How to fix the Nessus Finding Remote Desktop Protocol Network Level Authentication through GPO.
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Step 1:
Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security ->
Require User Authentication for Remote Connections by Using Network Level Authentication -> Enabled
Set Client Connection Encryption Level - > Enabled
Encryption Level: High Level
Showing posts with label Windows Server. Show all posts
Showing posts with label Windows Server. Show all posts
Monday, September 26, 2016
Fixing Nessus POODLE Finding through GPO
How to fix the Nessus POODLE Finding through GPO.
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Step 1:
Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer - > Internet Control Panel -> Advanced Page -> Turn off Encryption support -> Enabled
Should be set to: User TLS 1.0, TLS 1.1, and TLS 1.2
Step 2:
Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.
Reg Item 1:
Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0
Reg Item 2:
Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Step 1:
Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer - > Internet Control Panel -> Advanced Page -> Turn off Encryption support -> Enabled
Should be set to: User TLS 1.0, TLS 1.1, and TLS 1.2
Step 2:
Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.
Reg Item 1:
Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0
Reg Item 2:
Action: Update
Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Value Name: Enabled
Value Type: REG_DWORD
Value Data: 0
Fixing Microsoft Security Bulletin MS15-124 Finding in Nessus
How to fix the Microsoft Security Bulletin MS15-124 Finding in Nessus.
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.
Reg Item 1:
Action: Update
Hive: HKLM
Key Path: SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1
Reg Item 2:
Action: Update
Hive: HKLM
Key Path: SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Click Computer Configuration -> Preferences -> Windows Settings -> Registry -> Right Click, New Registry Item.
Reg Item 1:
Action: Update
Hive: HKLM
Key Path: SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1
Reg Item 2:
Action: Update
Hive: HKLM
Key Path: SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING
Value Name: iexplore.exe
Value Type: REG_DWORD
Value Data: 1
Nessus Finding: Hardened UNC Path through a GPO
How to fix the Nessus Hardened UNC Path finding.
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Provider -> Hardened UNC Paths -> Set to Enable
Scroll down and click show. Enter the following:
Click Start -> Control Panel -> Administrative Tools -> Group Policy Management
Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Provider -> Hardened UNC Paths -> Set to Enable
Scroll down and click show. Enter the following:
Wednesday, June 12, 2013
How do I get my Dell Service Tag Remotely?
Log on to the server
Open a command prompt
Type wmic -> then hit enter
Type csproduct -> then hit enter
And now your number is right there.
Open a command prompt
Type wmic -> then hit enter
Type csproduct -> then hit enter
And now your number is right there.
Tuesday, February 15, 2011
Finding your base DN in Active Directory
I was trying to do an LDAP query against Active Directory and I was unable to get the query to work. A good tool to use to troubleshoot this is ldp.exe. It is installed by default on Windows Server 2008, but I believe its on the Windows Server 2003 disc, just not installed by default. A typical base DN is DC=microsoft, DC=com. I was using exactly the same logic and it still wasn't working. I then found a tool called dsquery.
I was able to use dsquery on my 2008 server. I haven't had a chance to see if runs on Server 2003. This is how it can be used to help you.
Open a command prompt (Start->Run->cmd).
If you type "dsquery" (Link) you will get what is below: (I modified it a little bit and added Links)
Description: This tool's commands suite allow you to query the directory
according to specified criteria. Each of the following dsquery commands finds
objects of a specific object type, with the exception of dsquery *, which can
query for any type of object:
For help on a specific command, type "dsquery <ObjectType> /?" where
<ObjectType> is one of the supported object types shown above.
For example, dsquery ou /?.
Remarks:
The dsquery commands help you find objects in the directory that match
a specified search criterion: the input to dsquery is a search criterion
and the output is a list of objects matching the search. To get the
properties of a specific object, use the dsget commands (dsget /?).
The results from a dsquery command can be piped as input to one of the other
directory service command-line tools, such as dsmod, dsget, dsrm or dsmove.
Commas that are not used as separators in distinguished names must be
escaped with the backslash ("\") character
(for example, "CN=Company\, Inc.,CN=Users,DC=microsoft,DC=com").
Backslashes used in distinguished names must be escaped with a backslash
(for example,
"CN=Sales\\ Latin America,OU=Distribution Lists,DC=microsoft,DC=com").
Examples:
To find all computers that have been inactive for the last four weeks and
remove them from the directory:
dsquery computer -inactive 4 | dsrm
To find all users in the organizational unit
"ou=Marketing,dc=microsoft,dc=com" and add them to the Marketing Staff group:
dsquery user ou=Marketing,dc=microsoft,dc=com | dsmod group
"cn=Marketing Staff,ou=Marketing,dc=microsoft,dc=com" -addmbr
To find all users with names starting with "John" and display his office
number:
dsquery user -name John* | dsget user -office
To display an arbitrary set of attributes of any given object in the
directory use the dsquery * command. For example, to display the
sAMAccountName, userPrincipalName and department attributes of the object
whose DN is ou=Test,dc=microsoft,dc=com:
dsquery * ou=Test,dc=microsoft,dc=com -scope base
-attr sAMAccountName userPrincipalName department
To read all attributes of the object whose DN is ou=Test,dc=microsoft,dc=com:
dsquery * ou=Test,dc=microsoft,dc=com -scope base -attr *
Directory Service command-line tools help:
dsadd /? - help for adding objects.
dsget /? - help for displaying objects.
dsmod /? - help for modifying objects.
dsmove /? - help for moving objects.
dsquery /? - help for finding objects matching search criteria.
dsrm /? - help for deleting objects.
------
Hopefully this helped you like it helped me!
UPDATED: Need to add the full config because we missed 2 things, but here is a page I wanted to link to because it talks about how to deny users by using LDAP.
Link
I was able to use dsquery on my 2008 server. I haven't had a chance to see if runs on Server 2003. This is how it can be used to help you.
Open a command prompt (Start->Run->cmd).
If you type "dsquery" (Link) you will get what is below: (I modified it a little bit and added Links)
Description: This tool's commands suite allow you to query the directory
according to specified criteria. Each of the following dsquery commands finds
objects of a specific object type, with the exception of dsquery *, which can
query for any type of object:
- Type "dsquery computer" -
- finds computers in the directory.
- More Info: Link
- Type "dsquery contact" -
- finds contacts in the directory.
- More Info: Link
- Type "dsquery subnet" -
- finds subnets in the directory.
- More Info: Link
- Type "dsquery group" -
- finds groups in the directory.
- More Info: Link
- Type "dsquery ou" -
- finds organizational units in the directory.
- More Info: Link
- Type "dsquery site" -
- finds sites in the directory.
- More Info: Link
- Type "dsquery server" -
- finds AD DCs/LDS instances in the directory.
- More Info: Link
- Type "dsquery user" -
- finds users in the directory.
- More Info: Link
- Type "dsquery quota" -
- finds quota specifications in the directory.
- More Info: Link
- Type "dsquery partition" -
- finds partitions in the directory.
- More Info: Link
- Type "dsquery *" -
- finds any object in the directory by using a generic LDAP query.
- More Info: Link
For help on a specific command, type "dsquery <ObjectType> /?" where
<ObjectType> is one of the supported object types shown above.
For example, dsquery ou /?.
Remarks:
The dsquery commands help you find objects in the directory that match
a specified search criterion: the input to dsquery is a search criterion
and the output is a list of objects matching the search. To get the
properties of a specific object, use the dsget commands (dsget /?).
The results from a dsquery command can be piped as input to one of the other
directory service command-line tools, such as dsmod, dsget, dsrm or dsmove.
Commas that are not used as separators in distinguished names must be
escaped with the backslash ("\") character
(for example, "CN=Company\, Inc.,CN=Users,DC=microsoft,DC=com").
Backslashes used in distinguished names must be escaped with a backslash
(for example,
"CN=Sales\\ Latin America,OU=Distribution Lists,DC=microsoft,DC=com").
Examples:
To find all computers that have been inactive for the last four weeks and
remove them from the directory:
dsquery computer -inactive 4 | dsrm
To find all users in the organizational unit
"ou=Marketing,dc=microsoft,dc=com" and add them to the Marketing Staff group:
dsquery user ou=Marketing,dc=microsoft,dc=com | dsmod group
"cn=Marketing Staff,ou=Marketing,dc=microsoft,dc=com" -addmbr
To find all users with names starting with "John" and display his office
number:
dsquery user -name John* | dsget user -office
To display an arbitrary set of attributes of any given object in the
directory use the dsquery * command. For example, to display the
sAMAccountName, userPrincipalName and department attributes of the object
whose DN is ou=Test,dc=microsoft,dc=com:
dsquery * ou=Test,dc=microsoft,dc=com -scope base
-attr sAMAccountName userPrincipalName department
To read all attributes of the object whose DN is ou=Test,dc=microsoft,dc=com:
dsquery * ou=Test,dc=microsoft,dc=com -scope base -attr *
Directory Service command-line tools help:
dsadd /? - help for adding objects.
dsget /? - help for displaying objects.
dsmod /? - help for modifying objects.
dsmove /? - help for moving objects.
dsquery /? - help for finding objects matching search criteria.
dsrm /? - help for deleting objects.
------
Hopefully this helped you like it helped me!
UPDATED: Need to add the full config because we missed 2 things, but here is a page I wanted to link to because it talks about how to deny users by using LDAP.
Link
Subscribe to:
Posts (Atom)