WIFI #HOW TO RETRIEVE STORED PC PASSWORD

In case you have necessity to view stored wifi passwords this is command that is necessary to be executed. (with administrative rights)

for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | findstr -i -v echo | netsh wlan show profiles %j key=clear

Antivirus - Windows 7 high memory usage due to SophosFileScanner.exe

Since yesterday night several Windows 7 O.S. was affected by high memory usage due to SophosFileScanner.exe process.

CPU usage was constantly at 100%.

Sophos support indicated that problem was due to this reason:

• During a staged roll-out of an updated machine learning model, customers began reporting excess CPU usage.  As it became apparent that the performance issues were related to this silent update, the decision was made to roll back to the previous version. 
• The problematic model version identifier is 20230629.  The rolled back version is 20230202.  The rollback should be completed imminently. 

Server - Active Directory Time syncronization problems

During these years I faced, on server and clients, several authentication problems due to wrong time and date.

Here they are some commands and tips useful for this troubleshottoing purpose:

1. Command useful on DC to see any time differences in place and relative (offset)

w32tm /monitor 

2. Run the following command on the PDC emulator:  

w32tm /config /manualpeerlist:timeserver /syncfromflags:manual /reliable:yes /update

Once done, restart W32Time service.

net stop w32time | net start w32time 

3. Run the following command on all other DCs (that are not PDC):  

w32tm /config /syncfromflags:domhier /update

Once done, restart W32Time service:

net stop w32time | net start w32time 

I have often, in recent years, to solve problems of e-mail or authentication domain generated from misconfigurations time servers. 

4. To check the source time server: 

w32tm /query /status

5. You can check registry entries if the domain controller is using NTP (should be on PDC) or NT5DS (on non-PDC):
Find the value of Type under 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

reg query 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

6. re-sync the w32time service using the following command:

w32tm /resync /rediscover

<---------->
7. Execute the following command to actually perform a time synchronization with the external source

w32tm.exe /config /update


Some articles and tools

port query Tool GUI

https://www.microsoft.com/en-us/download/details.aspx?id=24009

Technet - Windows Time Service Tools and Settings

https://technet.microsoft.com/en-us/library/cc773263(v=ws.10).aspx

Time Configuration in Active Directory

http://blogs.technet.com/b/nepapfe/archive/2013/03/01/it-s-simple-time-configuration-in-active-directory.aspx

Configure DC to synchronize time with external NTP server

https://community.spiceworks.com/how_to/65413-configure-dc-to-synchronize-time-with-external-ntp-server

[update 2021.03.04]

Here they are register keys related to date and time Windows services

Microsoft Registry

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer

https://docs.microsoft.com/it-it/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings

https://www.raffaelechiatto.com/configurare-il-server-ntp-su-windows-da-riga-di-comando/

[update 2026.03.25]

w32tm /stripchart /computer:10.107.1.35 /dataonly /samples:5

Microsoft - ADV200006 | Type 1 Font Parsing Remote Code Execution Vulnerability

There is an important/Critical Microsoft Font vulnerability (still un-patched) that is affecting Adobe Type Manager Library.

There are multiple ways an attacker could exploit the vulnerability, such as convincing a user to open a specially drafted document or viewing it in the Windows Preview panel with Explorer.

Here it is Microsoft Security Advisory (ADV200006 | Type 1 Font Parsing Remote Code Execution Vulnerability)

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV200006

About Patch release most probably it will be released on Microsoft Update Tuesday (the second Tuesday of each month)

Affected operative systems are below indicated, consider that windows 10, due to mitigations that were put in place with the first version released in 2015 is considered with low risk impact.

Please see the mitigation section for details. Microsoft is not aware of any attacks against the Windows 10 platform. The possibility of remote code execution is negligible and elevation of privilege is not possible. We do not recommend that IT administrators running Windows 10 implement the workarounds described below.

Microsoft recommends upgrading to the Windows 10 family of clients and servers.

