Macetes TI

Kaspersky Security Center WSUS Files Storage Location

Kaspersky seems to be storing windows update files on the C Drive:

Here -> C:\ProgramData\KasperskyLab\adminkit\1093\.working

Change folder location with klsrvswch.exe utility.

You can reach it from the KSC installation folder. Utility named as "Administration Server Account Switch Utility". It seems like just allows you to switch service account, but also allows to change "wsus" folder path. Continue wizard as if you want to switch service account. You don't need to provide a new service account, you can use current. Last step is the place of path change.

Limit SSH access by user and network

Add user filtering with AllowUsers option in sshd_config file:

AllowUsers johndoe@192.168.1.* admin2@192.168.1.* otherid1 otherid2

This allows johndoe and admin2 only from 192.168.1.* addresses and otherid1, otherid2 from anywhere.

Send Mail with Office365 Auth

Step-1

    mkdir ~/.certs

Step-2

    certutil -N -d ~/.certs
    Enter a password which will be used to encrypt your keys.
    The password should be at least 8 characters long,
    and should contain at least one non-alphabetic character.

    Enter new password:
    Re-enter password:

Step-3

    echo -n | openssl s_client -starttls smtp -crlf -connect smtp.office365.com:587| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/.certs/365.crt
    certutil -A -n "Google Internet Authority" -t "C,," -d ~/.certs -i ~/.certs/365.crt

Step-4

    vim mail-office365.sh
    echo -e "Email content" | mailx -v -s "Email subject" \
     -S smtp-auth=login \
     -S smtp-use-starttls \
     -S nss-config-dir=~/.certs \
     -S smtp=smtp.office365.com:587 \
     -S from="user@office365.com" \
     -S smtp-auth-user=user@office365.com \
     -S smtp-auth-password="passwordxxxx" \
     -S ssl-verify=ignore \
    user@gmail.com

Rename windows computer command

Command Prompt:

netdom renamecomputer Thecomputernamehere /newname:newnamehere /force /userd:domain\username /passwordd:***** /reboot

Powershell:

Example 1: Rename the local computer

This command renames the local computer to Server044 and then restarts it to make the change effective.
PowerShell

Rename-Computer -NewName "Server044" -DomainCredential Domain01\Admin01 -Restart

Example 2: Rename a remote computer

This command renames the Srv01 computer to Server001. The computer is not restarted.

The DomainCredential parameter specifies the credentials of a user who has permission to rename computers in the domain.

The Force parameter suppresses the confirmation prompt.
PowerShell

Rename-Computer -ComputerName "Srv01" -NewName "Server001" -DomainCredential Domain01\Admin01 -Force

Fix Remote Desktop Connection "Internal Error has Occurred"

Step 1

Remove the expired RDP cert
Open Certificates (Local Computer)
Expand Remote Desktop --> Certificates
Delete the expired certificate
If there is no cert listed, that is fine.

Step 2

Fix the owner on the corrupt file.
Browse to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Locate the file starting with f686aace
Right click and select properties --> Security --> Advanced
Change the owner to "Administrators" or "SYSTEM"
Click OK
Backup the file (optional)
Rename or delete the file starting with f686aace

Open services
Restart "Remote Desktop Service"

source:
https://levitrares.com/host-https-social.technet.microsoft.com/Forums/ie/en-US/a9c734c1-4e68-4f45-be46-8cae44c95257/unable-to-remote-desktop-to-windows-server-2012-due-to-failed-to-create-self-signed-certificate?forum=winserverTS

Create DHCP scope with powershell

Create scope:

Add-DhcpServerv4Scope -Name "dhcp.contoso.com" -StartRange 10.110.0.10 -EndRange 10.110.0.250 -SubnetMask 255.255.255.0 -LeaseDuration 8.00:00:00

Set scope options:
Set-DhcpServerv4OptionValue -ComputerName "dhcp.contoso.com" -ScopeId 10.110.0.10 -DnsServer 10.110.0.2,10.110.0.3 -WinsServer 10.110.0.2 -DnsDomain "contoso.com" -Router 10.110.0.1

Check the hard drive integrity - firewall checkpoint 5800

To check the integrity of a hard drive in the Gaia/SecurePlatform OS:

    Connect to the machine over console (serial).

    Reboot the machine.

    Press a key on the "Press any key to see the boot menu" screen. The Check Point Boot Menu now opens.

    Select the "Start in maintenance mode".

    Enter the Expert mode credentials.

    Unmount the file system:

    # umount -a

    For the EXT3 file system, run the applicable 'fsck' commands (skip this step if you have a XFS file system):

        Check and update the bad block list, but do NOT repair:

        # fsck -f -n -c -v

        Repair automatically:

        # fsck -f -p -c -v

        Note: If you detect inconsistencies, 'fsck' may require the user to remove the '-p' flag from the syntax. In such a case, use the 'fsck -f -y' command instead to assume 'yes' to all questions.

        # fsck -f -c -v -y
        # sync
       # reboot