@dbeato said in Patch all your Windows DNS servers - CVE-2020-1350 - CVSS score of 10:

@pmoncho said in Patch all your Windows DNS servers - CVE-2020-1350 - CVSS score of 10:

Just wondering - Is anyone seeing a patch for 2019 with a reference to the KB article?
Checked yesterday, last night and this morning. No update that I can see.

Currently performing the workaround.

c46cc947-cad4-4bfc-877c-dbd1c1ddfd16-image.png

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4558998

Thanks. Forgot about the update catalog.

There you go
http://nitindupare.blogspot.com/2012/08/uninstall-kms-host.html

@Grey said in Issues uninstalling Windows Server 2012 R2 Key:

You mean sfc /scannow? Or DISM.exe /Online /Cleanup-image /Restorehealth?

@op Check your event logs for more information, and try running the commands above.

Ran both, so far nothing, but I will run chkdsk tonight to see if that fixes anything. So far I can't find anything in the logs but I'll keep looking.

@dbeato said in Access Changed Files on VSS Copy on Write Disk Image:

@scottalanmiller said in Access Changed Files on VSS Copy on Write Disk Image:

@black3dynamite said in Access Changed Files on VSS Copy on Write Disk Image:

Mount the disk image on Windows Server instance, from the mounted disk drive, go to Properties and then Previous Versions?

That's what I thought. But it just seemed too easy, lol.

Lol, anything that appears with Microsoft as easy should work but emphasis on "should" 🙂

Emphasis with "assume" too. lol

@teece I haven't seen that happened ever, no other transport rules modified the DKIM at all.

@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@wrx7m said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.

Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else.

I am guessing creating another OU as a sub container and move the RD servers into.

Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way.

If you can make those changes directly in the registry, maybe can allow you to use GPP and item level targeting.

Hmmm. That makes sense. Let me mull it over.

@Pete-S said in Windows Server licensing for HA?:

If you have two servers and run HA, does that mean that you have to license Windows Server standard for the maximum number of VMs running when you have a failure?

So for example,
Server A: 16 cores, runs 6 VMs normally
Server B: 16 cores, runs 6 VMs normally

So each server has to be licensed for all 12 VMs running on 16 cores - so 6 x Windows Server Standard licenses for each server, total of 12 licenses?

But if you didn't run HA, you would only license each server for 6 VMs, with 3 x Windows Server Standard, a total of 6 licenses?

Is this correct?

Yup.

If you're running a HA setup of Server Standard, all physical servers must be licensed for all Windows Server VMs that can run on them. This means each physical server in your HA cluster must be licensed for 12 Windows Server VMs.

So yes, you are correct in that to license 12 Windows Server VMs on both of your physical servers, you'll need 6x Windows Server Standard licenses for each server, 12 "licenses" total as you said.

WSL2 tells us a lot.

First, Microsoft is really making it more known that WSL has no Linux and is just Ubuntu (or whatever) on the Windows kernel.

Second, Microsoft is making it clearer that there was no virtualization going on in WSL.

Third, now there is Hyper-V and a Linux kernel involved. So now it is just virtualizating a Linux instance on top of Windows.

Fourth, now it is much faster. That means that Linux on Hyper-V is faster than Windows on bare metal!

Within PowerShell can't use something like Push-Location \\Server\Share\path or Set-Location \\Server\Share\path and then run the cipher command?

@dbeato said in Windows Server 2012 Remote Web Access not connecting and RDS services showing error 23005:

@scottalanmiller Yeah, RDW is the problem I understand now. Basically you can remote desktop without need of App Resources Proxy without any problems. But if you try to load the App Resources from a Windows 10 device then yes I understand now.

Yeah. It's a weird "Essentials only" issue, only on 2012 and older. From what I can tell.

@Dashrender said in Domain Planning: Network shares or ,..:

@dafyre said in Domain Planning: Network shares or ,..:

@notverypunny said in Domain Planning: Network shares or ,..:

Does NC allow exposure of their "file shares" as smb? If you have users that can't / don't want to use a browser-based access they can always mount it in windows explorer via webdav. Alfresco allows (allowed?) access via both, but the last time I played with it the performance was meh, which I attributed to it being built on java...

You can mount NextCloud into a drive letter or folder using WebDav.

The question does become the aforementioned performance issue (if there is one).

I wonder how file locks are handled when using WebDav?

There are a few topics elsewhere here where file locking and cloud hosting were discussed. You do have to give up what we have all come to appreciate in file locking. Here is a response in one of those other topics I spoke about:

@scottalanmiller said in file sharing in the 21st century:

@Donahue said in file sharing in the 21st century:

I am aware of that. It's online locking that I am after. Though, I will concede that any locking scheme has to plan for both online and offline. I like sync because of local performance and offline availability, but it really feels like it is best for non shared files. When you add multiple users into the mix, almost everything goes out the window, especially when and if they go offline.

Everything is best for non-shared files 🙂

SMB shines at "always online, always nearly local" files because it handles offline so poorly. It's a balance. To handle offline or very distant (e.g. high latency) networks well, you have to sacrifice locking.

@marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?:

@flaxking said in Any Way to Automate Adding a New Computer to an AD Group?:

@marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?:

Ansible can do that. https://docs.ansible.com/ansible/latest/modules/win_domain_group_membership_module.html#win-domain-group-membership-module
You can add new PCs to domain, and change their group membership, you just need to know computer names in advance.

Which is just a layer on top of Powershell. The Active Directory Powershell module is still required.

It's not required, or that module is included already in Windows 10 by default. Because I haven't had to install it on any machine I managed with Ansible.

"win_domain_group_membership requires the ActiveDirectory PS module to be installed"
https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_domain_group_membership.ps1

They have it in the documentation as well "This must be run on a host that has the ActiveDirectory powershell module installed."
https://docs.ansible.com/ansible/latest/modules/win_domain_group_module.html

@Obsolesce said in Deploy Azure resources with Terraform:

@IRJ said in Deploy Azure resources with Terraform:

@Obsolesce said in Deploy Azure resources with Terraform:

@IRJ said in Deploy Azure resources with Terraform:

@Obsolesce

@IRJ said in Deploy Azure resources with Terraform:

@Obsolesce

Yeah good stuff. I have a couple Udemy courses on it.

Something I didn't see in this article was that Cloud Shell has Terraform built in... so you really don't even need to install it. I try to keep things serverless and source controlled, so I wouldn't want to install Terraform.

As long as it uses the latest version of terraform. There are many differences between current and last release.

Screenshot_20190805-163610_Edge.jpg

Cool. Yeah 11 vs 12 are much different. Alot of things have to be redone

@jt1001001 Thanks. If you are running from PDQ deploy, you won't see anything. But, if you are doing it from PS/ISE or similar, that would be a great help.

@pmoncho said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?:

@Dashrender said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?:

Cool, then you should have it easy.

FYI - Published apps still create a full profile on the RDS box, Just the desktop isn't presented to the user. If the application allows them to browse around, they could typically see the drive letters, the mapped printers, etc... that's why you still need to lock all that stuff down.

Thanks for the info. I will keep that in mind. I was debating about using UPD's like @wrx7m and that was my interest in this post.

Also, still planning out where to put Connection Broker, WebAccess and Licensing but that is another post.

For local profile management, UPDs are a lot cleaner. If we are not putting them on a file server across the network then a second partition/VHDX is set up for that task to keep them separate.

With the inclusion of FSLogix with RDS CALs/SALs now it's a no-brainer, IMNSHO, to set the project up on the FSLogix version.

Storage management is another reason why UPDs on a network or separate partition make sense. Keeping a local profile on the C:\ of the session host is messy and can cause issues down the road with users coming and going.

As far as the Broker/Gateway/Web put those roles on one VM but separate from the Session Host.

MS licensing on Sharepoint is as easy as licensing gets. It can't be more straightforward.

https://products.office.com/en-us/sharepoint/sharepoint-licensing-overview

"For On-Premises, intranet sites are licensed using a Server/CAL (Client Access License) model. SharePoint Server 2019 is required for each running instance of the software, and CALs are required for each person or device accessing a SharePoint Server."

It's that simple. CALs are requires for each person or device accessing SP. That's it. Nothing more or less. It's not just easy, but exactly what you'd logically expect the licensing to do if they were being rational.

@IRJ said in Windows Server 2012 R2 - Share Auditing for Changes:

I know you use wazuh..

Check this out

https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html

Thanks! Checking out setting this up. Hopefully, it will reveal the culprit.

@black3dynamite said in Salt - Can't Connect to Minions After Adding Them to Master:

I sometimes have to add --timeout 60 so I can see a response
salt FP01.domain.local test.ping --timeout 60

Seems to be working. I think that it was the firewall needing the exception AND using the

Thanks!