Totally coincidence that I posted this same topic for PowerShell yesterday and today I started moving over my Windows Admin blog content and the first post over there was the same topic, but without PowerShell!

@IRJ said in Building a First Active Directory Domain Controller on Windows 2012 R2 Core:

@thwr said in Building a First Active Directory Domain Controller on Windows 2012 R2 Core:

@coliver said in Building a First Active Directory Domain Controller on Windows 2012 R2 Core:

@thwr said in Building a First Active Directory Domain Controller on Windows 2012 R2 Core:

@IRJ said in Building a First Active Directory Domain Controller on Windows 2012 R2 Core:

Good article. There is ZERO reason to have a GUI on a Domain Controller. Everything can be done through Server Manager on Windows 10/8

You mean RSAT 😉

Both? You can do a lot of directory management through Server Manager as well.

Ok, agree. Just don't like the Server Manager this much, ugly interface. I want to be sure WHICH drive on WHICH host I'm going to format for example. But that is just my personal opinion and I'm more or less a console fetishist 😉

But when it comes to ADSIedit or AD sites, you really want to have RSAT.

huh?

0_1469044083616_2016-07-20_15-47-37.png

Those options are generally only there is RSAT is installed.

Sweet. Thanks for getting this for us @adam-ierymenko

@scottalanmiller said in Renaming a Windows Computer from the Command Line:

@IRJ said in Renaming a Windows Computer from the Command Line:

@scottalanmiller said in Renaming a Windows Computer from the Command Line:

@IRJ said in Renaming a Windows Computer from the Command Line:

I learned something new today. I have been using the shutdown command for years. I never realized you could rename a PC with it.

shutdown doesn't do the renaming, you just have to reboot after you rename.

I use "m" instead of c for computer name

/c is the comment for the logs to tell them that you just "Renamed Machine", it doesn't rename it, it literally puts "Renamed Machine" into the reboot logs.

Ok. Got ya.

@dafyre said in Installing Scale Tools on Windows Server Core from Command Line:

@scottalanmiller said in Installing Scale Tools on Windows Server Core from Command Line:

@dafyre said in Installing Scale Tools on Windows Server Core from Command Line:

@scottalanmiller said in Installing Scale Tools on Windows Server Core from Command Line:

@dafyre said in Installing Scale Tools on Windows Server Core from Command Line:

I'm unfamiliar with the Server Core setup... but can't you install these drivers as part of the Windows installation process?

Storage yes, but I'm unaware of a simple way during a stock install to include other drivers. The storage ones are requested, and necessary, during the install. Otherwise the installation location does not show up (unless you don't use VirtIO block devices.) You can definitely add the tools into an image, and there is probably a way to include Ethernet devices ahead of time, but I'm not used to the installation process to know where it happens.

I just select all 3 of the INF files and go... It's always installed everything for me, lol... Just point it at the folder for the right OS and 32 or 64 bit... (Note: This is the way I did it in Scale v4.3... I've not had a chance to use their newer stuff yet.

At what stage are you selecting them?

During the install process... the same place where you go when you're picking the storage drivers.

I rarely do modifications at that stage. Still, handy to have a simple option because a lot of people will get the install done and find that there is no networking and need to know what to do at that point. 🙂

Veeam just announced this week that they now consider ReFS to be ready for production use for the first time due to last week's WIndows Server patch that addressed some ReFS issues.

Lots of VMs creates a licensing nightmare. Sure with a Datacenter license that would be no big deal, but I don't have that.

@Kelly said in Docker for Mac and Windows public beta is out! No more VirtualBox!:

I don't think Docker is going to eliminate VirtualBox, but it is going to make canned trials more the norm. Being able to download and launch a containerized trial version of software will make this so much easier.

I agree, two different shoes to fill. Both have a useful place.

@MattSpeller Who doesn't love pinkeye?

You /could/ turn on Operational Event logs for PrintService in Windows Server, then make an xml collector that adds up Param 8 from Event ID 307 in that log over a given time. Or get software where someone has already done that. (papercut prob does this).

@Grey said in Firefox continually crashing out in VDI:

I installed Firefox Portable and removed standard FireFox. Something between v32 and v42 changed the way that profiles are handled and they can't deal with data that's copied/imaged in the way that Personas/View handles %appdata%.

Odd. I haven't run into this yet, I'd knock on wood, but it's all fake plastic around me right now.

@aaronstuder said in Changing SQL SPN:

You missed blacking out some hostnames 😉

😆 Damn VNC!

@Dashrender said in From Windows to UNIX: Monolithic to Modular Design:

I suppose it's less of an issue as well, since Linux Distros are free, you just have another VM running the other software.
Windows, you'd have the Windows tax.

Exactly. A VM or a container or an application jail. Lots of options for mediation if you want the conflicting packages.

Downloading? It was done downloading before my finger was off the mouse, lol.

I can't wait to dive into 2016, though. They're bringing a lot of improvements that me and this team I am with here are excited about in the RemoteApp and VDI realms.

From the Badlock page:

What can attackers gain?

The security vulnerabilities can be mostly categorised as man-in-the-middle or denial of service attacks.

