2. oktober 2020

Server har skiftet "Network Location" til "Private"

Powershell:

Get-NetConnectionProfile



Genstart NLA så skifter den selv til "Domainauthenticated" hvis DC er oppe

10. juli 2020

Slip af med Cortana popup

Deaktiver Cortana :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search]

"AllowCortana"=dword:00000000

Reaktiver Cortana

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search]

"AllowCortana"=dword:00000001

26. juni 2020

Byg Autounattend.xml

Windows Answer File Generator

https://www.windowsafg.com/index.html

24. juni 2020

https://www.altaro.com/vmware/reset-esxi-root-password/

Boot på GParted Live, start terminal session
https://gparted.org/download.php

Normalt sda5 med mindre at der er installeret på f.eks. USB

sudo su
mkdir /boot /temp
mount /dev/sda5 /boot
cd /boot
cp state.tgz /temp
cd /temp
tar -xf state.tgz
tar -xf local.tgz
rm *.tgz
cd etc

Brug Nano til at editere shadow
Delete the encrypted root password to reset it to null i.e. the root account will not have a set password

Delete the encrypted root password to reset it to null i.e. the root account will not have a set password

gå til root og slet alt mellem de to første colon så det ser sådan ud [root::12345:0:12345:7:::]

cd ..
tar -cf local.tgz etc/
tar -cf state.tgz local.tgz
mv state.tgz /boot
umount /boot

reboot

12. juni 2020

Kan ikke validere begge selectors på O365 DKIM

Selector der ikke valideres bliver først aktiv efter en "rotate" i Exchange Admin /DKIM

11. juni 2020

Connect to Exchange Online PowerShell using multi-factor authentication

https://docs.microsoft.com/en-us/powershell/exchange/mfa-connect-to-exchange-online-powershell?view=exchange-ps

Disconnect : Disconnect-ExchangeOnline

10. juni 2020

Skift password i AD fra webside

https://social.technet.microsoft.com/wiki/contents/articles/10755.windows-server-2012-rds-enabling-the-rd-webaccess-expired-password-reset-option.aspx

Kræver at der er en RDWeb server min. 2012 men ingen licens server eller RDS server

Skulle også løse problem med at NLA forhindrer skift af password i RDP session, når password er udløbet

C:\Windows\Web\RDWeb\Pages\en-US\Password.aspx

https://YourServerName/RDWeb/Pages/en-US/Password.aspx

Dansk oversættelse af Password.aspx uden redirect efter logon :

<?xml version="1.0" encoding="UTF-8"?>

<?xml-stylesheet type="text/xsl" href="../Site.xsl"?>

<?xml-stylesheet type="text/css" href="../RenderFail.css"?>

<% @Page Language="C#" Debug="false" ResponseEncoding="utf-8" ContentType="text/xml" %>

<% @Import Namespace="System " %>

<% @Import Namespace="System.Security" %>

<% @Import Namespace="Microsoft.TerminalServices.Publishing.Portal.FormAuthentication" %>

<% @Import Namespace="Microsoft.TerminalServices.Publishing.Portal" %>

// Customizable Text

string L_CompanyName_Text = "Skift Kodeord";

// Localizable Text

const string L_DomainUserNameLabel_Text = "CONTOSO\\Brugernavn:";

const string L_OldPasswordLabel_Text = "Nuværende kodeord:";

const string L_NewPasswordLabel_Text = "Nyt kodeord:";

const string L_ConfirmNewPasswordLabel_Text = "Gentag nyt kodeord:";

const string L_PasswordChangedLabel_Text = "Dit kodeord er successfuldt skiftet.";

const string L_ComplexityFailureLabel_Text = "Din nye adgangskode opfylder ikke dit domænes længde, kompleksitet eller historikkrav. Prøv at vælge en anden ny adgangskode.";

const string L_NewPasswordsDontMatchLabel_Text = "De indtastede kodeord er ikke ens.";

const string L_BlankPasswordFailureLabel_Text = "Indtast et nyt kodeord.";

const string L_PasswordChangeGenericFailure_Text = "Din adgangskode kan ikke ændres. Kontakt din administrator for at få hjælp.";

const string L_LogonFailureLabel_Text = "Det angivne brugernavn eller adgangskode er ikke gyldigt. Prøv at skrive det igen.";

const string L_SubmitLabel_Text = "Indsend";

const string L_CancelLabel_Text = "Annuller";

const string L_RenderFailTitle_Text = "Fejl: Kan ikke vise RD Web Access";

const string L_RenderFailP1_Text = "Der opstod en uventet fejl, der forhindrer, at denne side vises korrekt.";

const string L_RenderFailP2_Text = "Visning af denne side i Internet Explorer med den udvidede sikkerhedskonfiguration aktiveret kan forårsage en sådan fejl.";

const string L_RenderFailP3_Text = "Prøv at indlæse denne side uden den udvidede sikkerhedskonfiguration aktiveret. Hvis denne fejl fortsat vises, skal du kontakte din administrator.";

