Sysinternals – Permissions, LoggedOn, Endpoints

How to Get the permission on folders:
PowerShell:
Get-ChildItem | Get-ACL
Path | Owner | Access

or more in depth use:

GUI based : Run AccessEnum against the drive or folder – (SysInternals tool) and save to text file (Run as administrator or a specific user)

Who is logged on via the resource shares:
Launch cmd and run PSLoggedon (SysInternals tool)
Displays :
1) Users logged on locally
2) Users logged on via resource shares

List TCP and UDP Endpoints connected
Run TCPView application (SysInternals tool) and save to text file

Ever need to identify the before and after changes in Active Directory
Use : ADExplorer (SystInternals tool)

Download Sysinternals 
https://docs.microsoft.com/en-gb/sysinternals/downloads/sysinternals-suite

Suggested top 10 sysinternals tools
https://www.techrepublic.com/blog/10-things/10-sysinternals-tools-you-shouldnt-be-without/
See an advert of interest, CLICK IT!  This site is funded by AD clicks.

Client failed to RDP to RDS server following Windows Server Patching – CredSSP updates for CVE-2018-0886

CredSSP updates for CVE-2018-0886

That Monday morning issue when servers were patched on a Sunday… All Windows 10 clients fail to RDP to the RDS server following Windows Server Patching.

The cause?

“By default, after this update is installed, patched clients cannot communicate with unpatched servers. Use the interoperability matrix and group policy settings described in this article to enable an “allowed” configuration.”

https://support.microsoft.com/en-us/help/4093492/credssp-updates-for-cve-2018-0886-march-13-2018

Temp Solution until clients are patched

Create a registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters

CredSSP and Parameters keys had to be created
Create the AllowEncryptionOracle DWORD and give it a value of 2

or Command lined:

REG  ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\ /v AllowEncryptionOracle /t REG_DWORD /d 2

 

Tested on Windows 7 and Windows 10.
No reboot required.

Note this reduces the security the patch was put in to fix

See an advert of interest, CLICK IT!  This site is funded by AD clicks.

How to Disable Windows Defender

1) Open Control Panel
2) Open up Windows Defender
3) Click Tools on the top menu
4) Click on Options
5) Find the Administrator section, uncheck the box for “Use this program”
6) Click the Save button.

Now open services.msc

7) Select Windows Defender
8) Right click and select properties
8) Stop the service
9) Change Startup type to Disabled.