Windows on vanstechelman.eu

Managing Windows firewall with PowerShell

Wed, 21 Apr 2021 09:38:13 +0000

To check the status of the Windows firewall with PowerShell, type the following:

$FWProfiles = (Get-NetFirewallProfile);
Write-Host "Windows Firewall Profile Statuses" -Foregroundcolor Yellow;
$FWProfiles | %{
    If($_.Enabled -eq 1){
        Write-Host "The Windows Firewall $($_.Name) profile is enabled"  -Foregroundcolor Green
        }Else{
        Write-Host "The Windows Firewall $($_.Name) profile is disabled" -Foregroundcolor Red
        }
    };

To disable the Windows firewall for all profiles with PowerShell, type the following:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

The most common BitLocker command-line commands

Wed, 19 Dec 2018 10:25:40 +0000

Make sure to execute these command from an Elevated Prompt!

Add a startup key as additional authentication method:

Adds a TPM and startup key protector for the operating system drive C:. The generated startup key will be stored on the removable drive E:. The effect of this command is that the removable drive on which this startup key is created must always be inserted in the computer when it starts up. Once Windows is starting, the removable drive can be removed from the USB port.\

How to run the WSUS Server Cleanup Wizard from command-line

Thu, 13 Jul 2017 18:34:06 +0000

When running the WSUS Server Cleanup Wizard from the MMC snap-in, it can occur that you receive the following WSUS database error:

Error: Database Error
An error occurred when trying to perform a database operation. This can happen if the database is very busy, if the database service is stopped, if the connection to the database is lost, of if the Post-Installation task is not completed successfully. Please contact your system administrator if the problem persists.

Click Reset Server Node to try to connect to the server again.

If you haven’t performed the cleanup in a long time, then this can happen. So you might decide to read through the manual of the wsusutil.exe tool where you think that the deleteunneededrevisions switch will resolve all your problems, however, it seems that the wsusutil.exe parameter deleteunneededrevisions doesn’t exist on WSUS 3.1.

Luckily, you can achieve the same thing using powershell. The advantages here are:\

Scanning for CVE-2017-0143 (EternalBlue) using nmap (MS17-010)

Sat, 01 Jul 2017 08:30:00 +0000

With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. This vulnerability has been assigned CVE-2017-0143. The vulnerability is also often nicknamed EternalBlue. This page explains how you can scan for it from a Windows machine using nmap.

The SMBv1 server in many Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets, aka “Windows SMB Remote Code Execution Vulnerability.” This vulnerability is actively being exploited.

Scanning for CVE-2017-5638 using nmap

Tue, 14 Mar 2017 21:00:00 +0000

On March 6, 2017, Apache disclosed a vulnerability in the Jakarta multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on the targeted system using a crafted Content-Type header value.
This vulnerability has been assigned CVE-ID CVE-2017-5638.
This page explains how you can scan for it from a Windows machine using nmap.

How to allow a normal user to start, stop, and pauze/continue a Windows service

Mon, 12 Oct 2015 07:06:15 +0000

By default, starting and stopping Windows services are tasks that can only be performed by administrators. There are cases where you want regular users to be able to start or stop services. This can be easily accomplished using the subinacl.exe command-line tool.

This is the subinacl.exe syntax of how you can allow a normal user to start, stop, and pauze/continue a service.

subinacl.exe /service SERVICE_NAME /grant=COMPUTER_NAME\USERNAME=TOP

Note that the COMPUTER_NAME is optional. So you can also use:

How to list hidden shares remotely

Tue, 22 Sep 2015 09:41:22 +0000

When sharing Windows folders on the network, it is possible to hide the shared folder from the list of shares. This can be done by adding a $-sign to the end of a share name.
It is important to mention that this does not really hide such shares from the network. If you ask a Windows machines for a list of its shares, then it reports all shares, including those with a $-sign. It are then the clients who filter out all shares that end in a dollar-sign.