Here they are O.S. impacted briefly indicated:

Product	Impact	Severity
Windows 10 All versions	Remote Code Execution	Important
Windows 7 All versions	Remote Code Execution	Critical
Windows 8,1 All versions	Remote Code Execution	Critical
Windows RT 8.1 All versions	Remote Code Execution	Critical
Windows Server 2008 & R2 All Versions	Remote Code Execution	Critical
Windows Server 2012 e R2 All Versions	Remote Code Execution	Critical
Windows Server 2016 All Versions	Remote Code Execution	Important
Windows Server 2019 All versions	Remote Code Execution	Important

Here they are workaround applicable (be Aware that about windows 10 these are deprecated):

Workaround	Applicability
Disable the Preview Pane and Details Pane in Windows Explorer	Works on all systems but won't mitigate the issue if you open a document with the vulnerable font class
Disable the WebClient service	Works on all systems but won't mitigate the issue if you open a document with the vulnerable font class
Rename ATMFD.DLL	Only works on older (before Windows 10) but completely mitigates the issue though can introduce usability issues in rare cases

In Microsoft Advisory ADV 200006 It is indicated how to disable wbeclient service to protect you against attack vector through the Web Distributed Authoring and Versioning (WebDAV) client service. 

Impact of workaround.

When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the WebClient service will not start, and an error message will be logged in the System log. For example, WebDAV shares will be inaccessible from the client computer.

Workaround effects and how to implement it is indicated in Microsoft advisory.

Consider that Windows 7  and Windows 2008 are no longer supported, it is highly probable that patch would not be available except for customers that subscribed extended patch support:

- Extended Security Update Program di Microsoft (ESU) windows 7
- Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 SP1 and Windows Server 2008 R2 SP1
- Extended Security Updates (ESU) Windows 2008 and 2008 R2 
- Extended Security Updates (ESU) SQL 2008 and 2002 R2


[references articles]

https://www.cwi.it/cio/windows-server-2008-non-e-ancora-morto-ecco-perche_42124905 

https://www.hdblog.it/microsoft/articoli/n518582/windows-10-8-7-hacker-vulnerabilita-critica-patch/ 

https://www.hdblog.it/microsoft/articoli/n515774/windows-7-germania-costi-supporto/ 

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV200006 


[Update 2020.04.15]

Microsoft released patches and new workarounds to mitigate problem:



https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020


Be aware about this information:

"Do I need an ESU license to receive the update for Windows 7, Windows Server 2008 and Windows Server 2008 R2 for this vulnerability?

Yes, to receive the security update for this vulnerability for Windows 7, Windows Server 2008, or Windows Server 2008 R2 you must have an ESU license. See 4522133 for more information."

Freeware - HEIC Freeware tool converter

Apple with new iOS releases store images with a new format HEIC that use less space than .JPG but converting free tool for Windows is not so easy to be found.

I share and take note about correct tool that I succesfully identified.

 iMazing HEIC Converter, free tool to convert HEIC to JPG

If you would like to disable your iphone/ipad device storing in HEIC and mantaining it when transferring foto to your pc below pictures are enough clear about necessary settings.

Microsoft - Windows 7, SQL 2008, 2008 R2 Server, Exchange 2010, Office 2010 EOL - End of life date

Just a quick post taking note about several Microsoft Products where End Of Life date is 2019 or 2020, the first important effect would be related about product and security patches unavailability.

End Of life Product and date

Windows 7 --> January 14, 2020
Office 2010 EOL --> October 13th, 2020
SQL Server 2008 and 2008 R2 Extended Support --> will end on July 9, 2019
Windows Server 2008 and 2008 R2 Extended Support --> will end on January 14, 2020.
Exchange Server 2010 --> January 14, 2020
Products Reaching End of Support for 2019
Products Reaching End of Support for 2020 


Here they are some interesting information:

- Windows 7 Embedded editions follow different EOL dates, you could use following official link.
- You could upgrade compatible Windows 7 PCs based on these requirements with a full license. 
- About SQL 2008 and W2008 R2 please review this article.
- Here it is indicated how Microsoft threat all its products since first release about Mainstream Support and Extended Support.
- About Windows Server Microsoft propose Microsoft Server upgrade center.
- To have visibility about all Microsoft Product EOL here it is correct link.