// Page Variables

public string strErrorMessageRowStyle;

public string strButtonsRowStyle;

public bool bFailedLogon = false, bPasswordMismatchFailure = false, bPasswordBlankFailure = false, bComplexityFailure = false, bGenericFailure = false, bSuccess = false;

public string sHelpSourceServer, sLocalHelp;

public Uri baseUrl;

void Page_PreInit(object sender, EventArgs e)

{

// Deny requests with "additional path information"

if (Request.PathInfo.Length != 0)

{

Response.StatusCode = 404;

Response.End();

}

// gives us https://<hostname>[:port]/rdweb/pages/<lang>/

baseUrl = new Uri(new Uri(PageContentsHelper.GetBaseUri(Context), Request.FilePath), ".");

sLocalHelp = ConfigurationManager.AppSettings["LocalHelp"];

if ((sLocalHelp != null) && (sLocalHelp == "true"))

{

sHelpSourceServer = "./rap-help.htm";

}

else

{

sHelpSourceServer = "http://go.microsoft.com/fwlink/?LinkId=141038";

}

void Page_Load(object sender, EventArgs e)

{

string strPasswordChangeEnabled = ConfigurationManager.AppSettings["PasswordChangeEnabled"];

if (strPasswordChangeEnabled == null || !(strPasswordChangeEnabled.Equals("true", StringComparison.CurrentCultureIgnoreCase)))

{

SafeRedirect(null);

}

if ( Request.QueryString != null )

{

NameValueCollection objQueryString = Request.QueryString;

if ( objQueryString["Error"] != null )

{

if ( objQueryString["Error"].Equals("FailedLogon", StringComparison.CurrentCultureIgnoreCase) )

{

bFailedLogon = true;

}

else if ( objQueryString["Error"].Equals("ComplexityFailed", StringComparison.CurrentCultureIgnoreCase) )

{

bComplexityFailure = true;

}

else if (objQueryString["Error"].Equals("FailedBlankPassword", StringComparison.CurrentCultureIgnoreCase))

{

bPasswordBlankFailure = true;

}

else if (objQueryString["Error"].Equals("FailedPasswordMatch", StringComparison.CurrentCultureIgnoreCase))

{

bPasswordMismatchFailure = true;

}

else if (objQueryString["Error"].Equals("FailedGeneric", StringComparison.CurrentCultureIgnoreCase))

{

bGenericFailure = true;

}

else if (objQueryString["Error"].Equals("PasswordSuccess", StringComparison.CurrentCultureIgnoreCase))

{

bSuccess = true;

}

if ( objQueryString["UserName"] != null )

{

DomainUserName.Value = SecurityElement.Escape(objQueryString["UserName"]);

}

private void SafeRedirect(string strRedirectUrl)

{

string strRedirectSafeUrl = null;

if (!String.IsNullOrEmpty(strRedirectUrl))

{

Uri baseUrl = PageContentsHelper.GetBaseUri(Context);

Uri redirectUri = new Uri(new Uri(baseUrl, Request.FilePath), strRedirectUrl);

if (

redirectUri.Authority.Equals(baseUrl.Authority) &&

redirectUri.Scheme.Equals(baseUrl.Scheme)

)

{

strRedirectSafeUrl = redirectUri.AbsoluteUri;

}

if (strRedirectSafeUrl == null)

{

strRedirectSafeUrl = "default.aspx";

}

Response.Redirect(strRedirectSafeUrl);

}

</script>

<RDWAPage

helpurl="<%=sHelpSourceServer%>"

workspacename="<%=SecurityElement.Escape(L_CompanyName_Text)%>"

baseurl="<%=SecurityElement.Escape(baseUrl.AbsoluteUri)%>"

<head>

</head>

<body>

</body>

</html>

</RenderFailureMessage>

<tr>

</tr>

<tr>

<td>

<tr>

</td>

</tr>

</table>

</td>

</tr>

<tr>

</tr>

<tr>

<td>

<tr>

</td>

</tr>

</table>

</td>

</tr>

<tr>

</tr>

<tr>

<td>

<tr>

</td>

</tr>

</table>

</td>

</tr>

<tr>

</tr>

<tr>

<td>

<tr>

</td>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if ( bGenericFailure == true )

