Category Archives: Windows

Selfsign with Windows Certification Authority

If you just create a certificate, and it signed by a Windows Certification Authority, the certs is working just fine in the old Internet Explorer, but Chrome/Firefox and the new Edge browser will failed, with Common Name invalid, the precise error in Chrome is: NET::ERR_CERT_COMMON_NAME_INVALID.

This is because a normal certificate request, does not included a subject alternative name.
So to fix this you new to request the certficate, by an inf file instead

So first create a new Certreq.inf file and paste this into it:

;----------------- request.inf -----------------
[Version]

Signature="$Windows NT$"

[NewRequest]

Subject = "CN=kennethdalbjerg.dk, OU=Hosting, O=KennethDalbjerg, L=DK, S=DK, C=DK" ; replace attribues in this line
KeySpec = 1
KeyLength = 2048
; Can be 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
FriendlyName = "Kennethdalbjerg.dk-2024"
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft Strong Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication

[RequestAttributes]

SAN="kennethdalbjerg.dk&dns=www.kennethdalbjerg.dk"
;-----------------------------------------------

Replace kennethdalbjerg.dk and www.kennethdalbjerg.dk, with the name you want. If you don’t want more than one common name, in yours certificate. Then you just in last line remove:
&dns=www.kennethdalbjerg.dk
Also replace the name in FriendlyName.

Now run this command to prepare the CSR file:

certreq -new certreq.inf certreq.csr

Copy the certreq.csr to yours Certication Authority server, and the run this command on that server

certreq -Submit -Attrib "CertificateTemplate:webserver" -Config - c:\certreq.txt

Replace CertificateTemplate:webserver with the correct name for the template that you want to use.
Save the certificate by name, i use signcert.cer
Copy signcert.cert back to the server, that you have generate the CSR file on, and run this command on that server

certreq -accept signcert.cer

Problems in connection to a Webservice from Windows Server 2016 / 2019

Today, I have this issue, that i could not connect to a webservices, that are hosted by the Danish Tax Service, the URL where: https://emcstest.skat.dk
I got this warning:

Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

When running these commands

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$WebResponse = Invoke-WebRequest "https://emcstest.skat.dk"

No matter what I did. But final I tested the webpage against SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=emcstest.skat.dk
Found these ciphers

I then run these commands:

Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384

And finally I where able to access the webpage though powershell.

Clear mssql cache

If you for example need to test a query against two SQL servers hardware, its a good idea to clear the cache first.
This query can do this:

DBCC DROPCLEANBUFFERS; 

-- Removes all elements from the plan cache.

DBCC FREEPROCCACHE;

-- Displays the number of milliseconds required to parse, compile, and execute each statement.

SET STATISTICS TIME ON; 

-- Display information regarding the amount of disk activity generated by Transact-SQL statements.

SET STATISTICS IO ON; 

Computer won’t join Azure AD

When going to Settings -> Accounts -> Access work or school, og push the “connect” buttom. I could just see that the popup, asking for my mail address, just popup, but then disapear again very quick.

Starting a powershell with administrative rights, and type in the command

Get-AppXPackage | foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

And let it run, it toke 1-3 minutes to complete, but when it completed i could push the buttom, and the popup show just fine.

Again this is a danish screenshot.


Expand an EXT4, on a SCSI device

If you have vmware ESXi or Microsoft Hyper-v, you can expand a disk, from the hypervisor console, very simple. But afterwards the partition the servers is not expand.
It is always a good idea to create a Snapshot/checkpoint before. Just remember, that the disc can’t be expanded in Hyper-v when there are a checkpoint. So first expand the disk in Hyper-v and then create a snapshot.

To do this you first need to rescan the disk for change

echo "1" > /sys/class/block/sda/device/rescan

Replace sda with the disk name.
Then you can run fdisk -l /dev/sda, to see the disk information, if you got an error on the top like in the screenshot below

Then you need to repair the disk partition table.

parted -l

After you have check the partition table, you need to delete the old partition, and recreate it

This is done by type fdisk /dev/sda

In the fdisk, you type d to delete, choice the partition, in the example is two. (Beaware that this guide can only be used to expand the last partition on the disk, if you have multiple)
Then you type n to create a new one, and just goes for the default once settings.
In the end type N to not remove the signature.

