@dbeato said in Patch all your Windows DNS servers - CVE-2020-1350 - CVSS score of 10: @pmoncho said in Patch all your Windows DNS servers - CVE-2020-1350 - CVSS score of 10: Just wondering - Is anyone seeing a patch for 2019 with a reference to the KB article? Checked yesterday, last night and this morning. No update that I can see. Currently performing the workaround. https://www.catalog.update.microsoft.com/Search.aspx?q=KB4558998 Thanks. Forgot about the update catalog.

There you go http://nitindupare.blogspot.com/2012/08/uninstall-kms-host.html

@Grey said in Issues uninstalling Windows Server 2012 R2 Key: You mean sfc /scannow? Or DISM.exe /Online /Cleanup-image /Restorehealth? @op Check your event logs for more information, and try running the commands above. Ran both, so far nothing, but I will run chkdsk tonight to see if that fixes anything. So far I can't find anything in the logs but I'll keep looking.

@dbeato said in Access Changed Files on VSS Copy on Write Disk Image: @scottalanmiller said in Access Changed Files on VSS Copy on Write Disk Image: @black3dynamite said in Access Changed Files on VSS Copy on Write Disk Image: Mount the disk image on Windows Server instance, from the mounted disk drive, go to Properties and then Previous Versions? That's what I thought. But it just seemed too easy, lol. Lol, anything that appears with Microsoft as easy should work but emphasis on "should" Emphasis with "assume" too. lol

@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?: @wrx7m said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?: @black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?: @wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups. Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else. I am guessing creating another OU as a sub container and move the RD servers into. Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way. If you can make those changes directly in the registry, maybe can allow you to use GPP and item level targeting. Hmmm. That makes sense. Let me mull it over.

@Pete-S said in Windows Server licensing for HA?: If you have two servers and run HA, does that mean that you have to license Windows Server standard for the maximum number of VMs running when you have a failure? So for example, Server A: 16 cores, runs 6 VMs normally Server B: 16 cores, runs 6 VMs normally So each server has to be licensed for all 12 VMs running on 16 cores - so 6 x Windows Server Standard licenses for each server, total of 12 licenses? But if you didn't run HA, you would only license each server for 6 VMs, with 3 x Windows Server Standard, a total of 6 licenses? Is this correct? Yup. If you're running a HA setup of Server Standard, all physical servers must be licensed for all Windows Server VMs that can run on them. This means each physical server in your HA cluster must be licensed for 12 Windows Server VMs. So yes, you are correct in that to license 12 Windows Server VMs on both of your physical servers, you'll need 6x Windows Server Standard licenses for each server, 12 "licenses" total as you said.

WSL2 tells us a lot. First, Microsoft is really making it more known that WSL has no Linux and is just Ubuntu (or whatever) on the Windows kernel. Second, Microsoft is making it clearer that there was no virtualization going on in WSL. Third, now there is Hyper-V and a Linux kernel involved. So now it is just virtualizating a Linux instance on top of Windows. Fourth, now it is much faster. That means that Linux on Hyper-V is faster than Windows on bare metal!

Within PowerShell can't use something like Push-Location \\Server\Share\path or Set-Location \\Server\Share\path and then run the cipher command?

@dbeato said in Windows Server 2012 Remote Web Access not connecting and RDS services showing error 23005: @scottalanmiller Yeah, RDW is the problem I understand now. Basically you can remote desktop without need of App Resources Proxy without any problems. But if you try to load the App Resources from a Windows 10 device then yes I understand now. Yeah. It's a weird "Essentials only" issue, only on 2012 and older. From what I can tell.

@Dashrender said in Domain Planning: Network shares or ,..: @dafyre said in Domain Planning: Network shares or ,..: @notverypunny said in Domain Planning: Network shares or ,..: Does NC allow exposure of their "file shares" as smb? If you have users that can't / don't want to use a browser-based access they can always mount it in windows explorer via webdav. Alfresco allows (allowed?) access via both, but the last time I played with it the performance was meh, which I attributed to it being built on java... You can mount NextCloud into a drive letter or folder using WebDav. The question does become the aforementioned performance issue (if there is one). I wonder how file locks are handled when using WebDav? There are a few topics elsewhere here where file locking and cloud hosting were discussed. You do have to give up what we have all come to appreciate in file locking. Here is a response in one of those other topics I spoke about: @scottalanmiller said in file sharing in the 21st century: @Donahue said in file sharing in the 21st century: I am aware of that. It's online locking that I am after. Though, I will concede that any locking scheme has to plan for both online and offline. I like sync because of local performance and offline availability, but it really feels like it is best for non shared files. When you add multiple users into the mix, almost everything goes out the window, especially when and if they go offline. Everything is best for non-shared files SMB shines at "always online, always nearly local" files because it handles offline so poorly. It's a balance. To handle offline or very distant (e.g. high latency) networks well, you have to sacrifice locking.

@marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?: @flaxking said in Any Way to Automate Adding a New Computer to an AD Group?: @marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?: Ansible can do that. https://docs.ansible.com/ansible/latest/modules/win_domain_group_membership_module.html#win-domain-group-membership-module You can add new PCs to domain, and change their group membership, you just need to know computer names in advance. Which is just a layer on top of Powershell. The Active Directory Powershell module is still required. It's not required, or that module is included already in Windows 10 by default. Because I haven't had to install it on any machine I managed with Ansible. "win_domain_group_membership requires the ActiveDirectory PS module to be installed" https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_domain_group_membership.ps1 They have it in the documentation as well "This must be run on a host that has the ActiveDirectory powershell module installed." https://docs.ansible.com/ansible/latest/modules/win_domain_group_module.html

@Obsolesce said in Deploy Azure resources with Terraform: @IRJ said in Deploy Azure resources with Terraform: @Obsolesce said in Deploy Azure resources with Terraform: @IRJ said in Deploy Azure resources with Terraform: @Obsolesce @IRJ said in Deploy Azure resources with Terraform: @Obsolesce Yeah good stuff. I have a couple Udemy courses on it. Something I didn't see in this article was that Cloud Shell has Terraform built in... so you really don't even need to install it. I try to keep things serverless and source controlled, so I wouldn't want to install Terraform. As long as it uses the latest version of terraform. There are many differences between current and last release. Cool. Yeah 11 vs 12 are much different. Alot of things have to be redone

@jt1001001 Thanks. If you are running from PDQ deploy, you won't see anything. But, if you are doing it from PS/ISE or similar, that would be a great help.

@pmoncho said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?: @Dashrender said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?: Cool, then you should have it easy. FYI - Published apps still create a full profile on the RDS box, Just the desktop isn't presented to the user. If the application allows them to browse around, they could typically see the drive letters, the mapped printers, etc... that's why you still need to lock all that stuff down. Thanks for the info. I will keep that in mind. I was debating about using UPD's like @wrx7m and that was my interest in this post. Also, still planning out where to put Connection Broker, WebAccess and Licensing but that is another post. For local profile management, UPDs are a lot cleaner. If we are not putting them on a file server across the network then a second partition/VHDX is set up for that task to keep them separate. With the inclusion of FSLogix with RDS CALs/SALs now it's a no-brainer, IMNSHO, to set the project up on the FSLogix version. Storage management is another reason why UPDs on a network or separate partition make sense. Keeping a local profile on the C:\ of the session host is messy and can cause issues down the road with users coming and going. As far as the Broker/Gateway/Web put those roles on one VM but separate from the Session Host.

MS licensing on Sharepoint is as easy as licensing gets. It can't be more straightforward. https://products.office.com/en-us/sharepoint/sharepoint-licensing-overview "For On-Premises, intranet sites are licensed using a Server/CAL (Client Access License) model. SharePoint Server 2019 is required for each running instance of the software, and CALs are required for each person or device accessing a SharePoint Server." It's that simple. CALs are requires for each person or device accessing SP. That's it. Nothing more or less. It's not just easy, but exactly what you'd logically expect the licensing to do if they were being rational.