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<table>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if (bPasswordBlankFailure == true)

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<table>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if ( bComplexityFailure == true )

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<table>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if (bPasswordMismatchFailure == true)

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<table>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if ( bSuccess == true )

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<tr>

</tr>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strErrorMessageRowStyle = "style=\"display:none\"";

if ( bFailedLogon == true )

{

strErrorMessageRowStyle = "style=\"display:\"";

}

<td>

<table>

<tr>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

strButtonsRowStyle = "style=\"display:none\"";

if ( bSuccess == false )

{

strButtonsRowStyle = "style=\"display:\"";

}

<tr>

</tr>

<td align="right"><label><input type="submit" class="formButton" id="btnSignIn" value="<%=L_SubmitLabel_Text%>" /></label><label><input type="button" class="formButton" id="Cancel" value="<%=L_CancelLabel_Text%>" onClick="window.location='login.aspx'"/></label>

</td>

</tr>

<tr>

</tr>

</table>

</form>

</HTMLMainContent>

</RDWAPage>

2. juni 2020

CAA record på DNS

https://sslmate.com/caa/

14. maj 2020

Slå Sophos Tamperprotection fra

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SavService\TamperProtection]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config]
"SAVEnabled"=dword:00000000
"SEDEnabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\TamperProtection]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection]
"Enabled"=dword:00000000

13. maj 2020

Easy DMARC

Stop Hackers From

Sending Emails From

Your Domain

Protect your business against phishing attacks today

https://easydmarc.com/

SPF Flattening

100% free SPF flattening with alerting or automatic SPF

https://www.autospf.com/

DKIM på Office365 med Powershell

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps
https://docs.microsoft.com/en-us/office365/securitycompliance/use-dkim-to-validate-outbound-email#SetUpDKIMO365

http://www.mail-tester.com/spf-dkim-check (Her kan du få navnet på DNS CNAME record - selector1._domainkey.contoso.dk + ***)
https://mxtoolbox.com (tjek dkim opsætning - dkim:contoso.dk:selector1)

Start powershell som administrator, log på og indlæs PS Exchange extensions

Set-ExecutionPolicy RemoteSigned
Log på (O365 tenant credentials)
$UserCredential = Get-Credential

Indlæs PS Exchange extensions
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking

Start dkim konfiguration
New-DkimSigningConfig -DomainName contoso.dk -Enabled $false (sætter dkim til Off - viser fejl hvis det allerede er off)
Get-DkimSigningConfig -Identity contoso.dk | fl Selector1CNAME, Selector2CNAME (*** den viser de records der skal oprettes)

Selector1CNAME : selector1-contoso-dk._domainkey.dkcontoso.onmicrosoft.com (navn selector1._domainkey.contoso.dk, FQDN selector1-contoso-dk._domainkey.dkcontoso.onmicrosoft.com)
Selector2CNAME : selector2-contoso-dk._domainkey.dkcontoso.onmicrosoft.com (navn selector2._domainkey.contoso.dk, FQDN selector2-contoso-dk._domainkey.dkcontoso.onmicrosoft.com)

Tilføj DNS records - tjek med http://www.mail-tester.com/spf-dkim-check (bemærk at det kan tage lang tid før MS's DNS opdateres og brug output fra Get-DkimSigningConfig -Identity contoso.dk | fl Selector1CNAME, Selector2CNAME)

Set-DkimSigningConfig -Identity contoso.dk -Enabled $true
https://mxtoolbox.com (tjek dkim opsætning - dkim:contoso.dk:selector1)

Når færdig
Remove-PSSession $Session

Start DMARC opsætning

28. april 2020

Tjek TLS på mailserver

https://www.checktls.com/

Hvis der er problemer, vil man ofte se at certifikatet er udløbet eller er self-signed

24. april 2020

Free OCR software

Windows 10 app :
https://www.microsoft.com/da-dk/p/a9t9-free-ocr-software/9nblgggz5nsn?activetab=pivot:overviewtab

Windows program - også til GPO :
https://www.naps2.com/

Du kan også OCR genkende med OneNote

16. april 2020

Check DKIM Office365

Powershell som administrator

Set-ExecutionPolicy RemoteSigned

winrm get winrm/config/client/auth (skal være Basic = true)

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session -DisableNameChecking

Get-DkimSigningConfig -Identity CONTOSO.DK | Format-List (dit domæne navn)

