Azure – Log Analytics Workspace and AzureVirtual Machine Agent Install

How to prepare to collect security log data from your Azure Windows virtual machines. You require two things:

  1. Log Analystics Workspace to be created
  2. The agent to be installed on the Virtual machine.

This guide shows how to setup the workspace and install the agents on the virtual machine.

Create a Log Analytics Workspace

Pricing is Pay as you go

Next you connect to the data source

Click Virtual Machines > Select Virtual Machine and click Connect.

The Agent is then automatically installed and ready to configure for the log analytics workspace

Next Configure workspace under advanced settings. See MS Doc Quick Start Guide

Windows event log collect from Windows VM

  • Click Data > Windows Event Logs.
  • Add an event log. Example type System and then select “+”.
  • In the table, check the options Error and Warning.
  • Select Save at the top of the page to save the configuration.

Azure – Update Management

How to maintain the patch status of your Windows and Linux machines

You can use Update Management in Azure Automation to manage operating system updates for your Windows and Linux machines in Azure, in on-premises environments, and in other cloud environments.” Microsoft

To enable on a specific virtual machine in Azure

Note – You only pay for logs stored (Log Analytics)

Enabling the option can take up to 15mins

Useful reference links

Bulk Add Azure VMs and Non Azure Machines

Multiple displays on Windows 10

Connecting a monitor to your laptop. Find the correct cable and port.

Next, dual-monitor, which screen is where? Any order would work but having the physical location match the logical location set on the computer is a next option.

Step 1. Right click any blank space on the desk top background > click display settings

Step 2. Under the “Select and rearrange displays” section, drag and drop each display to rearrange them according to their physical layout on your desktop.

(If you’re not sure which monitor you’re selecting, click the Identify button to figure out.)

Step 3. Click the Apply button.

Once you complete the steps, Windows 10 will save the physical layout, and you’ll be able to work across each display and run apps without issues.

Robocopy. Copy Move Files Older or Newer than X number of days

Script options

  • Move only files under 60days old
  • Move files older than 60days
  • Move files back
  • Move files older than 182 is number of days (6 months roughly)
  • Move only files under 60days old

Parameters

  • /MAXAGE:n :: MAXimum file AGE – exclude files older than n days/date.
  • /MINAGE:n :: MINimum file AGE – exclude files newer than n days/date.
  • /copyall /s  :: copys all sub folders and moves files to the folders
  • /mov Moves files, and deletes them from the source after they are copied.
  • /move Moves files and directories, and deletes them from the source after they are copied.  (note the MOVE option will fail if any files are open and locked)

Examples:
Move only files under 60days old
robocopy c:\temp c:\temparchive /mov /MAXAGE:60 /copyall /s >c:\temp\FileUnder60daysMoved.txt

Move only files under 60days old back 
robocopy c:\temparchive c:\temp /mov /MAXAGE:60 /copyall /s >c:\temp\FileUnder60daysMovedReturned.txt

Move files older than 60days
robocopy c:\temp c:\temparchive /mov /MINAGE:60 /copyall /s >c:\temp\FilesOver60daysMoved.txt

Move files older than 60days back
robocopy c:\temparchive c:\temp /mov /MINAGE:60 /copyall /s >c:\temp\FilesOver60daysMovedreturned.txt

182 number of days (6 months roughly)
robocopy c:\temp c:\temparchive /mov /MINAGE:182 /copyall /s >c:\temp\FilesOver182daysMoved.txt

Deletes the original directories after moving
robocopy c:\temp c:\temparchive /move /MINAGE:60 /copyall /s >c:\temp\FilesOver60daysMoved.txt

Microsoft examples in more detail
https://social.technet.microsoft.com/wiki/contents/articles/1073.robocopy-and-a-few-examples.aspx#Move_files_over_14_days_old

WSUS and Windows 10 Clients – UsoClient.exe

So, you deploy a GPO to Window 10 clients, but your in a hurry to get the clients to check in…

As a SysAdmin for many years I would log on to a client, open command prompt and type :

wuauclt /detectnow  (Windows 7 / Windows Server 2008/2012 clients)

 

In Windows 10 you will notice that it doesn’t do anything and doesn’t show you anything. (As shown above)

(confirmed on https://blogs.technet.microsoft.com/yongrhee/2017/11/09/wuauclt-detectnow-in-windows-10-and-windows-server-2016/)

An example of “Whats New” in Windows 10, and Windows Server 2016 To check or scan “Windows Update” from the command prompt :
CMD (Run As Administrator)
c:\windows\system32\

UsoClient.exe startscan

And there is more switches….

  1. StartScan – Used To Start Scan
  2. StartDownload – Used to Start Download of Patches
  3. StartInstall – Used to Install Downloaded Patches
  4. RefreshSettings  – Refresh Settings if any changes were made
  5. StartInteractiveScan  – May ask for user input and/or open dialogues to show progress or report errors
  6. RestartDevice – Restart device to finish installation of updates
  7. ScanInstallWait – Combined Scan Download Install
  8. ResumeUpdate – Resume Update Installation On Boot

Check / Set / Sync Time Source for Windows Servers

To set the time ( Tested against Windows 2016)

Launch CMD as administrator
exampled c:\time 09:00:00 AM   – This will set the time to 9am

Note a time source if domain joined will up date the time clock again
Check the source
c:\w32tm /query /status Will show the time “Source”

To set an internet based NTP

c:\w32tm /config /syncfromflags:manual /manualpeerlist:”0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org
3.pool.ntp.org”

This will take effect after stopping and starting the W32Time service

Powershell….
stop-service w32time
start-service w32time

for settings to take effect

check status
c:\w32tm /query /status Will show the new time “Source”

To check sync is working
c:\w32tm /resync (Check the time sync)

 

See an advert of interest, click it, this site is funded by ad clicks.

Get-AdUser -Filter {Multiple Filters Complex } -Properties | Export to CSV

#Import AD modules

import-module servermanager
Add-WindowsFeature -Name “RSAT-AD-PowerShell” -IncludeAllSubFeature

#List AD user accounts and show DisplayName, Email, Title and export to CSV

Get-ADUser -Filter * -Properties DisplayName, EmailAddress, Title | select DisplayName, EmailAddress, Title | Export-CSV “C:\temp\Email_Addresses.csv”

#List AD user accounts and show DisplayName, Email, Title and export to CSV. Advanced filter to show ENABLED accounts only

Get-ADUser -Filter {Enabled -eq $true} -Properties DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | select DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | Export-CSV “C:\temp\Email_Addresses_allusers.csv”

#List AD user accounts and show DisplayName, Email, Title and export to CSV. Advanced filter to show ENABLED accounts only and email address ending @test.com

Get-ADUser -Filter {(Enabled -eq $true) -And (EmailAddress -Like “*@test.com”)} -Properties DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | select DisplayName, SamAccountName, EmailAddress, Enabled, DistinguishedName | Export-CSV “C:\temp\Email_Addresses_testdomain.csv”

Get a list of inactive computers which have not logged on to the domain in the last 12 weeks

# Inactive computers ( this will include systems not regularly used)

# Launch command prompt as administrator and run the following commands

Dsquery computer -inactive 12 -limit 500

# Lists computers inactive for over 12 weeks and returns a limit of 500 results

Dsquery computer -inactive 12 -limit 500 | dsmod computer -disabled

# Lists computers inactive for over 12 weeks and returns a limit of 500 results and disables the computer accounts

 

# Similar command can be done for users.