So how can you get a list of all the hidden shares on a server?
Easy: open a DOS prompt and issue the following command: net view \test-server /all

The output will be the following:

C:\Users\Lode>net view \test-server /all
Shared resources at \test-server

Share name                 Type Used as Comment
——————————————————————————-
ADMIN$                     Disk           Remote Admin
C$                         Disk           Default share
IPC$                       IPC            Remote IPC
Temp                       Disk
The command completed successfully.\

ICACLS command line options

Fri, 12 Jun 2015 07:16:26 +0000

\

ICACLS name /save aclfile [/T] [/C] [/L] [/Q]

stores the DACLs for the files and folders that match the name

into aclfile for later use with /restore. Note that SACLs,

owner, or integrity labels are not saved.

\

ICACLS directory [/substitute SidOld SidNew [...]] /restore aclfile

[/C] [/L] [/Q]

applies the stored DACLs to files in directory.

\

ICACLS name /setowner user [/T] [/C] [/L] [/Q]

changes the owner of all matching names. This option does not

force a change of ownership; use the takeown.exe utility for

that purpose.

\

ICACLS name /findsid Sid [/T] [/C] [/L] [/Q]

finds all matching names that contain an ACL

explicitly mentioning Sid.

\

ICACLS name /verify [/T] [/C] [/L] [/Q]

finds all files whose ACL is not in canonical form or whose

lengths are inconsistent with ACE counts.

\

ICACLS name /reset [/T] [/C] [/L] [/Q]

replaces ACLs with default inherited ACLs for all matching files.

\

ICACLS name [/grant[:r] Sid:perm[...]]

[/deny Sid:perm [...]]

[/remove[:g|:d]] Sid[...]] [/T] [/C] [/L] [/Q]

[/setintegritylevel Level:policy[...]]

\

/grant[:r] Sid:perm grants the specified user access rights. With :r,

the permissions replace any previously granted explicit permissions.

Without :r, the permissions are added to any previously granted

explicit permissions.

\

/deny Sid:perm explicitly denies the specified user access rights.

An explicit deny ACE is added for the stated permissions and

the same permissions in any explicit grant are removed.

\

/remove[:[g|d]] Sid removes all occurrences of Sid in the ACL. With

:g, it removes all occurrences of granted rights to that Sid. With

:d, it removes all occurrences of denied rights to that Sid.

\

/setintegritylevel [(CI)(OI)]Level explicitly adds an integrity

ACE to all matching files.  The level is to be specified as one

of:

L[ow]

M[edium]

H[igh]

Inheritance options for the integrity ACE may precede the level

and are applied only to directories.

\

/inheritance:e|d|r

e - enables inheritance

d - disables inheritance and copy the ACEs

r - remove all inherited ACEs

\

\

Note:

Sids may be in either numerical or friendly name form. If a numerical

form is given, affix a * to the start of the SID.

\

/T indicates that this operation is performed on all matching

files/directories below the directories specified in the name.

\

/C indicates that this operation will continue on all file errors.

Error messages will still be displayed.

\

/L indicates that this operation is performed on a symbolic link

itself versus its target.

\

/Q indicates that icacls should suppress success messages.

\

ICACLS preserves the canonical ordering of ACE entries:

Explicit denials

Explicit grants

Inherited denials

Inherited grants

\

perm is a permission mask and can be specified in one of two forms:

a sequence of simple rights:

N - no access

F - full access

M - modify access

RX - read and execute access

R - read-only access

W - write-only access

D - delete access

a comma-separated list in parentheses of specific rights:

DE - delete

RC - read control

WDAC - write DAC

WO - write owner

S - synchronize

AS - access system security

MA - maximum allowed

GR - generic read

GW - generic write

GE - generic execute

GA - generic all

RD - read data/list directory

WD - write data/add file

AD - append data/add subdirectory

REA - read extended attributes

WEA - write extended attributes

X - execute/traverse

DC - delete child

RA - read attributes

WA - write attributes

inheritance rights may precede either form and are applied

only to directories:

(OI) - object inherit

(CI) - container inherit

(IO) - inherit only

(NP) - don't propagate inherit

(I) - permission inherited from parent container

\

Examples:

\

icacls c:\windows\* /save AclFile /T

- Will save the ACLs for all files under c:\windows

and its subdirectories to AclFile.

\

icacls c:\windows\ /restore AclFile

- Will restore the Acls for every file within

AclFile that exists in c:\windows and its subdirectories.

