Microsoft Windows – Technology News and Information by SeniorDBA

5 Tips to Secure Digital Devices in High-Risk Situations

Traveling to a high-risk area can expose your electronic devices to hacking or data theft risks. Here are five recommended steps to secure your devices and protect your sensitive information.

Back up your data before you travel – Make sure you have a copy of your important files and documents in a secure cloud service or an external hard drive. Don’t bring the backup to the risky area, which will help preserve a copy of critical data if your data so you can restore your data if your device is lost, stolen, or compromised.
Encrypt your devices and use strong passwords – Encryption is a process that scrambles your data and makes it unreadable without a key or a password. You can encrypt your entire device or specific folders and files. Use a strong password that is hard to guess and different for each device and account. You can also use a password manager to store and generate passwords securely.
Disable or remove unnecessary features and apps – Some features and apps on your devices can make you more vulnerable to hacking or data theft. For example, Bluetooth, Wi-Fi, GPS, and NFC can be used to track your location or access your data without your permission. Disable or remove these features and apps when you are not using them or when you are in a public place.
Use a VPN and avoid public Wi-Fi networks – A VPN (virtual private network) is a service that creates a secure connection between your device and the internet. It encrypts your data and hides your IP address, making it harder for hackers or third parties to intercept or monitor your online activity. Avoid using public Wi-Fi networks, such as those in hotels, airports, or cafes, as they are often unsecured and can expose your data to hackers or malicious software.
Be vigilant and cautious – The most important step to secure your devices is to be aware of the potential risks and take precautions to avoid them. Do not leave your devices unattended or lend them to strangers. Do not open suspicious emails or attachments or click on unknown links. Do not download or install software from untrusted sources. Do not enter sensitive information on websites that are not secure (look for the padlock icon and https in the address bar). If you notice any signs of hacking or data theft, such as unusual activity, pop-ups, or messages, disconnect from the internet and scan your device for malware.

How to Create a Secure Windows 10 Workstation for Beginners

If you are new to Windows 10 and want to create a secure workstation for your personal or professional use, this blog post is for you. In this post, I will show you how to set up a Windows 10 workstation with some basic security features that will help you protect your data and privacy. Here are the steps you need to follow:

Continue reading “How to Create a Secure Windows 10 Workstation for Beginners”

How to Detect a New Domain Controller in Your Network

Some malware can create a Domain Controller to infect your network and steal data. DCShadow is a late-stage kill chain attack that allows an attacker with compromised privileged credentials to register a rogue Active Directory (AD) domain controller (DC). Then the adversary can push any changes they like via replication — including changes that grant them elevated rights and create persistence. It can be extremely difficult to detect a new Domain Controller, so you need to know how to find one if you suspect an infection.

Overview

A domain controller is a server that manages the security and authentication of users and computers in a domain. A domain is a logical grouping of network resources that share a common name and directory database. A new domain controller can be added to a domain for various reasons, such as increasing redundancy, improving performance, or expanding the network.

However, a new domain controller can also pose a security risk if it is not authorized or configured properly. An unauthorized domain controller can compromise the security of the entire domain by granting access to unauthorized users or computers, or by intercepting and modifying network traffic. Therefore, it is important to detect and monitor any new domain controllers in your network.

In this blog post, we will show you how to detect a new domain controller in your network using some simple tools and techniques. We will assume that you have administrative privileges on your network and that you are familiar with basic Windows commands and PowerShell.

Use the Netdom Command

The netdom command is a Windows command-line tool that can be used to manage domains and trust relationships. One of the functions of the netdom command is to list all the domain controllers in a domain. To use the netdom command, you need to open a command prompt as an administrator and type the following command:

netdom query dc

This command will display all the domain controllers in your current domain. You can also specify a different domain name after the dc parameter if you want to query another domain. For example:

netdom query dc example.com

The output of this command will look something like this:

List of domain controllers with accounts in the domain:

DC1DC2DC3The command completed successfully.

You can compare this output with your previous records or expectations to see if there is any new or unexpected domain controller in your domain. If you find one, you should investigate further to determine its origin and purpose.

Use the Get-ADDomainController PowerShell Cmdlet

The Get-ADDomainController PowerShell cmdlet is another tool that can be used to retrieve information about domain controllers in a domain. To use this cmdlet, you need to open a PowerShell window as an administrator and type the following command:

Get-ADDomainController -Filter *

This command will display all the domain controllers in your current domain along with some additional information, such as their name, site, operating system, IP address, and roles. You can also specify a different domain name after the -Server parameter if you want to query another domain. For example:

Get-ADDomainController -Filter * -Server example.com

The output of this command will look something like this:

DistinguishedName : CN=DC1,OU=Domain Controllers,DC=eexample, DC comDNSHostName : DC1.example.comEnabled : TrueName : DC1ObjectClass : computerObjectGUID : 12345678-1234-1234-1234-123456789012SamAccountName : DC1$SID : S-1-5-21-1234567890-1234567890-1234567890-1000Site : Default-First-Site-NameOperatingSystem : Windows Server 2019OperatingSystemVersion : 10.0 (17763)Forest : example.comDomain : example.comIPv4Address : 192.168.1.1IPv6Address : fe80::1234:5678:90ab:cdef%12IsGlobalCatalog : TrueIsReadOnly : FalseIsSeized : FalseRoles : {PDCEmulator, RIDMaster, InfrastructureMaster, SchemaMaster...}DistinguishedName : CN=DC2,OU=Domain Controllers,DC=example, DC ComDNSHostName : DC2.example.comEnabled : TrueName : DC2ObjectClass : computerObjectGUID : 23456789-2345-2345-2345-234567890123SamAccountName : DC2$SID : S-1-5-21-2345678901-2345678901-2345678901-1000Site : Default-First-Site-NameOperatingSystem : Windows Server 2019OperatingSystemVersion : 10.0 (17763)Forest : example.comDomain : example.comIPv4Address : 192.168.1.2IPv6Address : fe80::1235:5678:90ac:cdef%12IsGlobalCatalog : TrueIsReadOnly : FalseIsSeized : FalseRoles : {PDCEmulator, RIDMaster, InfrastructureMaster, SchemaMaster...}

You can also use Event ID 4742 in your Security log to monitor the changes to your registered Domain Controllers. This event shows which user initiated the change, so you know which Domain Administrator account is being used to perform the attack.

Windows 10 Security Overview

Windows 10 is the most popular operating system in the world, powering millions of devices from desktops to laptops to tablets to smartphones. Windows 10 offers many features and functionalities that enhance the user experience and productivity. However, Windows 10 also faces many security challenges and threats from hackers, malware, ransomware, phishing, and other cyberattacks.

Windows 10 security settings are the policies and configurations that define how Windows 10 devices are protected from unauthorized access or modification. Windows 10 security settings are important for several reasons. First, they help ensure the confidentiality, integrity, and availability of the device and the data. By applying appropriate security settings, users can control who can access their device and data and monitor any changes or activities. This prevents data breaches, identity theft, or sabotage by malicious actors.

Second, they help maintain compliance with various regulations and standards, such as HIPAA, PCI DSS, GDPR, and NIST. These regulations and standards require organizations and individuals to implement certain security measures to protect the personal or sensitive information of their customers, employees, or partners. By following the best practices for Windows 10 security settings, users can avoid fines, lawsuits, or reputational damage.

Third, they help improve the performance and efficiency of the device and the IT staff. By using Windows 10 security settings to enforce password policies, firewall rules, antivirus software, encryption methods, and other settings, users can reduce the risk of human errors, virus infections, network attacks, or data loss. This also reduces the workload and costs of managing and troubleshooting the device.

In this post, we’ll discuss the importance of the top 5 security settings in Windows 10:

BitLocker
Windows Defender
Windows Firewall
User Account Control
Windows Update

Continue reading “Windows 10 Security Overview”

Active Directory Security Overview

Active Directory (AD) is a directory service that manages the identities and access rights of users and devices in a network. AD security settings are the policies and configurations that define how AD objects, such as users, groups, computers, and organizational units, are protected from unauthorized access or modification.

AD security settings are essential for any organization that uses AD as their directory service. They help protect the network from internal and external threats, comply with various regulations and standards, and optimize the network performance and management. However, not all AD security settings are equally important. Some settings have a greater impact on the security posture and compliance status of the network than others.

In this post, I will discuss the importance of the top 5 security settings in AD, namely:

Password policy
Account lockout policy
Group policy
Permissions and auditing
Kerberos policy

Password Policy

Password policy is the set of rules that govern how passwords are created, changed, and stored in AD. Password policy affects the security of user accounts and the authentication process. A strong password policy should enforce the following requirements:

Minimum password length
Password complexity
Password history
Password expiration
Password encryption

A strong password policy helps prevent password cracking, guessing, or phishing attacks by making passwords harder to break or steal. It also reduces the risk of password reuse or sharing by requiring users to change their passwords regularly and use different passwords for different accounts. You should look at minimum password length of 10-12 characters with complexity requirements enabled, remembering at least the last 5 passwords, etc.

Account Lockout Policy

Account lockout policy is the set of rules that govern how AD responds to failed logon attempts. Account lockout policy affects the security of user accounts and the authentication process. A reasonable account lockout policy should enforce the following requirements:

Account lockout threshold
Account lockout duration
Account lockout reset

A reasonable account lockout policy helps prevent brute force attacks by locking out accounts after a certain number of failed logon attempts. It also reduces the risk of denial-of-service attacks by unlocking accounts after a certain period of time or by allowing administrators to manually reset them. You should look at disabling a user account if they guess their password incorrectly 10 times in 30 minutes, and automatically enabling their account after it has been locked for 30 minutes.

Group Policy

Group policy is the set of rules that govern how AD objects are configured and managed. Group policy affects the security of users, devices, and data. A comprehensive group policy should enforce the following requirements:

Security settings
Software settings
Administrative templates
Preferences

A comprehensive group policy helps enforce consistent and secure configurations across the network by applying security settings to users, devices, and data. It also helps automate and simplify the deployment and management of software, policies, and preferences across the network.

You should minimize any GPOs linked at the root domain level as these policies will apply to all users and computers in the domain. You should also avoid blocking policy inheritance and policy enforcement.

Permissions and Auditing

Permissions and auditing are the set of rules that govern how AD objects are accessed and monitored. Permissions and auditing affect the security of users, devices, and data. A granular permissions and auditing policy should enforce the following requirements:

Least privilege principle
Role-based access control
Object ownership
Inheritance and propagation
Audit policy

A granular permissions and auditing policy helps ensure the confidentiality, integrity, and availability of AD objects by granting only the necessary access rights to authorized users or groups based on their roles and responsibilities. It also helps detect and deter unauthorized access or modification by recording and reporting any changes or activities on AD objects.

Kerberos Policy

Kerberos policy is the set of rules that govern how AD uses Kerberos as its primary authentication protocol. Kerberos policy affects the security of user accounts and the authentication process. A secure Kerberos policy should enforce the following requirements:

Ticket lifetime
Ticket renewal
Maximum tolerance for computer clock synchronization

A secure Kerberos policy helps prevent replay attacks by limiting the validity and renewability of Kerberos tickets. It also helps prevent man-in-the-middle attacks by requiring a close synchronization of computer clocks within the network. It’s advisable to set Maximum lifetime for service ticket to 600 minutes and Maximum lifetime for user ticket renewal to 7 days.

In conclusion, AD security settings are vital for any organization that uses AD as their directory service. Among them, password policy, account lockout policy, group policy, permissions and auditing, and Kerberos policy are the most important ones. They help protect the network from internal and external threats, comply with various regulations and standards, and optimize the network performance and management.

Limit SMB Traffic in Windows Environments

Microsoft recently posted an article talking about reducing your SMB traffic, and thereby reducing the risk of compromise on your systems. Before you think we’re saying this one change is the solution to all network security issues, even Microsoft states “We are not trying to make the entire network impervious to all threats. We are trying to make your network so irritating to an attacker that they just lose interest and go after some other target.”

