Attack Computer Wiz

Starting with Windows Server 2016 and also in 2019, an out of the box build will often display the following error when trying to initial a Remote Desktop Connection.

"The connection cannot proceed because authentication is not enabled and the remote computer requires that authentication be enabled to connect."

To make this error go away, perform the following steps:

1. Open "regedit"
2. Go to: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

3. Set “SecurityLayer” to a "zero"

Posted by Mike Wright

In some cases users in an Active Directory environment may see repeated lockouts after a recent password change. This is commonly associated with forgetting their new password, forgetting that they are logged onto another machine or server somewhere, or their old credentials are cached.

If after you have rebooted the machine, checked domain logs to try to figure out where accounts may be logged in, deleted Temporary Internet Files and you are at your whits end, cached credentials may likely be your culprit.

On your affected machine, run the blow command and delete any cached credentials that appear. This would especially be relevant if you are using a Proxy server.

rundll32.exe keymgr.dll, KRShowKeyMgr

Posted by Mike Wright

System Center Endpoint Protection (SPEC) may not install via SCCM policy if a conflicting application exists and cannot be uninstalled. This is commonly associated with an existing Antivirus application.

In order to find what the conflict is;

1. Open regedit 
2. Navigate to \HKLM\SOFTWARE\Microsoft\CCM\EPAgent 
3. Look at “StateEventMessage” where you will find a message similar to the below:

System Center Endpoint Protection installation error. The System Center Endpoint Protection Setup wizard was unable to remove one or more programs that conflict with System Center Endpoint Protection. To install System Center Endpoint Protection you must manually uninstall the following programs and then run the wizard again. Error code:0x80041108. Programs: Trend Micro OfficeScan Client

In this example, the Trend Micro OfficeScan Client was installed and for whatever reason, SCEP could not remove it. At this point you will need to manually remove the conflicting application and re-initiate a policy refresh to the SCCM server.

Navigate to Control Panel, open the Configuration Manager client, clicked on the Actions tab, and force each action to run.

After a while the new SCEP icon will appears as expected.

Posted by Mike Wright

Posted by Mike Wright

While trying to demote an existing Windows Server 2008 R2 Domain Controllers I ran into quite the headache. After running "dcpromo" and following the first few steps of the demotion it seems to start and run just fine. But within a few seconds I was promoted for credentials with the below "access is denied" message.

I searched and searched but was not able to find a good solution so finally I gave up and ran "dcpromo /forceremoval". I then did the metadata cleanup and moved on. I then tried to remove the old DC computer object from the Domain Controllers OU and I was denied access again. I scratched my head and realized that the object was protected. Could this whole problem be that simple!? The answer is YES, it was that simple.

On my next DC demotion I re-created the same errors. I cancelled the dcpromo, went into ADUC and unchecked the "Protect object from accidental deletion" box, ran dcpromo and and everything went smooth without error!


  

Posted by Mike Wright

For reasons unknown to me, during the installation of Windows 8 Enterprise (from Technet), you are not prompted to enter in your Windows Key. This may be on other versions too, I do not have other versions to test. Once Windows 8 is installed you are prompted to Activate Windows and you see the nag text in the lower right corner. There does not seem to be an easy "click here" way to enter in your correct product key. But, if you follow the below steps, you will be able to enter your key easy enough and active your Windows 8 installation. 

1. Press the "Windows Key" on your keyboard which will bring you to the "Modern" menu. 
2. Type "cmd" and you will see "Command Prompt" displayed on the left side of your screen. 
3. "Right Click" "Command Prompt" and on the bottom of your screen choose "Run as Administrator". 
4. Click "Yes" on the User Access Control warning screen. 
5. At the command prompt screen type "slmgr.vbs -ipk PRODUCT KEY". It should look something like "slmgr.vbs -ipk 11111-22222-33333-44444-55555". Press "Enter" 
6. You should now be prompted that the product key was installed successfully, if not your key is invalid, you typed it wrong, or you forgot to include the dashes. I suggest you copy and paste. 
7. Next, still at the command prompt, typ "slmgr.vbs -ato" and press "Enter". 
8. You should now be prompted that Windows was successfully activated.

Posted by Mike Wright

I have installed and am currently evaluating Windows 8 Enterprise RTM. In my test domain I discovered right away a glaring item was missing. No I don't mean the start menu, though the lack of a start menu is going to thoroughly confuse most users. What I noticed was missing, as compared to all previous versions of Windows, is the CTRL+ALT+DEL key press to logon to the domain. In all previous versions of Windows after the computer starts up, before the user is allowed to type in their username and password, they are required to press CTRL+ALT+DEL. This key press has been historically tied to ending any unauthorized processes. But in theory, it also requires a human interaction before the logon. This extra key press can show that a user intended to logon. Should they violate corporate policy it may be shown that they did press the keys, they did logon, they were displayed a policy banner, and so on. Alas, in Windows 8 this requirement seems to have become optional.

Now domain administrators need a way to enable this requirement with as little work and as little impact as possible. What I discovered in my testing, and confirmed by a review by others in the same position, a Global Policy Object modification can accomplish this.

To require CTRL+ALT+DEL during logon of WIndows 8 Domain member system follow the below steps.

1. Navigate to the following GPO setting: "Computer > Policies > Windows Settings > Security Settings > Local Policies > Security Options"
2. Locate the following key: "Interactive logon: Do not require CTRL+ALT+DEL"
3. Change the setting to: "Disabled"
4. Reboot the computer or preform a "gpupdate /force" from the command prompt.

On your next logon you will be required to press CTRL+ALT+DEL to logon to the domain member Windows 8 system. This can be applied at the top level of your domain to apply to all child objects.

Posted by Mike Wright

1. Download and install the latest version of TrueCrypt. (7.1a at the time of this post) http://www.truecrypt.org/.
2. Launch TrueCrypt and click on “System”, then “Encrypt System Partition/Drive...”.
3. Choose a “Normal” or a "Hidden” system encryption, for this guide I am choosing “Normal”, click “Next”.
4. Choose to “Encrypt the Windows system partition” or “Encrypt the whole drive”, for this guide I am choose whole drive, click “Next” *Choosing whole drive will take a considerable amount of time however all of your data on the drive will be secure, not just the Windows system.
5. If prompted, acknowledge the 'User Account Control' by clicking “Yes”.
6. Choose your option on whether or not to encrypt the “Host Protected Area”. *The host protected area may have drivers, such as RAID drivers, that need to be accessed ‘pre-boot’.
7. Choose whether you have a single OS installed or are booting between multiple OS’s, click “Next”.
8. Choose the 'Encryption Algorithm' and the 'Hash Algorithm' you want to use. Read each description and select the one that you feel is best for you. By clicking the “Benchmark” button you can estimate how many megabytes per second your encryption task may take. Click “Next”.
9. Create your encryption password, the bigger the better, recommended is 20 characters, click “Next”. *Here is a link to check the strength of your password http://howsecureismypassword.net/.
10. On the next screen you will see moving text. Simply move your mouse around your screen for a while to create a random data pool. Do this for as long or as little as you like, but you should give it a few seconds at the very least. Click “Next”.
11. The next screen will show you the generated keys. You do not need to do anything here, just click “Next”.
12. On the 'Rescue Disk' screen you need to specify a path for an ISO file to be created. You will need this ISO file in the event you need to boot your system from a disk. So “Browse” to a location and save your rescue disk. Click “Next”.
13. Acknowledge the action and insert a blank CD into your CD burner. Choose your CD burner from the drop down box and click “Burn”.
14. Now, before you continue, navigate to the location of the ISO file that you created in the last step. Copy that ISO file to an external location such as a thumb drive. If your disk is lost or broken you can use this ISO file to create a new one.
15. Click “Close”, then click “Next” to verify that your cd is good, click “Next” again.
16. Remove the burned disk, label it, and store it in a safe location.
17. On the next screen you are asked if you want to wipe unused space on your disk. This can be important if you need to securely erase any data that can possibly be recovered. Choose your wipe mode (3 pass is sufficient) or choose “None” if this is not a concern to you. Click “Next”.
18. Next you are asked to perform a 'Pretest'. Be sure that all of your applications are closed and your work is saved. Next click “Next”, agree to the terms, then click “Yes” to reboot your computer and begin the pretest.
19. Assuming there are no issues, your computer will reboot normally and after the POST screen you are asked for your TrueCrypt password. Type the password that you created earlier and press “Enter” on your keyboard.
20. Assuming there are no issues, your computer will start into Windows as it always does. Logon if needed and click on the “Desktop” button from your new start screen. Once on the desktop Trucrypt should be waiting for you. Simply press the “Encrypt” button to begin the whole disk encryption process. You may need to agree to the terms again and User Account Control may prompt you for permission again.
21. At this point just sit back and wait.

Posted by Mike Wright

.NET Framework 3.5 is not installed out of the box in Windows 8. I found that this version is still required for a handful of applications and it must be installed. The "check the box" method within the Windows 8 GUI did not work for me so I needed to find another way to get it installed. I found an MSDN post that explained it. In short, easiest way that I found to get .NET Framework 3.5 is by following the below steps:

1. Open a "cmd" prompt by browsing to the "C:\Windows\System32\", find the "cmd.exe" icon and right click, choose "Run as administrator".
2. In the cmd console type "DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:d:\sources\sxs" replace the "d" in "/Source:d:\sources\" with the drive letter that corresponds with your DVD drive, your mounted ISO, or if you run into difficulties with this, copy the entire contents of your sxs directory from your DVD to your local drive and change the path accordingly.
3. Execute the command and confirm success.

That was it. After I preformed the above steps I could install and run my .NET 3.5 applications without issue.

Posted by Mike Wright

The replacement for AdminPack.msi is called Remote Server Administration Tools or RSAT. It is a little bit different in Windows 8 than it was on Windows 7. These tools can be used to manage servers running Windows 2012. They can also manage Windows 2008/2008R2 and 2003, though limitations may apply.

In order to install and configure these tools on Windows 8 follow the below instructions.

1. Download and Install the appropriate package from this link, Download Link
2. Return to your "Start" screen and you will see the new feature "Server Manager".
3. Click on "Server Manager" and in the upper right corner click on "Tools". This is where your RSAT tools are.

If you if find that there are too many tools here that you do not need to use, simply follow the below steps to remove the unwanted options.

1. Click on Control Panel > Programs and Features.
2. Click on "Turn Windows features on or off".
3. Expand the "Remote Server Administration Tools".
4. Now choose any or all of the tools that you wish to disable from this workstation and Click OK.

Posted by Mike Wright

I installed the Bing app on my iPad because it has been getting some good reviews. I too thought it was nice but was noticing right away that a hand full of the headlines did not match the photos. I noticed a headline about Tina Fey's pregnancy but showed a photo of Russel Brand. There were a few others, some comical, but the one that caught my keen eye was a headline that said "Longoria shows her kitchen skills in new cookbook." One would expect to see a photo of Eva Longoria and her new cookbook. Instead there is a photo of Cermeron Diaz with her breast exposed and another woman also with an exposed breast. Need proof, see the photos below. You can confirm that it is Cameron Diaz with a simple Google image search. Also below there is a mistake where a school shooting in Brazil is somehow associated with the movie Rio and Governor Rick Snyder is associated with the movie Sucker Punch.

Posted by Mike Wright

Microsoft is currently running a promotion through June 30, 2011 that will give away a Microsoft TechNet Subscription to the first 1,000 participants who sign up and pass any Microsoft Virtualization Certification. You must register at the site I link below and you must pass your exam before June 30, 2011. The TechNet subscription is good for 12 months. TechNet is a great deal at $349 but free is even better! You can also find promo codes that are good for discounts on TechNet. I have seen them as high as 50% off.

Virtualization Exam Offer

Posted by Mike Wright

I have been noticing odd behavior with Internet Explorer yesterday and today. The program opens and then crashes with the typical send bug report to Microsoft.

Upon examining the logs, we noticed a faulting application of “yt.dll”.

"yt.dll" appears to be associated with Yahoo Toolbar.

If you experience this type of behavior, removing the Yahoo Toolbar from add/remove programs should resolve the problem.

Posted by Mike Wright

On a few occasions I have needed to retrieve data and information from a Windows XP hard disk drive when I do not have the actual computer to work with. When that copy of Windows XP is an OEM version or other version that requires re-activation due to hardware change, I am caught in this endless “You must activate” loop that does not allow me to logon or even get past the activation screen. Often I only need to run a few tools in order to recover passwords, recently opened documents, internet history, cache, or access to the disk drive.

A very easy, and only minimally annoying, work around to this activation is achieved by simply following the below steps;

1. Boot into Windows,
2. Choose the user you wish to logon as,
3. You will get a message that you need to activate, click “OK:,
4. When you see the next screen, “Activate Windows”, Press the “Windows Key + U”,
5. At this point you will see the “Narrator” screen, In the title bar of the Narrator screen click the little icon of a computer and choose “About Narrator”,
6. In the text of the next screen you will see a web link called “Microsoft Web site”, click that link and IE will open,
7. In the navigation bar, type “C:\” and you will get an error message, however, at this point you can access the start menu and everything in it.

You will have a short time that you can access the c drive and other drives, along with applications, CD\DVD, thumb drives, and you can execute programs. After some time you may encounter an error and be brought back to IE, simply type “C:\” back into the navigation bar and start over again.

Posted by Mike Wright

Have you ever locked your Windows 7 system, came back to log on, and when you type your password that contains the letter "u" the Windows Ease of Access window pops up?

This is happening because you locked Windows 7 computer AND you have left an RDP session open. To test this (be sure you read this whole article first);

1. Change your password so that it contains the letter "u"
2. Open an RDP connection
3. Leave the RDP connection open and lock your computer
4. Now log back in, and you will notice that as soon as you press the "u" Ease of Access pops up

The work around for this is;

1. When the Ease of Access window opens, Click Cancel
2. Now click the ease of access icon in the lower left corner
3. The Ease of Access window opens again, Click Cancel again
4. Now enter your password and Ease of Access should not pop up again.

** If you just keep typing your password Ease of Access will just keep popping up when you type "u" unless you follow the above steps. Annoying isn't it? 

This is not a fix, it is just a work around. Next time you lock your machine with the RDP connection open it will happen again, just repeat the steps.

Posted by Mike Wright

The replacement for AdminPack.msi is called Remote Server Administration Tools or RSAT. In order to install and configure these tools on Windows 7 follow the below instructions.

1. Download and Install the appropriate package from the below link, don't let the name AMD64fre fool you. It is not for AMD and it is not in French.   Download Link
2. Click on Start > Control Panel > Programs.
3. Under "Program Features" click on "Turn Windows Features on or off".
4. Expand the "Remote Server Administration Tools".
5. Now choose any or all of the tools that you wish to manage from this workstation and Click OK.

Now, after you click on the "Start" button you will see a new option called "Administration Tools". There you will find the specified tools that you enabled.

Posted by Mike Wright

The AutoPlay feature, built into Microsoft Windows operating systems, will begin reading a device as soon as it is inserted. Often this is done using the autorun.inf file. This file will specify to Windows what application(s) to launch within the device. It would be very easy for someone to modify the autorun.inf file to launch a malicious application.

It is a best practice to disable AutoPlay completely. To do so, follow these steps from your Windows 7 system:

1. Click Start and type "gpedit.msc" in the search box.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies.
3. Then find the policy called "Turn off AutoPlay".
4. Select the "Enabled" radio button.
5. Close all windows.

You may need to reboot your machine for the changes to take effect.

Posted by Mike Wright

Below are the easy steps to creating and sharing a folder on a Windows 7 system to be accessed from a Ubuntu 10.04 system, on the same network:

1. On your Windows 7 system, create a new folder or locate an existing folder to be shared.
2. Right click the folder and choose “Share With” “Specific People…”.
3. Type the user account of a user that has local rights on the Windows 7 Machine that you are using.
4. Change the permissions level on the right accordingly.
5. Click the “Share” button then click “Done”
6. On your Ubuntu 10.04 system, right click on your desktop and choose "Create Launcher.”
7. In the “Type” field, choose "Location"
8. In the "Name" field, type a name for your share.
9. In the "Location" filed, type “smb://username@IPAddress/share”
      Username = the username of your Windows 7 account you specified.
      IPAddress = the IP address of your Windows 7 Computer.
      Share = the name of the shared folder on your Windows 7 Computer.
      Example= smb://dave@192.85.45.2/pictures
10. Click the "OK" button and when prompted enter the password of your Windows 7 user account.
11. At that point the shared folder should be mounted on your Ubuntu 10.04 desktop and should show up under “Places”

Posted by Mike Wright

Below are the easy steps to creating and sharing a folder on a Ubuntu 9.10 system to be accessed from a Windows 7 system, on the same network:

1. On your Ubuntu 9.10 system, create a new folder or locate an existing folder to be shared.
2. Right click the folder and choose “Sharing Options”.
3. Check the “Share this folder” box.
4. Check the “Allow others to create and delete files in this folder” and “Guest access” boxes IF you want those features.
5. Click the “Create Share” button.
6. Click the “Add the permissions automatically” button
7. If prompted to install Ubuntu components, do so, accepting the defaults, and restart your Ubuntu system if prompted.
8. On your Windows 7 system, type the UNC path of your Ubuntu 9.10 system in the “run” field. You can see this by clicking the “Start” button. Type “\\IPAddress\share”

IPAddress = the IP Address of your Ubuntu 9.10 computer.
Share = the name of the shared folder on your Ubuntu 9.10 computer.
Example = \\192.85.45.2\pictures


9. Press the enter key and you will be prompted for a username and password of your Ubuntu 9.10 user account.
10. After you have entered your credentials the folder will open and its contents displayed.

If you encounter an error after typing in your username and password, try rebooting your Ubuntu 9.10 computer and try to connect again.

Posted by Mike Wright

Below are the easy steps to creating and sharing a folder on a Windows 7 system to be accessed from a Ubuntu 9.10 system, on the same network:

1. On your Windows 7 system, create a new folder or locate an existing folder to be shared.
2. Right click the folder and choose “Share With” “Specific People…”.
3. Type the user account of a user that has local rights on the Windows 7 Machine that you are using.
4. Change the permissions level on the right accordingly.
5. Click the “Share” button then click “Done”
6. On your Ubuntu 9.10 system, click on “Places” then “Computer”
7. In the “Location” field, type “smb://username@IPAddress/share”
Username = the username of your Windows 7 account you specified.
IPAddress = the IP address of your Windows 7 Computer.
Share = the name of the shared folder on your Windows 7 Computer.
Example= smb://dave@192.85.45.2/pictures

8. Press the “Enter” key on your keyboard and when prompted enter the password of your Windows 7 user account.
9. At that point the shared folder should be mounted on your Ubuntu 9.10 desktop and should show up under “Places”

Posted by Mike Wright