The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,858 other subscribers

Archive for the ‘Windows 9’ Category

PRANK: Windows XP Updates

Posted by jpluimers on 2024/01/25

This one is cool: [Wayback/Archive] PRANK: Windows XP Updates.

Note that unlike the screenshot below, the actual prank does count the percentage. The actual page does.

You can start this one and various other OSes plus Windows versions and other pranks via [Wayback/Archive] FakeUpdate.net – Windows Update Prank by fediaFedia (at the time of writing Windows 98 install, Windows Vista update, Windows 8 update, Windows 7 update, Mac OS boot, Windows 10 install, Windows 10 update, steam and “fake ransomware”).

It is a cool and relatively harmless way of teaching people to use their lock screen when away from their machine (Windows: Win+L, Mac OS: Ctrl+Shift+Power).

Read the rest of this entry »

Posted in Awareness, Fun, Power User, Security, Windows, Windows 10, Windows 11, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2000, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »

I had some Windows ATOM issues before, but this beats them easily

Posted by jpluimers on 2022/10/19

I’ve had some issues with Windows ATOM tables filling up, but nothing like this security bypass:

A new Windows code injection technique, atombombing, which bypasses current security solutions.

Source: AtomBombing: Brand New Code Injection for Windows – Breaking Malware [WayBack] with source code at BreakingMalwareResearch/atom-bombing: Brand New Code Injection for Windows

Note that since writing the first draft, the above AtomBombing article moved via Wayback: blog.ensilo.com to [Wayback/Archive.is] AtomBombing – A Brand New Code Injection Technique for Windows | FortiGuard Labs.

Read the rest of this entry »

Posted in Development, FortiGate/FortiClient, Hardware, Network-and-equipment, Power User, Security, Software Development, VPN, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Development, Windows Server 2000, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »

Digging Through Event Log Hell (finding user logon & logoff) – Ars Technica OpenForum

Posted by jpluimers on 2021/08/31

This helped me big time finding failed logon attempts: [WayBack] Event Log Hell (finding user logon & logoff) – Ars Technica OpenForum

Alternatively, you can use the XPath query mechanism included in the Windows 7 event viewer. In the event viewer, select “Filter Current Log…”, choose the XML tab, tick “Edit query manually”, then copy the following to the textbox:

Code:
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[EventID=4624] and EventData[Data[@Name='TargetUserName'] = 'USERNAME']]</Select>
  </Query>
</QueryList>

This selects all events from the Security log with EventID 4624 where the EventData contains a Data node with a Name value of TargetUserName that is equal to USERNAME. Remember to replace USERNAME with the name of the user you’re looking for.

If you need to be even more specific, you can use additional XPath querying – have a look at the detail view of an event and select the XML view to see the data that you are querying into.

Thanks user Hamstro!

Notes:

Related:

–jeroen

Posted in Development, Microsoft Surface on Windows 7, Power User, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Vista, Windows XP, XML/XSD | Leave a Comment »

How to turn on automatic logon in Windows

Posted by jpluimers on 2021/08/09

[WayBack] How to turn on automatic logon in Windows

Describes how to turn on the automatic logon feature in Windows by editing the registry.

Most archivals of the above post fail with a 404-error after briefly flashing the content, but this particular one usually succeeds displaying.

It is slightly different from the one referenced in my blog post automatic logon in Windows 2003, and because of the archival issues, I have quoted most of it below.

A few observations, at least in Windows 10 and 8.1:

  • Major Windows 10 upgrades will disable the autologon: after each major upgrade, you have to re-apply the registry patches.
  • If the user has a blank password, you can remove the DefaultPassword value.
    • Empty passwords allow local logon (no network logon or remote desktop logon), no network access and no RunAs, which can actually help improve security. More on that in a later blog post
  • For a local machine logon, you do not need the DefaultDomainName value either (despite many posts insisting you need them), but you can technically set it to the computer name using reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d %ComputerName% /f
  • If another user logs on and off, the values keep preserved, so after a reboot, the correct user automatically logs on
  • you need a full reboot cycle for this to take effect
  • The AutoLogon tool does not allow blank passwords

I wrote a batch file enable-autologon-for-user-parameter.bat that makes it easier:

if [%1] == [] goto :help

:enable
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
:setUserName
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d %1 /f
:removePasswordIfItExists
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f
if [%2] == [] goto :eof
:setPassword
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d %2 /f  
  goto :eof

:help
  echo Syntax:
  echo   %0 username password

The article quote:

Read the rest of this entry »

