Hacker - Defending Active Directory Against Cyberattacks

Here is a very interesting Microsoft Virtual Academy about Active directory Security.

https://mva.microsoft.com/en-US/training-courses/defending-active-directory-against-cyberattacks-16327?l=Gj8k5XsSC_2004300474


Interested in the why, how, and what of Active Directory (AD) and enterprise protection? This course has the answers you need to help you defend AD against cyberattacks. Learn from the experts, as they look at Active Directory from an enterprise risk perspective. The key to success is knowing what your high-value assets are, securing them, and securing their dependencies.

Whether your digital assets are on-premises or in the cloud, join us to explore the AD environment, today’s adversaries, relationship dynamics, and strategic prioritization, along with adoption of least privilege. Take a look at the different aspects of Active Directory security, based on findings from the Microsoft Cybersecurity Services team, learn strategies to protect privileged identities in your environment, and finish the course with a roadmap for hardening your AD environment. Defenders should be as extremely adaptive as adversaries are these days, and this course is a great place to start.

1 | Active Directory Security: First Things First
Take a look at the sophisticated threats that target Active Directory. Examine the anatomy of a cyberattack, and review the basics of Active Directory security.
2 | Adopt Least Privilege
Learn about the centricity of Active Directory, further explore Tier 0, and understand the importance of assigning least privilege, including its role in your organization’s cyberdefense strategy.
3 | Protect Privileged Identities
Adversaries leverage privileged identities, the primary attack vector, to persist and expand the scope of compromise. Learn strategies to protect privileged identities in your environment.
4 | Defend Your Directory
Do you know who your admins are? Learn why maintaining solid access control to sensitive directory objects is important for mitigating stealthy means of persistence and escalation of privilege.
5 | Defend Your Domain Controllers
Protecting Domain Controller hosts is fundamental to maintain the integrity of the overall access model and security boundary provided by Active Directory. Learn how to mitigate the risks.
6 | Beware of Security Dependencies
Security dependencies are one of the more sophisticated means of compromising Active Directory. Learn how to minimize and protect the security dependencies in your organization's environment.
7 | Monitoring
Collection is not the same as detection. Learn what to collect and how to analyze and respond to your collected data. Start making more informed decisions in response to security events.

Windows 10 - Remote Server Administration Tools for Windows 10

Remote Server Administration Tools for Windows 10 lets IT administrators manage Windows Server Technical Preview from a remote computer running the full release version of Windows 10.

Remote Server Administration Tools for Windows 10 includes Server Manager, Microsoft Management Console (MMC) snap-ins, consoles, Windows PowerShell cmdlets and providers, and command-line tools for managing roles and features that run on Windows Server Technical Preview. 

Microsoft Download:

https://www.microsoft.com/en-us/download/details.aspx?id=45520

HyperV 2012 R2 - Veeam 9 B&R clustered host freezed issue and resolution

On two servers Windows 2012 R2 with Hyper V role installed, SAN and CSV we faced problems with Veeam 9 B&R that freezes single host where B&R was backing up active VM.

(more specifically public lan was unreachable unless hard reset) and only replication lan was working giving us this issue:

1. Host server with problems was reachable via RDP from working host using Replication lan ip/subnet.

2. Cluster was ok but VM that was backing up mode was locked.

3. We was not able to live migrate vm from one host to another or any other action. (shutdown, hard reset....)

Here they are action taken to solve issue other then temporary HyperV freezes hard reset.

Veeam B&R showed that there was missing on both hosts these Microsoft hotfixes (please be aware to take note about patch prerequisites before installation)

Host: XXXXXXX
KB3068444:  Resolves an issue where a cluster node experiences a Stop 0xF5 FLTMGR_FILE_SYSTEM when using Shared VHDX. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.
Description:  Resolves an issue where a cluster node experiences a Stop 0xF5 FLTMGR_FILE_SYSTEM when using Shared VHDX. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.

https://support.microsoft.com/en-us/kb/3068444

KB3068445:  Resolves an issue where a deadlock or Stop 0x9E occurs on a cluster node when there is a lot of network (SMB) I/O requests to large files (1 TB or more). Includes the fix from 3044457. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.
Description:  Resolves an issue where a deadlock or Stop 0x9E occurs on a cluster node when there is a lot of network (SMB) I/O requests to large files (1 TB or more). Includes the fix from 3044457. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.