Then you w to save the settings

Then we just have to resize the ext4 information on the disk, this is done by the command resize2fs

Afterwards you can check that the server have been expand by the command df -h

Here we have expand the disk from 195GB to 295GB.

Get Certificate from remote computers

If you need to get all certificates, from a list of remote computers, you can use this script:

$Servers = "kennethdalbjerg-dc01",
           "kennethdalbjerg-dc02",
           "kennethdalbjerg-exch01",
           "kennethdalbjerg-fs01"
 
  $Results = @()
  $Results = Invoke-Command -cn $Servers {
          $Certs = @{} | Select Certificate,Expired
          $Cert = Get-ChildItem Cert:\LocalMachine\My
          If($Cert){
              $Certs.Certificate = $Cert.subject
              $Certs.Expired = $Cert.NotAfter
          }
          Else{
              $Certs.Certificate = " - "
              $Certs.Expired = " - "
          }
          $Certs
  } | Select-Object @{n='ServerName';e={$_.pscomputername}},Certificate,Expired
 
  #Display results in console
  $Results | Sort-Object Expired -Descending
 
  #Save results to CSV file
  $Results | Sort-Object Expired -Descending | Export-Csv -Path C:\users\$env:username\desktop\cert_results.csv -NoTypeInformation -Force
 
  #Open results in new window
  $Results | Sort-Object Expired -Descending | Out-GridView -Title "Final results"

Found groups that a 365 contacts is member of

If you need to found out whitch groups (mailling groups) a contact is member of in Microsoft 365, then you case use these powershell commands:

$getsessions = Get-PSSession | Select-Object -Property State, Name
$isconnected = (@($getsessions) -like '@{State=Opened; Name=ExchangeOnlineInternalSession*').Count -gt 0
If ($isconnected -ne "True") {
Connect-ExchangeOnline
}

$dn = (Get-MailContact "[email protected]").DistinguishedName
Get-Recipient -Filter "Members -eq '$dn'"

Replace [email protected] with yours mail address.

Extend a raidset with STORCLI CLI

You can use this command to see the status of the Raid Controller and Raidset.

storcli /c0 show
Generating detailed summary of the adapter, it may take a while to complete.

Controller = 0
Status = Success
Description = None

Product Name = Intel(R) RAID Controller RS3DC080
Serial Number = SK94678290
SAS Address =  500605b00f7ef7e0
PCI Address = 00:b5:00:00
System Time = 03/18/2022 15:44:57
Mfg. Date = 11/24/19
Controller Time = 03/18/2022 15:44:29
FW Package Build = 24.21.0-0126
BIOS Version = 6.36.00.3_4.19.08.00_0x06180203
FW Version = 4.680.00-8519
Driver Name = lsi-mr3
Driver Version = 7.702.13.00
Current Personality = RAID-Mode
Vendor Id = 0x1000
Device Id = 0x5D
SubVendor Id = 0x8086
SubDevice Id = 0x9360
Host Interface = PCI-E
Device Interface = SATA-3G
Bus Number = 181
Device Number = 0
Function Number = 0
Drive Groups = 1

TOPOLOGY :
========

-----------------------------------------------------------------------------
DG Arr Row EID:Slot DID Type  State BT       Size PDC  PI SED DS3  FSpace TR
-----------------------------------------------------------------------------
 0 -   -   -        -   RAID5 Optl  N    5.451 TB dflt N  N   dflt N      N
 0 0   -   -        -   RAID5 Optl  N    5.451 TB dflt N  N   dflt N      N
 0 0   0   252:4    8   DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   1   252:5    9   DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   2   252:6    10  DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   3   252:7    11  DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   4   252:0    15  DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   5   252:1    12  DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
 0 0   6   252:2    13  DRIVE Onln  N  930.390 GB dflt N  N   dflt -      N
-----------------------------------------------------------------------------

DG=Disk Group Index|Arr=Array Index|Row=Row Index|EID=Enclosure Device ID
DID=Device ID|Type=Drive Type|Onln=Online|Rbld=Rebuild|Dgrd=Degraded
Pdgd=Partially degraded|Offln=Offline|BT=Background Task Active
PDC=PD Cache|PI=Protection Info|SED=Self Encrypting Drive|Frgn=Foreign
DS3=Dimmer Switch 3|dflt=Default|Msng=Missing|FSpace=Free Space Present
TR=Transport Ready

Virtual Drives = 1

VD LIST :
=======

-------------------------------------------------------------
DG/VD TYPE  State Access Consist Cache Cac sCC     Size Name
-------------------------------------------------------------
0/0   RAID5 Optl  RW     Yes     RWBD  -   ON  5.451 TB
-------------------------------------------------------------

EID=Enclosure Device ID| VD=Virtual Drive| DG=Drive Group|Rec=Recovery
Cac=CacheCade|OfLn=OffLine|Pdgd=Partially Degraded|Dgrd=Degraded
Optl=Optimal|RO=Read Only|RW=Read Write|HD=Hidden|TRANS=TransportReady|B=Blocked|
Consist=Consistent|R=Read Ahead Always|NR=No Read Ahead|WB=WriteBack|
AWB=Always WriteBack|WT=WriteThrough|C=Cached IO|D=Direct IO|sCC=Scheduled
Check Consistency

Physical Drives = 8

PD LIST :
=======

-------------------------------------------------------------------------------------
EID:Slt DID State DG       Size Intf Med SED PI SeSz Model                   Sp Type
-------------------------------------------------------------------------------------
252:0    15 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 870 QVO 1TB U  -
252:1    12 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 870 QVO 1TB U  -
252:2    13 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 870 QVO 1TB U  -
252:3    14 UGood  - 930.390 GB SATA SSD N   N  512B Samsung SSD 870 QVO 1TB U  -
252:4     8 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 860 EVO 1TB U  -
252:5     9 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 860 EVO 1TB U  -
252:6    10 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 860 EVO 1TB U  -
252:7    11 Onln   0 930.390 GB SATA SSD N   N  512B Samsung SSD 860 EVO 1TB U  -
-------------------------------------------------------------------------------------

EID=Enclosure Device ID|Slt=Slot No.|DID=Device ID|DG=DriveGroup
DHS=Dedicated Hot Spare|UGood=Unconfigured Good|GHS=Global Hotspare
UBad=Unconfigured Bad|Onln=Online|Offln=Offline|Intf=Interface
Med=Media Type|SED=Self Encryptive Drive|PI=Protection Info
SeSz=Sector Size|Sp=Spun|U=Up|D=Down|T=Transition|F=Foreign
UGUnsp=Unsupported|UGShld=UnConfigured shielded|HSPShld=Hotspare shielded
CFShld=Configured shielded|Cpybck=CopyBack|CBShld=Copyback Shielded


Cachevault_Info :
===============

---------------------------------------------------------
Model  State   Temp Mode MfgDate    Next Learn
---------------------------------------------------------
CVPM02 Optimal 23C  -    2020/04/09 2022/03/31  00:41:59
---------------------------------------------------------

Here you can see under PD List, that drive 252:3 14 stand as UGood. Thats the new disk i have put into the server, and have been detected by the raidset.

To include this disk into the array that you see under VD List, you need to do this

 storcli /c0/v0 start migrate type=raid5 option=add drives=252:3

This will add the disk to the raidset. This can takes hours and even days, if you have a big raidset.
You can check the status with this command:

storcli /c0/v0 show migrate
Controller = 0
Status = Success
Description = None


VD Operation Status :
===================

------------------------------------------------------------
VD Operation      Progress% Status      Estimated Time Left
------------------------------------------------------------
 0 Reconstruction         2 In progress 9 Hours 52 Minutes
------------------------------------------------------------

DG=Arrays | Slot=Drive Bay No|VD=Virtual Drive/Logical Drive|EID=Enclosure Device ID

Here you can see that it will take 9 hours and 52 minutes to complete the Reconstruction

When it done with the reconstuction, the command from before will output this:

VD Operation Status :
===================

-----------------------------------------------------------
VD Operation Progress% Status          Estimated Time Left 
-----------------------------------------------------------
 0 Migrate   -         Not in progress -                   
-----------------------------------------------------------

And then you can check the array with the command from the top of this guide

storcli /c0 show

After this you need to change the partition table, and then expand the volume.