moon, just work on a spreadsheet or PowerPoint presentation, and collect email. 

If you are looking at it purely from the point of view of a budget, then you should be planning to spend $900 to get a good quality computer that will meet most demands and last a while.  Less than that and you are looking at pre-built PC’s from London Drugs or Staples that are being blown out for cheap and will probably only last two or three years at most – with a warranty of 1 year max.

Selecting the processor falls into 3 categories:

• basic use – typically no more than 120 processes running at any given time – Intel i3-series processor is probably fine
  • I would avoid these on general principle – i3-Series processors are usually deficient of onboard cache memory (L1/L2). This has improved somewhat in the later generations of i3-series chips but they still tend to run out of gas too quickly when the system is even slightly pushed
• moderate use – user opens dozens of web pages, may run a couple small databases (MySQL seems popular), email is always open, and maybe some light graphics-capable rendering applications – like a web developer – Intel i5-series processor (quad core)
  • for Office PC’s this is the defacto standard – idles beautifully but also still performs well when you put your foot on the gas
• heavy lifting – same criteria as a moderate use profile but add in local server/services (MS SQL as an example) where you don’t want the background processes to kill the performance of the PC, 3D rendering (CAD) software, etc. – Intel i7-series processor (quad core)
  • this is freeway performance while pulling a loaded trailer – you step on the gas and rapidly accelerate despite the load you’re pulling

Most “Business Class” workstation grade motherboards will come with enough USB hookups, onboard display features, etc., to more than meet the demands of the end user. 

We have started opting for “Tiny” systems, where everything is integrated, there are no floppy drives, no CD-DVD ROM drives, and even the HDD is an mSATA Solid State ‘drive’ (looks like a memory stick). Solid State Drives tend to be small but the need for lots of storage on a workstation is usually counter-intuitive.  On a business network you want the users to store the company data on the company servers, not the workstations.

For the home user I would still push for the business class products as they tend to have better support and much better warranty, and are capable of handling most things.  Cheap is as cheap does – you get what you pay for.  Going cheap, unless you are a very occasional PC user with almost no ambition or little interest and/or skill with the PC, will leave you frustrated with your PC in the long run.

Once you’ve worked out the processor, you match it to a motherboard:  

• at least 4 USB ports but more is better with good mix between USB2 and USB3
• minimum of 4 GB memory – recommend 8 for moderate use or better
• 1 GB memory allocation for video

Gaming PC’s require a bit more thought.  How many monitors am I hooking up?  What is the resolution of those monitors?  What is the size/space I’m putting in a tower?  What peripherals will be hooked up?  Headphone/headset? AC3 or 7.1 digital Dolby Surround Sound? Gaming controllers?  

If the PC is used for gaming, or hosting virtual machines, the i7-series processor may still be sufficient but there is also the option to move into the i9-series where you have more cores than you know what to do with.  

At this point it’s a given that you need a powerful processor.  What you need to decide on is the motherboard.  This is where the selection of equipment becomes mind-boggling.  Every motherboard manufacturer makes probably 8 gamer boards for every entry level and business class motherboard.  However, the actual differences between gamer boards appears to be more to do with the requirements or preferences of the end user – such as front USB support, the number of ports provided, the number of PCIE slots provided, etc.  Side by Side comparisons between a lot of gamer boards doesn’t differentiate a lot with performance but rather with options.

At the time of writing this the 8th generation i-Series processors are out and they are pretty different from the previous generations.  Because of this only current operating systems (such as Windows 10) will even run on these boards.  This has to be a factor in your thinking – if the game or software you already have is legacy and isn’t already ported to the most current operating system – you may not want to go with the bleeding edge to get the best possible performance.

So for gamers, it’s less about the processor and more about the motherboard.  

• Chipset – Z-series is preferred for gaming
• Video – CPU and Video is closely intertwined so if you already have your favorite gamer video card you need to make sure it’s compatible – or if you are staying with onboard video it needs to match your monitor and gaming requirements
• Audio – depends on the space (good luck with 7.1 Dolby Surround or AC3 using headphones)
• Peripheral hookups – DisplayPort, HDMI, DVI, USB 2, 3, (and sub-versions), SATA, etc.

