Category Archives: Windows

VMware and Powershell

Broadcom the owner and vendor of VMWare have release a new powershell module, called VCF.PowerCLI instead of the vmware PowerCLI.
If you computer is online, you can installed it with the powershell command Install-Module

Install-Module -Name VCF.PowerCLI

If yours computer/server is not online, you can download it from another computer, and installed it though the manuel way, please look here: https://developer.broadcom.com/powercli/installation-guide

When upgradering from Vmware PowerCLI – Throubleshooting
If you allready have Vmware PowerCLI installed on the computer, you may encounter the following error when trying to install VCF.PowerCLI

PackageManagement\Install-Package : The following commands are already available on this system

This happens because some of the commandlets which are part of the PowerCLI SDK have been moved to other modules. To resolve the conflict you need to add the AllowClobber parameter to Install-Module

Install-Module -Name VCF.PowerCLI -AllowClobber

AllowClobber overrides warning messages about installation conflicts about existing commands on a computer. Overwrites existing commands that have the same name as commands being installed by a module. AllowClobber and Force can be used together in an Install-Module command.

Selfsign with Windows Certification Authority

If you just create a certificate, and it signed by a Windows Certification Authority, the certs is working just fine in the old Internet Explorer, but Chrome/Firefox and the new Edge browser will failed, with Common Name invalid, the precise error in Chrome is: NET::ERR_CERT_COMMON_NAME_INVALID.

This is because a normal certificate request, does not included a subject alternative name.
So to fix this you new to request the certficate, by an inf file instead

So first create a new Certreq.inf file and paste this into it:

;----------------- request.inf -----------------
[Version]

Signature="$Windows NT$"

[NewRequest]

Subject = "CN=kennethdalbjerg.dk, OU=Hosting, O=KennethDalbjerg, L=DK, S=DK, C=DK" ; replace attribues in this line
KeySpec = 1
KeyLength = 2048
; Can be 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
FriendlyName = "Kennethdalbjerg.dk-2024"
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft Strong Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication

[RequestAttributes]

SAN="kennethdalbjerg.dk&dns=www.kennethdalbjerg.dk"
;-----------------------------------------------

Replace kennethdalbjerg.dk and www.kennethdalbjerg.dk, with the name you want. If you don’t want more than one common name, in yours certificate. Then you just in last line remove:
&dns=www.kennethdalbjerg.dk
Also replace the name in FriendlyName.

Now run this command to prepare the CSR file:

certreq -new certreq.inf certreq.csr

Copy the certreq.csr to yours Certication Authority server, and the run this command on that server

certreq -Submit -Attrib "CertificateTemplate:webserver" -Config - c:\certreq.txt

Replace CertificateTemplate:webserver with the correct name for the template that you want to use.
Save the certificate by name, i use signcert.cer
Copy signcert.cert back to the server, that you have generate the CSR file on, and run this command on that server

certreq -accept signcert.cer

Problems in connection to a Webservice from Windows Server 2016 / 2019

Today, I have this issue, that i could not connect to a webservices, that are hosted by the Danish Tax Service, the URL where: https://emcstest.skat.dk
I got this warning:

Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

When running these commands

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$WebResponse = Invoke-WebRequest "https://emcstest.skat.dk"

No matter what I did. But final I tested the webpage against SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=emcstest.skat.dk
Found these ciphers

I then run these commands:

Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384

And finally I where able to access the webpage though powershell.

Clear mssql cache

If you for example need to test a query against two SQL servers hardware, its a good idea to clear the cache first.
This query can do this:

DBCC DROPCLEANBUFFERS; 

-- Removes all elements from the plan cache.

DBCC FREEPROCCACHE;

-- Displays the number of milliseconds required to parse, compile, and execute each statement.

SET STATISTICS TIME ON; 

-- Display information regarding the amount of disk activity generated by Transact-SQL statements.

SET STATISTICS IO ON; 

Computer won’t join Azure AD

When going to Settings -> Accounts -> Access work or school, og push the “connect” buttom. I could just see that the popup, asking for my mail address, just popup, but then disapear again very quick.

Starting a powershell with administrative rights, and type in the command

Get-AppXPackage | foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

And let it run, it toke 1-3 minutes to complete, but when it completed i could push the buttom, and the popup show just fine.

Again this is a danish screenshot.


Expand an EXT4, on a SCSI device

If you have vmware ESXi or Microsoft Hyper-v, you can expand a disk, from the hypervisor console, very simple. But afterwards the partition the servers is not expand.
It is always a good idea to create a Snapshot/checkpoint before. Just remember, that the disc can’t be expanded in Hyper-v when there are a checkpoint. So first expand the disk in Hyper-v and then create a snapshot.

To do this you first need to rescan the disk for change

echo "1" > /sys/class/block/sda/device/rescan

Replace sda with the disk name.
Then you can run fdisk -l /dev/sda, to see the disk information, if you got an error on the top like in the screenshot below

Then you need to repair the disk partition table.

parted -l

After you have check the partition table, you need to delete the old partition, and recreate it

This is done by type fdisk /dev/sda

In the fdisk, you type d to delete, choice the partition, in the example is two. (Beaware that this guide can only be used to expand the last partition on the disk, if you have multiple)
Then you type n to create a new one, and just goes for the default once settings.
In the end type N to not remove the signature.

Then you w to save the settings

Then we just have to resize the ext4 information on the disk, this is done by the command resize2fs

Afterwards you can check that the server have been expand by the command df -h

Here we have expand the disk from 195GB to 295GB.

Get Certificate from remote computers

If you need to get all certificates, from a list of remote computers, you can use this script:

$Servers = "kennethdalbjerg-dc01",
           "kennethdalbjerg-dc02",
           "kennethdalbjerg-exch01",
           "kennethdalbjerg-fs01"
 
  $Results = @()
  $Results = Invoke-Command -cn $Servers {
          $Certs = @{} | Select Certificate,Expired
          $Cert = Get-ChildItem Cert:\LocalMachine\My
          If($Cert){
              $Certs.Certificate = $Cert.subject
              $Certs.Expired = $Cert.NotAfter
          }
          Else{
              $Certs.Certificate = " - "
              $Certs.Expired = " - "
          }
          $Certs
  } | Select-Object @{n='ServerName';e={$_.pscomputername}},Certificate,Expired
 
  #Display results in console
  $Results | Sort-Object Expired -Descending
 
  #Save results to CSV file
  $Results | Sort-Object Expired -Descending | Export-Csv -Path C:\users\$env:username\desktop\cert_results.csv -NoTypeInformation -Force
 
  #Open results in new window
  $Results | Sort-Object Expired -Descending | Out-GridView -Title "Final results"

Found groups that a 365 contacts is member of

If you need to found out whitch groups (mailling groups) a contact is member of in Microsoft 365, then you case use these powershell commands:

$getsessions = Get-PSSession | Select-Object -Property State, Name
$isconnected = (@($getsessions) -like '@{State=Opened; Name=ExchangeOnlineInternalSession*').Count -gt 0
If ($isconnected -ne "True") {
Connect-ExchangeOnline
}

$dn = (Get-MailContact "[email protected]").DistinguishedName
Get-Recipient -Filter "Members -eq '$dn'"

Replace [email protected] with yours mail address.