Many times we know a security change doesn’t completely fix an issue, we are just making another small change in a series of small changes to make things slightly more secure. A group of small changes often work together to create an overall more secure environment.

If nothing else you’ll have a better understanding of what systems need SMB enabled and where SMB traffic is common on your network.

Server Message Block (SMB) Traffic

Reducing your SMB traffic can really help your risk profile. Server Message Block (SMB) traffic is a communication protocol for providing shared access to files, printers, and serial ports between devices on your network. It also provides an authenticated inter-process communication (IPC) mechanism. There are also security issues in Microsoft’s implementation of the protocol. Many vendors have security vulnerabilities in their solutions because of their lack of support for newer authentication protocols like NTLMv2 and Kerberos. Recent attacks show that SMB is one of the primary attack vectors for many intrusion attempts. Recently two SMB high-severity vulnerabilities were disclosed which can provide RCE (Remote Code Execution) privileges to systems that allow SMB traffic.

Recommendations

Block inbound SMB access at the corporate firewalls – This means block inbound SMB traffic at the corporate firewall before it is on your LAN. This is usually the easiest way to block unauthorized traffic to your network and corporate systems. This will not work for remote systems that aren’t behind a managed firewall, but you can use this to help protect servers and other devices on the corporate network.
Block outbound SMB access at the corporate firewall with exceptions for specific IP ranges – Sometimes, rarely, you need outbound SMB traffic. If you don’t know, block the traffic and monitor logs for anything that might break.
Inventory for SMB usage and shares – It is understandable that employees need to connect to file servers to access file shares, as one example. Great, then allow inbound SMB traffic to just those servers, and block inbound SMB traffic to all Windows 10 clients or other servers. Start looking at your environment and begin blocking traffic unless it is required.
Configure Windows Defender Firewall to block inbound and outbound traffic on the workstations – Use the client firewall to block traffic except to required devices. There are several references to how to make this work, but it is past the time to start working out the details.
Disable SMB Server if unused – If you know the device doesn’t require SMB services, you may be able to stop the SMB Server service on Windows clients and even many of your Windows Servers.
Test at a small scale – Test the changes and make sure you understand the impact before you just deploy changes into production and break everything. As always, test twice and make sure you understand the changes (and have a rollback plan) before you deploy any changes into production.

Finding Last Login Date for an Active Directory User Account

You can check the Last Login Date information for a user account in Active Directory. The information for last login date is stored in an attribute called “lastLogonTimestamp”. You can check the value of “lastLogonTimestamp” using the Microsoft “ADSI Edit” tool.

Continue reading “Finding Last Login Date for an Active Directory User Account”

Windows 11 Alpha-Themed Malware Attacks

With the newest version of Windows, named Windows 11, just a few months away and criminals have started distributing malware with content targeting a user’s interest in the newest version of Microsoft’s desktop operating system.

Using the same tactics that work (asking users to perform tasks they should know is dangerous) these criminals are attempting to get users interested in Windows 11 information to willingly disable security features on their current computer to view what they assume is Windows 11 themed content.

Security researchers at Anomali, who observed a recent malware campaign from the group that used six different Word documents in an attempt to attack employees at a point-of-sale provider called Clearmind, say the cyber criminals attempted to get users to disable their workstation security so they could view content supposedly showing Windows 11 content.

The attack was attributed to FIN7, an Eastern European threat group, that primarily targets US-based companies that operate on a global scale. Anomali says the infection chain began with a Microsoft Word document (.doc) containing a decoy image claiming to have been made with Windows 11 Alpha. The image asks the user to Enable Editing and Enable Content to begin the next stage of malicious activity.

It’s interesting how the VBA code is stored to make analysis difficult, but it attempts to drop a JavaScript backdoor that appears to have similar functionality with other backdoors reportedly used by FIN7. It is interesting that if the script finds eastern-European specific languages in use (Russian, Ukrainian, etc.) or a virtual machine is currently running, it doesn’t drop its payload and immediately stops executing.

While it might be mildly interesting that they used Windows 11 as a hook to grab the user’s attention, it is still the same basic methods that are used every day to convince users to do something (disable security or violate procedures) to allow the attacker into the user’s workstation. Users have to be educated on what not to do, and the basic security controls have to be in place, to help block this type of attack from being successful.

Responding to Ransomware Attacks

In the event that your personal computer or even the computers on your corporate network fall victim to a successful ransomware attack, an effective response plan determine the difference between disaster and successful recovery. If you are impacted by a company-wide malware infection that takes down multiple endpoints, it could mean a permanent business closure if you are unable to recover critical data.

We will discuss how you might respond in the beginning of an attack to help remediate any issues before you make some wrong decisions.

How to respond to a ransomware attack

If preventative measures fail, like hardening your systems from Mimikatz attacks (links here and here), making users more cybersecurity aware with Security Awareness Training tips, and all the Windows 10 hardening tips didn’t work, then your organization should take the following actions immediately after identifying a successful ransomware infection.

If you have an Incident Recovery Plan, execute the notification process and get all the teams required started communicating and remediating the systems impacted by the attack.

1. Quarantine Infected Systems

The majority of ransomware attacks will include a function to scan the target network, identifying other systems on the same network that can also be targeted for attack, and then encrypting all the files stored on network shares or other computers as the attackers movers laterally across the network. To help contain any infection and to prevent the ransomware from spreading to all infected systems the infected systems must be removed from the network as soon as possible. This will significantly slow the spread and buy you time for analysis and troubleshooting before everything is rendered useless.

Note: This includes blocking them from wired and wireless network access.

This will also help prevent infected system from access resources like internal email, backup systems, employee record systems, critical databases, etc.

2. Block Internet Access

Every system on the network may already have the malware copied to the system and it just might not have started the encryption process yet because it hasn’t been able to access the command and control server on the internet. Disconnect all systems from the internet. Those that are still working will not start encrypting the drives, and those already encrypting have been removed from their ability to communicate to the safe systems by the step listed above.

Note: This includes blocking internet access from wired and wireless networks.

Now you have known bad systems (they are actively encrypting the user files or have already encrypted all the user files) isolated from the network (can’t see other systems on your network) and are blocked from the internet (can’t see other systems on the internet). You also have suspected good systems that are blocked from accessing the internet and are disconnected from the bad systems. You can now verify those clean looking systems are definitely clean and return them to normal as you are sure they are not infected. More about that in Step 5 below.

3. Identify Ransomware

Identify the “brand” of ransomware that has infected your systems. While this might seem strange, there are many types of ransomware from many different malware groups. Knowing which one has infected your systems could help you better identify the methods used in the attack, how to stop the spread, and how you might be able to get your data back without paying a ransom.

There have been instances of law enforcement agencies shutting down a ransomware authors “business” and releasing the decryption keys. Also older ransomware from groups that no longer are actively infecting new systems have sometimes released their decryption keys.

You can visit a website like this to help identify which malware has infected your systems so you can get help stopping, removing, and decrypting your locked files. To get a better understanding of the volume of internet threats that exist today, a visual threat map can be helpful. This threat map from Fortinet helps visualize the threats in a more “real-time” visual presentation.

4. Disable Scheduled Tasks

You should immediately disable any automated or system-scheduled maintenance tasks such as user or system clean-up routines, log deletion tasks, deleting old backup files, etc. because these automated tasks can remove files you might wish you had later, might be something your forensic teams might need, or you might perform an action that could prevent a successful remediation from the ransomware attack.

5. Remove Ransomware from Infected Systems

You can use available antivirus tools to identify and successfully remove the ransomware from your computer. If you are already using anti-virus and it didn’t stop the infection, this is probably a good time to investigate your current configuration issues or get a better solution. Once you have scanned and cleaned the system, it is ready to restore your files.

Once you find the right software to scan and detect the malware, run the scanner on all your systems, not just the infected systems. You might think you know which systems are infected, but the scanner can help you determine which systems are actually infected. You want to do the clean-up and remediation just one time, so do it right the first time.

6. Don’t Pay the Ransom

Note: Only restore your files to systems that you know are clean.

I realize you may not have an option if your critical business files are encrypted, you don’t have good backups you can recover, and you can’t find a free decryption tool. If backups are unavailable or damaged and there is no free decryption tool available, you will be tempted to pay the ransom and recover your files. Just remember you may pay the ransom and still not get your files back. These people are criminals looking for easy money, they are not in the business of being your friend.

While paying the ransom may seem like an easy answer, only consider paying the ransom if all other options have been exhausted and the loss of data will likely result in your company going out of business. Paying the ransom might also get you into trouble with the law, so be very careful and consult an attorney.

7. Restore Your Backups

Note: Only restore your files to systems that you know are clean.

Hopefully you were able to jump right past Step 6 (Don’t Pay the Ransom) because you know not to pay a ransom to a criminal because it only encourages them and finances their next attack. You don’t need to pay the ransom because you either don’t need the files that were encrypted, you were able to find a free decryption tool, or you had good backups ready for you to use.

Restoring backups can take a long time, be difficult to perform, and you still might lose some data. If you have been verifying your backups, practicing the restore process at least once a year, and have a well documented process the effort will be less likely to fail.

If your user files are also backed up to the cloud using a tool like OneDrive, this might also be useful and a quick way to restore a user’s personal files including documents, music, and pictures.

8. Restore Network

Now that you know which systems are clean, the cleaned machine can have access to the internet and other network resources. The infected machines can be cleaned one at a time, files can be restored, then the systems can be returned to the proper network.

Don’t forget to restore internet access for the clean systems. Once you have verified your backup files won’t be over-written, the log files are intact, and what files are required for the audit and forensics teams are saved, you can re-enable scheduled tasks that you have reviewed and know are safe to enable.

9. Change Passwords

Now that you know someone has had access to your systems, you can’t be sure they did not steal your user and system passwords. Have all users reset their passwords. Reset the passwords for all service accounts, accounts used to run scheduled tasks, the KRBTGT account (used by Active Directory), and any enabled accounts used by your systems. Make sure all administrator-level users also change their passwords. Do a full inventory of accounts, looking at the last time the password was changed, and either change the password or disable the account.

10. Investigate Intrusion

Things are now back to normal. Users are back onto their computers, the files are all back where they should be, and users are back to work and not on the telephone with you. That doesn’t mean you are done.

You have to look at what happened so you can make sure it doesn’t happen again.

How was the ransomware able to get past your computer controls and be easily installed onto a user’s computer without being detected? Was it a user bypassing a control (authorized or unauthorized), or did the ransomware just not get stopped by any existing security control?
Are there changes required to your anti-virus software to make it a stronger defense against ransomware? Is it time to remove the existing solution and replace it with something more powerful or can you just change the configuration of the solution you already own to make it work better?
Do you need to make changes to the hardening of your Windows 10 devices to make it harder to bypass your security controls and encrypt the users files?
Do you need to alter or improve your corporate firewall controls? What about the security of your remote users and they way they connect to the Virtual Private Network (VPN)?
Do you need to make changes to your network to make it harder for software running on the user’s computer to get access to systems like Domain Controllers, Database Servers, File Servers, Web Servers, etc.?
Do you need to change the way you perform (or don’t perform) backups of user and system files? How about changes to the way you restore files? Do you have adequate documentation of the procedures used for backing up and restoring files?
Do user accounts have the correct level of authorization? Maybe now is a good time to remove elevated permissions from normal users, limit who has elevated permissions, and lock down the use of all admin-level accounts?

Summary

If you need help, now is the time to really get some help figuring out the changes that can help prevent a repeat of the security event. A ransomware incident can stop a company from normal business for days, weeks, or forever. It can chase away customers, compromise business critical data, and cost you a lot of money to remediate.

Looking at the steps required now can help you practice and plan for a future incident. Careful planning, remediation of security gaps, and technical training can help prevent a successful ransomware attack, shorten the remediation timeline, and help promote confidence in your Information Technology team.