[Update 2019.08.14]

Here it is new Microsoft Article that refer to some interesting documents/links:

1. Download the Migration Guide for Windows Server
2. Storage Migration Service overview
3. Prepare for Windows Server 2008 end of support
4. Azure Migration Center

Server - How to Execute RSAT snapins with different users without server/client logon necessity

If you need to launch some mmc snapins with different AD account (without logging on server/pc with that credentials) you could follow these steps:

1. Execute command prompt start --> cmd.exe
2. Copy and paste this command text:
   C:\Windows\System32\runas.exe /netonly /user:aduser@domain.suffix "mmc %SystemRoot%\system32\xxxx_command.msc" 
3. where command.msc is any command with .msc.
   Usually any .msc command that is included in your RSAT tool (win 7, Win 10)  installed on your pc 

You can review these blog articles too:

Scripting - Tutti i comandi .cpl, .msc ed altri dal menu start --> Esegui

http://www.alessandromazzanti.com/2011/05/tutti-i-comandi-cpl-msc-ed-altri-dal.html

2012 Server – RSAT anche in 2008 R2 SP1 e 2008 SP2

http://www.alessandromazzanti.com/2012/10/2012-server-rsat-anche-in-2008-r2-sp1-e.html

Scripting - Lista di comandi di start --> Esegui di Microsoft Windows

http://www.alessandromazzanti.com/2011/02/lista-di-comandi-di-start-esegui-di.html

Windows 10 - How to: Move from BIOS to UEFI with the new Windows 10 Creators Update

Microsoft Mechanics delivers a comprehensive yet concise explanation of how you can safely and non-destructively convert a Windows 10 machine from legacy BIOS to UEFI disk partitioning.

Windows Program Manager, Desmond Lee, demonstrates the new MBR2GPT disk conversion tool that’s part of Windows 10 Creators Update. 
This is a comprehensive yet concise overview that explains how you can safely and non-destructively convert a Windows 10 machine from legacy BIOS to UEFI disk partitioning; and how you can automate the conversion as part of your in-place upgrade process from Windows 7 to Windows 10. 

Importantly, unlike wipe and load methods, all of this can be achieved without having to move your data off the disk.
To learn more please also check out: http://aka.ms/mbr2gpt

Windows 7 - How to convert local domain users to domain users (profile)

Here it is an interesting article that well explain how to easily convert local user profiles to domain user profile.

It is in italian but argument is decisevely interesting and useful.

https://www.achab.it//achab.cfm/it/blog/achablog/windows-7-come-convertire-utenti-locali-in-utenti-di-dominio

Windows 7/8.X/10 - Installation Media creation

If you have necessity to reinstall your operative system on your pc but you are unable to find original installation media you can easily refer to following Microsoft article.

Make sure you have:

1. Your Windows product key (xxxxx-xxxxx-xxxxx-xxxxx-xxxxx). 
2. An internet connection.
3. Sufficient data storage available on a computer, USB or external drive for the download.
4. A blank USB or DVD (and DVD burner) with at least 4 GB of space if you want to create media. We recommend using a blank USB or blank DVD, because any content on it will be deleted.

https://support.microsoft.com/en-us/help/15088/windows-create-installation-media

Tips - Incompatibility between Windows 8 roaming user profiles and roaming profiles in other versions of Windows

Symptons:

Roaming user profiles on Windows 8-based or Windows Server 2012-based computers are incompatible with roaming user profiles in other versions of Windows. 

Profiles are compatible only between the following client and server operating system pairs: 

• Windows 8.1 and Windows Server 2012 R2
• Windows 8 and Windows Server 2012 
• Windows 7 and Windows Server 2008 R2
• Windows Vista and Windows Server 2008  

Note In this article, when the client operating system is referenced, the same issue applies to its corollary server operating system. 