Remove-PSSession $Session

27. marts 2020

SPF, DKIM, DMARC

Test the Spammyness of youre-mails
https://www.mail-tester.com

Sørg for at emnefeltet har relevant indhold, f.eks. "Question about service provided) - ikke bare "Test" eller lign.
Selve e-mailen skal også have et relevant indhold, gerne en 25-50 ord (kopier en tekst fra et andet sted)

Check if your domain has these 2 email signatures set up and valid (DKIM)
https://www.mail-tester.com/spf-dkim-check

Selector = Selector1 og Selector2

dmarcian.eu
mxtoolbox.com DKIM:domain.dk:selectorX

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps

https://docs.microsoft.com/en-us/office365/securitycompliance/use-dkim-to-validate-outbound-email#SetUpDKIMO365

https://blogs.technet.microsoft.com/timmcmic/2018/02/09/office-365-spam-detection-and-reverse-dns-lookups/

24. marts 2020

Omgå Sophos tamper protection

https://community.sophos.com/kb/en-us/124377

13. marts 2020

Sophos ZAP

https://community.sophos.com/products/sophos-central/b/blog/posts/sophos-zap-is-now-available

6. marts 2020

BRUG DISM til at rense ud i WinSxS efter Windows Update

dism /online /Cleanup-Image /StartComponentCleanup /ResetBase

5. marts 2020

Test webcam / Test microphone /Test speakers

Test webcam

https://da.webcamtests.com/

Test microphone

https://micworker.com/

Test speakers

https://www.onlinemictest.com/sound-test/

Kan ikke installere sprogpakke på RDS server

Installer fra lokal administrator konto

eller

Lokal GPO :
- Log på som lokal adm.
- gpedit.msc
- Computer Configuration / Windows Settings / Security Settings / Local Policies / Security Options / User Account Control: Admin Approval Mode for the Built-in Administrator Account - Enabled
(Kontrol af brugerkonti : Administratorgodkendelsestilstand for den indbyggede administratorkonto - Aktiveret)
- Kør gpupdate /force
- Log af op på igen som domæne adm.

4. marts 2020

Reperation af Windows komponenter

Gem som .cmd fil

@echo off
cls
echo Kør som administrator
echo Luk først alle programmer
echo.
pause
dism.exe /online /cleanup-image /checkhealth
dism.exe /online /cleanup-image /scanhealth
dism.exe /online /cleanup-image /restorehealth
dism.exe /online /cleanup-image /startcomponentcleanup
sfc /scannow
pause
shutdown.exe -f -r -t 00

6. februar 2020

Search/søgning på Windows 10 virker ikke

Gem nedenstående som en .reg fil og dobbeltklik på den :

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search]

“BingSearchEnabled”=dword:00000000

Genstart Windows Explorer (start kommando prompt) :

taskkill /f /im explorer.exe

start explorer.exe

Fuldt script til at klare det hele : (klippe klistre til kommandoprompt)

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v CortanaConsent /t REG_DWORD /d 0 /f
taskkill /f /im explorer.exe
start explorer.exe
exit

13. januar 2020

NTP time service i Active Directory

F.eks. (på DC):
w32tm /config /update /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 2.pool.ntp.org,0x8 3.pool.ntp.org,0x8" /syncfromflags:MANUAL
net stop w32time
net start w32time
w32tm /resync

Check NTP servers connection : w32tm /query /peers

Laptop som ikke er på AD så tit :
w32tm /config /update /manualpeerlist:"pool.ntp.org,0x8" /syncfromflags:MANUAL,DOMHIER

Check time sync: w32tm /stripchart /computer:192.168.0.10 (servers IP)

PS!
Time synchronization may not succeed when you try to synchronize with a non-Wind...
http://support.microsoft.com/kb/875424

DOMHIER— Synchronize from a domain controller in the domain hierarchy

12. januar 2020

Kan ikke se andre computere på netværket (ser typisk kun 3)

Tilføj til registry :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"EnableLinkedConnections"=dword:00000001

Etiketter

2. oktober 2020

10. juli 2020

26. juni 2020

24. juni 2020

12. juni 2020

11. juni 2020

10. juni 2020

2. juni 2020

14. maj 2020

13. maj 2020

Stop Hackers From Sending Emails From Your Domain

Protect your business against phishing attacks today

28. april 2020

24. april 2020

16. april 2020

27. marts 2020

24. marts 2020

13. marts 2020

6. marts 2020

5. marts 2020

4. marts 2020

6. februar 2020

13. januar 2020

12. januar 2020

Stop Hackers From

Sending Emails From

Your Domain