Reset the Azure VM administrator password

To reset the password of an Azure virtual machine, you can use the Azure portal or Azure PowerShell.

Azure Portal

Log into the Azure portal (http://portal.azure.com), go to the Azure VM you want to reset. Under the Support + Troubleshooting menu, click on Reset Password, and follow to the Reset Password wizard to update the credentials.

Note: This is not supported for Active Directory Domain Controllers.

PowerShell

If you want to use Azure PowerShell, you can edit this script and run the following commands:

$SubID = "<SUBSCRIPTION ID>" $RgName = "<RESOURCE GROUP NAME>" $VmName = "<VM NAME>" $Location = "<LOCATION>" Connect-AzAccount Select-AzSubscription -SubscriptionId $SubID Set-AzVMAccessExtension -ResourceGroupName $RgName -Location $Location -VMName $VmName -Credential (get-credential) -typeHandlerVersion "2.0" -Name VMAccessAgent

This information should help you to reset the password of an Azure virtual machine if you have lost access. If you want to know more, read the following troubleshooting article on Microsoft Docs.

Using Microsoft Intune to Secure Windows 10

Microsoft Endpoint Management (Microsoft Intune) is a service available as part of the traditional O365 environment that allows a business to configure and enroll their Windows 10 devices (as well as macOS, iOS, and Android devices) to centrally manage corporate devices while ensuring that they meet your basic compliance requirements. You can read more about Microsoft Intune here.

The basic approach to cloud management of your Windows 10 devices is quite simple, but it can take a little work to get the pieces into place.

Enroll new devices so that once you remove a new laptop from the box, your users log directly into the device using their standard network login to enroll new devices into Endpoint Management. This is how your devices will be managed and configured. This will take a little bit of work to get configured.
Configure new devices so that your preferred settings are detected and applied to the devices during the initial enrollment. This can be a few settings to hundreds of specific settings, depending on how detailed you want your configuration to be, and the settings applied can be controlled based on Azure AD groups, so some devices can be configured differently that other devices.
Require specific settings be applied before the device can be considered “compliant”, which can help you verify how secure a device is or isn’t, which can help you target specific devices for remediation.
Download software directly onto the device, which can make software deployment almost effortless, software inventory easier, and may significantly reduce user complaints.
Configure Windows Update to automatically update the Windows 10 endpoint, which will help avoid a missing patch from causing security headaches later.

Configuration Policy – Endpoint Security

Click on the Devices option, then select Configuration Policies, then select Create new policy, for the platform, select Windows 10 and later, select Profile and select Endpoint Protection. Set a name for your policy, such as “Windows Security Configuration”.

Microsoft Defender Smart Screen

SmartScreen for apps and files: Enable

Interactive Logon

Minutes of lock screen inactivity until screen saver initiates: 15
Require CTRL + ALT + DEL to log on: Enable

Local device security options

Accounts

Guest account: Block
Guest Account: Rename
Administrator Account: Rename

Network access and security

Anonymous access to Names Pipes ad Shares: Block
Anonymous enumeration of SAM accounts: Block
Anonymous enumeration of SAM accounts and shares: Block
LAN Manager hash value stored on password change: Block
Insecure Guest logons: Block

User Account Control

Elevated prompt for app installations: Enabled

Compliance Policy

Click on the Devices option, then select Compliance Policies, then select Create new policy, for the platform, select Windows 10 and later. Set a name for your policy, such as ‘Windows Security Compliance”.

Device Health

Require Bitlocker: Require

System Security

Require a password to unlock mobile devices.: Require
Password type: Device default
Minimum password length: 8

Device Security

Firewall: Required
Trusted Platform Module (TPM): Required
Antivirus: Required
Antimalware: Required

Defender

Microsoft Defender Antimalware: Required
Microsoft Defender Antimalware security intelligence up-to-date: Required
Real-time protection: Required

Windows 10 Update rings

Click on the Devices option, then select Windows 10 update rings, then select Create profile, set a name for your policy, such as “Windows Update Configuration”.

Servicing channel: Semi-annual
Microsoft product updates: Allow
Windows drivers: Allow
Quality update deferral period (days) : 3
Feature update deferral period (days): 3
Automatic update behavior: Auto install at maintenance time
Active hours start: 8 am
Active hours end: 8 pm
Restart checks: Allow
Option to pause Windows updates: Disable

You can also create other Configuration Profiles to enforce various policies that you may be using GPO policies to enforce today, like various network settings, Windows Defender Firewall settings, renaming the local administrator account, disabling the guest account, etc. You can also create Apps, which allows you to install various software directly to the enrolled device.

Once you start working with Endpoint Manager (Intune) you will see the enormous potential that cloud management brings to your environment.

List of Command Prompt (CMD) Commands in Windows

The Command Prompt (CMD) in Windows provides access to over 280 commands that are used to perform actions from a command line interface instead of the standard graphical Windows interface.

To see the available commands from your CMD prompt, you can visit the Microsoft Knowledgebase, or review the list below.

This list also includes DOS commands from MS-DOS and early versions of Windows:

Continue reading “List of Command Prompt (CMD) Commands in Windows”

Enable or Disable Windows Defender Firewall with PowerShell

The Windows Defender Firewall with Advanced Security is an important feature of Windows 10 that should be enabled to help protect your computer. Many businesses disable the built-in Windows firewall to prevent it from interfering with any internal processes, but that is an extremely rare problem.

I recommend you enable the Windows Defender Firewall with Advanced Security, and use the features available to help properly secure the user’s Windows 10 endpoint.

To enable the Windows Defender Firewall with Advanced Security using PowerShell:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

To configure the firewall to configure the “default” behavior:

Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow –NotifyOnListen True -AllowUnicastResponseToMulticast True –LogFileName %SystemRoot%\System32\LogFiles\Firewall\DefenderFirewall.log

To disable the Windows Defender Firewall with Advanced Security using PowerShell:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

My advice is to learn how to properly configure the Windows 10 firewall so you can use if to better secure the Windows 10 endpoint.

Reset the Azure VM administrator password

To reset the password of an Azure virtual machine, you can use the Azure portal or Azure PowerShell.

Azure Portal

Note: This is not supported for Active Directory Domain Controllers.

PowerShell

If you want to use Azure PowerShell, you can edit this script and run the following commands:

$SubID = "<SUBSCRIPTION ID>" $RgName = "<RESOURCE GROUP NAME>" $VmName = "<VM NAME>" $Location = "<LOCATION>" Connect-AzAccount Select-AzSubscription -SubscriptionId $SubID Set-AzVMAccessExtension -ResourceGroupName $RgName -Location $Location -VMName $VmName -Credential (get-credential) -typeHandlerVersion "2.0" -Name VMAccessAgent

This information should help you to reset the password of an Azure virtual machine if you have lost access. If you want to know more, read the following troubleshooting article on Microsoft Docs.

Finding Last Password Changed for an Active Directory User Account

You can check the Last Password Changed information for a user account in Active Directory. The information for last password changed is stored in an attribute called “PwdLastSet”. You can check the value of “PwdLastSet” using the Microsoft “ADSI Edit” tool.

Continue reading “Finding Last Password Changed for an Active Directory User Account”

Finding Last Password Changed for an Active Directory User Account

Continue reading “Finding Last Password Changed for an Active Directory User Account”

List of Command Prompt (CMD) Commands in Windows

The Command Prompt (CMD) in Windows provides access to over 280 commands that are used to perform actions from a command line interface instead of the standard graphical Windows interface.

To see the available commands from your CMD prompt, you can visit the Microsoft Knowledgebase, or review the list below.

This list also includes DOS commands from MS-DOS and early versions of Windows:

Command	Description
adprep	Adprep.exe is a command-line tool that is available on the Windows Server 2008 installation disc in the \sources\adprep folder, and it is available on the Windows Server 2008 R2 installation disk in the \support\adprep folder. You must run adprep from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.
Append	The append command can be used by programs to open files in another directory as if they were located in the current directory. The append command is available in MS-DOS as well as in all 32-bit versions of Windows. The append command is not available in 64-bit versions of Windows.
Arp	The arp command is used to display or change entries in the ARP cache. The arp command is available in all versions of Windows.
Assoc	The assoc command is used to display or change the file type associated with a particular file extension. The assoc command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
At	The at command is used to schedule commands and other programs to run at a specific date and time. The at command is available in Windows 7, Windows Vista, and Windows XP. Beginning in Windows 8, command line task scheduling should instead be completed with the schtasks command.
Atmadm	The atmadm command is used to display information related to asynchronous transfer mode (ATM) connections on the system. The atmadm command is available in Windows XP. Support for ATM was removed beginning in Windows Vista, making the atmadm command unnecessary.
Attrib	The attrib command is used to change the attributes of a single file or a directory. The attrib command is available in all versions of Windows, as well as in MS-DOS.
Auditpol	The auditpol command is used to display or change audit policies. The auditpol command is available in Windows 8, Windows 7, and Windows Vista.
Autochk	Autochk.exe is a version of Chkdsk that runs only on NTFS disks and only before system starts. Autochk cannot be run directly from the command-line. Instead, Autochk runs in the following situations: – If you try to run Chkdsk on the boot volume – If Chkdsk cannot gain exclusive use of the volume – If the volume is flagged as dirty
Bcdboot	The bcdboot command is used to copy boot files to the system partition and to create a new system BCD store. The bcdboot command is available in Windows 8 and Windows 7.
Bcdedit	The bcdedit command is used to view or make changes to Boot Configuration Data. The bcdedit command is available in Windows 8, Windows 7, and Windows Vista. The bcdedit command replaced the bootcfg command beginning in Windows Vista.
Bdehdcfg	The bdehdcfg command is sued to prepare a hard drive for BitLocker Drive Encryption. The bdehdcfg command is available in Windows 8 and Windows 7.
Bitsadmin	The bitsadmin command is used to create, manage, and monitor download and upload jobs. The bitsadmin command is available in Windows 8, Windows 7, and Windows Vista. While the bitsadmin command is available in both Windows 8 and Windows 7, it is being phased out. The BITS PowerShell cmdlets should be used instead.
Bootcfg	The bootcfg command is used to build, modify, or view the contents of the boot.ini file, a hidden file that is used to identify in what folder, on which partition, and on which hard drive Windows is located. The bootcfg command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The bootcfg command was replaced by the bcdedit command beginning in Windows Vista. Bootcfg is still available in later versions of Windows but it has no purpose since boot.ini is not used in these newer operating systems.
Bootsect	The bootsect command is used to configure the master boot code to one compatible with BOOTMGR (Vista and later) or NTLDR (XP and earlier). The bootsect command is available in Windows 8 and later. The bootsect command is also available in Windows 7 and Windows Vista, but only from the System Recovery Options Command Prompt.
Break	The break command sets or clears extended CTRL+C checking on DOS systems. The break command is available in all versions of Windows, as well as in MS-DOS. The break command is available in Windows XP and later versions of Windows to provide compatibility with MS-DOS files but it has no effect in Windows itself.
Cacls	The cacls command is used to display or change access control lists of files. The cacls command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The cacls command is being phased out in favor of the icacls command, which should be used instead in all versions of Windows after Windows XP.
Call	The call command is used to run a script or batch program from within another script or batch program. The call command is available in all versions of Windows, as well as in MS-DOS. The call command has no effect outside of a script or batch file. In other words, running the call command at the Command Prompt or MS-DOS prompt will do nothing.
Cd	The cd command is the shorthand version of the chdir command. The cd command is available in all versions of Windows, as well as in MS-DOS.
Certreq	The certreq command is used to perform various certification authority (CA) certificate functions. The certreq command is available in Windows 8, Windows 7, and Windows Vista.
Certutil	The certutil command is used to dump and display certification authority (CA) configuration information in addition to other CA functions. The certutil command is available in Windows 8, Windows 7, and Windows Vista.
Change	The change command changes various terminal server settings like install modes, COM port mappings, and logons. The change command is available in Windows 8, Windows 7, and Windows Vista.
Chcp	The chcp command displays or configures the active code page number. The chcp command is available in all versions of Windows, as well as in MS-DOS.
Chdir	The chdir command is used to display the drive letter and folder that you are currently in. Chdir can also be used to change the drive and/or directory that you want to work in. The chdir command is available in all versions of Windows, as well as in MS-DOS.
Checknetisolation	The checknetisolation command is used to test apps that require network capabilities. The checknetisolation command is available in Windows 8.
Chglogon	The chglogon command enables, disables, or drains terminal server session logins. The chglogon command is available in Windows 8, Windows 7, and Windows Vista. Executing the chglogon command is the same as executing change logon.
Chgport	The chgport command can be used to display or change COM port mappings for DOS compatibility. The chgport command is available in Windows 8, Windows 7, and Windows Vista. Executing the chgport command is the same as executing change port.
Chgusr	The chgusr command is used to change the install mode for the terminal server. The chgusr command is available in Windows 8, Windows 7, and Windows Vista. Executing the chgusr command is the same as executing change user.
Chkdsk	The chkdsk command, often referred to as check disk, is used to identify and correct certain hard drive errors. The chkdsk command is available in all versions of Windows, as well as in MS-DOS.
Chkntfs	The chkntfs command is used to configure or display the checking of the disk drive during the Windows boot process. The chkntfs command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Choice	The choice command is used within a script or batch program to provide a list of choices and return the value of that choice to the program. The choice command is available in MS-DOS and all versions of Windows except Windows XP. Use the set command with the /p switch in place of the choice command in batch files and scripts that you plan to use in Windows XP.
Cipher	The cipher command shows or changes the encryption status of files and folders on NTFS partitions. The cipher command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Clip	The clip command is used to redirect the output from any command to the clipboard in Windows. The clip command is available in Windows 8, Windows 7, and Windows Vista.
Cls	The cls command clears the screen of all previously entered commands and other text. The cls command is available in all versions of Windows, as well as in MS-DOS.
Cmd	The cmd command starts a new instance of the cmd.exe command interpreter. The cmd command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Cmdkey	The cmdkey command is used to show, create, and remove stored user names and passwords. The cmdkey command is available in Windows 8, Windows 7, and Windows Vista.
Cmstp	The cmstp command installs or uninstalls a Connection Manager service profile. The cmstp command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Color	The color command is used to change the colors of the text and background within the Command Prompt window. The color command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Command	The command command starts a new instance of the command.com command interpreter. The command command is available in MS-DOS as well as in all 32-bit versions of Windows. The command command is not available in 64-bit versions of Windows.
Comp	The comp command is used to compare the contents of two files or sets of files. The comp command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Compact	The compact command is used to show or change the compression state of files and directories on NTFS partitions. The compact command is available in Windows XP and newer versions of Windows.
Convert	The convert command is used to convert FAT or FAT32 formatted volumes to the NTFS format. The convert command is available in Windows XP and newer versions of Windows.
Copy	The copy command does simply that – it copies one or more files from one location to another. The copy command is available in all versions of Windows, as well as in MS-DOS. Xcopy is a more powerful version of the copy command.
Cscript	The cscript command is used to execute scripts via Microsoft Script Host. The cscript command is available in all versions of Windows. The cscript command is most popularly used to manage printers from the command line using scripts like prncnfg.vbs, prndrvr.vbs, prnmngr.vbs, and others.
Ctty	The ctty command is used to change the default input and output devices for the system. The ctty command is available in Windows 98 and 95 as well as in MS-DOS. The functions provided by the ctty command were no longer necessary beginning in Windows XP because the command.com interpreter (MS-DOS) is no longer the default command line interpreter.
Date	The date command is used to show or change the current date. The date command is available in all versions of Windows, as well as in MS-DOS.
Dblspace	The dblspace command is used to create or configure DoubleSpace compressed drives. The dblspace command is available in Windows 98 and 95, as well as in MS-DOS. DriveSpace, executed using the drvspace command, is an updated version of DoubleSpace. Windows natively handles compression beginning in Windows XP.
Debug	The debug command starts Debug, a command line application used to test and edit programs. The debug command is available in MS-DOS as well as in all 32-bit versions of Windows. The debug command is not available in 64-bit versions of Windows.
Defrag	The defrag command is used to defragment a drive you specify. The defrag command is the command line version of Microsoft’s Disk Defragmenter. The defrag command is available in all versions of Windows, as well as in MS-DOS.
Del	The del command is used to delete one or more files. The del command is available in all versions of Windows, as well as in MS-DOS. The del command is the same as the erase command.
Deltree	The deltree command is used to delete a directory and all the files and subdirectories within it. The deltree command is available in Windows 98 and 95, as well as in MS-DOS. Beginning in Windows XP, a folder and its files and subfolders can be removed using the /s function of the rmdir command. Deltree was no longer needed with this new rmdir ability so the command was removed.
Diantz	The diantz command is used to losslessly compress one or more files. The diantz command is sometimes called Cabinet Maker. The diantz command is available in Windows XP and newer versions of Windows. The diantz command is the same as the makecab command.
Dir	The dir command is used to display a list of files and folders contained inside the folder that you are currently working in. The dir command also displays other important information like the hard drive’s serial number, the total number of files listed, their combined size, the total amount of free space left on the drive, and more. The dir command is available in all versions of Windows, as well as in MS-DOS.
Diskcomp	The diskcomp command is used to compare the contents of two floppy disks. The diskcomp command is available in all versions of Windows, as well as in MS-DOS.
Diskcopy	The diskcopy command is used to copy the entire contents of one floppy disk to another. The diskcopy command is available in all versions of Windows, as well as in MS-DOS.
Diskpart	The diskpart command is used to create, manage, and delete hard drive partitions. The diskpart command is available in Windows XP and newer versions of Windows. The diskpart command replaced the fdisk command beginning in Windows XP.
Diskperf	The diskperf command is used to manage disk performance counters remotely. The diskperf command is available in Windows XP and newer versions of Windows.
Diskraid	The diskraid command starts the DiskRAID tool which is used to manage and configure RAID arrays. The diskraid command is available in Windows Vista and newer versions of Windows.
Dism	The dism command starts the Deployment Image Servicing and Management tool (DISM). The DISM tool is used to manage features in Windows images. The dism command is available in Windows 7 and newer versions of Windows.
Dispdiag	The dispdiag command is used to output a log of information about the display system. The dispdiag command is available in Windows Vista and newer versions of Windows.
Djoin	The djoin command is used to create a new computer account in a domain. The djoin command is available in Windows Vista and newer versions of Windows.
Doskey	The doskey command is used to edit command lines, create macros, and recall previously entered commands. The doskey command is available in all versions of Windows, as well as in MS-DOS.
Dosshell	The dosshell command starts DOS Shell, a graphical file management tool for MS-DOS. The dosshell command is available in Windows 95 (in MS-DOS mode) and also in MS-DOS version 6.0 and later MS-DOS versions that were upgraded from previous versions that contained the dosshell command. A graphical file manager, Windows Explorer, became an integrated part of the operating system beginning in Windows 95.
Dosx	The dosx command is used to start DOS Protected Mode Interface (DPMI), a special mode designed to give MS-DOS applications access to more than the normally allowed 640 KB. The dosx command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The dosx command is not available in 64-bit versions of Windows. The dosx command and DPMI is only available in Windows to support older MS-DOS programs.
Driverquery	The driverquery command is used to show a list of all installed drivers. The driverquery command is available in Windows XP and newer versions of Windows.
Drvspace	The drvspace command is used to create or configure DriveSpace compressed drives. The drvspace command is available in Windows 98 and 95, as well as in MS-DOS. DriveSpace is an updated version of DoubleSpace, executed using the dblspace command. Windows natively handles compression beginning in Windows XP.
Echo	The echo command is used to show messages, most commonly from within script or batch files. The echo command can also be used to turn the echoing feature on or off. The echo command is available in all versions of Windows, as well as in MS-DOS.
Edit	The edit command starts the MS-DOS Editor tool which is used to create and modify text files. The edit command is available in MS-DOS as well as in all 32-bit versions of Windows. The edit command is not available in 64-bit versions of Windows.
Edlin	The edlin command starts the Edlin tool which is used to create and modify text files from the command line. The edlin command is available in all 32-bit versions of Windows but is not available in 64-bit versions of Windows. In MS-DOS, the edlin command is only available up to MS-DOS 5.0 so unless your later version of MS-DOS was upgraded from 5.0 or prior, you won’t see the edlin command.
Emm386	The emm386 command is used to give MS-DOS access to more than 640 KB of memory. The emm386 command is available in Windows 98 and 95, as well as in MS-DOS. Windows itself has access to extended and expanded memory beginning in Windows 95.
Endlocal	The endlocal command is used to end the localization of environment changes inside a batch or script file. The endlocal command is available in Windows XP and newer versions of Windows.
Erase	The erase command is used to delete one or more files. The erase command is available in all versions of Windows, as well as in MS-DOS. The erase command is the same as the del command.
Esentutl	The esentutl command is used to manage Extensible Storage Engine databases. The esentutl command is available in Windows XP and newer versions of Windows.
Eventcreate	The eventcreate command is used to create a custom event in an event log. The eventcreate command is available in Windows XP and newer versions of Windows.
Eventtriggers	The eventtriggers command is used to configure and display event triggers. The eventtriggers command is available in Windows XP. Beginning in Windows Vista, event triggers are created using the Attach Task To This Event feature in Event Viewer, making the eventtriggers command unnecessary.
Exe2bin	The exe2bin command is used to convert a file of the EXE file type (executable file) to a binary file. The exe2bin command is available in 32-bit versions of Windows 8, Windows 7, Windows Vista, and Windows XP. The exe2bin command is not available in any 64-bit version of Windows.
Exit	The exit command is used to end the cmd.exe (Windows) or command.com (MS-DOS) session that you’re currently working in. The exit command is available in all versions of Windows, as well as in MS-DOS.
Expand	The expand command is used to extract the files and folders contained in Microsoft Cabinet (CAB) files. The expand command is available in MS-DOS as well as in all versions of Windows. The expand command is not available in the 64-bit version of Windows XP.
Extrac32	The extrac32 command is used to extract the files and folders contained in Microsoft Cabinet (CAB) files. The extrac32 command is available in all versions of Windows. The extrac32 command is actually a CAB extraction program for use by Internet Explorer but can be used to extract any Microsoft Cabinet file. Use the expand command instead of the extrac32 command if possible.
Extract	The extract command is used to extract the files and folders contained in Microsoft Cabinet (CAB) files. The extract command is available in Windows 98 and 95. The extract command was replaced by the expand command beginning in Windows XP.
Fasthelp	The fasthelp command provides more detailed information on any of the other MS-DOS commands. The fasthelp command is only available in MS-DOS. The help command replaced the fasthelp command beginning in Windows 95.
Fastopen	The fastopen command is used to add a program’s hard drive location to a special list stored in memory, potentially improving the program’s launch time by removing the need for MS-DOS to locate the application on the drive. The fastopen command is available in MS-DOS as well as in all 32-bit versions of Windows. The fastopen command is not available in 64-bit versions of Windows. Fastopen is only available in Windows 8, 7, Vista, and XP to support older MS-DOS files.
Fc	The fc command is used to compare two individual or sets of files and then show the differences between them. The fc command is available in all versions of Windows, as well as in MS-DOS.
Fdisk	The fdisk command is used to create, manage, and delete hard drive partitions. The fdisk command is available in Windows 98 and 95, as well as in MS-DOS. The fdisk command was replaced by the diskpart command beginning in Windows XP. Partition management is also available from Disk Management in Windows 8, 7, Vista, and XP.
Find	The find command is used to search for a specified text string in one or more files. The find command is available in all versions of Windows, as well as in MS-DOS.
Findstr	The findstr command is used to find text string patterns in one or more files. The findstr command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Finger	The finger command is used to return information about one or more users on a remote computer that’s running the Finger service. The finger command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Fltmc	The fltmc command is used to load, unload, list, and otherwise manage Filter drivers. The fltmc command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Fondue	The fondue command, short for Features on Demand User Experience Tool, is used to install any of the several optional Windows features from the command line. The fondue command is available in Windows 8. Optional Windows features can also be installed from the Programs and Features applet in Control Panel.
For	The for command is used to run a specified command for each file in a set of files. The for command is most often used within a batch or script file. The for command is available in all versions of Windows, as well as in MS-DOS.
Forcedos	The forcedos command is used to start the specified program in the MS-DOS subsystem. The forcedos command is only available in 32-bit versions of Windows XP. The forcedos command is only used for MS-DOS programs that are not recognized as such by Windows XP.
Forfiles	The forfiles command selects one or more files to execute a specified command on. The forfiles command is most often used within a batch or script file. The forfiles command is available in Windows 8, Windows 7, and Windows Vista.
Format	The format command is used to format a drive in the file system that you specify. The format command is available in all versions of Windows, as well as in MS-DOS. Drive formatting is also available from Disk Management in Windows 8, 7, Vista, and XP.
Fsutil	The fsutil command is used to perform various FAT and NTFS file system tasks like managing reparse points and sparse files, dismounting a volume, and extending a volume. The fsutil command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Ftp	The ftp command can used to transfer files to and from another computer. The remote computer must be operating as an FTP server. The ftp command is available in all versions of Windows.
Ftype	The ftype command is used to define a default program to open a specified file type. The ftype command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Getmac	The getmac command is used to display the media access control (MAC) address of all the network controllers on a system. The getmac command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Goto	The goto command is used in a batch or script file to direct the command process to a labeled line in the script. The goto command is available in all versions of Windows, as well as in MS-DOS.
Gpresult	The gpresult command is used to display Group Policy settings. The gpresult command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Gpupdate	The gpupdate command is used to update Group Policy settings. The gpupdate command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Graftabl	The graftabl command is used to enable the ability of Windows to display an extended character set in graphics mode. The graftabl command is available in all versions of Windows and in MS-DOS up to version 5.0. The graftabl command is not available in 64-bit versions of Windows.
Graphics	The graphics command is used to load a program that can print graphics. The graphics command is available in MS-DOS as well as in all 32-bit versions of Windows. The graphics command is not available in 64-bit versions of Windows.
Help	The help command provides more detailed information on any of the other Command Prompt or MS-DOS commands. The help command is available in all versions of Windows, as well as in MS-DOS.
Hostname	The hostname command displays the name of the current host. The hostname command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Hwrcomp	The hwrcomp command is used to compile custom dictionaries for handwriting recognition. The hwrcomp command is available in Windows 8 and Windows 7.
Hwrreg	The hwrreg command is used to install a previously compiled custom dictionary for handwriting recognition. The hwrreg command is available in Windows 8 and Windows 7.
Icacls	The icacls command is used to display or change access control lists of files. The icacls command is available in Windows 8, Windows 7, and Windows Vista. The icacls command is an updated version of the cacls command.
If	The if command is used to perform conditional functions in a batch file. The if command is available in all versions of Windows, as well as in MS-DOS.
Interlnk	The interlnk command is used to connect two computers via a serial or parallel connection to share files and printers. The interlnk command is only available in MS-DOS. The ability to directly connect two computers is handled by the networking functions in all versions of Windows.
Intersvr	The intersvr command is used to start the Interlnk server and to copy Interlnk files from one computer to another. The intersvr command is only available in MS-DOS. The ability to directly connect two computers is handled by the networking functions in all versions of Windows.
Ipconfig	The ipconfig command is used to display detailed IP information for each network adapter utilizing TCP/IP. The ipconfig command can also be used to release and renew IP addresses on systems configured to receive them via a DHCP server. The ipconfig command is available in all versions of Windows.
Ipxroute	The ipxroute command is used to display and change information about IPX routing tables. The ipxroute command is available in Windows XP. Microsoft removed their native NetWare client beginning in Windows Vista, removing the associated ipxroute command as well.
Irftp	The irftp command is used to transmit files over an infrared link. The irftp command is available in Windows 8, Windows 7, and Windows Vista.
Iscsicli	The iscsicli command starts the Microsoft iSCSI Initiator, used to manage iSCSI. The iscsicli command is available in Windows 8, Windows 7, and Windows Vista.
Kb16	The kb16 command is used to support MS-DOS files that need to configure a keyboard for a specific language. The kb16 command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The kb16 command is not available in 64-bit versions of Windows. The kb16 command replaced the keyb command beginning in Windows XP but only exists to support older MS-DOS files.
Keyb	The keyb command is used to configure a keyboard for a specific language. The keyb command is available in Windows 98 and 95, as well as in MS-DOS. See the kb16 command for an equivalent command in later versions of Windows. Keyboard language settings are handled by the Region and Language or Regional and Language Options (depending on the version of Windows) Control Panel appletsin Windows beginning in Windows XP.
Klist	The klist command is used to list Kerberos service tickets. The klist command can also be used to purge Kerberos tickets. The klist command is available in Windows 8 and Windows 7.
Ksetup	The ksetup command is used to configure connections to a Kerberos server. The ksetup command is available in Windows 8 and Windows 7.
Ktmutil	The ktmutil command starts the Kernel Transaction Manager utility. The ktmutil command is available in Windows 8, Windows 7, and Windows Vista.
Label	The label command is used to manage the volume label of a disk. The label command is available in all versions of Windows, as well as in MS-DOS.
Lh	The lh command is the shorthand version of the loadhigh command. The lh command is available in Windows 98 and 95, as well as in MS-DOS.
Licensingdiag	The licensingdiag command is a tool used to generate a text-based log and other data files that contain product activation and other Windows licensing information. The licensingdiag command is available in Windows 8.
Loadfix	The loadfix command is used to load the specified program in the first 64K of memory and then runs the program. The loadfix command is available in MS-DOS as well as in all 32-bit versions of Windows. The loadfix command is not available in 64-bit versions of Windows.
Loadhigh	The loadhigh command is used to load a program into high memory and is usually used from within the autoexec.bat file. The loadhigh command is available in Windows 98 and 95, as well as in MS-DOS. Memory usage is handled automatically beginning in Windows XP.
Lock	The lock command is used to lock a drive, enabling direct disk access for a program. The lock command is only available in Windows 98 and 95. Drive locking is no longer available as of Windows XP.
Lodctr	The lodctr command is used to update registry values related to performance counters. The lodctr command is available in all versions of Windows.
Logman	The logman command is used to create and manage Event Trace Session and Performance logs. The logman command also supports many functions of Performance Monitor. The logman command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Logoff	The logoff command is used to terminate a session. The logoff command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Lpq	The lpq command displays the status of a print queue on a computer running Line Printer Daemon (LPD). The lpq command is available in all versions of Windows. The lpq command is not available by default in Windows 8, 7, or Vista, but can be enabled by turning on the LPD Print Service and LPR Port Monitor features from Programs and Features in Control Panel.
Lpr	The lpr command is used to send a file to a computer running Line Printer Daemon (LPD). The lpr command is available in all versions of Windows. The lpr command is not available by default in Windows 8, 7, or Vista, but can be enabled by turning on the LPD Print Service and LPR Port Monitor features from Programs and Features in Control Panel.
Makecab	The makecab command is used to losslessly compress one or more files. The makecab command is sometimes called Cabinet Maker. The makecab command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The makecab command is the same as the diantz command, a command that was removed after Windows 7.
Manage-bde	The manage-bde command is used to configure BitLocker Drive Encryption from the command line. The manage-bde command is available in Windows 8 and Windows 7. A script by the name of manage-bde.wsf exists in Windows Vista and can be used with the cscript command to perform BitLocker tasks from the command line in that operating system.
Md	The md command is the shorthand version of the mkdir command. The md command is available in all versions of Windows, as well as in MS-DOS.
Mem	The mem command shows information about used and free memory areas and programs that are currently loaded into memory in the MS-DOS subsystem. The mem command is available in MS-DOS as well as in all 32-bit versions of Windows. The mem command is not available in 64-bit versions of Windows.
Memmaker	The memmaker command is used to start MemMaker, a memory optimization tool. The memaker command is available in Windows 98 and 95, as well as in MS-DOS. Memory usage is automatically optimized beginning in Windows XP.
Mkdir	The mkdir command is used to create a new folder. The mkdir command is available in all versions of Windows, as well as in MS-DOS.
Mklink	The mklink command is used to create a symbolic link. The mklink command is available in Windows 8, Windows 7, and Windows Vista.
Mode	The mode command is used to configure system devices, most often COM and LPT ports. The mode command is available in all versions of Windows, as well as in MS-DOS.
Mofcomp	The mofcomp command properly displays the data within a Managed Object Format (MOF) file. The mofcomp command is available in all versions of Windows.
More	The more command is used to display the information contained in a text file. The more command can also be used to paginate the results of any other Command Prompt or MS-DOS command. The more command is available in all versions of Windows, as well as in MS-DOS.
Mount	The mount command is used to mount Network File System (NFS) network shares. The mount command is available in Windows 7 and Windows Vista. The mount command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Services for NFS Windows feature from Programs and Features in Control Panel. The mount command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Mountvol	The mountvol command is used to display, create, or remove volume mount points. The mountvol command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Move	The move command is used to move one or files from one folder to another. The move command is also used to rename directories. The move command is available in all versions of Windows, as well as in MS-DOS.
