I’ve got it up and running in the lab. Now I see this article;
A few years ago, Microsoft switched from per-processor to per-core licensing in SQL Server, and it’s about to do the same with Windows Server 2016. You may not be thrilled with the results.
“Microsoft’s auditors likely will have a field day with these new requirements for Windows Server, in the same way that they have used the ever-more-complex licensing rules for SQL Server to increase the company’s audit-based revenue in recent years,” warned Christopher Barnett, an associate attorney with Scott & Scott LLP.
This is simply a quick video showing how to open the case on this HP Envy M6 AE 151 D laptop since there didn’t seem to be anything online. These were a pretty popular Black Friday sales item this year (2015) so there are probably a few people working on replacing the default mechanical 1 Tb drive with a SSD, adding memory, etc.
These came without a optical drive. The battery is NOT removable. But you can upgrade the battery also by opening the case. I’ve had a couple open replacing the drive with a SSD.
So I got a call tonight from those scammers that try to get you to let them connect to your computer. I
Microsoft scammers webpage
recorded the call if you want to listen to what it sounds like. I’m not as dumb as I sound on the audio; it was an act to drag it out and build rapport to try to get more information. It’s about 30 minutes. Everything I say on the call is made up; I was trying to stretch it out but finally I had other things to do. When I told him there was someone at the door I actually made me some dinner. This is actually a fairly unsophisticated attack, entirely based on social engineering and not technical. Some tips to avoid this type of attack, based on this call (based on my 20 years in IT, some in Director roles);
1) It was a blocked number on caller ID. This alone is already illegal.
2) Who INITIATED the call? If THEY initiated the call, you are at risk. If you have a problem with your computer, go fix it, don’t wait for someone legit to call you.
3) I it was pretty obvious it was a crowded, lots of background noise, and not very good English. A real Microsoft support person has a very professional demeanor.
4) Even without being technical, it was/should be a red flag when the Microsoft guy said they could also fix Apple. One guy said they COULD fix Android, one said they could not.
5) The website they directed me to was a “free” hosted website company. I have already contacted them, and the site is being shut down.
6) Technically; they ask you to open Event Viewer, and look at the Critical Events, and you’re supposed to get panicked, but there are ALWAYS bad looking events in there.
7) Then, they directed me to a website, which had several remote control links on it, I’m sure the next step was to get me to install one of them. The tools listed on that site; Teamviewer, Goto Meeting, etc, are legit tools, just being used for a scam.
8) I started asking about a phone number, for my “friends” to call them. They hung up. Most of their website and phone activity can be faked, but a call back number would be a way to identify them, and they knew it.
From what I’ve read, if it works, they get you to go to a Western Union site and send them money to pay for their “help” fixing your computer.
Today the news came out that http://error.000webhost.com/ was hacked and 13,000,000 user’s information was released. This isn’t even the biggest breach. In order of size the Adobe breach was still the largest at 152,000,000. The site is now in “maintenance” mode for all, causing a lot of alarm with the user community.
The background of the issue, and the site’s reluctance to face the issue is outlined in numerous articles
Has my account been compromised or hacked? Look it up here.
Starting with Server Graphical Shell (normal full blown GUI)
We remove the Graphical Shell, which takes us to MINIMAL SERVER INTERFACE. Then we return to the Server Graphical Shell.
Link to video going from Server Graphical Shell to Minimal Server Interface, and back. Also looking at the tools in Minimal Server Interface, and how you restart your tools if you close them all and are looking at a black, blank desktop in Minimal Server Interface.
We remove Graphical Shell and minimal interface and go directly to CORE, then we return to Graphical Shell
This command gets you from CORE to Minimal Server Interface; Install-WindowsFeature Server-Gui-Mgmt-Infra
Add this command as well, and you go back to full Server Graphical Shell; Install-WindowsFeatureServer-Gui-Shell
So, to go from Core back to Server Graphical Shell in one step, this is your command; Install-WindowsFeature Server-Gui-Mgmt-Infra, Server-Gui-Shell
Link to video going from Server Graphical Shell to Core, and back. Also looking at the tools in Core, and how you restart your tools if you close them all and are looking at a black, blank desktop in Core.
Prepare yourself for the Microsoft MCSA 70-412 exam. This course explores how to implement an advanced DHCP solution, implement an advanced DNS solution, and deploy and manage IP Address Management.
