The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged

2

Windows' tracert is using ICMP while incrementing TTL to do probes: How to Use the TRACERT Utility The TRACERT diagnostic utility determines the route to a destination by sending Internet Control Message Protocol (ICMP) echo packets to the destination. Fedora's traceroute, by default, sends UDP probes, as have been previous Unix traceroute ...


0

Falco's answer is typically going to be more useful, but for completeness, the individual file permissions flags are documented under File Access Rights Constants in the Windows Dev Center, and the standard and generic flags are documented under ACCESS_MASK. Breaking down 0x001E01FF, we have: 0x00100000 = SYNCHRONIZE (used by the kernel? not too sure ...


0

Using WEF together with the WEC collector does not offer any possibility to add this information. However, some alternative exist but they are not perfect: Use your DHCP server logs and correlate the IP contained in those logs with the one you would have resolved while doing the DNS resolution in your SIEM Use an emulated WEC server (creates a WinRM ...


2

You will need to query the security event log for the event id 4264 event, which includes the logon type. Type 11 is cached interactive logon. (This also implies auditing must be enabled). https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624


0

I would set it up like this: In case you find the picture hard to read, here are the entries in text form: Administrators: Full control, applies to this folder, subfolders and files Users: Full control, applies to files only Users: Create files / write data, applies to this folder only Users: Read & execute, applies to this folder, subfolders and files ...


0

Apparently windows cannot install when there are 2 or more EFI partitions. Deleting the "Drive 1 partition 1" will probably allow for the installation to continue.


1

the SDDL meanings are documented e.g. here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070 meaning of 0x001F01FF for example is "file full access" 0x001F01FF = 0x001E01FF + 0x00010000 (which is delete-> see link). this means the delete permission is missing in your calcs result. bit wise ...


0

So i figured out the solution thanks to Harry Johnston's comment, cheers to him : Under Security tab->Advanced, you need to set 2 sets of permissions for any concerned group : -One applied to folders, subfolders and files (the default) where you un-check the "Create/append folders" permission. -One applied TO FILES ONLY where you give them regular edit ...


0

The error message is incorrect. The problem is that Win10 <= 1703 does not support importing SHA256 encrypted pfx certificates. https://github.com/PowerShell/CertificateDsc/issues/153


0

can't open the folder in Explorer because "you do not have permission". I suspect this is because normal processes do not have the administrator permission token because of UAC, unless you also 'run as administrator'. But I can't do that for Windows Explorer, can I? Yes, you CAN run Explorer with Elevated privileges to solve your issue! To do so, you ...


2

In Remote Desktop Connection, you need to ensure that Local Resources > Remote Audio > Settings > Remote Audio Playback is set to Play on this computer. On the server, you need to ensure that audio redirection is not disabled in group policy: Computer > Administrative Templates > Remote Desktop Services > Remote Desktop Session Host > Device and Resource ...


0

Found out the issue. AD_child_02 forwarder was pointing to old (non existence) domain controller. I updated forwarder to point to AD_Parent_01 and now it can resolve example.com


0

Most group policies (GPOs) are associated with a certain Registry key/value, so when you enable/disable one, the proper key/value for that setting in the Registry will be set. However, some of these keys/values do NOT revert back to their default value even if you set back the GPO to "Not configured". In that case, you have to find the matching key/value for ...


-2

if you don't know how to clear the Protection history just check out the video https://youtu.be/vWyoptIYlak


1

You can create a custom view in the Event Viewer: Right click on Custom Views -> Create Custom View. As you want to filter on a specific value in the event data, we have to create an advanced query, so click on the "XML" tab and use a query like this one: <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(...


0

"... looks like it will grant the Administrator account Full control and leave the other ACLs" - this is NOT true, and I learned it the hard way... The switch /d y is in fact answering Yes to this question: "All permissions will be replaced if you press Yes." Instead, you can use Subinacl – a free utility available from Microsoft. https://www.experts-...


0

According to Wikipedia, HKEY_CURRENT_CONFIG is an alias to the path HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current So try \registry\machine\System\CurrentControlSet\Hardware Profiles\Current\Software\E [1 7] and see if that works better. If it still doesn't work, you might like to try another technique; registry permissions can be ...