Mrinfo	The mrinfo command is used to provide information about a router’s interfaces and neighbors. The mrinfo command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Msav	The msav command starts Microsoft Antivirus. The msav command is only available in MS-DOS. Microsoft Antivirus was designed for MS-DOS and Windows 3.x only. Microsoft provides an optional virus protection suite called Microsoft Security Essentials for Windows XP and later operating systems and third party antivirus tools are available for all versions of Windows.
Msbackup	The msbackup command starts Microsoft Backup, a tool used to back up and restore one or more files. The msbackup command is only available in MS-DOS. The msbackup command was replaced with Microsoft Backup beginning in Windows 95 and then Backup and Restore in later versions of Windows.
Mscdex	The mscdex command is used to provide CD-ROM access to MS-DOS. The mscdex command is available in Windows 98 and 95, as well as in MS-DOS. Windows provides access to CD-ROM drives for the MS-DOS subsystem beginning in Windows XP so the mscdex command is unnecessary in this and later operating systems.
Msd	The msd command starts Microsoft Diagnostics, a tool used to display information about your computer. The msd command is only available in MS-DOS. The msd command was replaced with System Information beginning in Windows 95.
Msg	The msg command is used to send a message to a user. The msg command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Msiexec	The msiexec command is used to start Windows Installer, a tool used to install and configure software. The msiexec command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Muiunattend	The muiunattend command starts the Multilanguage User Interface unattended setup process. The muiunattend command is available in Windows 8, Windows 7, and Windows Vista.
Nbtstat	The nbtstat command is used to show TCP/IP information and other statistical information about a remote computer. The nbtstat command is available in all versions of Windows.
Net	The net command is used to display, configure, and correct a wide variety of network settings. The net command is available in all versions of Windows.
Net1	The net1 command is used to display, configure, and correct a wide variety of network settings. The net1 command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The net command should be used instead of the net1 command. The net1 command was made available in Windows NT and Windows 2000 as a temporary fix for a Y2K issue that the net command had, which was corrected before the release of Windows XP. The net1 command remains in later versions of Windows only for compatibility with older programs and scripts that utilized the command.
Netcfg	The netcfg command is used to install the Windows Preinstallation Environment (WinPE), a lightweight version of Windows used to deploy workstations. The netcfg command is available in Windows 8, Windows 7, and Windows Vista.
Netsh	The netsh command is used to start Network Shell, a command-line utility used to manage the network configuration of the local, or a remote, computer. The netsh command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Netstat	The netstat command is most commonly used to display all open network connections and listening ports. The netstat command is available in all versions of Windows.
Nfsadmin	The nfsadmin command is used to manage Server for NFS or Client for NFS from the command line. The nfsadmin command is available in Windows 7 and Windows Vista. The nfsadmin command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Services for NFS Windows feature from Programs and Features in Control Panel. The nfsadmin command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Nlsfunc	The nlsfunc command is used to load information specific to a particular country or region. The nlsfunc command is available in MS-DOS as well as in all 32-bit versions of Windows. The nlsfunc command is not available in 64-bit versions of Windows. Nlsfunc is only available in Windows 8, 7, Vista, and XP to support older MS-DOS files.
Nltest	The nltest command is used to test secure channels between Windows computers in a domain and between domain controllers that are trusting other domains. The nltest command is available in Windows 8 and Windows 7.
Nslookup	The nslookup is most commonly used to display the hostname of an entered IP address. The nslookup command queries your configured DNS server to discover the IP address. The nslookup command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Ntbackup	The ntbackup command is used to perform various backup functions from the Command Prompt or from within a batch or script file. The ntbackup command is available in Windows XP. The ntbackup command was replaced with the wbadmin beginning in Windows Vista.
Ntsd	The ntsd command is used to perform certain command line debugging tasks. The ntsd command is available in Windows XP. The ntsd command was removed beginning in Windows Vista due to the addition of dump file support in Task Manager.
Ocsetup	The ocsetup command starts the Windows Optional Component Setup tool, used to install additional Windows features. The ocsetup command is available in Windows 8, Windows 7, and Windows Vista. Beginning in Windows 8, Microsoft is depreciating the ocsetup command in favor of the dism command.
Openfiles	The openfiles command is used to display and disconnect open files and folders on a system. The openfiles command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Path	The path command is used to display or set a specific path available to executable files. The path command is available in all versions of Windows, as well as in MS-DOS.
Pathping	The pathping command functions much like the tracert command but will also report information about network latency and loss at each hop. The pathping command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Pause	The pause command is used within a batch or script file to pause the processing of the file. When the pause command is used, a “Press any key to continue…” message displays in the command window. The pause command is available in all versions of Windows, as well as in MS-DOS.
Pentnt	The pentnt command is used to detect floating point division errors in the Intel Pentium chip. The pentnt command is also used to enable floating point emulation and disable floating point hardware. The pentnt command is available in Windows XP. The pentnt command was removed beginning in Windows Vista due to the lack of Intel Pentium CPU use at the time of this operating system release.
Ping	The ping command sends an Internet Control Message Protocol (ICMP) Echo Request message to a specified remote computer to verify IP-level connectivity. The ping command is available in all versions of Windows.
Pkgmgr	The pkgmgr command is used to start the Windows Package Manager from the Command Prompt. Package Manager installs, uninstalls, configures, and updates features and packages for Windows. The pkgmgr command is available in Windows 8, Windows 7, and Windows Vista.
Pnpunattend	The pnpunattend command is used to automate the installation of hardware device drivers. The pnpunattend command is available in Windows 8, Windows 7, and Windows Vista.
Pnputil	The pnputil command is used to start the Microsoft PnP Utility, a tool used to install a Plug and Play device from the command line. The pnputil command is available in Windows 8, Windows 7, and Windows Vista.
Popd	The popd command is used to change the current directory to the one most recently stored by the pushd command. The popd command is most often utilized from within a batch or script file. The popd command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Power	The power command is used to reduce the power consumed by a computer by monitoring software and hardware devices. The power command is available in Windows 98 and 95, as well as in MS-DOS. The power command was replaced by operating system integrated power management functions beginning in Windows XP.
Powercfg	The powercfg command is used to manage the Windows power management settings from the command line. The powercfg command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Print	The print command is used to print a specified text file to a specified printing device. The print command is available in all versions of Windows, as well as in MS-DOS.
Prompt	The prompt command is used to customize the appearance of the prompt text in Command Prompt or MS-DOS. The prompt command is available in all versions of Windows, as well as in MS-DOS.
Pushd	The pushd command is used to store a directory for use, most commonly from within a batch or script program. The pushd command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Pwlauncher	The pwlauncher command is used to enable, disable, or show the status of your Windows To Go startup options. The pwlauncher command is available in Windows 8.
Qappsrv	The qappsrv command is used to display all Remote Desktop Session Host servers available on the network. The qappsrv command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Qbasic	The qbasic command starts QBasic, the MS-DOS based programming environment for the BASIC programming language. The qbasic command is available in Windows 98 and 95, as well as in MS-DOS. The qbasic command is not installed by default with Windows 98 or 95 but is available from the installation disc or disks.
Qprocess	The qprocess command is used to display information about running processes. The qprocess command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Query	The query command is used to display the status of a specified service. The query command is available in Windows 8, Windows 7, and Windows Vista.
Quser	The quser command is used to display information about users currently logged on to the system. The quser command is available in Windows 8, Windows 7, and Windows Vista.
Qwinsta	The qwinsta command is used to display information about open Remote Desktop Sessions. The qwinsta command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Rasautou	The rasautou command is used to manage Remote Access Dialer AutoDial addresses. The rasautou command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Rasdial	The rasdial command is used to start or end a network connection for a Microsoft client. The rasdial command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Rcp	The rcp command is used to copy files between a Windows computer and a system running the rshd daemon. The rcp command is available in Windows 7, Windows Vista, and Windows XP. The rcp command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Subsystem for UNIX-based Applications Windows feature from Programs and Features in Control Panel and then installing the Utilities and SDK for UNIX-based Applications available here for Windows Vista and here for Windows 7. The rcp command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Rd	The rd command is the shorthand version of the rmdir command. The rd command is available in all versions of Windows, as well as in MS-DOS.
Rdpsign	The rdpsign command is used to sign a Remote Desktop Protocol (RDP) file. The rdpsign command is available in Windows 7.
Reagentc	The reagentc command is used to configure the Windows Recovery Environment (RE). The reagentc command is available in Windows 8 and Windows 7.
Recimg	The recimg command is used to create a custom refresh image. The recimg command is available in Windows 8.
Recover	The recover command is used to recover readable data from a bad or defective disk. The recover command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Reg	The reg command is used to manage the Windows Registry from the command line. The reg command can perform common registry functions like adding registry keys, exporting the registry, etc. The reg command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Regini	The regini command is used to set or change registry permissions and registry values from the command line. The regini command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Register-cimprovider	The register-cimprovider command is used to register a Common Information Model (CIM) Provider in Windows. The register-cimprovider command is available in Windows 8.
Regsvr32	The regsvr32 command is used to register a DLL file as a command component in the Windows Registry. The regsvr32 command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Relog	The relog command is used to create new performance logs from data in existing performance logs. The relog command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Rem	The rem command is used to record comments or remarks in a batch or script file. The rem command is available in all versions of Windows, as well as in MS-DOS.
Ren	The ren command is the shorthand version of the rename command. The ren command is available in all versions of Windows, as well as in MS-DOS.
Rename	The rename command is used to change the name of the individual file that you specify. The rename command is available in all versions of Windows, as well as in MS-DOS.
Repair-bde	The repair-bde command is used to repair or decrypt a damaged drive that’s been encrypted using BitLocker. The repair-bde command is available in Windows 8 and Windows 7.
Replace	The replace command is used to replace one or more files with one or more other files. The replace command is available in all versions of Windows, as well as in MS-DOS.
Reset	The reset command, executed as reset session, is used to reset the session subsystem software and hardware to known initial values. The reset command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Restore	The restore command is used to restore files that were backed up using the backup command. The restore command is only available in MS-DOS. The backup command was only available up to MS-DOS 5.00 but the restore command was included by default with later versions of MS-DOS to provide a way to restore files that were backed up in previous versions of MS-DOS.
Rexec	The rexec command is used to run commands on remote computers running the rexec daemon. The rexec command is available in Windows Vista and Windows XP. The rsh command is not available by default in Windows Vista but can be enabled by turning on the Subsystem for UNIX-based Applications Windows feature from Programs and Features in Control Panel and then installing the Utilities and SDK for UNIX-based Applications available here. The rexec command is not available in Windows 7 but can be executed in Windows XP via Windows XP Mode if need be.
Rmdir	The rmdir command is used to delete an existing or completely empty folder. The rmdir command is available in all versions of Windows, as well as in MS-DOS.
Robocopy	The robocopy command is used to copy files and directories from one location to another. This command is also called Robust File Copy. The robocopy command is available in Windows 8, Windows 7, and Windows Vista. The robocopy command is superior to the both the copy command and the xcopy command because robocopy supports many more options.
Route	The route command is used to manipulate network routing tables. The route command is available in all versions of Windows.
Rpcinfo	The rpcinfo command makes a remote procedure call (RPC) to an RPC server and reports what it finds. The rpcinfo command is available in Windows 7 and Windows Vista. The rpcinfo command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Services for NFS Windows feature from Programs and Features in Control Panel. The rpcinfo command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Rpcping	The rpcping command is used to ping a server using RPC. The rpcping command is available in Windows 8, Windows 7, and Windows Vista.
Rsh	The rsh command is used to run commands on remote computers running the rsh daemon. The rsh command is available in Windows 7, Windows Vista, and Windows XP. The rsh command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Subsystem for UNIX-based Applications Windows feature from Programs and Features in Control Panel and then installing the Utilities and SDK for UNIX-based Applications available here for Windows Vista and here for Windows 7. The rsh command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Rsm	The rsm command is used to manage media resources using Removable Storage. The rsm command is available in Windows Vista and Windows XP. The rsm command was optional in Windows Vista and then removed in Windows 7 due to Removable Storage Manager being removed from the operating system. Search for the rsm command in the C:\Windows\winsxs folder in Windows Vista if you’re having trouble executing the command.