These notes are my personal notes from the FREE training on Pluralsight. You can get your FREE signup through technet/MSDN or Dreamspark. The title of this course is exactly the title of this post. These notes are from this specific course only. I use these as a refresher Study Guide. POWERSHELL topics and cmdlets are in purple. I have a few notes with the “DEMO” each time the training included a DEMO just so you can see how many demos there were which were really helpful. Thanks to Greg Shields @ConcentratdGreg, the trainer, contact info at the end.
Install and Configure AD Certificate Services. Essentially setting up internal certificate trusts to mirror, and and can negate the need for, external certificates like Microsoft, Verisign, etc.
Install an Enterprise Certificate Authority
The “issuing CA” creates the actual cert file. Issuing CA gets trust from Policy CA, who gets it from a Root CA
Root is typically standalone, offline. Policy CA standalone or enterprise, typically online. Issuing CA typically enterprise online.
Issuing CA is the one doing all the day to day work.
Install CA ROLE, and the Online Responder ROLE
optional web enrollment pieces, or can use the console to manage
Post install configuration; configure active directory certificate services, requires member of local admins for some services, and Enterprise Admin for some.
Decide what TYPE of CA you’re installing.
Choose a NAME for the CA, usually combination of server name, domain name. Choose validity period (default = 5 years)
Certificate Templates – basic templates are provided, then when you fill them out with specific information it creates the actual certificate. Some are “available for issue” then there are dozens of additional ones that are not available for issue by default.
refresh GP then root cert should be available through AD. certs are automatically trusted by any computer in the domain
from a client, you can “request a new certificate”, and it automatically enrolls
Configure CRL (certificate revocation list) Distribution Points
when you need to manage expiration due to termination, employee leaving, new job responsibilities, etc.
The CRL location shows up in the “details” tab on the actual cert
set up CRL revocation list locations BEFORE passing out certs
you can’t delete crl revocations. Think about it, that makes sense. But when the list gets really long there are ways to make the queries faster.
Install and Configure Online Responder
Configure the Online Responder (which also needs a cert) OCSP response signing
Revocation Configuration for the Online Responder
Online responder downloads a copy of the CRL to make responses
enter the URL for the Online Responder in cert templates, and again have this set up prior to issuing any certs or you have to redo them all.
right click, all tasks, back up and restore recommend private key and logs (checkboxes)
certutil can also do backups (old way)
now of course PS Backup-CARoleService
Enrolling for Certificates
instead of “find cert” start with “request”
From IIS, you can create request and complete request from wizard on the right side of IIS.
Example using a PS code signing certificate
Manage Certificate Templates
Certificate Template Tabs
right click / manage, see “code signing certificate”
copy “duplicate” the template, then modify the new duplicate for use
publish certificate in AD checkbox
choose encrypt/signature or both
auto renewal can force a different private key
WHAT this cert is going to be used for is baked in the cert configuration. For this example signing PS, this would be “code signing”
“subject name” is usually the FQDN of the webserver. In this case, we specify the user name for our PS signing cert.
you can configure manager approvals or signatures prior to approval
security tab; read, enroll, auto-enroll.
Implement and Manage Certificate Deployment, Validation and Revocation
now that the template is created, we talk about deployment, validation and revocation
now you have to right click on Certificate Templates, choose new certificate to issue and find the newly created template to issue.
revoke certificate from a right click on the cert. This is PERMANENT and not reversible. Note there is a “HOLD” that can be a temporary hold.
force a CRL update by “publish CRL”
new crl once a week, new delta crl once a day.
Configure and Manage Key Archival and Recovery
there is no default capability to archive keys
archive when enabled happens in AD
KRA Key recovery agent cert can recover keys
copy and modify certificate template
then you “enroll” for the KRA certificate
two commands to recover
PS certutil -GetKey
Manage Certificate Renewal
manual non-GPO renewal
in Certificate console, right click on template, “re-enroll all certificate users”
Manage Certificate Enrollment and Renewal to Computers and Users using Group Policy
to auto populate our PS code signing certificate, assigned to our IT group
GPMC, new GPO
user side, public key policies
need certificate enrollment (AD)
auto-renewal /log expiry events, other options
auto renewal is 80% of cert lifespan, or the expiry of the renewal period
testing on machine, log in, gp runs, check for PS Signing cert
Configure and Enroll a Hyper-V Replica Certificate
If you choose replication in Hyper-V and select “encrypt”, then it will error as there is no dedicated custom cert
copy and rename a “Computer” template
then make it available for use
now when you go back to Hyper-V Manager it shows up.
