Windows on wporter.org

Offline domain join - djoin.exe

Wed, 09 Sep 2026 20:00:00 +0000

djoin allows you to join devices to Active Directory with a provisioning blob (a text file) that is generated somewhere with line-of-sight to a DC, then used anywhere (on an online or offline Windows image). This means you can:

skip authentication on the target device
- helps reduce privileges required on the endpoint - no longer need an account with permission to create the computer object to sign into the endpoint
join devices while they’re offline (e.g., at a remote site, or in a staging location without connectivity to the domain)
join devices during provisioning without the need to save credentials capable of many or arbitrary domain joins

An offline domain-joined machine will still require line-of-sight to a domain controller for initial user authentication, Group Policy processing, Kerberos, certificate enrollment, et cetera.

An Active Directory security checklist

Tue, 24 Mar 2026 21:45:00 +0000

Use a freely available Active Directory configuration/vulnerability scanner like Purple Knight or PingCastle to get a quick assessment of the environment’s state. Purple Knight is a great tool, PingCastle.. meh.
Keep the Default Domain and Default Domain Controllers policies minimal. Explicitly name your policies and consider targeting them by security group rather than at the OU level. Audit your GPOs regularly.
Consider disabling AAD Connect’s Seamless SSO if you’re not using it (e.g., your machines are all hybrid joined and W10+, so they use PRTs for SSO to Entra ID instead). The SSO computer account is a threat vector.
Apply the freely available Microsoft Security and Compliance Toolkit configuration baselines for your Windows client & server OSes.
- READ. THE. SPREADSHEETS. AND. TEST. BEFORE. PUSHING. TO. PROD.
- Consider applying the baseline for Office, too.
If you’ve got Defender for Endpoint, deploy it. Even if you’re using another EDR agent. Deploy Defender for Endpoint in passive or EDR block mode. Defender for Endpoint is REALLY good.
- Apply Defender Attack Surface Reduction rules, too, while you’re at it. They’re free bits of hardening preconfigured for you.
PATCH!! YOUR!!! STUFF!!!!!!
Remove users from the “Operators” groups. These are often legacy leftovers from a more “consolidated” AD environment (e.g., a DC was a terminal server, and users occasionally had to restart the print spooler, so users were added to the Print Operators and Server Operators groups.. making it trivial for one to elevate to SYSTEM on a DC in the absence of other controls).
DO NOT RUN ANYTHING BUT AD DS (and DHCP) ON A DOMAIN CONTROLLER.
- I’ll repeat that. DO NOT RUN ANYTHING BUT AD DS (and DHCP) ON A DOMAIN CONTROLLER.
- DO NOT USE A DOMAIN CONTROLLER AS A JUMPBOX!!!
- If you think this is good because you’ll save money on a Windows Server license, consider the cost of rebuilding the entire environment after it gets compromised vs $800 for another Server Standard OSE. If you do this and have Server Datacenter licenses I WILL find you and I WILL slap you silly.
- STOP
- RUNNING
- OTHER
- SERVICES
- ON
- DOMAIN
- CONTROLLERS
- Think about how much harder it would be to clean up a compromised domain versus JUST SETTING UP ANOTHER SERVER.
Disable multicast name resolution, including mDNS if your environment is using a .local TLD.
- This means NetBIOS, LLMNR, and mDNS.
- Either disable mDNS and break Spotify/Miracast, rename your domain, or get Responder’d to death. Three options. The first two are preferred.
Phase out RC4 Kerberos encryption.
- RC4 is highly vulnerable to offline attacks (“Kerberoasting”) and will be disabled by default in July 2026.
- Reset the KRBTGT password twice (reset once, wait at least 10H for old tickets to expire, reset again), then audit security events 4768 & 4769 for encryption type 0x17/0x18 (RC4, RC4 with preauth). If you don’t see anything, turn RC4 off!
Enable Kerberos armoring (FAST).
- Encrypts pre-authentication. If in place, an attacker must first compromise a machine account to read pre-auth handshakes (making an offline attack against preauth much less worthwhile).
- Notably provides mutual authentication of the KDC (protecting against a MITM with a spoofed KDC), provides downgrade attack prevention, and protects the TGS exchange.
Ensure host firewalls are enabled. Restrict access to administrative services (e.g., RDP, WSMAN, SMB for the admin shares) to dedicated jump hosts/PAWs.
- Use PAWs on trusted hypervisors or dedicated, modern physical hardware (e.g., with a TPM and supporting hardware virtualization, so you can make use of Credential Guard) for best results. A VM is only as good as the machine hosting it.
- Your 8th - 10th gen Intel machines in the ewaste pile are just begging for a second life!