Runas	The runas command is used to execute a program using another user’s credentials. The runas command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Rwinsta	The rwinsta command is the shorthand version of the reset session command. The rwinsta command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Sc	The sc command is used to configure information about services. The sc command communicates with the Service Control Manager. The sc command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Scandisk	The scandisk command is used to start Microsoft ScanDisk, a disk repair program. The scandisk command is available in Windows 98 and 95, as well as in MS-DOS. The scandisk command was replaced by the chkdsk command beginning in Windows XP.
Scanreg	The scanreg command starts Windows Registry Checker, a basic registry repair program and backup utility. The scanreg command is available in Windows 98 and Windows 95. The functions provided by the scanreg command were no longer necessary beginning in Windows XP due to changes in how the Windows Registry functions.
Schtasks	The schtasks command is used to schedule specified programs or commands to run a certain times. The schtasks command can be used to create, delete, query, change, run, and end scheduled tasks. The schtasks command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Sdbinst	The sdbinst command is used to deploy customized SDB database files. The sdbinst command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Secedit	The secedit command is used to configure and analyze system security by comparing the current security configuration to a template. The secedit command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Set	The set command is used to display, enable, or disable environment variables in MS-DOS or from the Command Prompt. The set command is available in all versions of Windows, as well as in MS-DOS.
Setlocal	The setlocal command is used to start the localization of environment changes inside a batch or script file. The setlocal command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Setspn	The setspn command is used to manage the Service Principal Names (SPN) for an Active Directory (AD) service account. The setspn command is available in Windows 8 and Windows 7.
Setver	The setver command is used to set the MS-DOS version number that MS-DOS reports to a program. The setver command is available in MS-DOS as well as in all 32-bit versions of Windows. The setver command is not available in 64-bit versions of Windows.
Setx	The setx command is used to create or change environment variables in the user environment or the system environment. The setx command is available in Windows 8, Windows 7, and Windows Vista.
Sfc	The sfc command is used to verify and replace important Windows system files. The sfc command is also referred to as System File Checker or Windows Resource Checker depending on the operating system. The sfc command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Shadow	The shadow command is used to monitor another Remote Desktop Services session. The shadow command is available in Windows 7, Windows Vista, and Windows XP.
Share	The share command is used to install file locking and file sharing functions in MS-DOS. The share command is available in MS-DOS as well as in all 32-bit versions of Windows. The share command is not available in 64-bit versions of Windows. Share is only available in Windows 8, 7, Vista, and XP to support older MS-DOS files.
Shift	The shift command is used to change the position of replaceable parameters in a batch or script file. The shift command is available in all versions of Windows, as well as in MS-DOS.
Showmount	The showmount command is used to display information about NFS mounted file systems. The showmount command is available in Windows 7 and Windows Vista. The showmount command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Services for NFS Windows feature from Programs and Features in Control Panel. The showmount command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Shutdown	The shutdown command can be used to shut down, restart, or log off the current system or a remote computer. The shutdown command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Smartdrv	The smartdrv command installs and configures SMARTDrive, a disk caching utility for MS-DOS. The smartdrv command is available in Windows 98 and 95, as well as in MS-DOS. Caching is automatic beginning in Windows XP, making the smartdrv command unnecessary.
Sort	The sort command is used to read data from a specified input, sort that data, and return the results of that sort to the Command Prompt screen, a file, or another output device. The sort command is available in all versions of Windows, as well as in MS-DOS.
Start	The start command is used to open a new command line window to run a specified program or command. The start command can also be used to start an application without creating a new window. The start command is available in all versions of Windows.
Subst	The subst command is used to associate a local path with a drive letter. The subst command is a lot like the net use command except a local path is used instead of a shared network path. The subst command is available in all versions of Windows, as well as in MS-DOS. The subst command replaced the assign command beginning with MS-DOS 6.0.
Sxstrace	The sxstrace command is used to start the WinSxs Tracing Utility, a programming diagnostic tool. The sxstrace command is available in Windows 8, Windows 7, and Windows Vista.
Sys	The sys command is used to copy the MS-DOS system files and command interpreter to a disk. The sys command is available in Windows 98 and 95, as well as in MS-DOS. The sys command is used most often to create a simple bootable disk or hard drive. The necessary system files for Windows are too large to fit on a disk so the sys command was removed beginning in Windows XP.
Systeminfo	The systeminfo command is used to display basic Windows configuration information for the local or a remote computer. The systeminfo command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Takeown	The takedown command is used to regain access to a file that that an administrator was denied access to when reassigning ownership of the file. The takeown command is available in Windows 8, Windows 7, and Windows Vista.
Taskkill	The taskkill command is used to terminate a running task. The taskkill command is the command line equivalent of ending a process in Task Manager in Windows. The taskkill command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tasklist	Displays a list of applications, services, and the Process ID (PID) currently running on either a local or a remote computer. The tasklist command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tcmsetup	The tcmsetup command is used to setup or disable the Telephony Application Programming Interface (TAPI) client. The tcmsetup command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Telnet	The telnet command is used to communicate with remote computers that use the Telnet protocol. The telnet command is available in all versions of Windows. The telnet command is not available by default in later versions of Windows, but can be enabled by turning on the Telnet Client Windows feature from Programs and Features in Control Panel.
Tftp	The tftp command is used to transfer files to and from a remote computer that’s running the Trivial File Transfer Protocol (TFTP) service or daemon. The tftp command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The tftp command is not available by default in Windows 8, 7, or Vista, but can be enabled by turning on the TFTP Client Windows feature from Programs and Features in Control Panel.
Time	The time command is used to show or change the current time. The time command is available in all versions of Windows, as well as in MS-DOS.
Timeout	The timeout command is typically used in a batch or script file to provide a specified timeout value during a procedure. The timeout command can also be used to ignore keypresses. The timeout command is available in Windows 8, Windows 7, and Windows Vista.
Title	The title command is used to set the Command Prompt window title. The title command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tlntadmn	The tlntadmn command is used to administer a local or remote computer running Telnet Server. The tlntadmn command is available in Windows 8, Windows 7, Windows Vista, and Windows XP. The tlntadmn command is not available by default in Windows 8, 7, or Vista, but can be enabled by turning on the Telnet Server Windows feature from Programs and Features in Control Panel.
Tpmvscmgr	The tpmvscmgr command is used to create and destroy TPM virtual smart cards. The tpmvscmgr command is available in Windows 8.
Tracerpt	The tracerpt command is used to process event trace logs or real-time data from instrumented event trace providers. The tracerpt command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tracert	The tracert command sends Internet Control Message Protocol (ICMP) Echo Request messages to a specified remote computer with increasing Time to Live (TTL) field values and displays the IP address and hostname, if available, of the router interfaces between the source and destination. The tracert command is available in all versions of Windows.
Tree	The tree command is used to graphically display the folder structure of a specified drive or path. The tree command is available in all versions of Windows, as well as in MS-DOS.
Tscon	The tscon command is used to attach a user session to a Remote Desktop session. The tscon command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tsdiscon	The tsdiscon command is used to disconnect a Remote Desktop session. The tsdiscon command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tskill	The tskill command is used to end the specified process. The tskill command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tsshutdn	The tsshutdn command is used to remotely shut down or restart a terminal server. The tsshutdn command is available in Windows XP. The ability to shut down a computer remotely is also available in the more powerful shutdown command so tsshutdn was removed beginning in Windows Vista.
Type	The type command is used to display the information contained in a text file. The type command is available in all versions of Windows, as well as in MS-DOS.
Typeperf	The typerperf command displays performance data in the Command Prompt window or writes the data to specified log file. The typeperf command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Tzutil	The tzutil command is used to display or configure the current system’s time zone. The tzutil command can also be used to enable or disable Daylight Saving Time adjustments. The tzutil command is available in Windows 8 and Windows 7.
Umount	The umount command is used to remove Network File System (NFS) mounted network shares. The umount command is available in Windows 7 and Windows Vista. The umount command is not available by default in Windows Vista or Windows 7 but can be enabled by turning on the Services for NFS Windows feature from Programs and Features in Control Panel. The umount command is not available in Windows 8 because Service for UNIX (SFU) was discontinued.
Undelete	The undelete command is used to undo a deletion performed with the MS-DOS delete command. The undelete command is only available in MS-DOS. The undelete command was removed beginning in Windows 95 due to the availability of the Recycle Bin in Windows.
Unformat	The unformat command is used to undo the formatting on a drive performed by the MS-DOS format command. The unformat command is only available in MS-DOS. The unformat command was removed beginning in Windows 95 due to file system changes.
Unlock	The unlock command is used to unlock a drive, disabling direct disk access for a program. The unlock command is only available in Windows 98 and 95. Drive locking is no longer available as of Windows XP.
Unlodctr	The unlodctr command removes Explain text and Performance counter names for a service or device driver from the Windows Registry. The unlodctr command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Vaultcmd	The vaultcmd command is used to create, remove, and show stored credentials. The vaultcmd command is available in Windows 8 and Windows 7.
Ver	The ver command is used to display the current Windows or MS-DOS version number. The ver command is available in all versions of Windows, as well as in MS-DOS.
Verify	The verify command is used to enable or disable the ability of Command Prompt, or MS-DOS, to verify that files are written correctly to a disk. The verify command is available in all versions of Windows, as well as in MS-DOS.
Vol	The vol command shows the volume label and serial number of a specified disk, assuming this information exists. The vol command is available in all versions of Windows, as well as in MS-DOS.
Vsafe	The vsafe command is used to start VSafe, a basic virus protection system for MS-DOS. The vsafe command is only available in MS-DOS. VSafe was designed for MS-DOS and Windows 3.x only. Microsoft provides an optional virus protection suite called Microsoft Security Essentials for Windows XP and later operating systems and third party antivirus tools are available for all versions of Windows.
Vssadmin	The vssadmin command starts the Volume Shadow Copy Service administrative command line tool which displays current volume shadow copy backups and all installed shadow copy writers and providers. The vssadmin command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
W32tm	The w32tm command is used to diagnose issues with Windows Time. The w32tm command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Waitfor	The waitfor command is used to send or wait for a signal on a system. The waitfor command is available in Windows 8, Windows 7, and Windows Vista.
Wbadmin	The wbadmin command is used start and stop backup jobs, display details about a previous backup, list the items within a backup, and report on the status of a currently running backup. The wbadmin command is available in Windows 8, Windows 7, and Windows Vista. The wbadmin command replaced the ntbackup command beginning in Windows Vista.
Wecutil	The wecutil command is used to mange subscriptions to events that are forwarded from WS-Management supported computers. The wecutil command is available in Windows 8, Windows 7, and Windows Vista.
Wevtutil	The wevtutil command starts the Windows Events Command Line Utility which is used to manage event logs and publishers. The wevtutil command is available in Windows 8, Windows 7, and Windows Vista.
Where	The where command is used to search for files that match a specified pattern. The where command is available in Windows 8, Windows 7, and Windows Vista.
Whoami	The whoami command is used to retrieve user name and group information on a network. The whoami command is available in Windows 8, Windows 7, and Windows Vista.
Winmgmt	The winmgmt command starts the command line version of WMI, a scripting tool in Windows. The winmgmt command is available in all versions of Windows.
Winrm	The winrm command is used to start the command line version of Windows Remote Management, used to manage secure communications with local and remote computers using web services. The winrm command is available in Windows 8, Windows 7, and Windows Vista.
Winrs	The winrs command is used to open a secure command window with a remote host. The winrs command is available in Windows 8, Windows 7, and Windows Vista.
Winsat	The winsat command starts the Windows System Assessment Tool, a program that assesses various features, attributes, and capabilities of a computer running Windows. The winsat command is available in Windows 8, Windows 7, and Windows Vista.
Wmic	The wmic command starts the Windows Management Instrumentation Command line (WMIC), a scripting interface that simplifies the use of Windows Management Instrumentation (WMI) and systems managed via WMI. The wmic command is available in Windows 8, Windows 7, Windows Vista, and Windows XP.
Wsmanhttpconfig	The wsmanhttpconfig command is used to manage aspects of the Windows Remote Management (WinRM) service. The wsmanhttpconfig command is available in Windows 8, Windows 7, and Windows Vista.
Xcopy	The xcopy command can copy one or more files or directory trees from one location to another. The xcopy command is generally considered a more “powerful” version of the copy command though the robocopy command trumps even xcopy. The xcopy command is available in all versions of Windows, as well as in MS-DOS. A command by the name of xcopy32 existed in Windows 95 and Windows 98. To avoid a long and confusing explanation here, just know that no matter if you executed the xcopy command or the xcopy32 command, you were always executing the most updated version of the command.
Xwizard	The xwizard command, short for Extensible Wizard, is used to register data in Windows, often from a preconfigured XML file. The xwizard command is available in Windows 8 and Windows 7.