For example, if you try to deploy Windows 8 in an environment that uses roaming, mandatory, super-mandatory, or domain default profiles in Windows 7, you experience the following:

• After you use a user account that has an existing Windows 7 profile to log on to a Windows 8-based computer for the first time, the components from Windows 8 read and modify the profile state.
• Certain Windows 8.1 features may not work as expected because the expected profile state is not present.
• When you try to use the same user account to log on to a Windows 7-based computer, the user profile modification that was performed in Windows 8 may not work as expected in Windows 7.

The issues occur because the profile will contain values that are used differently between the versions of Windows. The user profile will be missing default profile configuration information that is expected by the operating system, and could contain unexpected values that are set by a different operating system version. Therefore, the operating system will not behave as expected. Additionally, profile corruption may occur.

Hotfix download:

https://support.microsoft.com/en-us/help/2887239/incompatibility-between-windows-8-roaming-user-profiles-and-roaming-profiles-in-other-versions-of-windows

Tips - How to Fix Pinned Jump List problems in Windows 7/8/8.1/10

If you are facing problems, using file explorer, and having this behavior you might review this article about related fixes.



you need to delete all files that you will find in this path:

%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations

https://www.howtogeek.com/howto/5245/fix-for-when-pinned-jump-list-items-get-stuck-in-windows-7/


[update 2020.04.29]

Please review below article if you like to increase jump list show items:

Windows 10 - How to increase Jump list items number

Powershell - Manage AD through Command line

There are several powershell command line to manage or to get Ad information.

To use these feature you need to install some modules depending on your Operative system.

1) Windows 7 
These feature is enabled on RSAT module (download Link) and then you need to enable it as follow:

After that you need to launch this command (if you are using old powershell version

Import-Module ActiveDirectory

Precedent command need to be launched everytime. If you want to have it automatically installed you need to , for your account only, add the command Import-Module ActiveDirectory to %UserProfile%\My Documents\WindowsPowerShell\profile.ps1.
If you only want to import the module in the PowerShell console, you would add the above command to Microsoft.PowerShell_profile.ps1.

REMARKS PowerShell command will work only if execution policy is set to RemoteSigned or Unrestricted.

Here it is correct command line:

Set-ExecutionPolicy RemoteSigned

2) Windows 2008 R2 Rsat is already installed and you simple need to enable it like following screenshot.




Import-Module ServerManager
Add-WindowsFeature RSAT-AD-PowerShell
Import-Module ActiveDirectory

Alternatively:

3) Windows 8/8.1 you need only to download RSAT @ 8.0 or RSA @8.1.

All options are enabled by default and nothing more is necessary.

4) Windows 2012 and 2012 R2

You can install from here 

or utilizing this command

Add-WindowsFeature RSAT-AD-PowerShell

You do not need to import module.

5) Windows 2016

Through Powershell you can launch these commands:

Get-WndowsFeature RSAT-AD-PowerShell to view if it is installed.

Install-WindowsFeature RSAT-AD-PowerShell

Then:

Import-module activedirectory

Get-Module

You will review in Administrative tools --> Active Directory Module for Active directory

6) Windows 10

you can use this script:

https://gallery.technet.microsoft.com/Install-the-Active-fd32e541

RSAT Windows 10

https://www.microsoft.com/en-us/download/details.aspx?id=45520

<---------->

You can launch this command line to verify installation went fine

Get-ADUser

You can review all powershell commands available here:

Just to take confidence about potentiality of this commands you can.

Finding Locked-Out Users

Search-ADAccount -LockedOut | where {$_.ObjectClass -eq 'user'} | FT Name,ObjectClass -A

Finding Users Whose Accounts Are About to Expire

The following example demonstrates how to find all the users whose accounts are about to expire in the next 90 days:

Search-ADAccount -AccountExpiring -TimeSpan 90.00:00:00 | where {$_.ObjectClass -eq 'user'} | FT Name,ObjectClass –A

 Get-ADUser, which enables you to query information about Active Directory user objects. 