Sell your customer on PKI. The security benefits are colossal and it’s a prerequisite for a lot of stuff you’ll want to do:
- LDAPS - turn off LDAP, require encryption, without LDAPS your DCs are chatting with other services in plaintext
- Machine cert auth for 802.1X or VPN access (maybe even machine-cert-based AOVPN for your full AD-joined environments with remote workers)
- TLS for your internal services
- SMB over QUIC
- PKINIT - Kerberos pre-authentication with certificates!
  - Replaces the traditional AS-REQ phase. No more password hash on the wire during preauth; instead, use the public key (an X509 cert). Private key stays on your device, as with any other form of keypair auth.
  - You should still use FAST (Kerberos armoring) to encrypt the TGS exchange.
- Foundation for WHfB/passwordless strong authentication (great for the user experience)
- Allows you to start signing internal apps/scripts
- Avoid getting MITM’d when you RDP or SSH around (trusted cert = more of a guarantee that this machine is who it says it is!)
DO NOT EVER log in to a Domain Administrator on a workstation. Add your Domain Admins (and any other privileged roles) to the Protected Users group so that their credentials cannot be cached and reused later.
Adopt LAPS rather than creating a domain-wide admin account for your workstations - even if you “tier” the admin accounts and dedicate one to your workstations, that’s a wide blast radius.
Segment your network.
Treat hypervisors with even more sanctity than you do your DCs. If someone can knock over the server hosting your DC (and you don’t have confidential computing) they can read the memory of your DC and go to town.
SEGMENT YOUR NETWORK!! Use firewall rules! Use deep packet inspection, MITM your traffic (SSL inspection), block all outbound by default! THIS IS A GOOD THING and worth the effort!
Enforce security policy. For example, if you say “don’t sign in to workstations with a Domain Admin account” and your techs still have access to the domain admin password, they WILL sign into workstations with said Domain Admin account. Disable accounts, change passwords, and add the SeDenyLocalLogon privilege to that darn account.
Consider adopting (at least partially adopting) the tiered AD privilege model.
- Your domain controllers are the king in the castle. DO NOT GIVE A DOMAIN ADMIN ACCOUNT AWAY by logging it in to poor old Judy’s workstation. She HAS installed or WILL install SocialSecurity.pdf.exe at some point. Somehow, despite all your efforts.
Enable and enforce SMB encryption. If this means too much overhead, fall back to just enabling SMB signing. Avoid getting MITM’d.
Disable NTLM where possible, or audit and restrict it to the best of your ability.
Audit and remove unnecessary SPNs.
Replace traditional service accounts with MSAs and/or gMSAs for automatic password rotation.
Audit ACLs on privileged AD objects. Don’t let some random account modify properties on your tier zero admin accounts.
Ship your logs somewhere, configure basic alerting. I like to use VictoriaLogs and Grafana, but you can use any SIEM or log store you’d like.
Alert on sensitive group membership changes.
Enable PowerShell Script Block and Module logging.
Disable the print spooler where it’s not needed.
Remove stale AD objects regularly.
Test your AD backup and restore procedure regularly.
Do not synchronize privileged Active Directory identities to Microsoft Entra. ABSOLUTELY DO NOT sync a Domain Admin account to a Global Admin in M365.
If hardware supports it, enable Credential Guard.
- This requires a TPM and hardware virtualization, but protects you against pass-the-hash and pass-the-ticket attacks by sandboxing credentials on your device.
Restrict dynamic DNS updates to authenticated clients to prevent “ADIDNS” (Active Directory-Integrated DNS) spoofing.
- With unauthenticated dynamic updates enabled, anyone can bump a DNS record and either break things or, perhaps worse, redirect connection attempts intended to go to a server to themselves.
- Consider locking this down further to specific principals (e.g., computer accounts and Domain Admins only) so Domain Users can’t make dynamic updates (by default, even with secure updates on, any authenticated user can create new DNS records, including wildcard records).
Restrict DCSync permissions.
- Accounts with “Replicating Directory Changes” and “Replicating Directory Changes All” permissions can steal password hashes by simulating Active Directory replication to a fake DC.
Finally.. consider joining your endpoints to Entra ID rather than Active Directory. Microsoft has made it quite clear that this is their new way forwards. You can still authenticate to on-prem resources with no hassle (see my blog post on the Cloud Kerberos Trust and getting WHfB passwordless auth to both M365 and on-premises resources from an Entra-joined client).

Configuring the cloud Kerberos trust - Kerberos SSO to domain resources with WHfB for Entra-joined clients

Sat, 07 Mar 2026 17:30:00 +0000

The scenario: I have a hybrid AD environment (identity and password hash synchronization) with Entra-joined endpoints. I’d like to authenticate to both cloud resources and on-premise domain-joined resources (via Kerberos) with my Windows Hello keypair.

Introduction

Entra-joined devices authenticating to domain resources

Right out of the box, an Entra-joined workstation with a user who’s synchronized from the on-premise domain and has signed in with a password will be able to authenticate to domain resources.

Using Fluent Bit on Windows to ship event logs to VictoriaLogs

Wed, 14 Jan 2026 23:30:00 +0000

Windows install docs

Windows service setup

Fluent Bit is designed solely as a low-overhead forwarding agent, primarily for logs (though it does have support for metrics as well), and has a wide ecosystem of “input” and “output” plugins that permit it to be used to collect logs or metrics from a wide variety of things, then ship said logs or metrics to a wide variety of data stores (e.g., in our case, it’ll ship via a web request POSTing events to VictoriaLogs).

Windows Encrypted File System basics

Sun, 04 Jan 2026 17:45:00 +0000

BitLocker is great, but is primarily useful for preventing tampering when the system is offline. Once your system is online, a sufficiently privileged user could write to or read from anywhere on the disk. The Encrypted File System (EFS) exists to mitigate this.

EFS, a capability of NTFS (since Windows 2000) allows you to mark files or directories for transparent encryption.

This is not to be confused with Windows Personal Data Encryption, an Enterprise-edition feature tied to Windows Hello for Business introduced with Windows 11, version 24H2. PDE is similar, requires Windows 11 Enterprise (e.g., M365 E3/E5) and uses WHfB keypairs rather than user certificates (and thus requires Entra join and Windows Hello logon, and thus doesn’t work via RDP).

PowerShell Core (Microsoft Graph and Az) in a toolbox container on your Linux box

Sun, 24 Aug 2025 22:00:00 +0000

If you’re like me (god, for your sake I hope you aren’t) you love PowerShell and use Linux.

I’m also super lazy. And I don’t like Microsoft adding 5,000 repositories to my system to keep PowerShell updated. The solution? A container!

Toolbox lets you very easily jump into a podman container for a development environment. In this container, you can typically install whatever you’d need as if it was on a bare metal install - no special anything required. Since all I need is PowerShell, we’ll keep things simple.

Microsoft MD-102 (Endpoint Administrator): Pass!

Sat, 23 Aug 2025 12:00:00 +0000

My thoughts on the certification

I passed the Intune test!

It’s been about a year since I started working at a shop that uses Intune (a bit - for iOS and Macs), so on a whim I decided I should get the cert. It took me about three weekends, plus a few hours of study during the week.

I had a decent bit of experience with Intune, but don’t use it daily.

Configuring silent OneDrive sign-in and Known Folders sync

Sun, 17 Aug 2025 17:00:00 +0000

MS Learn link here.

You can do this via Group Policy or Intune, depending on how your environment is configured, but the policies are the same.

Deploying silent OneDrive sync with Intune

For successful, silent sync, you MUST configure these three policies:

Silently move known folders to OneDrive
Silently sign users in to OneDrive with their Windows credentials
Enable Files on Demand

Here is an example of this minimal configuration in Intune. Choose just these settings from the Settings Catalog and enable them:

Onboarding Microsoft Defender for Endpoint with Intune

Sun, 17 Aug 2025 16:45:00 +0000

Licensing Prerequisites

Your tenant requires a license for Defender for Endpoint - either a Microsoft Defender for Endpoint P1 or P2, Microsoft Defender for Server, or Microsoft Defender for Business (“P1.5” edition for SMBs included with Microsoft 365 Business Premium).

Without one of these licenses, you will not see the Assets > Devices tab or the Settings > Endpoints menu, and cannot onboard devices to MDE.

It may take up to 24 hours for your Defender tenant to be provisioned once you have purchased and assigned the required licensing. Your admin account does not need to be licensed.

Microsoft Intune Assignment Filters

Sun, 17 Aug 2025 16:30:00 +0000

For info on designing filters for performance and manageability, see MS docs.

Device assignment filters allow you to select what devices a policy assigned to users will apply to, and let you select what devices in a device group are eligible for a policy.

App assignment filters allow you to select what devices specific app protection policies apply to.

They’re both useful tools for scoping down your Intune configuration policies. Let’s have a look at them!

Deploying Windows LAPS for client PCs with Microsoft Intune

Sat, 09 Aug 2025 16:35:00 +0000

Introduction

The Windows Local Administrator Password Solution (LAPS) allows administrators to configure a randomized, automatically rotated administrative password for Windows devices. This is a distinct feature from macOS LAPS.

Windows LAPS, integrated with Entra ID, replaces the older ’legacy’ Microsoft LAPS solution as of Windows 11 23H2. Microsoft is no longer updating ’legacy’ LAPS and its .msi package will be blocked from installing on Windows 11 24H2, Server 2025, and newer OSes.

Hardening and customizing Google Chrome via policy (registry)

Sun, 13 Jul 2025 17:35:00 +0000

Quick one here. Just going to list some policies, discuss setting them, and link to the docs and a script for setting them.

We can manage Chrome via MDM (like Intune), Group Policy (if the machine is joined to an Active Directory domain and you’ve imported the relevant ADMX), via ‘preferences’ JSON config files (Mac or Linux), or via the Windows registry (my preferred option since it applies to any Windows PC, regardless of management infrastructure, and is easy to script).

Why doesn't Windows support modern cryptography?

Tue, 01 Jul 2025 19:35:00 +0000

Try to feed Windows a certificate with an Ed25519 signature somewhere in the chain and it’ll just FALL OVER because CNG doesn’t support Ed25519 AT ALL?

This is an operating system that is ‘modern’ and ‘current’ and ‘has AI’.

Here! Watch it fall over when I try to do anything with a cert:

God forbid you want to use something with an Ed25519 signature in the chain:

Using Grafana Alloy on Windows to export (push) metrics (from Prometheus) and logs (from Loki)

Sun, 29 Jun 2025 19:30:00 +0000

Grafana Alloy is a multi-use exporter that we can run on our hosts to expose metrics for Prometheus. It also does other stuff, like send logs to Loki. It’s got a lot of features - you can read more it at grafana.com/docs.

Essentially, Grafana Alloy is an Open Telemetry-compatible collector that serves as a unified telemetry agent for popular services like Loki and Prometheus.

Some relevant points about Alloy:

We can replace the Prometheus Windows Exporter with Alloy, as Alloy for Windows has the Prometheus Windows Exporter built in.
We can use Alloy as a collector/forwarder to push metrics to Prometheus (rather than the default pull) which may be desirable, depending on your specific environment and firewalling
Grafana Alloy replaced the older Grafana Agent.
Alloy allows us collect and push logs to Loki in addition to collecting and pushing metrics to Prometheus.
Alloy has a considerable memory footprint compared to the much leaner Windows Exporter, but is necessary if you would like to push metrics to Prometheus. I’ve noticed Alloy consuming an order of magnitude (20x, in this case) more memory than the standalone Exporter (~370 mb vs ~20 mb).

Installing Alloy on Windows

There is not yet a Winget package for Grafana Alloy (thought there was, but couldn’t find it). You can download and (silently) install it with the following PowerShell:

Using the Dell Command | Update CLI to update drivers from PowerShell

Mon, 23 Jun 2025 14:30:00 +0000

Dell Command | Update is the only piece of Dell software that I intentionally put on machines. It’s one of the two useful Dell apps, alongside the Power Manager applet. It’s a driver manager that can be used to fetch the most recent drivers validated and published for a piece of Dell hardware, and it’s a nice utility to have.

It’s better (in my opinion) than HP and Lenovo’s options (Support Assistant and Commercial Vantage, respectively) because it’s available via the Winget packages Dell.CommandUpdate (Classic, v4.6) and Dell.CommandUpdate.Universal (.NET 8, v5.5), and it has a usable CLI interface that can be used to configure the software with PowerShell!

Configuring a Server 2008 R2 domain

Sun, 25 May 2025 16:30:00 +0000

Why are you doing this?

Fun!

Goal

DNS, DHCP and AD DS installed and working for a FL 2008 AD domain that we can then join physical Hyper-V Server 2008 R2 machines to.

I’ll be installing a couple of VMs on my desktop/main Windows server running 24H2 (Windows 11 Enterprise LTSC and Windows Server 2025). These have an i9-12900KS and a pair of E5-2698 v3 CPUs, respectively, which are both x86-64-v3 (this is a newer 12900 without AVX512). Then, we’ll think about standing up a Hyper-V Server 2008R2 machine.. or a cluster of them.. in another post.

Setting up a Windows 7 box in mid 2025

Fri, 23 May 2025 16:30:00 +0000

Why on earth would you want to do that?

Windows 7 is great and I would love it if the whole world knew what kind of Content I watch. More seriously, I wanted to briefly play an old Command & Conquer game and didn’t feel like tinkering with my Windows 11 box. Plus, nostalgia.

Hardware

I will be using relatively appropriate hardware.

I briefly tried a NUC7, but it doesn’t really have any USB 2 ports, so getting through setup is annoying.

Lazy PowerShell ssh-copy-id for Windows with SSH keys stored in 1Password

Sun, 11 May 2025 16:30:00 +0000

Introduction

The version of OpenSSH bundled with Windows does not include the ssh-copy-id utility for quickly copying a SSH key to a remote machine.

I use 1Password’s SSH agent, and store my SSH key in 1Password, so I can unlock it with biometrics (Windows Hello) instead of a passphrase, easily synchronize it between my machines, and avoid storing it on local disks. However, this means I can’t just copy my id_ed25519.pub from one of my boxes using the 1Password SSH agent (because that file isn’t created!)

Quick and dirty - install KB5002623 fix for Office 2016 crashing after KB5002700 installation via executable patch

Thu, 10 Apr 2025 18:30:00 +0000

Really dirty quick fix to install Microsoft’s executable April 10, 2025 patch for Office 2016, KB5002623 that resolves a number of crashes caused by the KB5002700 security fix from April 8, 2025.

While it is not especially pretty, it works. Replace the $Fileserver variable with a parent directory that has the four executables for KB5002700 and KB5002623 (64 and 32-bit) as children, like so:

[liam@server ~]$ sudo ls -l /srv/www/files
-rw-r--r--. 1 nginx nginx 262752112 Apr 11 00:15 mso2016-kb5002700-fullfile-x64-glb.exe
-rw-r--r--. 1 nginx nginx 134911608 Apr 11 00:15 mso2016-kb5002700-fullfile-x86-glb.exe
-rw-r--r--. 1 nginx nginx   3556192 Apr 10 21:17 msodll202016-kb5002623-fullfile-x64-glb.exe
-rw-r--r--. 1 nginx nginx   3556144 Apr 10 22:10 msodll202016-kb5002623-fullfile-x86-glb.exe

And, without further ado, here’s the script:

Cleaning up ghost Saved-Critical Hyper-V VMs after nuking all their files

Sun, 06 Apr 2025 00:30:59 +0000

So, I decided to upgrade my laptop. Part of that upgrade was the very caring removal of my D: drive, since the new board only had a single M.2 slot. My D: drive happened to be a second SSD with.. my Hyper-V config and VM disk directories.

Once I’d powered the machine back on and jumped back in to try and get rid of my ghost VMs via PowerShell, I was greeted with a pleasant sight:

Adventures with secedit.exe and PowerShell, pt. 1

Thu, 27 Mar 2025 12:13:59 +0000

I have a problem

Secedit is a bit confusing to use at first, so let’s build a PowerShell wrapper to do our bidding!

First, how do we use this darn thing?

After a brief detour to MS Learn and some poking around…

Secedit is funky! It wants you to treat it with care and take it on long walks. No slamming random SIDs at it and making it figure the hard stuff out (at least, not yet)!

ReFS sucks and you shouldn't use it, but here's how you can configure ReFS deduplication and compression (if you really want to do this to yourself)

Sat, 22 Mar 2025 12:13:59 +0000

Microsoft’s ReFS is their (terrible) answer to ZFS - a “modern” filesystem with fancy features like deduplication and checksumming.

While the implementation of said features (specifically deduplication) frankly sucks, and I have not found it to be anywhere near production-ready, I have set ReFS up on my own machines to save some disk space when I’m being cheap and need Windows.

If at all possible, you should switch to Linux and use ZFS or BTRFS instead. You will most likely have a bad time with ReFS.

Revisited: Working with Hyper-V NAT switches

Sat, 01 Feb 2025 10:12:59 +0000

Foreword

This is an update to a similar post from back in October 2024.

I’ve been going through and cleaning up a lot of my setup scripts and the like in pursuit of ~~SCIENCE~~ easier to use and quickly reproducible testing environments.

Occasionally, I want to configure NAT switches for small-scale, self-contained environments. I didn’t have anything that made this process nice, so I decided to fix something up.

Of course, before I knew it I’d wound up redoing the original post linked above - so I’d might as well post it!

Getting started with Cloud-init on Hyper-V

Fri, 24 Jan 2025 10:10:10 +0000

Intro

This will go over setting up an environment to build Cloud-init nocloud data drives (ISO, not vfat), converting nocloud disk images to VHDX, and then using those to hands-off provision VMs on Hyper-V hosts that can then be configured with Ansible.

More specifically, this will demonstrate using Cloud-init and the Alma Linux genericcloud image to stand up an Alma Linux VM on a Server 2025 host.

What is Cloud-init?

Cloud-init is a Canonical project that’s become the defacto standard for touchless configuration of Linux VMs over the years. Cloud-init is a package that can be installed on a Linux or Unix system that will read configuration files and provision a template VM on first boot for its environment.

Enabling Hyper-V in Windows Home editions

Sat, 11 Jan 2025 10:10:10 +0000

There’s a batch script floating around that does this, but I was curious to see if it still worked and wanted to rewrite it in PowerShell.

Tested and working with a Media Creation Tool version of Windows 10 Home Single Language 22H2 and Windows 11 Home 24H2.

PowerShell:

Function Enable-HyperVOnWinHome {
    [CmdletBinding()]
    param ()
    $ssp = "$($env:SystemRoot)\Servicing\Packages"
    Get-ChildItem -Path $ssp |
    Where-Object Name -like "*Hyper-V*.mum" |
    ForEach-Object { & dism.exe /online /norestart /add-package:$ssp\$_ }

    & dism.exe /online /enable-feature /featurename:Microsoft-Hyper-V /all
}

# this is not required, but you might want to enable the VM Platform while you're here
# if it's missing, WSL won't work.

& dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Proof:

Windows Hello fingerprint 'too similar to one that's already registered' with no fingerprints registered

Sun, 05 Jan 2025 10:10:10 +0000

Problem

Windows Hello fingerprint/face broke themselves after a hardware change (reenabling iGPU.) Not sure why. Fingerprint still working in UEFI (as supervisor authentication.) Able to easily reregister Hello face ID. Not able to reregister Hello fingerprint ID with error “this fingerprint is too similar to one that’s already registered” when I attempt to register any fingerprint. Fingerprint is NOT cleared from the TPM (still usable for power on/supervisor authentication.)

Device: ThinkPad P1 Gen 4 w/ Synaptics UWP WBDI fingerprint reader (synaumdf.cat, WUDFRd.sys, AuthenticateFAM_SecureFP.dll) using 6.0.45.1136 driver (1/30/24)

The Bitlocker Script

Mon, 16 Dec 2024 10:10:10 +0000

Problem

Needed to enable BitLocker on lots of machines with varying configurations.

Really didn’t want to do it manually, especially since this problem will not go away.

Solution

Uhh. Couple hours of PowerShell.