-1

I don't know the language your screen shot is in, but I assume that the dialog box is the one I get (in Windows 10): I am an Administrator on the box, but am not running Explorer as Admin. If I click Continue, then a UAC dialog pops up confirming that I want to allow changes. If I do then I get access to the folder.


0

Another alternative would be to configure the necessary firewall settings in advance using group policy. Even if the server isn't a domain member, you could still use local group policy. However, I'm not sure whether the settings would kick in immediately in this scenario. They might only take effect on the next group policy refresh. Of course, you could ...


0

Based on your description, the LCS tool needs to access the remote LAN as if it were on the same network segment (the inverter managers are discovered using broadcast packets). This requirement rules out a routed VPN and can be satisfied with bridging as you started to explore. You'll need to: configure openvpn so that it uses a tap interface (if you are ...


-1

Whenever I mess with firewalls remotely, I make sure that I set up a backdoor. I've been bitten by this a few times, so I always do this first. You can do this by installing hamachi (or your favorite vpn software) on the server and tightvnc (or your favorite remote admin software) on the server and the workstation you're doing all the work from. Hamachi's ...


0

You are likely not going to be able to do this with the GPMC. Microsoft has the Microsoft Advanced Group Policy Management (AGPM) available in the Desktop Optimization Pack (MDOP) which can do it. More information at https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/agpm/index


1

It might be a really dumb idea but, if you know what rule you need to create via netsh after you restart the service, why not script it? Write a script that will start the Windows Firewall service, then the next command would be the netsh that allows everything in (or at least RDP so you can remote in and make the adjustments afterwards)


0

Dell Command Update, Activity Log, Export, unzip, open ActivityLog.xml & look for Install Log Information under Data look for old version, may have to go to section --- Start of Vendor Software Log ---


0

Debug dumps (process dumps) are not the same as memory.dmp which is a full write out of the memory contents at a given time. If you have 8GB of memory with a swap file of similar size, the . memory.dmp will be a few gigs as stated.


1

I analyzed the file system during deletion process. Basically the Folder C:\Windows\Minidump was not touched at all. It deleted the file C:\Windows\MEMORY.DMP and freed up several Gigabyte.


0

Service accounts are not meant to login interactively meaning they don't get the same login items created like a normal user. By logging in directly you are creating the items (profile, group policy items, etc). What you are experiencing is expected, your implementation and expectations are the issue (or not, its just how it works). From a security ...


1

I came across this exact error and my issue was that I was changing the Administrator password in a script that was executed in the provisioner prior to running sysprep. Are you changing the Administrator password in ./scripts/ConfigurePackageImage.ps1? If so, I ripped out the code that changes the Administrator's account password and I'm now running it in ...


2

More or less, yes: you can add "Link to Web Address" as a snap-in and write the path to your share \\server\d$\Exports. It's intended for web pages, but it can browse a folder as well.


0

You just set up a routing OpenVPN. Thus: your LAN should have route to VPN network and that route is through server running OpenVPN your VPN client should have route to LAN and that route is via its VPN "gateway" your firewalls should permit all those packets To achieve first target, you need proper routing on each system in the LAN. If your VPN server is ...


0

I had to close the file that I had open. Then I tried zipping it again, and it worked.


0

It is working as intended, the documentation says: Possible members Global Group Accounts from the same domain Other Global groups from the same domain Domain Local Group Accounts from any domain or any trusted domain Global groups from any domain or any trusted domain Universal groups from any domain in the same forest Other Domain ...


1

Michael Hampton, was right. Usually IPv6 assigned address is stable therefore before adding a server to the domain you have to check if IPv6 configured and a box received IPv6; Right after join a box to domain, it will create a record in DNS Server with required permissions. In case if statefull mode is use DHCP server has delegated rights to create a ...


0

I know this is old but this is a quick copy/paste I used $a = @() Get-PhysicalDisk | where { $_.SlotNumber } | ForEach-Object { $d=$_| Get-PhysicalDiskStorageNodeView| where { $_.IsPhysicallyConnected } |select StorageNodeObjectId $f=$d.StorageNodeObjectId -match '.*SN:(.*)"' $a += [pscustomobject]@{Server = $Matches.1;SlotNumber=$_.SlotNumber;...