\

icacls file /grant Administrator:(D,WDAC)

- Will grant the user Administrator Delete and Write DAC

permissions to file.

\

icacls file /grant *S-1-1-0:(D,WDAC)

- Will grant the user defined by sid S-1-1-0 Delete and

Write DAC permissions to file.

\

Windows Software Licensing Management Tool (slmgr.vbs)

Fri, 12 Jun 2015 06:13:31 +0000

This page lists the Windows Software Licensing Management Tool (slmgr.vbs) command line options.

Importing vbscript code at runtime

Thu, 30 Apr 2015 10:13:27 +0000

Many script languages have an import function that allows to import and execute code that is stored in another file. Microsoft’s vbscript however is lacking such functionality. This page shows how it can be accomplished to import and execute vbscript code that is stored in another file.

Assume that you have the following file with some functions that you have defined:\

' Filename = modMathFunction.vbs
Function Square(intNumber)
    Square = intNumber * intNumber
End Function

Normally you would have to copy this function in each script in which you want to use this function. It is however possible to define an import function in your vbscript code via which you can use this function without having to copy it.

Scan for FREAK using nmap

Sun, 08 Mar 2015 19:56:11 +0000

Not everyone is vulnerable to the potential attack vector that researchers from INRIA, a French research institute, and Microsoft disclosed recently. In order to be vulnerable, the computer or server must support a class of deliberately weak export cipher suites. Support for these weak algorithms has remained in many implementations, however they are typically disabled by default. Nevertheless, the researchers discovered that several implementations incorrectly allow the message sequence of export ciphersuites to be used even if a non-export ciphersuite was nogotiated. This post shows how you can test a server to detect if it has been configured to allow export cipher suites to be used.
\

Creating an UEFI bootable Linux USB stick

Thu, 26 Feb 2015 15:48:18 +0000

This article explains how to create a bootable USB stick with Linux that can be used to boot UEFI-systems.

How to activate a Windows computer that is not connected to the internet

Thu, 27 Nov 2014 17:24:02 +0000

If you are building a secure computer, then the best approach is to never connect it to the internet. If the operating system on this computer is Windows, then you will have to activate it before you will be able to use it. This article explains how you can activate it by phone.
\

Windows can’t be activated right now

If you try to use the standard Windows activation interface, then you will most probably receive the error Windows can’t be activated right now. This makes perfect sense since the activation application tried to connect to Microsoft’s activation servers. However, since you are offline, the computer can not connect these servers. It shouldn’t even be possible to resolve the DNS names of these servers!

The answer here is to activate the computer by phone. To start the Windows Activation Wizard, click Start, click Run, type slui.exe 4, and then click OK. An alternative approach is to press the Windows+R keyboard combination to open the Run window.
If you are running Windows 8, follow these steps:\

Scan for POODLE using nmap from a Windows machine

Wed, 15 Oct 2014 10:17:34 +0000

Researchers from the Google Security Team have published findings about a vulnerability in SSL 3.0. CVE-2014-3566 has been allocated for this protocol vulnerability. It is possible to use nmap to scan for the presence of this vulnerability by doing a scan on the supported SSL/TLS protocols. This post shows how to scan for the POODLE weakness using nmap.

Scan for Heartbleed using nmap from a Windows machine

Thu, 10 Apr 2014 08:01:14 +0000

You may have heard of “Heartbleed”, a flaw in OpenSSL that could allow the theft of data normally protected by SSL/TLS encryption.

It is possible to scan for the presence of this vulnerability using different methods.
This page explains how you can scan for it from a Windows machine using nmap.

VBScript tips

Wed, 09 Nov 2011 08:36:20 +0000

Some tips for doing things in vbscript.

How to bypass domain policy firewall settings

Wed, 17 Aug 2011 07:28:38 +0000

How to enable the Windows Firewall, even though Domain Policies are prohibiting you from enabling it…

How to use SubInAcl.exe

Tue, 12 Jul 2011 14:28:43 +0000

How to use SubInAcl.exe?

Example usage of xcacls.vbs

Tue, 21 Jun 2011 12:47:48 +0000

This webpage contains a series of examples of how xcacls.vbs can be used.