New and deprecated functionality

Feature or functionality	New or Deprecated?	Description
Cluster	Deprecated	Create a new cluster or configure an existing cluster.
Dfscmd	Deprecated	Configure DFS folders and folder targets in a DFS namespace.
Dirquota	Deprecated	Creates and manages File Server Resource Manager quotas.
Filescrn	Deprecated	Create and manage file groups, file screens, file screen exceptions, and file screen templates that are used to configure general administrative options for screening files.
Fondue	New	Enable optional features in Windows by downloading required files from Windows Update or a source that Group Policy specifies.
PowerShell_Ise	New	Read, write, run, debug, and test Windows PowerShell scripts and modules in a friendly, graphic-assisted environment.
Servermanagercmd	Deprecated	Install or remove roles, role services, and features.
Shadow	Deprecated	Monitor an RD Session Host session.
Storrept	Deprecated	Create and manage storage reports and storage report tasks, and configure general administrative options for File Server Resource Manager.

Microsoft Offers Premium Assurance – 16 Years of Product Support?

Microsoft has announced they will be rolling out Windows Server Premium Assurance and SQL Server Premium Assurance in early 2017. This new feature adds six more years of support beyond the current 10 years of standard support. During the six years of Premium Assurance, paying customers will get security updates and bulletins that are rated “Critical or “Important.”

“Premium Assurance pricing will start at 5% of the current product license cost, and will increase over time (up to 12%). Buying before the end of June 2017 means you will save nearly 60% on the cost of Premium Assurance,” according to Microsoft’s post.

This is seen as a favorable departure from Microsoft’s strict 10 year support calendar used today, which caused significant issues when many customers were unwilling to migrate from Window XP and Windows 2003 on schedule.

Tips and Tricks for Active Directory Management

Managing Active Directory is essential for your network security. Here are a few tips to help you better manage your Active Directory:

Disable the default Guest Account – This is a security best practice recommended by Microsoft. Disabling the guest account can protect you from simple and very basic attacks. It is also an item that security auditors look for to verify you are using security best practices.
1. Log on as a member of the Domain Admins group, and then open Active Directory Users and Computers.
2. In the console tree (left pane), click Users.
3. In the details pane (right pane), right-click Guest, and then click Rename.
4. Type the fictitious first and last name and press Enter.
5. Right-click the new name, and then click Properties.
6. On the General tab, delete the Description “Built-in account for guest access to the computer/domain” and type in a description to resemble other user accounts (for many organizations, this will be blank).
7. In the First name and Last name boxes, type the fictitious names.
8. On the Account tab, type a new User logon name, using the same format you use for your other user accounts, for example, first initial and last name.
9. Type this same new logon name in the User logon name (pre-Windows 2000) box, and then click OK.
10. Verify that the account is disabled. The icon should appear with a red X over it. If it is enabled, right-click the new name, and then click Disable Account.
Rename the default Administrator account – This is an essential security best practice. One of the first things a malicious user or hacker will do is look to compromise the default administrator account. You want to hide the default account by renaming it to something other than the default name. It is also an item that security auditors look for to verify you are using security best practices.
1. Log on as a member of the Domain Admins group, and then open Active Directory Users and Computers.
2. In the console tree (left pane), click Users.
3. In the details pane (right pane), right-click Administrator, and then click Rename.
4. Type the fictitious first and last name and press Enter.
5. In the Rename User dialog box, change the Full name, First name, Last name, Display name, User logon name, and User logon name (pre-Windows 2000) values to match your fictitious account name, and then click OK.
6. In the details pane (right pane), right-click the new name, and then click Properties.
7. On the General tab, delete the Description “Built-in account for administering the computer/domain” and type in a description to resemble other user accounts (for many organizations, this will be blank).
8. On the Account tab, verify that the logon names are correct.
Maintain Physical Security – People will often focus on system security when thinking about ways to secure your Active Directory, but physical security is also required. Make sure people can’t just walk up to your Domain Controllers and attempt to bypass your security. If there are places where you can’t prevent physical access then consider turning that instance into a Read-Only Domain Controller.
Disaster Planning – Disasters will happen, and I’m not just talking about fires, hurricanes, earthquakes, and tornadoes. What will you do if you find out an entire OU, containing 100 users, was deleted by mistake last night? Do you have a plan on how to resolve that issue, or are you expecting to just know all 100 users names, security settings, etc. as well as making the time to contact each user and help them log into the network with their new password and verify their network security setting are resolved? This could take days to resolve and it would be a PR nightmare.
Prohibit Shared Accounts – Never allow anybody to share accounts, especially if the account has administrator privileges. It is almost impossible to determine who performed what action if multiple people are sharing a network account. It also creates security problems when someone is terminated that might know the password.
Documentation – You can’t allow the Active Directory structure to grow uncontrolled and without a plan. Document the system, and keep the document updated. By creating a structure with basic logic and control, you are less likely to allow random changes that make no sense and people will never understand. Use the description fields in the tool to make this easier, but also an external document that explains the current status and reason for the structure.
Delegate Responsibilities – Don’t allow just one person to perform all the Active Directory work. Even if your backup resource is only available one or two days a week, at least they are familiar with your AD structure and corporate procedures. One day you will find that backup resource a safely net that could save the day.
Single Purpose Servers – You Domain Controller should be used only for user authentication, which is Active Directory and even DNS. Don’t install other applications or utilities, including products that can lead to security vulnerabilities like Adobe Reader, Microsoft Office, and Java.
Beware Storing Extra Data – There are many fields available in Active Directory, including fields like address, telephone numbers, etc. It can serve a business purpose to complete some of these fields, but you must be careful when making a decision about who should have access to this data to prevent privacy or security issues.
Delay Changes – Never allow yourself or others to make changes to your Active Diretcory before the weekend. Unless it is a required change that must be made on a Friday afternoon (a user termination is a good example) then wait until Monday to make the change. It can take days for a mistake to be uncovered, and you would rather deal with those mistakes during the week than on your precious weekend.

Free eBooks from Microsoft Blog

Interested in free ebooks from Microsoft? This post from Eric Ligman, Microsoft Director of Sales Excellence Blog, provides links to several free development books available in electronic format. The topics range from Visual Studio, Windows 10, Windows Phone, Office, and SQL Server. Take a look and see if you find something interesting.

Using “SQL Power Doc” to Document SQL Server Instances

There is a powerful SQL Server documentation tool available for you to use today, and you might not even know it exists. This free tool isn’t new, but it has been maintained and supported, so it is worth your evaluation if you want an easy to use scripting tool to output your documentation into Excel format.

This is a PowerShell-based tool that is a collection of scripts that you execute on your client PC, like your desktop, and it scans your network looking for Window instances running SQL Server. It then uses it’s collection of scripts to collect data on Windows and SQL Server, then dumps all that collected information into well-formatted and easy to read Excel documents.

Like the website says:

SQL Power Doc is a collection of Windows PowerShell scripts and modules that discover, document, and diagnose SQL Server instances and their underlying Windows OS & machine configurations. SQL Power Doc works with all versions of SQL Server from SQL Server 2000 through 2014, and all versions of Windows Server and consumer Windows Operating Systems from Windows 2000 and Windows XP through Windows Server 2012 R2 and Windows 8. SQL Power Doc is also capable of documenting Windows Azure SQL Databases.

Discover

Find SQL Server Services on your network by:

Active Directory DNS
Subnet Scan
Computer Name

Document

Collect comprehensive details about SQL Server instances and their underlying Windows OS, including:

Service Details For All Installed SQL Sever Services
Database Engine
- Configuration
- Security
- Server Objects
- Databases
  - Configuration
  - Database Objects
  - Service Broker
  - Storage
  - Security
SQL Agent
- Configuration
- Jobs
- Alerts
- Operators
Windows OS
- Machine Information
- OS Information
- Software

This documentation is useful for:

Baselines – know what your SQL Server environment looked like last week, last month, etc.
Security Audits
Licensing Audits
Provide a complete look at how your servers are configured without having to grant access
Troubleshooting
Comparing servers and databases
Creating a runbook that you can give to your operations team
Planning upgrades – see what hidden features are in use on an instance

Diagnose

SQL Power Doc performs over 100 checks to find hidden problems and performance bottlenecks on your SQL Servers before they turn into major headaches.

But Wait, There’s More!

SQL Power Doc isn’t limited to just SQL Server – you can also use it to collect an inventory of all the Windows machines on your network. If you’re in need of a free documentation solution for Windows SQL Power Doc is up to the task!

The stated goal of the “SQL Power Doc” scripts is to allow everyone to identify SQL Server instances, document the settings of SQL Server and the Windows hosts, and help diagnose any issues with those instances.

I’m no PowerShell expert, but I was able to use the available documentation and get it working in my environment. I will tell you that if you do run into issues, there is very limited help documentation available on the site. The more you know about PowerShell in general, the easier this will be for you if you need to troubleshoot issues.

Walkthrough

After you download the free installation, the next step is to follow the instructions to get it installed on the client PC you are going to use for the information collection process. There is a very good guide provided that will help walk you through that quick process.

The next step is to discover your servers and collect an inventory. While your environment is probably different from other networks for some reason or another, it should be fairly easy to scan your environment.

There are three ways to discover servers on your network:

You can query Active Directory, using DNS, for a list of endpoints
You can scan a specific subnet using IP Address ranges
You can use a list of specific machine names in a text file

Script Example

I use a fairly generic method of scanning all instances in a specific IP Address range. This method works well for me because I know the range of IP Addresses used for my SQL Server instances. If you have several different ranges or other network configuration issues that make this difficult to use, one of the other techniques listed should work in your environment (you may need to scroll the PowerShell code example to see the entire text).

./Get-SqlServerInventoryToclixml.ps1 -Subnet 10.10.10.0/24 -LoggingPreference Verbose

This script is an easy to understand example. It looks for all instances in the 10.10.10.0 – 10.10.10.255 range of IP Addresses looking for systems that respond to a ping. Then it attempts a WMI query on those systems that responded to the original ping, looking for instances with SQL Server. If both of those steps complete successfully, it begins collecting very detailed information about the Windows instance, as well as the SQL Server instance, on that device.

The “-LoggingPreference Verbose” at the end of the command forces the script to provide very detailed logging. The default setting is “standard”, but that will not provide you with the detailed data required for troubleshooting issues. Once you know your scripting solution is working as expected, you can drop this portion of the command or change the settings to your desired level of logging detail.

In my environment, this data collection script took less than 10 minutes to execute.

The next scripting command is to take the collected data and convert it into a human-readable format. This PowerShell script is also provided, and it just uses the data collected in the first script to output 3 Excel spreadsheets (you may need to scroll the PowerShell code example to see the entire text).

.\Convert-SqlServerInventoryClixmlToExcel.ps1 -FromPath "C:\Inventory\SQL Server Inventory.xml.gz"

This step took another 10-15 minutes to generate the desired Excel files.

Script Tips and Tricks

Here are the hints about my environment that might be a little different from your setup, but might be helpful if you are trying to learn about how to use these scripts.

The installation examples put the PowerShell scripts in your “My Documents” folder on your client, and it expects the scripts to be located in a folder named “WindowsPowerShell”. You can change this, but expect that to add some complexity to the installation and also the required troubleshooting steps if you run into an issue. My advice is to follow the examples and get the scripts working, then make changes to put everything where you want it, if a change is required.
The first script will expect to output the results into a folder on the root of your system disk, which is normally your C: drive. It attempts to output the results to “C:\Inventory”. This can also be changed, but once again I warn you to get the scripts working first, then explore the changes required to get a path change working correctly.
The second script expects the path to the output (the xml.gz file) from the first step. Don’t make this path too complicated or it could add too much complexity to the PowerShell script. Remember: K.I.S.S. = Keep It Simple Stupid
I found that you need to be a local administrator on the target Windows instance for the scanner to operate correctly. I’m sure there is a way around this issue, and I haven’t investigated a solution yet, but that will limit which systems will be discovered until that is resolved.

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Server Message Block (SMB) Traffic

Recommendations

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

How to respond to a ransomware attack

1. Quarantine Infected Systems

2. Block Internet Access

3. Identify Ransomware

4. Disable Scheduled Tasks

5. Remove Ransomware from Infected Systems

6. Don’t Pay the Ransom

7. Restore Your Backups

8. Restore Network

9. Change Passwords

10. Investigate Intrusion

Summary

Share this:

Like this:

Azure Portal

PowerShell

Share this:

Like this:

Configuration Policy – Endpoint Security

Compliance Policy

Windows 10 Update rings

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Azure Portal

PowerShell

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Discover

Document

Diagnose

But Wait, There’s More!

Walkthrough

Script Example

Script Tips and Tricks

Share this:

Like this:

Share this:

Like this: