Tag Archives: Windows

Problems in connection to a Webservice from Windows Server 2016 / 2019

Today, I have this issue, that i could not connect to a webservices, that are hosted by the Danish Tax Service, the URL where: https://emcstest.skat.dk
I got this warning:

Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

When running these commands

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$WebResponse = Invoke-WebRequest "https://emcstest.skat.dk"

No matter what I did. But final I tested the webpage against SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=emcstest.skat.dk
Found these ciphers

I then run these commands:

Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384

And finally I where able to access the webpage though powershell.

Computer won’t join Azure AD

When going to Settings -> Accounts -> Access work or school, og push the “connect” buttom. I could just see that the popup, asking for my mail address, just popup, but then disapear again very quick.

Starting a powershell with administrative rights, and type in the command

Get-AppXPackage | foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

And let it run, it toke 1-3 minutes to complete, but when it completed i could push the buttom, and the popup show just fine.

Again this is a danish screenshot.


Passler PRTG Windows update Probe says missing updates, but none in windows update

You can run this commands to see what updates, that PRTG windows update probes is warning about.

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher();$searcher.Search("Type='Software'").Updates | Sort-Object -Property Dates -Descending | ft -autosize IsInstalled, MsrcSeverity,title

Resetting windows password, with Windows ISO

If you have restored a server, or somehow lost the password for your windows installation, you can reset the password with only a Windows installation ISO or USB. It doesn’t need to be the right version, just a newer one (later that than 2012R2).

All you need to do is boot you computer/server with the ISO file.

After your have started it, set the “Keyboard or input method”, to the correct language and click Next
Click on “Repair your computer”
Click on “Troubleshoot”
Click on “Command Prompt”
Change to the OS drive, in this example it’s d: it could also be c:
then change directory to windows\system32

And then rename the file utilman.exe to utilman.bak
And last copy cmd.exe to utilman.exe

Then you should close the windows, and reboot your computer

Click on the “easy access tab” and a command prompt will start
Type “net user administrator NEWPASSWORD”

After the password have been changed, please close the command prompt, and login with “Administrator” and the new password you just have changed it to.

When you are login, you need to clean up, so that utilman.exe, is the correct utilman.exe file. so change to directory c:\windows\system32, and del tuilman.exe and rename utilman.bak back to utilman.exe

Now you are finish, and you have recovered your password.

Problems with running WMI Request from domain member to workgroup machine

Today, I have the problem that I could not run WMI request from a Domain join member server, to a standalone workgroup server.

It keeps telling me Access Denied.

It turn out that:
In a workgroup, the account connecting to the remote computer is a local user on that computer. Even if the account is in the Administrators group, UAC filtering means that a script runs as a standard user.

That is a good link to refer to. It is about Remote UAC and WMI. The solution is to go to the following registry key – HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System – and create a new name called LocalAccountTokenFilterPolicy (of type DWORD_32) with a value of 1. (Check the Serverfault post for one more solution if you are using a Server 2012).

Restart Explorer as Adminstrator

If you have problems with accessing a drive, with the error message: f:\ is not accessible. Access is denied

It can happen, if the drive doesn’t have this permission:
Everyone (This folder Only):

  • Read & Execute
  • List folder contents
  • Read

To access the drive, you need restart Explorer as administrator.

Find Explorer.exe as the user you are login as. In this example the username is admin_sofi, and kill it by right click on it and choice “End Task”

After start CMD as administrator, and write this command:
c:\windows\explorer.exe /NOACCHECK

After this you can see that explorer.exe is now running in “Elevated”

Windows 7/2008/2008 R2 Won’t boot after installation of KB4512506 / KB4512486 / KB4512476

After installation of these update, you can have problem booting you server. with this warning:

The digital signature for this file couldn’t be verified.
file:\windows\system32\winload.efi status 0xc0000428

You can fix it by booting you windows operation on the installation disc, and go to a Recovery command prompt and type these commands:

c:\> bcdedit

This screenshot is taken from a running Windows Server, in a recovery boot the identifier under the second Windows Boot Loader, will be named {default} instead of {current}

c:\> bcdedit -set {default} -nointegritychecks 1

Replace {default} with the one from the bcdedit output.

Normal this have been resolved by installation and updated version of KB4474419, but there have not been an updated version to Windows server 2008 yet.
But to Windows 7 and Windows server 2008 R2, you can download an updated version here:
http://www.catalog.update.microsoft.com/search.aspx?q=kb4474419


CAPI2 Error in event viewer when taking backup

When taking backup of a SQL server i got this error in my event viewer, every times the backup is running:
Event Viewer Error:

Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Solution:

During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with “Access Denied” error.

Turned out it fails because MSLLDP driver’s security permissions do not allow NETWORK_SERVICE to access the driver record.

The binary security descriptor for the record is located here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Security

It should be modified, I used SC.EXE and Sysinternals’ ACCESSCHK.EXE to fix it.

The original security descriptor looked like below:

>accesschk.exe -c mslldp

mslldp
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators
  RW S-1-5-32-549       <- these are server operators
  R  NT SERVICE\NlaSvc

No service account is allowed to access MSLLDP driver

The security descriptor for the drivers that were processed successfully looked this way:

>accesschk.exe -c mup

mup
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators
  R  NT AUTHORITY\INTERACTIVE
  R  NT AUTHORITY\SERVICE  <- this gives access to services

How to add access rights for NT AUTHORITY\SERVICE to MSLLDP service:

1. Run: SC sdshow MSLLDP

You’ll get something like below (SDDL language is documented on MSDN):

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

2. Run: SC sdshow MUP

You’ll get:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

3. Take NT AUTHORITY\ SERVICE entry, which is (A;;CCLCSWLOCRRC;;;SU) and add it to the original MSLLDP security descriptor properly, right before the last S:(AU… group.

4. Apply the new security descriptor to MSLLDP service :

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)


5. Check the result:

>accesschk.exe -c mslldp

mslldp
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators
  RW S-1-5-32-549
  R  NT SERVICE\NlaSvc
  R  NT AUTHORITY\SERVICE

6. Run you backup app, the error is gone for my Home Server backup.

!!! Do not forget to use your security descriptor for MSLLDP driver since I guess there can be some rare cases when its different for your machine. Do not copy my SDDL descriptions, just in case. And backup the old descriptor just in case !!!

Thanks to szz743
https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/cryptographic-services-failed-while-processing-the/c4274af3-79fb-4412-8ca5-cee721bda112

Move vSwitch vlans information from old host to a new one

To use this examples, there requirements are: VMware PowerCLI and a VMWare vCenter.

This example will copy all vlan’s (Virtualportgroup) from one host to another.
It will take all vlan’s from vSwitch0 on the old host, and copy it to the new host on vSwitch1.

connect-viserver
$oldhost = get-vmhost -name OldServerIP
$newhost = get-vmhost -name NewServerIP
 
$oldhost | get-virtualswitch -name vSwitch0 | get-virtualportgroup | foreach { $newportgroup = $newhost | get-virtualswitch -name vSwitch1 | new-virtualportgroup -name $_.Name -VLanID $_.VLanID }

 

Get a list of all VM in a cluster, that dosen’t hve Limit CPU For migration set to true

Get a list of all VM in a cluster, that dosen’t hve Limit CPU For migration set to true:

Import-Module -Name "virtualmachinemanager"
Get-Vmmserver localhost
$hc = Get-VMHostCluster -Name CLUSTERNMAE
$hosts =get-vmhost -VMHostCluster $hc
foreach($h in $hosts) {
	get-vm -vmhost $h |Where { $_.LimitCPUForMigration –eq $FALSE } | select Name
}