Hi all,

Im trying to implement a more secure means of using RDP. Having read up about I feel the TLS enabled option  would be sufficient. Having configured the host session properties on teh server to use SSL 1.0, encryption level high and ticked the box for allow connections from computers running NLA with auto generated Certificate. Haivng logged out and back in again I notice its still communicating over port 3389. Is this correct? Can I test whether this is encrypted?

I have two particular vulnerabilities that were found by our Qualys scan.

Vulnerability 1:  SSL/TLS Server supports TLSv1.0

Solution disable TLS 1.0

What I did. Set the registry entries below.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:00000000

The vulnerability is still showing up.

Vulnerability 2:  Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)

Solution: Disable DES and 3DES.

What I did.

Set the following Reg entries:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 168/168]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
"Enabled"=dword:00000000


For some reason the vulnerabilities are still showing up on the server.  I have followed what I have read on microsoft. I am beginning to think that it is a false positive.

I need to mount a ISO in 2008 server. Anybody have a free good tool to use?

This is really just an annoyance, but I have some KILLED/ROLLBACK spids from failed attempts to select data from Excel (working fine now), and I'd like to get rid of them without restarting the SQL service because it's on a production machine. I've read that restarting DTC might work, but will SQL patiently wait for the service to come back up or will users receive errors if they run a query requiring DTC? The machine is not clustered but does have linked servers. The box is Windows Server 2008 R2 and SQL 2008 R2. Google was an infinite rabbit hole. Thanks!

Is it possible for me to map a drive for someone to some files on my server without giving them permission on the server or how would I set this up on the server side to ensure minimal access.

I have a 2008 R2 server that had a GPO applied/enforced to all systems. This caused a lot of permissions problems and wont let a few applications launch.

How can I sort of "undo" this?

If i want to apply a "default" or blank GPO to the users, how can I do this? Effectively leaving them without any restrictions

I have a domain with two 2008 R2 servers, one being the licensing host and one being the license server.  We want to add a 2012 server as well.  Will the 2008 RDS licenses cover the 2012 server or do we need to add 2012 RDS licenses?  If we do, which I expect to be the correct answer, can the current 2008 license server handle those at the same time as the current 2008 licensing requirements which won't change.

Picked up a job half way through and discovering lots of problems...
A customer has an old SBS2008 but is adding a  Server 2012R2 Essentials to replace the SBS.  Exchange has already been decommissioned in favour of Office 365.

The new server has been added as a DC and the migration started - FSMOs were moved over successfully.  I've been called in to help them make the final swap but I couldn't edit any Group Policy - then noticed that the new DC didn't have a SYSVOL or NETLOGON share.

Looked at the old server and there's lots of JRNL_WRAP_ERROR errors which have lead to this I think.  FRS error 13568 - these have been going on for a long, long time unnoticed.

As this server is going to be decommissioned shortly, are there any shortcuts to get round this.  Don't want to force it off the domain until I can edit Group Policy on the new server.  Also really, really don't want to have to demote the new server as they've installed a serious bit of software on it which we can't easily reinstall without great cost.

Any advice welcomed. Thanks, Ian

Hi all,

We use our internal CA using a SHA1 to create certificates for internal web services. We are now tasked with upgrading this to SHA2. My colleague has suggested we renew all SHA1 certificates so that nothing is set to expire within the next 12 months. We will then look to upgrade the rootCA but im concerned that once we do that all the web certificates will need to be upgraded?

Can someone clarify what happens when the ROOTCA is upgraded to SHA2?

It will be difficult to know whether all web services are SHA2 compatible, is there a way to create a separate SHA2 ROOT CA?

Greetings,

We have a Windows Server 2008 R2 AD DC, I'm applying the Windows 10_Server 2016 templates to make some changes for Windows 10.  I've downloaded the msi, installed on my local computer and copied the PolicyDefinitions over to the Central Store on the domain controller.  I'm looking for a specific item regarding windows 10, that I'm not seeing in the Domain Group policy I'm modifying.
The setting I'm looking for is the Interactive logon: Machine account lockout threshold.  
I assumed it should be under this path:  Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
I can find this setting on my machine in the Local Policies,, but I don't see it in the domain policies.  

Am I missing a step when copying over these templates?

Thank you,

I tried adding some security GPs to a domain controller. Now that GP will not replicate or allow any GP updates to be performed on itself.
I tried dcpromo to demote it and got the above error.

The rest of the message was
Active Directory Domain Services could not transfer the remaining data in a directory partition: CN=Schema,CN=Configuration...
to AD DC dc6....

Someone suggested stopping the KDC service. Did not help.