Fixing Nessus Finding Remote Desktop Protocol Network Level Authentication through GPO

How to fix the Nessus Finding Remote Desktop Protocol Network Level Authentication through GPO.

Click Start -> Control Panel -> Administrative Tools -> Group Policy Management

Step 1:

Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security ->

Require User Authentication for Remote Connections by Using Network Level Authentication -> Enabled

Set Client Connection Encryption Level - > Enabled
Encryption Level: High Level

Fixing Nessus POODLE Finding through GPO

How to fix the  Nessus POODLE Finding through GPO.

Click Start -> Control Panel -> Administrative Tools -> Group Policy Management

Step 1:

Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer - > Internet Control Panel -> Advanced Page -> Turn off Encryption support -> Enabled

Should be set to:  User TLS 1.0, TLS 1.1, and TLS 1.2

Step 2:

Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.

Reg Item 1:

Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0

Reg Item 2:

Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0

Fixing Microsoft Security Bulletin MS15-124 Finding in Nessus

How to fix the Microsoft Security Bulletin MS15-124 Finding in Nessus.

Click Start -> Control Panel -> Administrative Tools -> Group Policy Management

Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.

Reg Item 1:

Action: Update
Hive: HKLM
Key Path: SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1

Reg Item 2:

Action: Update
Hive: HKLM
Key Path: SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1

How to fix "Can't verify who created this file error." when using redirecting folders

I've looked in to how to apply this with Group Policy but for some reason it just ignores the setting.  It seems to have to be done using a registry key.  Here is how I did it.  If there is a better way, please comment in the section below.

First open internet explorer and go in to the internet settings -> security -> local intranet -> sites.  From there enter the server name that you are trying to access that the data is stored on.  Click Ok until your back to the internet explorer window.

Now Open Group Policy Management, create or open a GPO and navigate to User Configuration -> Preferences -> Windows Settings -> Registry

Right click in the space to the right.  Select New Registry Item.  It should be set to update and HKEY_CURRENT_USER.

Now select the ... and your going to navigate to the spot to select what you just entered in to Internet Settings.

It should be like: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\xxxxxx

xxxx will be what ever you entered. Check the value in the bottom window and your window should now say:

Value Name = 1
Value Type = REG_SZ
Value data = (hostname or value you entered)

Save and close.  On host, open a command prompt and do gpupdate /force, log out login and it should be fixed.

Where do I set the default home page in group policy?

Since I can never remember where this is located, I thought I would post it.

User Configuration > Policies > Windows Settings > Internet Explorer Maintenance > URLs > Important URL


Source: Link

How Do I Copy an Existing Group Policy

Open Group Policy Management

Navigate the tree until you notice the container called "Group Policy Objects"

Right click the GPO and click Copy

Now right click "Group Policy Objects" and click Paste.

Click "Preserve the existing permissions" and click Ok

Source:  Link

Microsoft SQL Server 2008 R2 Fails when installed

I am trying to install MS SQL Server 2k8 R2 and keeps throwing an access denied error.  It gets hung up on sqlenginedbstartconfigaction_install_configrc_Cpu64.

OS: Windows Server 2008 R2 SP1
User: Domain Admin

It looks like the DISA STIG that was applied was causing the issue.  The local administrator account seems to be needed.  I turned off all GPO settings for the computer and it installed.

Here is what I used to help me troubleshoot the issue.  Link

Windows Server Update Service (WSUS) error 0x80072ee6, won't contact server

Are you getting some error like this?

WU client succeeds CClientCallRecorder::BeginFindUpdates from AutomaticUpdates with call...  WU client executing call ... of type Search Call
DownloadFileInternal failed for fs03/SelfUpdate/wuident.cab: error 0x80072ee6
IsUpdateRequired failed with error 0x80072ee6

The reason you are getting that is in the GPO under

Computer Configuration -> Policies -> Admin Templates -> Windows Components -> Windows Update:

"Specify intranet Microsoft update service location"


You probably entered the hostname as wsus.test.com when it should be http://wsus.test.com

Source:  Link