@IRJ said in Windows Server 2012 R2 - Share Auditing for Changes: I know you use wazuh.. Check this out https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html Thanks! Checking out setting this up. Hopefully, it will reveal the culprit.

@black3dynamite said in Salt - Can't Connect to Minions After Adding Them to Master: I sometimes have to add --timeout 60 so I can see a response salt FP01.domain.local test.ping --timeout 60 Seems to be working. I think that it was the firewall needing the exception AND using the --timeout 60 Thanks!

@ilyas said in Reset 120 Day Grace Period for Windows RDS Server with PowerShell: @scottalanmiller Hi, Thanks for wonderful script that save my time. Could You please guide me how we can run this script on multiple servers? I tried foreach PowerShell method but it does not work. From the ISE, load the script and then enter-pssession for each system. Once connected, run the script from the ise. Sorted.

@black3dynamite said in Windows Server 2019 Need to Download and Run without AV Deleting Files: https://www.thomasmaurer.ch/2016/07/how-to-disable-and-configure-windows-defender-on-windows-server-2016-using-powershell/ For now, just temporary disable Real-Time Protection via PowerShell Set-MpPreference -DisableRealtimeMonitoring $true Download the executable and scan it manually before you install Start-MpScan -ScanPath C:\datastore\file.exe -ScanType QuickScan Enable Real-Time Protection after the install Set-MpPreference -DisableRealtimeMonitoring $false Excellent, now THAT did it.

@scottalanmiller said in Windows Server 2019 Basic Installation: @dbeato said in Windows Server 2019 Basic Installation: @Obsolesce said in Windows Server 2019 Basic Installation: @scottalanmiller said in Windows Server 2019 Basic Installation: @Obsolesce said in Windows Server 2019 Basic Installation: @scottalanmiller said in Windows Server 2019 Basic Installation: @JaredBusch said in Windows Server 2019 Basic Installation: The current install method brings Windows Server on parity with the Linux ecosystem really. You install, choose some options and end up at a prompt after reboot. Then you remotely add the features and shit you want. Yeah, very in like with Fedora, Ubuntu, or Deepin. Deepin might still be my favourite installer for normal stuff of the four. Did you have a Deepin install screenshot chain on here? No, but I do it so often, it would be easy to get. That'd be nice to see on here. Last post on it was below https://mangolassi.it/topic/14453/deepin-linux-15-4-1-install The install still looks like that. LOL that's not an installer. That's a push button, get peanuts. Nice though.

@pmoncho said in The Hidden Cost of Licensing Windows Server - Activation: @scottalanmiller said in The Hidden Cost of Licensing Windows Server - Activation: Just looking at this with a customer that just put in a new Windows 2019 server. The machine was purchased with a volume license agreement for Server 2019 Standard. Everything should be super easy, in theory. Problem is, license key from the volume license center doesn't work. We spend a bit of time trying to get this to apply, but no luck. I have run into a similar situation this morning and not being able activate the VLSC liscense. Before I decided to call MS and getting frustrated, I was able to activate from an elevated command line. cscript c:\windows\system32\slmgr.vbs /ipk <product key> Throwing this out here in case someone comes along this post at a later time. I've heard that that often works. We had tried that in our case and it had failed.

@Reid-Cooper said in General Guidance on Windows Admin Center WAC: @Obsolesce said in General Guidance on Windows Admin Center WAC: Yes you do need to either add other devices manually or by importing a list... but it's a one-time thing so it's a non-issue IMHO. Not bad for tiny environments. But at any scale, how does that handle machines being added in the future? You have to manually add every new machine after every change to WAC? I've only had about 100 servers and a handful of Win10 in it, so I'm not familiar with handling that at scale. It really only requires a txt file of a list of devices which is simple to maintain in any aspect. I only had to import that to get everything back in. If I added a new server, I would add it to the text file then add that server.