https://support.microsoft.com/en-us/kb/3068445

KB3072380:  Resolves an issue on a Hyper-V cluster where the heartbeat component times out during a long-running snapshot. The snapshot fails and the VM restarts. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.
Description:  Resolves an issue on a Hyper-V cluster where the heartbeat component times out during a long-running snapshot. The snapshot fails and the VM restarts. Available for individual download. To apply this update, you must first install the update 2919355 on Windows Server 2012 R2.
https://support.microsoft.com/en-us/kb/3072380

KB3090343:  Cluster service stops during the VSS backup in a Windows Server 2012 R2-based Hyper-V cluster.
Description:  Resolves an issue an issue that occurs when you use the Volume Shadow Copy Service (VSS) backup on a Cluster Shared Volumes (CSV) volume by using a software snapshot provider in Windows Server 2012 R2. 

https://support.microsoft.com/en-us/kb/3090343

Meanwhile we verified Firewall status and we verified that Following AV exclusions was working fine.

*.AVHD
*.AVHDX
*.ISO
*.VHD
*.VHDX
C:\ClusterStorage\Volume1\
C:\ProgramData\Microsoft\Windows\Hyper-V\
Vmms.exe
Vmwp.exe


After these actions problem was successfully solved.

Here there is another veeam article (that successfully apply to veeam 9.0 too after veeam support querying)

Tips - How to read file .p7m DigitalSign Reader

During these years it happened that often some end users had problems to read on their computer .p7m files.

For that purpose and considering that finding suitable free tool for me was not immediately straight I take note of software that worked fine for me.

DigitalSign Reader 5.0 

http://www.comped.it/it/prodotti/digitalsign-reader/digitalsign-reader-5-scaricalo-subito

I hope that this information could be useful for someone.

Windows 2000 - "c:windows\system32\config\" missing or corrupted


I had a problem on a very old Windows 2010 server and I got precedent error and no boot way was available:

"c:windows\system32\config\" missing or corrupted

I tried several procedures:

  1. Last configuratioin restore
  2. Windows recovery mode.
  3. Boot from Server CD and going on recovery console and running Chkdsk command

The only solution was to follow this microsoft article:

KB269075


I am focusing on more important commands used:


cd system32\config
ren system system.old
ren system.alt systemalt.old

To copy the default System hive, type the following command, and then press ENTER:

copy c:\winnt\repair\system c:\winnt\system32\config

To copy the System hive that was backed up the last time that you ran the Emergency Repair Disk Wizard, type the following command, and then press ENTER:

copy c:\winnt\repair\regback\system c:\winnt\system32\config

In my case there was c:\winnt\repair\system.bak file that I copied with this command:

copy c:\winnt\repair\system.bak c:\winnt\system32\config

Windows 7/8/10 - How to enable God Mode

Windows God mode is a simple folder that contain all Windows 7/8/10 Administration shortcuts in a single place.

To enable God mode you simple need to create a folder with this name:

God Mode .{ED7BA470-8E54-465E-825C-99712043E01C}

We will have a single folder with control panel and any other windows command.

<--------->


Il God Mode è sostanzialmente una cartella semplice che porta tutti gli aspetti di controllo di Windows 7/8/10 in un solo luogo. 
Racchiude infatti tutte le funzioni del Pannello di controllo, la personalizzazione dell’interfaccia, le opzioni di accessibilità e quasi ogni aspetto del controllo di Windows 7 .

God Mode è molto facile da attivare e basta semplicemente seguire questi due passi:


  • creare una nuova cartella, in qualunque posto preferiamo del nostro PC;
  • rinominiamo la cartella incollando questo nome, esattamente così come appare: GodMode.
  • God Mode .{ED7BA470-8E54-465E-825C-99712043E01C}

Ecco, adesso avremo in una sola cartella, con l’icona del Pannello di controllo, tutti i controlli sul nostro Windows 7/8/10.

Old article:

http://www.alessandromazzanti.com/2010/12/attivare-il-god-mode-in-windows-7.html