Show current WAN IP:
nslookup myip.opendns.com. resolver1.opendns.com
nslookup myip.opendns.com. resolver1.opendns.com
https://helpcenter.itopia.com/en/articles/4859965-restricting-application-access-using-applocker
https://adamtheautomator.com/windows-10-applocker/
https://www.grouppolicy.biz/2010/08/how-to-use-group-policy-to-control-services/
Probably Application Identity service is not started. Configure Application Identity service startup in GPO:
Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Application Identity
Check this settings applied correctly:
gpresult /h DISK:\GPRESULT.html
It is possible to configure startup of this service on every machine, but it is a waste of s time:
sc config "AppIDSvc" start=auto & net start "AppIDSvc"
Shut down all VMs and PCs that might use shared on this server data.
On the old server:
Get and save information about all local accounts:
wmic useraccount get name,sid > D:\old-SIDs.txt
Get and save all permissions in selected folder:
icacls "D:\Data" /save D:\Data-icacls.txt /t /c
On the new server:
Configure new accounts
Get and save information about all local accounts:
wmic useraccount get name,sid > D:\new-SIDs.txt
On your PC:
Replace old SIDs with the new SIDs in ICACLS dump files (copy original dump files first)
On the new server:
Attach disk D: from an old server to the new one
Configure System to own D:
Allow admin to access D: (“This folder only” type)
Restore permissions from icacls dump:
icacls R:\ /restore D:\Data-icacls.txt
for %%G in (“C:\Program Files (x86)\Test Folder\*.exe”) do (
netsh advfirewall firewall add rule name=”Blocked With Batchfile %%G” dir=in action=block program=”%%G” enable=yes profile=any
netsh advfirewall firewall add rule name=”Blocked With Batchfile %%G” dir=out action=block program=”%%G” enable=yes profile=any
)
https://geekbullet.com/how-to-add-performance-stats-in-windows-11-taskbar/
https://www.partitionwizard.com/news/internal-hard-drive-ssd-shows-as-removable.html
Sometimes in Windows disks installed inside PC case may be seen as removable despite they are connected to the SATA or PCIe and fixed by the screw.
In my PC it happened because of the SATA controller: it has a hot swap drive function. I need that function because my PC case has an option to add/remove SATA HDD/SSD from the front panel very quickly and easy without unscrewing the case and shutting down the OS.
Add selected disks in the list of fixed drives:
In Device Manager look at which bus number seats the disk(s) you want to add to the fixed drives list.
Add the TreatAsInternalPort key:
reg add “HKLM\SYSTEM\CurrentControlSet\Services\storahci\Parameters\Device” /f /v TreatAsInternalPort /t REG_MULTI_SZ /d X
Than add the disks you need to be fixed to the list inside TreatAsInternalPort key. Each bus number should be placed in its own line.
If you need to add drive on the bus 0 together with the drives on the other buses, use this: reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\storahci\Parameters\Device" /f /v TreatAsInternalPort /t REG_MULTI_SZ /d "0\01\02\03"
https://superuser.com/a/217506
Windows Environment Path Variables
%AllUsersProfile% - Open the All User's Profile C:\ProgramData
%AppData% - Opens AppData folder C:\Users\{username}\AppData\Roaming
%CommonProgramFiles% - C:\Program Files\Common Files
%CommonProgramFiles(x86)% - C:\Program Files (x86)\Common Files
%HomeDrive% - Opens your home drive C:\
%LocalAppData% - Opens local AppData folder C:\Users\{username}\AppData\Local
%ProgramData% - C:\ProgramData
%ProgramFiles% - C:\Program Files or C:\Program Files (x86)
%ProgramFiles(x86)% - C:\Program Files (x86)
%Public% - C:\Users\Public
%SystemDrive% - C:
%SystemRoot% - Opens Windows folder C:\Windows
%Temp% - Opens temporary file Folder C:\Users\{Username}\AppData\Local\Temp
%UserProfile% - Opens your user's profile C:\Users\{username}
%AppData%\Microsoft\Windows\Start Menu\Programs\Startup - Opens Windows 10 Startup location for program shortcuts
Run commands
Calc - Calculator
Cfgwiz32 - ISDN Configuration Wizard
Charmap - Character Map
Chkdisk - Repair damaged files
Cleanmgr - Cleans up hard drives
Clipbrd - Windows Clipboard viewer
Cmd - Opens a new Command Window (cmd.exe)
Control - Displays Control Panel
Dcomcnfg - DCOM user security
Debug - Assembly language programming tool
Defrag - Defragmentation tool
Drwatson - Records programs crash & snapshots
Dxdiag - DirectX Diagnostic Utility
Explorer - Windows Explorer
Fontview - Graphical font viewer
Ftp - ftp.exe program
Hostname - Returns Computer's name
Ipconfig - Displays IP configuration for all network adapters
Jview - Microsoft Command-line Loader for Java classes
MMC - Microsoft Management Console
Msconfig - Configuration to edit startup files
Msinfo32 - Microsoft System Information Utility
Nbtstat - Displays stats and current connections using NetBios over TCP/IP
Netstat - Displays all active network connections
Nslookup - Returns your local DNS server
Odbcad32 - ODBC Data Source Administrator
Ping - Sends data to a specified host/IP
Regedit - registry Editor
Regsvr32 - register/de-register DLL/OCX/ActiveX
Regwiz - Registration wizard
Sfc /scannow - System File Checker
Sndrec32 - Sound Recorder
Sndvol32 - Volume control for soundcard
Sysedit - Edit system startup files (config.sys, autoexec.bat, win.ini, etc.)
Systeminfo - display various system information in text console
Taskmgr - Task manager
Telnet - Telnet program
Taskkill - kill processes using command line interface
Tskill - reduced version of Taskkill from Windows XP Home
Tracert - Traces and displays all paths required to reach an internet host
Winchat - simple chat program for Windows networks
Winipcfg - Displays IP configuration
Microsoft Office suite
winword - Microsoft Word
excel - Microsoft Excel
powerpnt - Microsoft PowerPoint
msaccess - Microsoft Access
outlook - Microsoft Outlook
ois - Microsoft Picture Manager
winproj - Microsoft Project
Management Consoles
certmgr.msc - Certificate Manager
ciadv.msc - Indexing Service
compmgmt.msc - Computer management
devmgmt.msc - Device Manager
dfrg.msc - Defragment
diskmgmt.msc - Disk Management
fsmgmt.msc - Folder Sharing Management
eventvwr.msc - Event Viewer
gpedit.msc - Group Policy (< XP Pro)
iis.msc - Internet Information Services
lusrmgr.msc - Local Users and Groups
mscorcfg.msc - Net configurations
ntmsmgr.msc - Removable Storage
perfmon.msc - Performance Manager
secpol.msc - Local Security Policy
services.msc - System Services
wmimgmt.msc - Windows Management
Control Panel utilities
access.cpl - Accessibility Options
hdwwiz.cpl - Add New Hardware Wizard
appwiz.cpl - Add/Remove Programs
timedate.cpl - Date and Time Properties
desk.cpl - Display Properties
inetcpl.cpl - Internet Properties
joy.cpl - Joystick Properties
main.cpl keyboard - Keyboard Properties
main.cpl - Mouse Properties
ncpa.cpl - Network Connections
ncpl.cpl - Network Properties
telephon.cpl - Phone and Modem options
powercfg.cpl - Power Management
intl.cpl - Regional settings
mmsys.cpl sounds - Sound Properties
mmsys.cpl - Sounds and Audio Device Properties
sysdm.cpl - System Properties
nusrmgr.cpl - User settings
firewall.cpl - Firewall Settings (sp2)
wscui.cpl - Security Center (sp2)
Wupdmgr - Takes you to Microsoft Windows Update
https://www.tomshardware.co.uk/forum/60125-45-change-floppy-drive-letters-disk-management-doesn
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
Look here for floppy drives, click on what you need, press F2, change letter. Reboot.
Configure “Use only TCP” in Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections
Configure “Turn Off UDP On Client” in Computer Configuration > Administration Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client
Query:
qwinsta /server:IP/servername
Reset:
rwinsta SESSIONID /server:IP/servername
https://winitpro.ru/index.php/2018/07/11/rdp-shadow-k-rabochemu-stolu-polzovatelya-windows-10/
Looks like latest Windows 2022 and 11 updates broke certificate reissuing mechanisms. It can be seen as expired certificate warning when connecting with RDP to windows machine.
According to this manual: https://docs.rackspace.com/docs/rdp-connection-failures-expired-self-signed-certificate the problem is with the “f686” file/ It shoud be replaced with the new one by Remode Desktop Services when needed, but somewhy it is not being replaced.
With help of this manual https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753525(v=ws.10)?redirectedfrom=MSDN I created Powershell script that can be placed in domain Group Policy and started at next reboot or this script can be manually run by admin on the machine that needs this fix:
Fix-Expired-RDP-Certificate.ps1:
net stop "TermService" /y
takeown /F "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*"
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" /grant administrators:F /t
Get-ChildItem "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" | foreach{ Rename-Item $_.FullName -NewName ($_.FullName + "-old")}
net start "TermService" /y
I prefer to keep old files and not delete them, but here is a tested broken f686* remove command just in case:
Remove-Item -Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" -Force
“In .rdp file remove string workspace id:s:
and enjoy a perfectly working RemoteApp with password saving.”
https://social.technet.microsoft.com/Forums/ru-RU/6bce67f0-b7e6-4c79-9cbc-f1f14425b5b7/-remoteapps?forum=WS8ru
Enabling WRSM in Windows Server 2012 R2 to manage resouses used by each user:
https://www.vioreliftode.com/index.php/windows-system-resource-manager-and-windows-server-2012-r2/
Enabling multiconnection in windows 7, 8.1, 10:
https://github.com/stascorp/rdpwrap
https://winitpro.ru/index.php/2015/09/02/neskolko-rdp-sessij-v-windows-10/
https://www.bullzip.com/products/pdf/info.php
error CS0016: Could not write to output file ‘c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
Grant local IIS_Users group r/w access to temp dir.
Before AD role seting up: Windows Internal Database, reboot
Remote Registry must be started at the time of adding AD role.
IPv6 is essential to be enabled on main network interface.
If on the second AD controller you get an error “Unable to add role, server needs to be restarted” you must install Windows Internal Databese feature, reboot server, addin GPO Logon As Service: NETWORK SERVICE, NT SERVICE\ALL SERVICES и NT SERVICE\MSSQL$MICROSOFT##WID, configure Remote Regitry service automatic startup (disable it after you finish with AD role), run gpupdate on both servers, reboot, check rights in GPO, and only after all this add second server with AD role.
Console commands:
https://community.spiceworks.com/topic/1495956-trransferring-fsmo-roles#entry-5601702
The GUI interface for the FSMO roles is spread all over the place. I always use NTDSUTIL to do this.
Open a command prompt on a Domain Controller
Enter “ntdsutil” and the following commands:
roles
connections
connect to server dc1 - put the target DC server's name here
quit
transfer infrastructure master
transfer naming master
transfer pdc
transfer rid master
transfer schema master
quit
quit
After each transfer you will see a list of the FSMO roles and where they are currently stored. Also, ntdsutil has the ability to seize the FSMO roles to a new domain controller. Instead of “transfer …” you use “seize …” for the roles. Use transfer first and seize only as a last resort.
If new group policies DC do not ally on the computers in domain after you move AD role to the new server, check DNS records connected to old DC server removed or changed to the new server’s IP and name.
Sometimes it can work better in Powershell. It used to for me because using ntdsutil once I got error with transferring Schema Master role:
https://petri.com/seizing_fsmo_roles/
Move-ADDirectoryServerOperationMasterRole -Identity "DC3" -OperationMasterRole PDCEmulator -Force
Move-ADDirectoryServerOperationMasterRole -Identity "DC3" -OperationMasterRole RIDMaster -Force
Move-ADDirectoryServerOperationMasterRole -Identity "DC3" -OperationMasterRole InfrastructureMaster -Force
Move-ADDirectoryServerOperationMasterRole -Identity "DC3" -OperationMasterRole SchemaMaster -Force
Move-ADDirectoryServerOperationMasterRole -Identity "DC3" -OperationMasterRole DomainNamingMaster -Force
Removal:
https://winitpro.ru/index.php/2022/01/13/udalenie-kontrollera-domena-active-directory/
Authoritative restore for DFSR replication:
https://www.rmtechteam.com/blog/dfs-replication-dfsr-fix/
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-authoritative-recovery-sysvol
It happens when you restore old controller’s backup due, as I suppose, to a outdated DC database.
https://support.hostway.com/hc/en-us/articles/360001126259-How-to-fix-Error-0xc00002e2-after-rebooting-Windows-Domain-Controller
Reboot the server into Directory Services Restore Mode by pressing F8 before the OS begins loading. You will be required to use the local Administrator account password.
In Directory Services Restore Mode, you can check if there is a problem with the database by running the following commands:
ntdsutil.exe
activate instance ntds
files
If there is a problem with the Active Directory database NTDS.DIT, you will see an error like the following:
Could not initialize the Jet engine: Jet Error -501. Failed to open DIT for AD DS/LDS instance NTDS. Error -2147418113
To resolve this issue, rename all of the .log files located in C:\Windows\NTDS\ to .log.old, so the logs can be recreated after reboot.
This should fixed the database after the server is rebooted once more. If you continue to get the error, you can access again Directory Services Restore Mode and run the following command:
esentutl /p "c:\windows\ntds\ntds.dit"
Reboot the server and the issue should be solved.
https://winitpro.ru/index.php/2022/01/13/udalenie-kontrollera-domena-active-directory/
An Active Directory Domain Controller Could Not Be Contacted
https://winitpro.ru/index.php/2019/03/18/primenenie-gpo-spravka-admina/
https://serverfault.com/a/516427
Test file share connectivity and permissions
Test command at workstation:
nslookup %USERDNSDOMAIN%
net view %USERDNSDOMAIN%
cd \\%USERDNSDOMAIN%\SYSVOL\%USERDNSDOMAIN%\
and check file permissions in folders: Policies and scripts
Check other ports’ connectivity
open and check port at domain infrastructure
Instructions here: Active Directory Firewall Ports – Let’s Try To Make This Simple
Delete local registry keys:
reg delete HKLM\SOFTWARE\Policies /f
reg delete HKCU\Software\Policies /f
Delete local folder:
RD /S /Q %windir%\System32\GroupPolicy
net stop spooler
del %systemroot%\system32\spool\printers\*.shd
del %systemroot%\system32\spool\printers\*.spl
net start spooler
https://it.ros-kit.ru/help/computers/kak-ochistit-ochered-pechati/
https://www.wintips.org/how-to-fix-dhcp-service-cannot-start-access-is-denied/
– windows update service not running. Start it manually before installing .msi.
Stop Windows Update
Remove c:\windows\SoftwareDistribution\Downloads
Remove c:\Windows_BT
Check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. If the value in ProfilesDirectory is not set as default %SystemDrive%\Users, set it like this temporary, update Windows, and change back as it was before update.
Reboot.
https://superuser.com/questions/1602404/win10-upgrade-to-version-20h2-failed-how-to-determine-the-cause
Fresh install with boot from original ISO:
After getting error about unsupported hardware press Shift + F10, then type “regedit” in CMD window
Go to HKEY_LOCAL_MACHINE\SYSTEM\Setup
Create key “LabConfig”
Create DWORD BypassTPMCheck, BypassSecureBootCheck, BypassRAMCheck, BypassCPUCheck with “1” in each
Close regedit and CMD
Go back in setup window and continue the installation.
https://adminwin.ru/oshibka-this-pc-doesnvt-meet-the-minimum-system-requirements-to-install-this-version-of-windows/
Updating existing installation to Windows 11:
Extract install.wim from Windows 11 ISO
Open Windows 10 .ISO equal to Windows 11 .ISO you’ve decided to install with any CD image editor like UltraISO. Replace ./Sources/install.wim with install.wim from Windows 11 .ISO. Save with decided name.
If you experience this symptoms:
– your secondary DC can’t resolve DNS names
– you see “Audit Failure” event ID 4625 with the name of your secondary DC in event viewer on your promary Domain Controller
Check that you have right Kerberos realm on the secondary DC in HKEY_LOCAL_MACHINE\SECURITY\Policy\PolPrDmN
Aquire Kerberos password change from Primary DC:
netdom resetpwd /server: /userd:domain\administrator /password:
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/problems-administrative-shares-missing
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
If the AutoShareServer and AutoShareWks DWORD values in the LanmanServer\Parameters subkey are configured with a value data of 0, change that value to 1.
https://answers.microsoft.com/ru-ru/windows/forum/all/после/fe32ecfd-2d08-43ae-91f9-401bda3ee803
If you’ve installed CryptoPRO before creating user profile in Outlook you’ll get this error. Remove the CryproPRO shit and create a profile without errors.
All Windows versions:
Show extensions of known file types:
ext.vbs:
HKEY_CURRENT_USER = &H80000001
strComputer = “.”
Set objReg = GetObject(“winmgmts:\\” & strComputer & “\root\default:StdRegProv”)
strKeyPath = “Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced”
objReg.CreateKey HKEY_CURRENT_USER, strKeyPath
ValueName = “HideFileExt”
dwValue = 0
objReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, ValueName, dwValue
Always show all icons and notifications in tray:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer!EnableAutoTray=0
Make Windows search inside file contents 1 & 2:
Type in content: into the search bar. Anything that you type after this prompt will be used as a content search term.
Search for Indexing Options in Start,
Go to Advanced,
Select the “Index Properties and File Contents” option,
Add needed files extensions if they are absent in list.
Go to Folder and Search Options,
On the “Search” tab, select the “Always search file names and contents” option.
Windows Server 2012:
Включить отобржение активности дисков в таксменеджере:
diskperf -Y
https://blogs.technet.microsoft.com/canitpro/2013/12/02/step-by-step-enabling-disk-performance-counters-in-windows-server-2012-r2-task-manager/
Disable Narrator forever (Windows + Enter hotkey):
Open regedit.exe.
Create the following key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe
In that key, create a new string value named Debugger and assign it the value %1.
Disable text/ink collection:
HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization RestrictImplicitTextCollection REG_DWORD 1
HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization RestrictImplicitInkCollection REG_DWORD 1
Disable “This app is preventing shutdown”:
HKEY_USERS\.DEFAULT\Control Panel\Desktop
Create new stringkey “AutoEndTasks” with value “1”
reg add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1
Change user appearance via one file:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Control Panel\Desktop]
"UserPreferencesMask"=hex:00,20,04,00,80,00,00,00
In this example everything is disabled except: Peek, Thumbnail previews, Thumbnails instead of icons, Translucent selection rectangle, Window contents, Smooth edges, Drop shadows icons.
There is a software UserPreferencesMask calculator, but it doesn’t work on Windows higher than 7.
https://www.silisoftware.com/tools/tweakui.php
Also there is a complete list of registry values of each feature:
https://www.bleepingcomputer.com/forums/t/416401/advanced-system-settings-performance-to-all-user-accounts/#entry3467731
Enable Office automatic updates 1 & 2:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\15.0\Common\OfficeUpdate]
“EnableAutomaticUpdates”=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\15.0\Common\OfficeUpdate]
“HideEnableDisableUpdates”=dword:00000000
Show Product (License) Key stored in BIOS:
https://www.kiloroot.com/how-to-get-your-windows-activation-key-from-uefi-bios/
In Powershell:
wmic path softwarelicensingservice get oa3xoriginalproductkey
Create persistent disk from folder:
https://superuser.com/a/217621
https://superuser.com/questions/1734542/how-to-change-the-drive-label-after-mapping-a-drive-letter-to-a-folder
https://en.wikipedia.org/wiki/SUBST
Add a disk from folder:
reg add “HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices” /v X: /t REG_SZ /d “\??\C:\DirectoryName” /f
Configure new disk’s volume name:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\X\DefaultLabel\
(DefaultValue) = Your Drive Label
Change environment valiables in Group Policy:
https://technet.microsoft.com/en-us/library/cc772047(v=ws.11).aspx
Open the Group Policy Management Console . Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit .
In the console tree under Computer Configuration or User Configuration , expand the Preferences folder, and then expand the Windows Settings folder.
Right-click the Environment node, point to New , and select Environment Variable .
Change user profile location in Regedit:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList.
Set needed location in “ProfileDirectory” key variable.
Delete hiberfil from c:
powercfg /h off
Disable Last Access Timestamp:
https://www.tenforums.com/tutorials/139015-enable-disable-ntfs-last-access-time-stamp-updates-windows-10-a.html
(See current status of Last Access Time Updates)
fsutil behavior query disablelastaccess
OR
(User Managed, Last Access Time Updates Enabled)
fsutil behavior set disablelastaccess 0
OR
(User Managed, Last Access Time Updates Disabled)
fsutil behavior set disablelastaccess 1
OR
(Default – System Managed, Last Access Time Updates Enabled)
fsutil behavior set disablelastaccess 2
OR
(System Managed, Last Access Time Updates Disabled)
fsutil behavior set disablelastaccess 3