Windows

Windows Server 2019 Server Manager

We all like the new admin center, right? But logging on to a new shiny Windows Server 2019 and getting a popup saying “hey you know about Windows Admin Center” thats not my idea of nice server management. Pops ups should be killed with fire! So when I first saw the box below well that got me thinking, how do we get rid of it before I even log on?

image

Answer to this is simple, this is controlled by a registry value and as such subject to the power of group policy preferences. Create a new GPO and create a new registry item following these settings

Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\ServerManager
Value name: DoNotPopWACConsoleAtSMLaunch
Value type: REG_DWORD
Value data: 00000001

image

Now hit ok and then link the policy to you server OU/OUs. Done, no more annoying popup!

/Peter

Advertisements

Windows 10 – Lifecycle change AGAIN!

Update 2018-09-07: Michael Niehaus was kind enough to supply some additional information on this subject. So to clarify this post and the information from MS. The currently available versions of Windows 10 Enterprise and Education will have 30 months of support and future releases starting with 1809 and 1903 will have 30 and 18 months of support.

Niehaus has also stated that Microsoft is still commited to deliver innovation and new features for every single Windows 10 release.

Orignial Post:

So its happend again, the lifecycle supportstatment surrounding Windows 10 has been changed. Some say for the better, but it remains to be seen. The change only applies to Enterprise and Education SKUs and only to the september relase of every year. So if you are on 1703 nothing has changed but if you are on 1607 or 1709 there has been some changes.

The new change is that Enterprise and Education now get 30months of support. There is also a small note to be made about a statment of the lifecycle facts page stating

“…you’ll need to install the latest feature update to help keep your device secure and have it remain supported by Microsoft.”

Which would mean that unless you apply the latest CU every month you are not really supported. How this will be “enforced” remains to be seen.

For more detailed information and source of the change review the lifecycle fact page from Microsoft here https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet

One last thing to note, up until now Microsoft have only been testing upgrading the previous version to the lastest version of Windows 10, example when 1709 was released the only path that was tested was 1703->1709. With the new support statement you might have an urge to skip versions. However unless Microsoft changes their test protcoll and actually tests jumps like 1607->1709 it might still be worth going with every version, altho not as quickly as before.

Support dates as of 2018-09-06

image

/Peter

The Death Of MBAM

Update: 2018-10-06
Microsoft has given out information that MBAM is not been removed but instead put into sustained engieering. Meaning it will continue to work and continue to recive bug fixes but no new features will be added. This also means that support for future Windows 10 release as well as new SQL release should be added.

This should hold true until Microsoft has a feature by feature compareable service elsewhere (Azure most likley).

 

Microsoft Bitlocker Administration and Monitoring (MBAM) has now recieved its finaly date. This means that if you have already implemented MBAM you have a couple of years to migrate away from it, but if you haven’t implemented it and was about to do so. Please refrain from it.

Mainstream support will end July 7th 2019, meaning up until that date new “features” will be brought out to support newer SQL versions and the like.

Extended support will end on July 7th 2024, meaning after this date there will be no security patches and no support at all available.

image

Hopefully Microsoft gives a solution to rotating keys and self-service through Active Directory or Azure Active directory soon to fill the gap between MBAM and a standarnd Bitlocker implementation.

/Peter

NIC 2018 – Future Edition

So NIC has come to and end and I was fortunate enought to be selected as a presenter for not one but two session. My first session was about whats changed in Windows 10 in the 2 years since its first release and how to keep up with the changes. The second session was a co-presented session with @nickolajA from SCconfigMgr.com about using community tools during OSD in ConfigMgr and MDT.

I had a blast presenting this and you can now find the presentations from those session (and others) over on github github.com/nordicinfrastructureconference/2018

If you want a some more details about what me and my coworkers did at NIC check out this post http://www.scconfigmgr.com/2018/02/07/nic-2018-future-edition/ from @modaly_it

image

PowerShell remoting – source vs destination

Powershell remoting, the ability to remotley manage and influence devices is a key part of PowerShell. By default PowerShell remoting is enabled on servers and one of the lazy “security” features you can use is to only allow connections from specified networks.

In a domain network this is very easy to do, all you need is a small group policy that sets the networks. There is one thing you need to note, that is not really documented.

The Group Policy

The group policy is a regular computer policy setting found under “Computer\Policies\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service” and the actual poliy item is named “Allow remote server management through WinRM”

When you enable this policy you can enter networks the server will consider trusted.  So lets say you have your server on the network 192.168.1.0, that would mean you set the filder to 192.168.1.1-.192.168.1.254.

The issue

What you need to consider is the following. Say you have servers on two seperate networks and one is considered management network, lets say it uses 172.16.1.0/24. This means you now specify the management network as approved. But the servers you are accessing is on your primary server network 192.168.1.0/24. You have to specifiy both source and destination networks for this to work as this also controls the actual listners and if you only specify the 172.16.1.0/24 network the listners on the servers on network 192.168.1.0/24 will not be enabled.

The solution

For the scenario above make sure to specify both networks in your GPO. So the filter will be set to 192.168.1.1-192.168.1.254,172.16.1.1-172.16.1.254

winrm

/Peter

Strange Case of the failed Remote Desktop Gateway

I have been having a kind of a strange issue for a longe while and finally got around to troubleshooting and figuring out why so here is a breakdown of the strange case of the failed remote desktop gateway connection.

The setup is as follow, using diffrent machines Windows 10, 8.1 and 7 to connect to diffrent remote desktop gateway solutions and for some reason the connection failed with wrong username and password to a couple of the RDGWs.

So after som digging and alot of help from my good friend over at isloation.se we found the issue and how to check if you are also running into this issue.

The check

On the RDGW check under incomming connections/monitoring and if the connections display as RPC-HTTP. This is the clue that something is not all right.

rdgw1

The cause

So over the years the has been alot of fixes and version of the RDP client for each version of Windows. In the later release support was introduced for RDP over HTTP with UDP as a performance booster. However due to bugs and other things happening there have been posts and information about setting a registry value to make RDP work again. The value is called RDGClientTransport. It is a DWORD and you set it to 1 to get everyting working again.

However what this does is force the RDP client to fall back to RPC-HTTP connections instead of HTTP/UDP. This in turn can cause connection issues if you have modern solutions.

The solution

Depsite several blogs and forum posts saying this the value should be 1 you really should change the default value of 0.

So here is the full path to set the value.

HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\RDPClientTransport

As you probably noted it is a current user setting and since I am very lazy. Most of my configuration is done through either Configuration Manager or GPO so in this case it was a GPO setting the value to 1 for all my users. Hence the problem was only on my devices and not my coworkers devices.

rdgw2

/Peter

Techdays 2017 Pre-Conf Slides

Me and Jörgen Nilsson (@ccmexec) did a pre-conf together at Techdays in sweden. And after much slacking here are now the slide deck from that pre-conf.

Here is the link to download the slidedeck!
https://1drv.ms/b/s!ArAh2CEqOjRkk-8ZDAVJ1vRqi8Glxg

Techday2017

/Peter