Man-in-the-middle (MITM) attacks:
There are several MITM attacks that can be performed against a variety of protocols used by Samba. These would permit execution of arbitrary Samba network calls using the context of the intercepted user.

Impact examples of intercepting administrator network traffic:
Samba AD server - view or modify secrets within an AD database, including user password hashes, or shutdown critical services.
standard Samba server - modify user permissions on files or directories.

Denial-of-Service (DoS) attacks:
Samba services are vulnerable to a denial of service from an attacker with remote network connectivity to the Samba service.
Who is affected?

Affected versions of Samba are:

3.6.x,
4.0.x,
4.1.x,
4.2.0-4.2.9,
4.3.0-4.3.6,
4.4.0
Earlier versions have not been assessed.

How can I fix my systems?

Please apply the patches provided by the Samba Team and SerNet for EnterpriseSAMBA / SAMBA+ immediately.

Patched versions are (both the interim and final security release have the patches):

4.2.10 / 4.2.11,
4.3.7 / 4.3.8,
4.4.1 / 4.4.2.
With the release of Samba 4.4.0 on March 22nd the 4.1 release branch has been marked DISCONTINUED (see Samba Release Planning). Please be aware that Samba 4.1 and below are therefore out of support, even for security fixes. There will be no official security releases for Samba 4.1 and below published by the Samba Team or SerNet (for EnterpriseSAMBA). We strongly advise users to upgrade to a supported release.

Some vendors may choose to ship 4.4.1, 4.3.7, and 4.2.10 versions and add regression patches on top of them, due to wide scale and complexity of this release. Some may also just backport the patches to older releases. Please contact your Samba supplier for details.

What further improvements after patching are suggested?

Mitigations for man-in-the-middle (MITM) attacks:
Network protections that could be used MITM attacks include DHCP snooping, ARP Inspection and 802.1x.

It is recommended that administrators set these additional options, if compatible with their network environment:

server signing = mandatory
ntlm auth = no

Without server signing = mandatory, Man in the Middle attacks are still possible against our file server and classic/NT4-like/Samba3 Domain controller. (It is now enforced on Samba's AD DC.) Note that this has heavy impact on the file server performance, so you need to decide between performance and security. These man in the Middle attacks for smb file servers are well known for decades.

Without 'ntlm auth = no', there may still be clients not using NTLMv2, and these observed passwords may be brute-forced easily using cloud-computing resources or rainbow tables.

Mitigations for denial-of-service (DoS) attack:
Apply firewall rules on the server to permit connectivity only from trusted addresses.

Will encryption protect against these attacks?

The SMB protocol, by default, only encrypts credentials and commands while files are transferred in plaintext. It is recommended that in security / privacy sensitive scenarios encryption is used to protect all communications.

Samba added encryption in version 3.2 in 2008, but only for Samba clients. Microsoft added SMB encryption support to SMB 3.0 in Windows 8 and Windows Server 2012. However, both of these types of encryption only protect communications, such a file transfers, after SMB negotiation and commands have been completed. It is this phase that contains the fixed vulnerabilities.

Samba/SMB encryption is good practice but is not sufficient for protection against these vulnerabilities. Network-level encryption, such as IPSec, is required for full protection as a workaround.

How bad is Badlock?

The severity of Badlock according to the Common Vulnerability Scoring System (CVSS):

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Base: 7.1 (High); Temporal: 6.4 (Medium)

Is this vulnerability exploited currently?

It may be possible since we already have several PoC (none of them will be released in the near future).

What does "Badlock" stand for?

"Badlock" was meant to be a rather generic name and does not point to any specifics.

Yet Another Bug With A Logo?

What branded bugs are able to achieve is best said with one word: Awareness. Furthermore names for bugs can serve as unique identifiers, other than different CVE/MS bug IDs.

It is a thin line between drawing attention to a severe vulnerability that should be taken seriously and overhyping it. This process didn't start with the branding - it started a while ago with everyone working on fixes. The main goal of this announcement was to give a heads up. Vendors and distributors of Samba are being informed before a security fix is released in any case. This is part of any Samba security release process.

Who found the Badlock Bug?

Badlock was discovered by Stefan Metzmacher. He's a member of the international Samba Core Team and works at SerNet on Samba. He reported the bug to Microsoft and has been working closely with them to fix the problem.

Of course it exists (awesome things tend to get ported 😉 ), I use it all the time, and I have for years. It's pretty great. Not only that but you can get a lot of tools on Windows:

http://gnuwin32.sourceforge.net/

I can't use Windows without this, that is the base and a lot of the packages (wget especially; yes I use both wget and curl :P)

@mlnews said:

And this is the current site for the project...

https://github.com/Pash-Project/Pash

I love it when people port garbage to other platforms

@scottalanmiller said:

What I don't understand is why people use Mac OSX for development or why WSL would be nice. In both cases I feel like people want Linux but just aren't using it. Why not? If you want Linux, why not work on Linux?

For me personally I have used all 3 platforms and for me, I like the Mac for the Host as it seems to be the most user friendly, everything just works, and I can focus on the task at hand OS. I then run VM's for Windows and Linux on top for whatever I need to get done. I like the hardware, I like the OS, I love the gestures on the mouse pad, and I like the 8hour battery life.