It works OK. Couple things I could still improve. I’ve run this probably a couple thousand times by now. It should be more or less idempotent and plays nicely with common edge cases (does not catastrophically fail.) It will happily encrypt my USB disks since they’re just exposed to the system as fixed NVMEs, but that’s not the script’s fault… as annoying as it can be.

Hide 'sign into all apps' pop-up in Microsoft apps

Tue, 10 Dec 2024 12:34:56 +0000

Problem

Users, when signing into Teams or Office, are prompted to “sign into all apps on this device” (Entra join a machine), which then fails with error “Your account was not set up on this device because device management could not be enabled” with code 80192EE7 (server msg: 0x80192ee7.)

We don’t want users getting this prompt at all.

Solution

Luckily, there’s a way to do just that (block our users from getting this prompt.) It’s only possible to do this directly from the registry, with key and value:

Snippet: one-liners to install all RSAT utilities

Mon, 02 Dec 2024 12:34:56 +0000

Server 2025

Get-WindowsFeature | Where Name -like "*RSAT*" | Install-WindowsFeature

Windows 11

Get-WindowsCapability -Online | Where Name -like "*RSAT*" | Add-WindowsCapability -Online

Requiring multiple, different factors for Windows Hello console authentication

Sun, 01 Dec 2024 12:34:56 +0000

NOTE: this works with normal Windows Hello without any backing infrastructure if you just want to require two Hello factors to sign on to a machine - this is how I use it (make a convenience PIN more secure.) NOTE: yes, Hello for Biz is MFA on its own, kind of.

By setting up first factor to be biometric or a PIN, then setting the second factor to be proximity or a PIN, I can make sure that I’m able to sign in with Hello when my phone is dead by passing biometric authentication and then entering my PIN.

Snippet: enabling forwarding between Hyper-V NAT vSwitches (WSL & int. NAT)

Tue, 26 Nov 2024 12:34:56 +0000

https://superuser.com/a/1764704

In my case, with NAT switch ‘vlab0-natswitch’ and the default WSL NAT switch (so I can run Ansible playbooks against VMs behind a different NAT switch) the following one-liner does the trick. Adjust interfacealias values to suit.

get-netipinterface | where {$_.interfacealias -eq 'vEthernet (vlab0-natswitch)' -or $_.interfacealias -eq 'vEthernet (WSL (Hyper-V firewall))'} | set-netipinterface -forwarding Enabled -verbose

Works!

liam@liam-p1g4i-0:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:b7:bc:42 brd ff:ff:ff:ff:ff:ff
    inet 172.28.133.19/20 brd 172.28.143.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:feb7:bc42/64 scope link
       valid_lft forever preferred_lft forever
liam@liam-p1g4i-0:~$ uname -r
5.15.167.4-microsoft-standard-WSL2
liam@liam-p1g4i-0:~$ ping 192.0.2.10
PING 192.0.2.10 (192.0.2.10) 56(84) bytes of data.
64 bytes from 192.0.2.10: icmp_seq=1 ttl=127 time=1.41 ms

Snippet: using Winget from system context (NinjaRMM scripts)

Fri, 22 Nov 2024 12:34:56 +0000

Yes, NinjaRMM has features for Winget package management. No, I didn’t look it up, and it wasn’t enabled in our tenant.

$WingetPath = Resolve-Path "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller*\winget.exe"

if (-not $WingetPath){

	Write-Error -Message "Winget path not found. Failure. Exiting."
	return 1
	
}

$WingetPath = Split-Path -Path $WingetPath -Parent

Set-Location $WingetPath

.\winget.exe install --exact --id Microsoft.Teams --silent --accept-package-agreements --accept-source-agreements

Renaming domain member detaches Computer Object

Wed, 20 Nov 2024 12:34:56 +0000

If renaming a domain member succeeds but the corresponding computer object is not updated, the trust relationship between the domain and the computer will break, preventing you from logging in, among other things.

Luckily, the fix is just modifying the Name, SamAccountName (mandatory) and DNSHostName (optional) properties of the computer object:

Get-ADComputer -Filter * | Where Name -eq 'OLDNAME' | Rename-ADObject -NewName 'NEWNAME' -PassThru | Set-ADComputer -SamAccountName 'NEWNAME$'

I’d probably rename the machine again afterwards in an attempt to get it to clean any remaining bits of itself up. You can do this once the computer account name and AD object name have been updated.