To view number of failed logons since the last successful logon for a particular user.

Get-ADUser -Filter {Name -eq "Administrator"} -Properties * | Select-Object Name, msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon

Here it is a Microsoft article that let review all commands that can be useful

https://technet.microsoft.com/it-it/library/dd728022(v=ws.10).aspx

Here it is an article that explain some advantages of powershell

https://www.itprotoday.com/powershell/top-10-active-directory-tasks-solved-powershell

More details here:

https://4sysops.com/archives/use-powershell-to-get-last-logon-information/

https://ss64.com/ps/ad.html

https://technet.microsoft.com/it-it/library/dd391936(v=ws.10).aspx


[Update 2020.04.29]

If you like to export all AD users you need to use Get-ADUser command using this syntax (it permit you export report in .CSV file)

Get-ADUser -filter * -Properties * | ft Name, saMAccountName, whencreated, LastLogondate, Enabled, Expirationdate, PassowrdExpired, PasswordLastSet, PasswordNeverExpires, Description | Export-CSV C:\TEMP\2020.04.29-ADUsers_1_00.csv -NoTypeInformation -Encoding UTF8

https://morgantechspace.com/2014/10/Powershel-Get-ADUser-Export-Select-Properties-Examples.html


============COMANDO 1 ========

Get-ADUser -filter * -Properties * | ft Name, saMAccountName, whencreated, LastLogondate, Enabled, accountexpirationdate, PasswordExpired, PasswordLastSet, PasswordNeverExpires, Description

============COMANDO 2  ========

Get-ADUser -filter * -Properties * | select Name, saMAccountName, whencreated, LastLogonDate, Enabled, accountexpirationdate, PasswordExpired, PasswordLastSet, PasswordNeverExpires, Description | Measure-Object 

============COMANDO 3 ========

Get-ADUser -filter * -Properties * | select Name, saMAccountName, whencreated, LastLogonDate, Enabled, accountexpirationdate, PasswordExpired, PasswordLastSet, PasswordNeverExpires, Description | Export-Csv C:\TEMP\ADUsers_1_01.csv -NoTypeInformation -Encoding UTF8

Windows 7 - How to install and remove software in safe mode

If you start your pc in safe mode due to fact that is not booting properly or you need to install/unistall any specific software you should be aware that by default is not possible.

To bypass problem you need modify a register part as follow:

Navigate to the Registry key: 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\

Right-click “Minimal”
Select “New—> Key”
Name the key MSIServer
Change the default data value to Service. 

The running of the uninstaller service in safe mode will now be enabled. 

If it is not already running, you can start the service from the command line. 


sc start msiserver

If you want the option of booting to safe mode with networking you need to modify register as follow as step 2

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\

Add a new sub-key called MSIServer to this key by right-clicking Network in the same way as described in steps 3-6 above.

Alternative procedure to register modify step 1 is:

command prompt --> 

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"

net start msiserver

Windows 7 - Problem Steps Recorder free windows tool psr.exe

There is an interesting Windows 7 tool called Problem Steps Recorder.

It’s intended for users that need to capture step by step actions and screenshots to illustrate a problem. 

If you create a lot of documents with screenshots or you need to document a procedure, this tool can save you a lot of time.

start --> psr.exe

After that you start recording and you press pause key, in that case you can highlight monitor section (like Windows snipped tool)  and you will acquire a monitor rectangle.

In that case after clicking on Add comment button you could add any suitable comment text.

Consider that if you need to acquire programs screenshots that was launched ad administrative rights it would be better to execute psr.exe with more permissions.

Consider that this tool acquire up to 25 screenshots, if you need to increase this value you need to click on settings:

When you will stop acquiring you will save a .mht file

This file will be viewable on your browser.

Here is an examplificative youtube video:

Snip Tip

You may have noticed I captured the Start menu in one of my screenshots.  This trick is outlined in the Snipping tool help. To capture a menu: Start the tool; Press Esc; Display the menu; Press Ctrl+Prnt Scrn and then use the snipping tool to capture the menu.