The supplementary equipment potential is also staggering.  Do I go with Intel Optane?  Should I invest in Solid State Drives?  What do I get if I need a lot of storage? If I overclock the system, don’t I need to also keep it running cool? Should I move to water-cooling systems? 

Honestly, unless you are a nerdy dork and you like to constantly tweak your PC, a standard setup is usually good enough when it comes to cooling.  Think about it – are you ripping the case off your X-Box Live so you can add water-cooling because you hacked the GS BIOS to overclock the processor?  If the answer is no, then you probably don’t need to worry about it too much for your gamer PC either.  Motherboards come with thermal controls and can alert you when you’re approaching temperature limits.  There are lots of gamer cases available (and I recommend getting one) that will allow you to expand your cooling requirements as needed.  I have always felt that overclocking a system is largely unnecessary.  Of course, I’m not a gamer trying to squeeze every ounce of performance out of my PC, so perhaps I’m biased.  I invest a lot in my PC, I don’t want to risk burning it out faster – I’d rather just pay more and get the performance I need without the risk.

Going SSD is just smart, at least for a system drive. They have no moving parts, generate very little heat, and are considerably faster than their mechanical counterparts.  If the budget is a concern, which it would be if you need multiple TB’s of space, a 7200 RPM server class SATA drive will do the trick, but do add at least a small SSD for your swap/cache.  This will give you a good boost in performance.

The PC I ended up building for my family member didn’t need to be bleeding edge.  While the preference was for a gaming class system, it’s not going to be used for gaming.  So I considered the hefty budget I was given ($5000) and decided these items were what I wanted to build a super-system that would last for at least the next 5 years and still be considered ‘fast’.

ASUS Prime H270-PRO motherboard

7th Generation i7 SkyLake 6700 processor – 3.4 GHz quad core
16 GB Kingston DDR4 memory
32 GB .M2 Optane

ASUS 27″ HD monitor

Seagate 2TB Barracuda “Pro” SATA3 drive

ASUS BluRay writer

fractal design Define R5 case

550 Watt “Gold” Thermaltake power supply with flat ribbon cables

Windows 10 Pro x64 OEM

This ran about $2200.  I would put this as a moderate to lower end gaming system.  A reasonable budget for a gaming system doesn’t really exist – there are too many options – but I’d say a pretty good one would run you around $4000.

Since the end user knows nothing about Windows 10 and has to be dragged kicking and screaming to use a more current operating system, but support for older operating systems (I think she’s still using Windows XP) is pretty much completely gone, I elected to build a system that would be fast enough to run VMware Player, allowing me to migrate her old PC over to the virtual realm, without breaking a sweat.  This option, I felt, gives the end user the best of both realms.  The performance of the XP system, even in the Player, will be far better than the 12 year old PC she’s been using, and she’ll be exposed to the newer (and supported) Windows environment, allowing her to become acclimated to Windows 10 at her own pace while still comfortably and with familiarity using her ‘old’ computer.

The time consuming part for me in selecting this particular board over others was price vs features.  I didn’t find a board that was 8th Generation i-Series that would be backwards compatible with previous generations.  Windows 10 Pro x64 allows for some ridiculous amount of memory (4 TB I think) but the motherboards are limited.  This motherboard was limited to 64 GB.  I couldn’t ever see the user needing more than 16 GB.  The board is feature rich, not bleeding edge, and very reasonably under $200.

If this had been a PC for me and I had the same budget I may have spent a bit more by going to the 8th generation, getting a moderately faster CPU, adding another 16 GB of memory, going completely Solid State, and adding a 4K capable video card.  Ballpark, add another $1000-$1500.  

A friend has also recently asked for advice on rebuilding her current PC.  A while ago she went to the store and requested “a monitor that she wouldn’t have to replace in 5 years”.  What she ended up with was a 4K monitor that completely outclassed her system.  Now it only runs at I think 24Hz (super choppy) and a lower than ideal resolution (or it would be even choppier).  She’s asking me for help on how to bring her PC up to match the monitor so she can game properly.