Posted in Batch-Files, Development, Microsoft Surface on Windows 7, Power User, Scripting, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »

How to install Telnet with only one command

Posted by jpluimers on 2020/12/01

Source: [WayBackHow to install Telnet with only one command:

dism /online /Enable-Feature /FeatureName:TelnetClient

–jeroen

Posted in Microsoft Surface on Windows 7, Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista | Leave a Comment »

Windows 7 Blue Screen Of Death with error 0x7B – twm’s blog

Posted by jpluimers on 2020/09/28

[WayBack] Windows 7 Blue Screen Of Death with error 0x7B – twm’s blog:

To allow Windows 7 to boot in IDE as well as AHCI mode, I had to enable the following drivers (by setting “Start” to “0” in the registry, there might be other options to do this):

HKLM\System\CurrentControlSet\services\intelide
HKLM\System\CurrentControlSet\services\pciide
HKLM\System\CurrentControlSet\services\msahci
HKLM\System\CurrentControlSet\services\iastorV

The first two allow Windows 7 to boot from SATA in IDE mode. The second two allow Windows 7 to boot from SATA in AHCI mode.

–jeroen

Posted in Development, Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9 | Leave a Comment »

if statement – How to ask for batch file user input with a timeout – Stack Overflow

Posted by jpluimers on 2019/05/14

The trick is to use the choice command; see [WayBackif statement – How to ask for batch file user input with a timeout – Stack Overflow

–jeroen

Posted in Batch-Files, Development, Microsoft Surface on Windows 7, Power User, Scripting, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2000, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Vista, Windows XP | Leave a Comment »

List of Shell GUIDs for various Windows versions for use in shortcuts and batch files

Posted by jpluimers on 2019/01/09

In my search for starting the Windows Credential Manager from the console, I found [WayBackCredential Manager Shortcut – Create – Windows 7 Help Forums explaining:

%windir%\explorer.exe shell:::{1206F5F1-0569-412C-8FEC-3204630DFB70}

This reminded me of From batch file or shortcut: start Windows Update (via: Windows 7 Help Forums) and batch-file trick: Starting Windows Explorer and selecting a file (“explorer” commandline parameters “/n” “/e” “/select” “/root” “/start” site:microsoft.com).

The odd thing is that some of the GUID shortcuts works fine using the shell::: syntax, but fail with the /e:: syntax, for instance Windows Update until Windows 8.1:

%windir%\explorer.exe shell:::{36eef7db-88ad-4e81-ad49-0e313f0c35f8}
%windir%\explorer.exe /e,::{36eef7db-88ad-4e81-ad49-0e313f0c35f8}

One day I’ll create a table of permutations for various Windows versions and execute options.

For now these links need to suffice:

–jeroen

Posted in Batch-Files, Development, Power User, Scripting, Software Development, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9 | 1 Comment »

Adding Windows machines to Samba domains and security

Posted by jpluimers on 2018/12/07

If adding a Windows machine to a Samba domain fails and the below “solves” your issue, then you need to tighten the security on the Samba side:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]
; Enable NT-Domain compatibility mode
; Default:
; [value not present]
; "DomainCompatibilityMode"=-
"DomainCompatibilityMode"=dword:00000001

; Disable required DNS name resolution
; Default:
; [value not present]
; "DNSNameResolutionRequired"=-
"DNSNameResolutionRequired"=dword:00000000


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogon\Parameters]
; Disable requirement of signed communication
; My Samba (3.0.33) works with signed communication enabled, so no need to disable it.
; Default:
; "RequireSignOrSeal"=dword:00000001
; Disable the usage of strong keys
; Default:
; "RequireStrongKey"=dword:00000001
"RequireStrongKey"=dword:00000000

–jeroen

Posted in *nix, *nix-tools, Power User, samba SMB/CIFS/NMB, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9 | Leave a Comment »

When you cannot RDP to a target because of “CredSSP-encryption Oracle remediation”: apply your target security patches.

Posted by jpluimers on 2018/06/29

If you get the below error, then your RDP target server needs to be patched.

You can choose to stay vulnerable and modify your policy or registry settings as explained in the first linked article below: that is a temporary “workaround” which I do not recommend. Please update your RDP target servers in stead.

English:

[Window Title]
Remote Desktop Connection

[Content]
An authentication error has occurred.
The function requested is not supported

Remote computer: rdp.example.org
This could be due to CredSSP-encryption Oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660

[OK]

Read the rest of this entry »

Posted in Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 | Leave a Comment »