Memoirs of a Consultant https://docs.microsoft.com/archive/blogs/janesays/feed.xml Great computing starts with a story. Welcome to my personal blog with tales from the field. Mon, 30 Jul 2018 14:03:05 GMT en-US hourly 1 Using SecPol to block access to a specific folder https://docs.microsoft.com/archive/blogs/janesays/blockfolderaccess Mon, 30 Jul 2018 09:58:29 GMT https://blogs.technet.microsoft.com/janesays/?p=305 Customers operating in high security environments, usually want to block access to specific folders. Using this method I was able to safely remove the write access from users without harming the functionality of Windows. BUT!!!! Please use at your own risk, and test in your own labs before executing and implementing. The use of SecPol to achieve this was passed onto me by friend, so shoutout to them :)  
  • Launch MMC (Run > MMC.exe)
  • Add Security Templates (File > Add/Remove Snap-in… > Security Templates)
   
  • You’ll have to set the source path to C:\Windows\security\templates
    • Delete the default generated source (Right click the source and delete)
    • Then right click and click on “New Template Search Path…”
      • Set it to: C:\Windows\security\templates
 
  • Create a new template (Right click on the source > New Template)
    • Name it “BlockFavoritesFolderAccess”
 
  • Expand the new directory and select file system folder.
    • Either right click on it or click on Actions > Add File…
 
  • Navigate to the user’s specific profile. (Users > Username > Favorites)
 
  • Add or select the user or group, set the permission, and click OK
    • Allow Read
    • Deny Write
    • Uncheck everything else
 
  • Select “Replace existing permission on all sub folders and files with inheritable permissions, and click OK
 
  • Close out of MMC (no need to “Save console settings to Console”
  • Then select yes to save the newly created .inf file Note: Notice where the .inf file is stored.
  Now you have an inf file to run Secedit against, which will set the decretory ACLs you specified. Create a script/batch file or manually copy that newly created inf file into C:\Windows\Security\Templates of the machine your targeting, and run the following command:
  • Open CMD (Admin)
    • Navigate to C:\Windows\Security\Templates
    • Then Run:
      • secedit /configure /db BlockFavoritesFolderAccess.sdb /cfg BlockFavoritesFolderAccess.inf /overwrite /log BlockFavoritesFolderAccess.log
      • Type “y” for Yes to accept the override
]]> WaaS (Windows as a Service) FAQ https://docs.microsoft.com/archive/blogs/janesays/waas-windows-as-a-service-faq Sun, 13 May 2018 18:57:52 GMT https://blogs.technet.microsoft.com/janesays/?p=205 I put together this comprehensive WaaS FAQ. These are the questions that I have come across in the field that are either scattered in more than one place or may not be documented explicitly. My main goal for this FAQ is to help you get comfortable with the idea of WaaS, which hopefully in turn will allow you to have that conversation with your peers and superiors. In my experience the beginning discussions of adopting WaaS are just as hard as the actual implementation phase. It is a very new way of doing things, and customers typically have the most peculiar questions with a lot of resistance upfront. The idea is for this FAQ to capture as much of that as possible and serve a single area information for those who need help or are interested in this topic. This post will be a living document and will continually be edited and updated.
  • What is WaaS?
    • “Windows as a Service” is really about simplifying the overall process of how to get the latest versions of Windows to your users. Instead of the fork-lift approach of building and then deploying, the process has become a lot more streamlined, where the building and deploying efforts are much smaller, but ongoing/constant. Think of your mobile device getting updates; iOS 11.01 to 11.02. No wipe and reloads, golden images, thick clients, and so on. Once on Windows 10 SAC (Semi Annual Channel – Formally Current Branch), the next version you get can be as simple as getting a patch like update from either Windows Updates or SCCM (assuming enterprise).
  • Give it to me straight, what does this mean for users?
    • Two (semi-annual) feature updates a year. One around March, and the other around September.
  • What is a feature update?
    • Targeted twice per year, a feature update is a patch-like package that can be deployed like you deploy any other Windows patch today. With this is newish direction, Microsoft will always be working on new features, that either don’t make the cut, or end up making in the next feature update. Expect subtle changes, not major. Think Windows 7 to SP1 not Windows XP to Windows 7.
  • How many features updates should we expect a year?
    • As mentioned above, two. One near the beginning of the year dubbed “2-Digit Year + 03” and another one later on in the year dubbed “2-digit year + 09”. As you may have guessed, the "03" and "09" in name refers to the months "March" and September".  Examples: 1703 (March of 2017) and 1709 (September of 2017). Note: This does not mean they will come out exactly in these months, but close to it. The fixed naming convention is for consistency.
  • Up to how many feature updates can a single machine/user skip, not in terms of support, but in terms of requisitions for going from one OS level to the other?
    • As of right now (with no known plans to change this) any Win10 version can be upgraded to any newer Win10 version. So, there is no limit as to the number of versions that can be skipped (outside of supportability for the older version).
      • Keep in mind the following:
        • When skipping many versions, this may lead to additional hurdles due to the big jump.
        • Another thing to keep in mind is the method you use to upgrade. For example, W10 1507 is not supported on SCCM 1802. So even though you can technically upgrade from any W10 version to any newer W10 version, the method of upgrade may be limited and not compatible. 
  • What is a UWP App?
    • A UWP (Universal Windows Platform) App is as the name the suggests; an application built on a platform that can be universally used across all your Windows 10 devices. All UWP apps are distributed as an .AppX package and are disturbed through the Windows Store. Think how of how the same application can work on both an iPad, or an iPhone.
  • Can a UWP App be Removed?
    • Yes. So, some of these apps come pre-installed, and among those are some that kind of feel built-in.  For the ones you have either downloaded yourself, or for some of the ones that have come pre-installed, you can simply remove them via the Windows Store, or by right clicking the app itself, and clicking on uninstall. For the Windows 10 built-in apps like Photos, Maps, Mail and Calendar, those require some more tinkering like running a PS script. I don’t recommend this route, instead I recommend blocking them via policy.
  • Can a UWP App be Blocked?
    • Yes. The best way to accomplish this is to use the built-in AppLocker tool (only available on the Enterprise version). This feature is configured via policy. Look for a guide to be posted on my blog soon. Until then, many tutorials out there on the net.
  • How are UWP App’s updated?
    • Through the Windows Store, and while the “Store” is the frontend platform/GUI, UWP App updates do also go through the Windows Update APIs.
  • What happened to “Windows Photo Viewer” (formally known as “Windows Picture and Fax Viewer”), which was the default photo viewer on Windows since XP?
    • “Windows Photo Viewer” is no longer the default photo viewer on Windows 10. The “Photos” UWP application that comes preinstalled with the OS has taken its place.
  • Can Cortona be blocked?
    • Yes. Via group policy, under: Computer Configuration > Administrative Templates > Windows Components > Search. Locate Allow Cortana and double-click on it to open the relevant policy. Select Disabled.
  • I thought “Paint” was R.I.P?
    • It was, then it wasn’t, and now who knows. Sarcasm aside, Paint is still available on Windows 10. The idea for now is that Microsoft plans to keep the original “Paint” as part of the system, but at some point, it will be removed from the OS officially, and will be available for download through the “Windows Store”. No timeframe has been provided for this move yet. “Paint 3D” which has been available since W10 1709 is considered to be its more modern replacement.
  • Can’t I just install the Long-term servicing branch/channel and call it a day?
    • This is not a solution. The rule of thumb is, if the machine has an Office applications on it, then it most likely should not be running LTSC. This servicing channel is meant for really specific and special cases. More importantly you may eventually run into a hardware compatibility issue when it comes to things like Silicon support for example. Again, this servicing channel is meant for machines that are not meant to be updated or changed frequently. Think specific computer for a line machine at the factory that is off the network, that may have a computer refresh cycle every 5-10 years.
  • How will Microsoft handle LTSC support and releases?
    • Microsoft will offer a new LTSC release every 2-3 years. This channel will support the currently released silicon at the time of release. As future silicon generations are released, you will need a newer version of Windows 10 to support the newly released silicon. So, if you receive new hardware, you will need to wait for next release of LTSC for support on the new silicon.
  • Does Edge need Internet Explorer to Function?
    • Edge does not need IE to function (Technically), but for the time being, the combo of having both of them is something I recommend especially for Enterprises in terms of experience. If you wanted to you can disable IE 11, and Edge would work just fine. No dependencies.
    • However, there are aspects that have been designed to work together:
      • For example: Using the Enterprise Mode Site List, you can dictate which sites Microsoft Edge should open in Internet Explorer 11. For those sites, they will essentially open automatically in IE 11. Depending on configuration you select, a user will either be warned about it, or it will just happen.
  • What type of Application is Edge?
    • Yes, it’s true, Edge is a UWP app. It is not available via the store per se, but built-in into the OS.
  • How does Edge receive updates?
    • Through Windows Update. Security updates are released every two to four weeks, and the bigger updates are pushed out as part of W10 feature updates.
]]> Compare all properties of two objects in Windows PowerShell https://docs.microsoft.com/archive/blogs/janesays/compare-all-properties-of-two-objects-in-windows-powershell Tue, 25 Apr 2017 00:12:54 GMT https://blogs.technet.microsoft.com/janesays/?p=45 Compare-Object cmdlet, which has been around forever in Windows PowerShell, is one of the most flexible and useful cmdlets out there. If you're an IT Professional of any kind, whether you work with Exchange Server or manage file servers, Compare-Object can make you look like a genius. In the past, I've used it for a number of random tasks, from comparing Active Directory group memberships to detecting changed files/folders on a file server. The Compare-Object cmdlet really shines when you're comparing collections of like objects, and, although it allows you to also compare based on specific object properties, that sometimes leaves a little to be desired. Take for instance, the comparison of two Active Directory user objects. It is fairly common for an administrator to come across scenarios where you need to compare two Active Directory users and find the specific differences. Usually, you're troubleshooting something strange that happens for one user but not the other. Often times it may come down to how particular attributes have been configured on the user object. So, Compare-Object to the rescue, right? Not so fast. [ps] $ad1 = Get-ADUser amelia.mitchell -Properties * $ad2 = Get-ADUser carolyn.quinn -Properties * Compare-Object $ad1 $ad2 [/ps] Running this code gives you the following output. Not exactly helpful. Of course, we know that the identity of the reference object and difference object will not be the same. 
InputObject						SideIndicator
-----------						-------------
CN=carolyn.quinn,OU=Users,DC=contosocorp,DC=us		=>           
CN=amelia.mitchell,OU=Users,DC=contosocorp,DC=us	<=
To take the comparison one step further, you can use the -Property parameter. This allows you to compare one or more specific parameters. More helpful than the last example, but it assumes you know where the differences between the objects lie. [ps] $ad1 = Get-ADUser amelia.mitchell -Properties * $ad2 = Get-ADUser carolyn.quinn -Properties * Compare-Object $ad1 $ad2 -Property title,department [/ps] Okay, this is definitely more helpful. We can see by the output below that the user objects have different title and department attributes. However, we had to specify the attributes we wanted to compare. If we wanted to compare all attributes, this would be a very long command or a very manual process to compare each attribute. 
title             department SideIndicator
-----             ---------- -------------
Finance Associate Finance    =>           
Accountant II     Accounting <=
So, with a little extra logic, we can do this pretty easily. First, we define the Compare-ObjectProperties function. That function will take any two source objects and get a unique list of all of the property names of both objects we're comparing. This is necessary because objects aren't always going to have the same set of attributes. When that is the case, we want to see where one has a null value and the other is populated. With the list of unique property names, our function can iteratively process them through Compare-Object and only return the properties that are different. [ps] Function Compare-ObjectProperties { Param( [PSObject]$ReferenceObject, [PSObject]$DifferenceObject ) $objprops = $ReferenceObject | Get-Member -MemberType Property,NoteProperty | % Name $objprops += $DifferenceObject | Get-Member -MemberType Property,NoteProperty | % Name $objprops = $objprops | Sort | Select -Unique $diffs = @() foreach ($objprop in $objprops) { $diff = Compare-Object $ReferenceObject $DifferenceObject -Property $objprop if ($diff) { $diffprops = @{ PropertyName=$objprop RefValue=($diff | ? {$_.SideIndicator -eq '<='} | % $($objprop)) DiffValue=($diff | ? {$_.SideIndicator -eq '=>'} | % $($objprop)) } $diffs += New-Object PSObject -Property $diffprops } } if ($diffs) {return ($diffs | Select PropertyName,RefValue,DiffValue)} } $ad1 = Get-ADUser amelia.mitchell -Properties * $ad2 = Get-ADUser carolyn.quinn -Properties * Compare-ObjectProperties $ad1 $ad2 [/ps] Running the above code produces the following output. This is definitely what we're looking for. 
PropertyName			RefValue						DiffValue
------------			--------						---------
CanonicalName			contosocorp.us/Users/amelia.mitchell			contosocorp.us/Users/carolyn.quinn
CN				amelia.mitchell						carolyn.quinn
Created				2/16/2017 9:31:12 AM					2/16/2017 9:31:15 AM
createTimeStamp			2/16/2017 9:31:12 AM					2/16/2017 9:31:15 AM
Department			Accounting						Finance
DisplayName			Amelia Mitchell						Carolyn Quinn
DistinguishedName		CN=amelia.mitchell,OU=Users,DC=contosocorp,DC=us	CN=carolyn.quinn,OU=Users,DC=contosocorp,DC=us
dSCorePropagationData		{2/16/2017 9:53:26 AM, 2/16/2017 9:31:12 AM,...		{2/16/2017 9:53:25 AM, 2/16/2017 9:31:15 AM, 12/31/1600 6:00:0...
employeeType			FullTime						Contractor
GivenName			Amelia							Carolyn
Manager				CN=christopher.walsh,OU=Users,DC=contosocorp,DC=us
MemberOf			{CN=Group8842,OU=Groups,DC=contosocorp,DC=us...		{CN=Group8896,OU=Groups,DC=contosocorp,DC=us...
Modified			4/24/2017 7:51:46 AM					4/24/2017 7:51:56 AM
modifyTimeStamp			4/24/2017 7:51:46 AM					4/24/2017 7:51:56 AM
Name				amelia.mitchell						carolyn.quinn
ObjectGUID			e3436c96-ac59-4b0a-a2cd-cea586676089			27abcbb9-57f8-4e4d-8f87-a5ee0e3d6ddd
objectSid			S-1-5-21-827217070-865584383-1086049070-1208 		S-1-5-21-827217070-865584383-1086049070-1249
Office				LON							NYC
PasswordLastSet			2/16/2017 9:31:12 AM					2/16/2017 9:31:15 AM
physicalDeliveryOfficeName	LON							NYC
pwdLastSet			131317326721610425					131317326757222285
SamAccountName			amelia.mitchell						carolyn.quinn
SID				S-1-5-21-827217070-865584383-1086049070-1208		S-1-5-21-827217070-865584383-1086049070-1249
sn				Mitchell						Quinn
Surname				Mitchell						Quinn
Title				Accountant II						Finance Associate
UserPrincipalName		amelia.mitchell@contosocorp.us				carolyn.quinn@contosocorp.us
uSNChanged			372797							372798
uSNCreated			17224							17511
whenChanged			4/24/2017 7:51:46 AM					4/24/2017 7:51:56 AM
whenCreated			2/16/2017 9:31:12 AM					2/16/2017 9:31:15 AM
One of the best things about this function is that you're not limited to comparing Active Directory user objects. You can use any two objects you want, and they don't even have to be the same type of object! Try for yourself using the example below, which compares a file object to a service. Granted, there probably aren't many use cases for such a scenario, but you never know. The capability is there nonetheless. [ps] $file = Get-Item -Path C:\Windows\System32\notepad.exe $service = Get-Service -Name WinRM Compare-ObjectProperties $file $service [/ps] Happy PowerShell'ing. See you next time. ]]>