1

You can connect and login on the default FTP port (TCP 21) but can't establish the second TCP connection, the data connection, that is required for passive FTP data transfers (and a directory listing is a data transfer). The PORT response typically contains 6 octets that encode the server address the passive data connection needs to be made to. eg PORT h1,...


0

I experienced the same problem with both Windows Server 2008 R2 and 2012 R2. After trying all sorts of things, the fix was simple in the end in my case. I had originally set Windows Firewall to block all Public network traffic, thinking I was exercising due diligence security-wise, considering that the servers wouldn't have a reason to communicate over a ...


2

Outbound connections are not blocked by default, usually 0.0.0.0/0 Can you browse the ftp site from your EC2 instance? ftp://site.com They may have allowed a certain IP to connect on their side (your home), but not your VPC in AWS.


1

It's interesting that no one answers, as if no one here deploys bitlocker, nowadays. If it still matters, I advise to set a random PIN and record it, so that for self-service and recovery, you may use the PINs and not the recovery passwords. See my article on the topic which offers scripts: https://www.experts-exchange.com/articles/33771/We-have-bitlocker-so-...


-1

Be glad, I wrote an article for that exact scenario: A new aspect to securing USB data: SID protectors


0

A layered approach is the best policy to deal with security threats. Using file screen can be useful but by its self, it would no be very effective. Limit share access by configuring ACLs that prevents users from writing to files that they only need read-only access to. For a share where everyone needs access to create files, a good approach is to use the ...


0

I've also found this issue can be caused by using an FQDN when connecting to the SQL server in SSMS. So if you've tried everything above and its still not working try... Adding an entry for the SQL server to your hosts file (C:\Windows\System32\drivers\etc\hosts) with the IP address and just the server name, not FQDN. Then try connecting to the SQL server ...


3

Why wouldn't the 3rd DNS server show up in the properties of the nic like the other 2? I could add it manually from the advanced menu of the TCP/IP settings. But I don't think I should have to. Well... the client TCP/IP settings don't know that you have a third DNS server unless you tell them that you do. You do that by either statically assigning the ...


0

You can run a program as a service but in your case, I would consider running Wireshark as a scheduled task with the right arguments.


0

Create a bat file, update and paste below code FOR /d /r . %%d IN ("Your folder name to be deleted") DO @IF EXIST "%%d" rd /s /q "%%d" Copy this bat file to your parent folder (could be C: or D: too) Run it


0

Using Packer to make AMIs, I had the same problem - when I launched an AMI made by Packer, any drives added were offline. I fixed it by adding to an existing PowerShell script provider in Packer the following line: Set-StorageSetting -NewDiskPolicy OnlineAll As this is a security sensitive environment, it's possible that a security scan will find that and ...


0

When doing shadowing (from what I understand) the communication is done over RPC instead, or at least setup is, and then a "random" port is used for the actual session. In practice this means that the port specified is ignored. http://woshub.com/rdp-session-shadow-to-windows-10-user/ mentions HKLM\SYSTЕM\CurrеntControlSеt\Control\Tеrminal Sеrvеr “...


3

You need a clustered file system for that. Neither NTFS nor ReFS w/out default CSVSFS mini-filter won't "propagate" updates for both data and metadata applied on one node to the other, so even "one writer - many readers" scenario won't work... Few options you have here: 1) Stick with some clustered file system like VMFS, MelioFS or whatever. Later ones aren'...


0

Partly at least. You could create a cluster shared volume (CSV). This provides both servers with write access, although there is one master at all times. Or you just make the volume available through SMB3. This would be the simplest approach. If one server must have read-only access, then SMB and restrictive permissions would be the preferred method.


0

For Windows 7 try this: net SHARE share=d:\share /GRANT:EVERYONE`,FULL /REMARK:" Above also works from PowerShell. Note ` before ,FULL


0

You can look into Just Enough Administration, it allows normal users to perform specific administrative tasks. It needs some time to learn and set up, but it should solve your problem.


Top 50 recent answers are included