In the end I recommended a 4K capable video card from newegg.com.  The class of her PC (2nd generation i5-Series processor) is still in question, but despite the age of the system the Z-series chipset and bus speeds make it still a reasonably good computer.  Perhaps not ideal for recently released games, but with the right video card she can probably squeeze at least a couple more years out of the PC.

The reason I bring this up is because along with all the changes in processors, everything else has changed as well.  Buying the right video card also now depends on the processor you’re running and whether that processor will support the features of the video card.  Integration between components is only increasing, so it’s now critical that you do your homework to find the right components for your system, or you could end up like my friend – with a high end monitor that causes the PC to tank because it’s not well supported.  Whoever sold her that monitor should have been shot – a higher end 2K monitor would have done the job much better and caused a lot less stress for my friend who just wants it to work.

The post Building a PC – finding the groove appeared first on Wiredwolf Canada.

There’s no way to send the notebooks back after they’ve been opened and setup has been run.  The only solution – upgrade to Windows 10 Pro.  And that’s where the fun begins. 

First off, it’s extremely irritating that with the Digital Entitlement it’s IMPOSSIBLE to see what license has been assigned to a notebook visually.  I had to run through the setups of all 3 notebooks, installing additional software and prepping for the client, before I even realized that I didn’t have a Professional operating system. 

Once I realized it I informed the powers that be who then ordered 3 copies of Windows 10 Professional OEM. The cost for Windows 10 OEM is 2/3 what it is to purchase the upgrade.  Since they were never supposed to be Home Edition in the first place, that’s just throwing money away, on top of the time now wasted setting up the wrong OS.

But that’s where the fun really begins.  Armed with my 3 copies of Windows 10 OEM I re-ran the setup on each system, booting from the Windows 10 Pro media.  Instead of wiping the partitions I just overwrote the Windows partition.  I completed the install, answered all of Cortana’s questions, and when I got to a desktop – Windows 10 Home Edition.

WHAT??!?

Ok, I check the media – nope it’s right.  Huh.  What the hell?

I ran the setup again, this time wiping out all of the partitions.  Fresh, clean install of Windows 10 Pro on a pristine drive.  No system partition, no recovery partition, just like a new PC.  Again, completed the setup, answered all of Cortana’s questions, and at the desktop… Windows 10 Home.

DOUBLE WHAT??

When I launched the setup again, the third time, I noticed that all of the partitions I thought were wiped were now back.  How is that possible?

Well, with HP notebooks, and probably others, the Security features (Secure Boot) and such, pretty much tells the notebook to ignore anything you do, run through the process as though you are actually doing something effective, then defeat you in the end. Even after disabling all of that in the BIOS and issuing new Secure Boot keys, the setup remained exactly the same.  Windows 10 Home is here to stay.

The solution I found that finally resolve this issue – use this Windows 10 Pro Upgrade Key to upgrade the OS to an non-activated Windows 10 Pro system:

VK7JG-NPHTM-C97JM-9MPGT-3V66T

After using this key, I was able to boot to Windows 10 Pro, and apply the keys we’d purchased.

I just want to say that while I understand and agree to some extent to defeat the efforts of the people who pirate software – the approaches taken to secure the licensing really only serve to frustrate the legitimate user.  This does little to protect the end user and clearly that was never the intention.  This is Microsoft ‘protecting their investment’.  The pirates are still going to find ways to defeat the security.

Microsoft and others need to find better ways to protect themselves.  Especially in the case of Microsoft where the licensing model changes multiple times on a yearly basis.  How does it make any kind of sense that an upgrade license costs more than an OEM license?  Presumably the OS being upgraded was OEM to begin with, so if the machine fails, the Upgrade License would fail with it.  Running out and purchasing another system with the downgraded license a second time is not logical.

The post Windows 10 Upgrade Home to Pro appeared first on Wiredwolf Canada.