Deny access to C-drive

Sun, 31 Jan 2010 20:35:23 +0000

In some companies, you can find that access to the C-drive of a Windows computer has been blocked. How do they do this?

SQL Server Auditing Queries

Wed, 01 Apr 2009 07:07:19 +0000

This page contains some SQL queries that can be used on an SQL Server to test some parts of the security configuration.

Windows audit settings

Fri, 13 Feb 2009 21:01:59 +0000

The following pages contain information about the default audit settings on Windows operating systems, how you can change these settings, how you can increase the size of the event logs, how all of this should be done via domain controller policies and on stand-alone servers/workstations.

php print l(“Adjust the Windows Event Log size”, “node/229”); ?
php print l(“Audit Policy Settings for Windows XP”, “node/230”); ?

Audit Policy Settings for Windows XP

Thu, 12 Feb 2009 08:05:06 +0000

An Audit policy determines the security events to report to administrators so that user or system activity in specified event categories is recorded. The administrator can monitor security-related activity, such as who accesses an object, when users log on to or log off from computers, or if changes are made to an Audit policy setting. For all of these reasons, Microsoft recommends that you form an Audit policy for an administrator to implement in your environment.

Adjust the Windows Event Log size

Tue, 10 Feb 2009 13:55:55 +0000

When many events logs are being generated, the possibility exists that events are being overwritten to quickly, which causes that important information would be lost. Increasing the maximum size of the Windows Event Logs might help to store events longer on each computer.

Auto-logon in Windows XP Professional

Sun, 23 Nov 2008 13:54:16 +0000

Having trouble finding the place where to enable auto-logon in Windows XP Professional? Since it’s not so secure, it’s well hidden. If you still want the functionality, do the following:

Windows Server 2003 Security Guide - The Member Server Baseline Policy

Mon, 27 Oct 2008 16:33:25 +0000

An overview of all options and settings available in the Windows audit policy and user rights assignments.

Windows Server 2003 Security Guide - The Domain Policy

Sat, 25 Oct 2008 12:00:20 +0000

An overview of all options and settings available in the domain policy.

Create a virtual host on IIS 6 using iisweb

Sun, 27 Jul 2008 08:17:55 +0000

Name-based virtual hosts use multiple host names for the same webserver IP address. This post show how you can create name-based virtual hosts using the iisweb command-line utility.

Dnscmd - Managing the Windows DNS Server

Sun, 13 Apr 2008 09:23:02 +0000

This page explains how you can script the creation of new domains in a Windows DNS server using the dnscmd utility.

WMIC help page

Sun, 09 Mar 2008 09:18:28 +0000

WMIC help page

WMIC Output Formats

Sun, 09 Mar 2008 09:16:13 +0000

WMIC Output Formats

Obtained by executing: wmic [stuff to do] /format /?

Keyword/XSL filename to process XML results.
USAGE:

/FORMAT:<format specifier>
NOTE: <formatspecifier> : ((<transformname>|<transformname> : <paramstring>)[,<formatspecifier>]).
where <paramstring>:((<parametername>=<value>)[,<paramstring>]).

NOTE: <transformname> is a <key word> or an <xsl file name>.

Keywords:

CSV
HFORM
HMOF
HTABLE
HXML
LIST
RAWXML
TABLE
VALUE
htable-sortby
htable-sortby.xsl
texttablewsys
texttablewsys.xsl
wmiclimofformat
wmiclimofformat.xsl
wmiclitableformat
wmiclitableformat.xsl
wmiclitableformatnosys
wmiclitableformatnosys.xsl
wmiclivalueformat
wmiclivalueformat.xsl

Windows Management Instrumentation Command-line (WMIC)

Sun, 09 Mar 2008 09:12:57 +0000

Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components can provide information and notification. WMI is Microsoft’s implementation of the Web-Based Enterprise Management (WBEM) Standard from the Distributed Management Task Force (DMTF).

Add a static IP route in Windows

Sun, 09 Mar 2008 09:09:20 +0000

How to add a static IP route in Windows?

The NET command

Sun, 09 Mar 2008 08:59:39 +0000

The NET Command is used to manage network resources as follows: