December 2009 Archives

• start Process Explorer
• proceed to 'Find' menu, 'Enter File/Folder name' and then click on 'Search'. A list of processes will be displayed, those blocking the file/folder.
• right click on the process and then click on Close Handle > Click OK to confirm

• press F8 when booting the system, while in splash screen, to invoke Safe Mode
• open a command prompt window (run cmd.exe)
• run the following commands:

• right-click the source virtual directory, choose 'Save Configuration To File'. That copies the chunk of the XML metabase containing the configuration info for the virtual directory
• after copying the file with saved configuration onto the other server, right-click on it and select 'New', 'Virtual Directory From File', select the file, click 'Read File', select what to import and click 'OK'

• open Control Panel, click on 'Ad/Remove Programs'
• click 'Add/Remove Windows Components'
• select 'Management and Monitoring Tools', click 'Details'
• check 'Network Monitor Tools', click 'OK'
• click 'Next'; if necessary, either insert the proper removable media with original Windows Server 2003 CD/DVD or enter the appropriate location
• click 'Finish'

• open Control Panel
• proceed to 'Network Connections'
• click on 'Create New Connection', click 'Next', select 'Setup an advanced connection' and 'Next' again
• select 'Accept incoming connections', click 'Next' twice, click 'Allow virtual private connections', click 'Next' again
• check the users you allow to connect via VPN, click 'Next', 'Next' and 'Finish'

• all the patches/fixes should be well-tested first, prior to installing on real-life server
• mission-critical applications may be quite sensible to any changes, including the fixes applied to system components

• open the registry editor, navigate to HKLM\System\CurrentControlSet\control\LSA
• search the key named "LMCompatibilityLevel"
• change the value of this key to "5"; that will completely disable LM authentication

• create a new policy using the Group Policy Management Console; navigate to Computer Configuration, then to Windows Settings > Security Settings > Local Policies.
• select Security Options
• double-click "Network Security: Do Not Store LAN Manager Hash Value On Next Password Change".
• select Enabled and click "OK"

• workstations begin to lose their IP addresses, other settings (DNS, for example)
• workstations report IP addresses conflicts
• DHCP-related traffic grows significantly (UDP ports 67 and 68)

• The ports that are used
• The processes that use the port
• Whether a process is a service
• The modules that a process loaded
• The user accounts that run a process

• synchronous backups (those we mention here), these settings are stored in Windows registry
• asynchronous backups (those initiated with DHCP console)
• Windows backups (performed using wbadmin.msc in Windows Server 2008)

When making use of customized Windows images, security should be provided to prevent unauthorized access to sensitive, proprietary or otherwise restricted information.

If Deployment Services are used,, the following steps are advised.

1. Create a security group; give it name to indicate its users are allowed to install images from your Windows Deployment Services.

2. In Windows Deployment Services console, select your Windows DS server, open Install Images node, right click on Image Group, proceed to Properties.

3. On the Security tab make user you grant Read and Execute permissions to the group mentioned and revoke all the rights for all the other users different from SYSTEM and Administrators group. Do the same for all the Image Groups.

The settings applied to Image Groups are automatically propagated to every single image within these groups.

You can also secure images individually.

Although memorizing the login credentials is convenient, it creates a security risk. It is often required to purge all the stored credentials to make sure they are not used by unauthorized third parties.

Login credentials used by 802.1X authentication can be purged in exactly the same way they are cleared in Windows XP. There's more convenient means in Vista; especially in case of multiple users. All you should do is to uncheck a checkbox at the Network's Properties dialog window.

The steps are:

1) Right-click the Network and Sharing Center icon, navigate to Network and Sharing Center.

2) Click the Manage Wireless Networks link (see Tasks on the left).

3) Select a network, double click it, choose Security tab on its Properties window.

4) Uncheck "Cache User Information for Subsequent Connections" and click OK to save.

There are no GUI tools for Server Core to handle firewall tasks. All of them can be handled using netsh command-line utility. To start, enter the ADv Firewall context of netsh by using the command

NetSH ADVFirewall

Use 'help' command in any context to get the list of available (sub)commands.

Three Firewall Profiles are configured in Windows Vista and Windows Serverv 2008. To get the information on all of them, run this:

NetSH ADVFirewall Show Allprofiles

State column of the output displays the profile state (on or off).

To enable all the profiles, use the command

NetSH ADVFirewall Set Allprofiles State on

to turn them all on (use 'off' to turn them all off).

To reset the firewall completely and restore default values, run the command

NetSH ADVFirewall Set Allprofiles FirewallPolicy BlockInbound,AllowOutbound

To switch on or off a single featurem use 'Settings' modifier to specify what is to change, i.e.

NetSH ADVFirewall Set AllProfiles Settings remotemanagement enable / disable

will change the state of Remote Management service.

Internet Explorer Enhanced Security feature can become a nuisance and may be effectively unnecessary under certain circumstance.

The master switches for IEES are stored in the Windows registry. The steps mentioned below must be followed to disable it. Note that any registry modification can result in irreparable damage to your system. You can either make the changes manually, or run a script using Group Policy, to affect a number of computers in your network.

The steps are:

1) Change the following to zero (value 0):

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}

Key name: InInstalled, set it to 0.

2) Issue the next commands from command prompt. Administrator privileges required.

Rundll32 iesetup.dll, IEHardenLMSettings

Rundll32 iesetup.dll, IEHardenAdmin

3) Delete the following:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}

All of this can be done either manually or by using a script.

There's a powerful utility, netsh, that can perform a number of useful administrative tasks. You can prevent users from accessing other Wi-Fi networks, thus hardening the security: unauthorized connection to such networks can result in an uncontrolled data leak.

The technique mentioned will work in Windows Server 2008 or Vista. To see the list of enabled filter, run the following command:

netsh wlan show filters

You can block an unwanted connection to outer network by creating a filter, the syntax is:

netsh wlan add filter permission={allow|block|denyall} ssid=NETWORKNAME networktype={infrastructure|adhoc}

The 'denyall' value doesn't require a ssid parameter. It allows to block all infrastructure or adhoc networks, but retain explicitly the ability to connect to other networks.

To remove an existing filter run this:

netsh wlan delete filter permission={allow|block|denyall} ssid=NETWORKNAME networktype={infrastructure|adhoc}

(just use the same parameters used when creating a filter).

Finally, to either hide or display the blocked networks on the Connect to a Network dialog, run this:

netsh wlan setblockednetworksdisplay={show|hide}

'hide' value can be most useful in most cases.

You can use netsh command to authorize a DHCP server from command line. Also, it's possible to remove a previously authorized DHCP server off the network via command line, too.

This technique may be useful in certain cases, an example: if you perform a maintenance works and the regular DHCP server must go offline for a while. Thus, authorizing another server may allow you to set up a backup DHCP service quickly (the procedure of loading the current DHCP configuration is not described here in details).

To authorize a DHCP server named backup-dhcp-05 with address 10.50.12.1 at the EXAMPLE domain use the following command:

netsh dhcp add server backup-dhcp-05.example.com 10.50.12.1

To make sure the changes are in effect, use the following command

*netsh dhcp show server * To remove the server afterwards, use the following command:

netsh dhcp delete server backup-dhcp-05.example.com 10.50.12.1

Please note that all the DHCP servers should have a proper domain authorization before starting to run. Make sure you have run the command like

dhcp server 10.50.12.1 set dnscredentials username domain password

Where username, domain and password must be replaced with actual domain user's name, domain name and current user's password of an account used to run the DHCP server as.

DHCP server offers flexible means top control the way it provides IP addresses and other information. All the major options may be changed on the fly using tools such as netsh utility.

DHCP scope is a pool (set) of IP addresses that a DHCP server may lease when requested. Those can be created from command-line, thus offering an automated means of manipulation scope

For example, the following command

netsh dhcp server add scope 10.50.12.0 255.255.0.0 "Building One"

will create a scope with network ID 10.50.12.0 and IP mask 255.255.0.0.

The subsequent command

netsh dhcp server scope 10.50.212.0 add iprange 10.50.12.50 10.50.12.100

wil create a range of dynamic IP addresses from the specified scope.

To exclude certain address from that dynamic pool, use command like

netsh dhcp server scope 10.50.12.0 add excluderange 10.50.12.75 10.50.12.80

the above command will excldue the six addresses from dynamical assignement.

You can create static address assignment for a specific MAC address using command like

netsh dhcp server scope 10.50.12.0 add reservedip 10.50.12.99 6E7A55109F0B

Similarly, the above records may be deleted with 'del' subcommand.

One can use netsh command to authorize a DHCP server from command line. Also, it's possible to remove a previously authorized DHCP server off the network via command line, too.

This technique may be useful in certain cases, an example: if you perform a maintenance works and the regular DHCP server must go offline for a while. Thus, authorizing another server may allow you to set up a backup DHCP service quickly (the procedure of loading the current DHCP configuration is not described here in details).

To authorize a DHCP server named backup-dhcp-05 with address 10.50.12.1 at the EXAMPLE domain use the following command:

netsh dhcp add server backup-dhcp-05.example.com 10.50.12.1

To make sure the changes are in effect, use the following command

netsh dhcp show server

To remove the server afterwards, use the following command:

netsh dhcp delete server backup-dhcp-05.example.com 10.50.12.1

Please note that all the DHCP servers should have a proper domain authorization before starting to run. Make sure you have run the command like

netsh dhcp server 10.50.12.1 set dnscredentials username domain password

Where username, domain and password must be replaced with actual domain user's name, domain name and current user's password of an account used to run the DHCP server as.