Install and Configure AD Rights Management Services
Install a Licensing or Certificate AD RMS Server
RMS servers are referred to as “cluster”, just meaning multiple servers. You can also do a single server cluster. You need to be Enterprise Admin to complete this setup.
If you go to a document on File Server, you go to “protect document” then “restrict access” to connect to RMS and “get templates”. Will error if you have no RMS set up.
Install Active Directory Rights Management Server ROLE.
Post install configuration is required (yellow alert top right of Server Manager)
RMS is tied to email field in AD properties general/email field. Even if you don’t have email in reality it just pulls from that field.
Store RMS Cluster Key (keep this), password, website.
For location, suggest CName instead of FQDN so you can adapt in the future if the hardware changes.
Manage AD RMS Service Connection Point
Manage RMS Templates
Rights Policy Templates determine what/how you are going to offer to your users.
example; content that Finance group needs to protect
Name policy “Finance Protected Content”, add description.
Tied to the email associated with the finance security group, and you can choose what they can do. Lots of rights / actions, and you can create custom ones as well. view/edit/save/print/save/save as/etc.
you can disallow client side caching; they would have to be online to access the data
define revocation policy; when you revoke the license, you revoke the ability to access that policy, you also provide a url where the policy resides.
Configuration DB, directory services DB, logging DB. Either in SQL or the Windows server internal SQL. The internal SQL requires a full server backup. So, from a backup perspective it’s better to use SQL.
server certificate needs to be backed up
cluster key password
export trusted publishing domain
Implement AD Federation Services – focus seems to be on Workplace Join
Configure Workplace Join
Traditionally, access is controlled by a user ID and login. Or, from AD permissions.
Federation is used when access needs to be provided to users OUTSIDE of your domain. (Partner, merger, acquisition, etc.)
Federation servers handle the federation process between organizations. It’s kind of a bridgehead or gateway for the access request/granting. It does this by generating “claims“.
Relying Party (us) and Claims Provider (them)
This happens from a pair of Trusts from each direction; Claims Provider Trust and Relying Party Trust.
Think also for BYOD situations for non-domain joined devices. Device itself is added to AD.
Typically connect through Web Application Proxy (not on the 412 test)
Settings / network / “workplace” is where you see it.. on your desktop, not the server.
VEEAM is offering a FREE ebook on the Microsoft 70-409 certification; Server Virtualization with Windows Server Hyper-V and System Center. This book is by @orinthomas (http://orinthomas.com/) who is a great IT author and trainer, I’ve used a lot of his material. You could study this book, online resources, and use the Second Shot to pick up this cert. Here is the link to the download page on VEEAM; http://go.veeam.com/microsoft-certification-exam
Prepare yourself for the Microsoft MCSA 70-412 exam. This course explores how to implement an advanced DHCP solution, implement an advanced DNS solution, and deploy and manage IP Address Management.
These notes are my personal notes from the FREE training on Pluralsight. You can get your FREE signup through technet/MSDN or Dreamspark. The title of this course is exactly the title of this post. These notes are from this specific course only. I use these as a refresher Study Guide. POWERSHELL topics andcmdlets are in purple. I have a few notes with the “DEMO” each time the training included a DEMO just so you can see how many demos there were which were really helpful. Thanks to Greg Shields @ConcentratdGreg, the trainer, contact info at the end.
“Storage” – think more than just file server.
Configure and Optimize Storage
Configure Storage Spaces
create a Storage Pool
all storage shows up (unused and available) in the PRIMORDIAL POOL
new storage pool wizard
during wizard can allocate “automatic” but can choose “manual” or “hot spare”
leave it as automatic, can set RAID
Then create a disk out of the storage pool. Then can create volumes on those disks as well.
storage tiers checkbox is grayed out as tiering is not set up.
can set simple/mirror/parity (RAID) in this wizard
next button lets you choose thin or fixed provisioning.
after creation, then create a volume on the new disk
can enable data deduplication in next field (have to turn on the ROLE)
general purpose or VDI de-dupe
can choose exclusions, schedule, etc. Throughput optimization.
Configure Tiered Storage
Start with creating a new storage pool. Has the different type disks (SSD and spinning)
(hack to create each with VMware workstation)
Get-PhysicalDisk | ft friendlyname,size,mediatype
can set them in PS to be and appear as SSD or mechanical
Set-PhysicalDisk -mediatype HDD
So essentially you are setting them to have some SSD and some HDD so you can set up tiering.
Now you have a different option in the wizard (Faster tier, Standard tier)
the tiering is handled by the windows subsystem, no mgmt
can set specific files to SSD by PS; Set-FileStorageTier
by DEFAULT all machines have read access, and root access is disallowed.
PS NfsShare, Get-NfsShare, etc.
Configure file access auditing
50 new sub-categories, but same way to set up as previously
Group Policy or local security policy
9 different original policies. Audit Object Access. Typically this is how we used to turn this on
“Advanced Audit Policy Configuration”
SACL; auditing view on file/folder properties, now you can also add CONDITIONS.
transparent; cache documents in remote locations. I.E., branch offices. Bandwidth was historical a reason. Used to need Enterprise Windows versions, limiting it’s use. Now any version of Windows 8 works. Turn it on and don’t think about. File server, web server, or BITS data.
First access of document initiates the copy to the branch.
Distributed Mode (stores on desktop machine) or server based Hosted Mode.
file is split into chucks that are hashed then only changed chunks are updated.
One piece only does files, different piece does Web and BITS. These are in different places in FEATURES
Turn it on via GPO, choose hash type, configure client side “turn on branch cache”, set hosted cache server name, set cache expiration, etc.
You can pre-populate bia PS Publish-BCFileContent, Export-BCCachePackage
Implement Dynamic Access Control (DAC) DAC is supposedly heavily represented on 70-412 and 70-417 tests. Here is a great example and scenario about how to use DAC in a real-world situation, from the Microsoft Storage Team; http://mints4.rssing.com/chan-3739609/all_p2.html
Addresses file permissions getting lost/changed during file moves. New security requirements also drive this advancement in security.
needs to have characteristics set in AD
Also settings on file servers.
Scenario; you can filter all documents for SSN, and then disallow anyone from viewing such document unless the user is in certain group, site, etc.
Can filter and scan files as they are updated (SSN added to file that did not previously have one)
Think big IF THEN statement; IF this user is in FINANCE group, AND user is in DENVER, then allow read/write/etc.
DAC scans documents regularly to keep up with changes.
Configure User and Device Claim Types
Install File Server Resource Manager ROLE (screenshot)
CLASSIFICATION tab in properties on your file server now.
Active Directory Administrative Center (different from ADUC) has DAC
Trying to get steps in order here;
create claim types in ADAC for USERS
Resource properties for files set up in ADAC / DAC console. Some examples built in are; Personal Use, Project, Intellectual Property, Immutable (?), Department, Compliancy, Personally Identifiable Information, etc. Then there are different values; NOT PII, Public, Low, Moderate, High, and you can create/edit values. These are set up then used later in AD to apply to files and folders
Resource property lists ( add resource property to global) This is just a container of resource properties. Grouping these makes it more manageable to attach to documents. To use this, use PS Update-FSRMClassificationproperyDefinition, which enables the property list. Now it shows up on folder/share/file “Properties” as a new TAB. Users aren’t going to use this manually very much so you have to use server options; screen templates, file screens, classification management. This is the first step to determine what type of content you’re looking for in files / folders. You can scope to specific types of files; user files/ backup files, application files, etc. Scope this down to only the ones interested in, or you can get into resource issues. After picking scope, then choose the TYPE of classifier; for this a “content classifier” which looks at file content. Then you set the content classifier to “high, low, etc.” to apply that to hits that it finds. then you build the classification parameters which are detailed search expressions. you can look up the patterns on the internet or wherever like this one for SSNs. Now schedule to determine when and how often it searches. Check-box ” enable fixed schedule” then choose the times/dates/recurrence. You CAN force it to “run now” to see if it works. It allows logging and post scan reports. When if finds a HIT, then it actually will show as an updated “properties” tab on the file. You also can configure email request assistance and notification for remediation.
Create new central access rule. This is in ADAC / DAC to set up how you want to apply the settings above to control access based on the detail above. Generally apply to “authenticated users” , they get access when certain defined conditions exist; user is in Kansas City, and belongs to HR, etc.
Create central access policy is how the rule above gets applied to file servers. Then use Group Policy to deploy. New GPO for DAC policy. This would apply to File Servers. Then go back to properties on the share/folder and there is a “Central Policy” tab that you have to choose the policy.
I guarantee this is a test question that MS uses. Keep in mind test questions are random so it might not be on EVERY test, but it’s on one I took.
Implement Policy Changes and Staging
Create and Configure Resource Properties and Lists
Configure File Classification
Perform Access Denied Remediation
Create and Configure Central Access Rules and Policies