HOW-TO: Import Out of Band Updates to WSUS using Microsoft Edge Chromium IE Mode and PowerShell
----- I recommend using https://www.powershellgallery.com/packages/Import-WSUSUpdate Full instructions to install the module are located here -https://www.ajtek.ca/blog/the-new-way-to-import-updates-into-wsus/ ----- History: 09/12/2023 - adding PowerShell method to the OP 07/30/2023 - please follow the latest comments for the updated approach using PowerShell. The method in the OP has become obsolete 01/13/2022 - update links and clarification to prevent an error "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS", added Troubleshooting and Q&A section. 02/11/2021 - initial version PREREQUISITES: Windows 10 / 11 / Windows Server 2016 or later with WSUS RSAT Tool installed. latest Microsoft Edge installed, version 97 as of time of writing. Internet Explorer (mode) is installed in Settings > Apps > Optional Features or equivalent location in Windows 11 HOW-TO: - Open Edge 97 or later - Open Microsoft Edge Options > Default Browser - Change "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow' - Add links to add to Microsoft Edge IE Mode - Remove allother links in the scope of *.catalog.update.microsoft.com, only these shall remain for the catalog.update.microsoft.com page. https://catalog.update.microsoft.com/ https://catalog.update.microsoft.com/v7/site/Home.aspx see screenshots below for better illustration. - Close Edge and all catalog tabs if there were any open, especially if you use "Open tabs from the previous session" feature - Open WSUS MMC and right click Updates from the tree > Import Updates - The link in Edge should open in IE mode, there are several indicators on this the open tab to point tohttps://catalog.update.microsoft.com/v7/site/Home.aspx?SKU=WSUS&Version=10.0.xxxxx.xxxx&ServerName=YOURSERVER.CONTOSO.LOCAL&PortNumber=8531&Ssl=True&Protocol=1.20 NOTES 1.When the link opened in importing updates from WSUS MMC does not contain the "v7/site/" part or does contain a https://www.updateinstead of https://catalog.updateyour configuration is wrong. 2. The "Default" setting will not be sufficient to allow the installation and use of the ActiveX plugin. Go back to your update catalog tab, Install the ActiveX if you have not done on this box already. Check if you have not setup restrictions to execute or install ActiveX plugins in IE directly or via group policy. 3. Edge now has the ability to an IE Mode button. Also it has a new feature to automatically add pages to the exception list.Do not use this ability as shown in the picture for this use case as it might add wrong exceptions to the list. 4. When there are wrong exceptions in the exception list for IE mode it might not work correctly and cause a missing but very important redirection, which ultimately cause the import to fail. More troubleshooting assistance below. LINKS STARTING FROM DECEMBER 2021 / JANUARY 2022: Links to add to Microsoft Edge IE Mode https://catalog.update.microsoft.com/ https://catalog.update.microsoft.com/v7/site/Home.aspx TROUBLESHOOTING: Q 1: Microsoft Edge does not allow me to configure any IE Site Mode links (greyed out). A: Either you have not enabled "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow', or your enterprise has set policies to prevent that. This should be clearly indicated by a lock and message in the Edge settings tab. Q 2: I have followed this guide or a previous version. I can see the cart to import into WSUS but cannot import any or just specific updates. Others fail with a message "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS". A: This is a "known" issue and the guide has been updated to reflect this issue and a potential change on the server-side. Please make sure only the two links are included in your IE mode list. They may not include www in the link name. You need to include both links, not just one or the other as in the previous version of this guide. Q 3: May I use the new Edge feature in Settings > Appearance > Internet Explorer Mode button A: I would recommend to refrain using this feature, as the mechanism between WSUS update import and the browser is extremly picky. It would not work if you just copy the same link into a browser tab. The feature of the cart to import into WSUS will be likely missing and you can just download to the Download folder instead. Q 4: Edge offers me to restart this tab in IE mode next time. A: you should not receive this message, otherwise the exceptions as stated in the guide are invalid or you have more than the stated links in place. Go through the guide again and double-check. Do not use this otherwise nice feature. It will cause to add more catalog links to the exception list which will cause an issue to import updates to WSUS, as described in Q #2. Thanks for the hintEric_VanAelstyn, thanks toabbodi1406for additional hints after this guide got invalid a redirection change in December 2021 / January 2022. ccAriaUpdatedMissyQ cc for the other teams as I did not want to repost it in Edge and Servicing communities, unless you insist šActive Directory Advanced Threat Hunting - Compare GPOs with the Security Compliance Toolkit
Dear Microsoft Active Directory friends, Even in the age of digital transformation, group policy settings (still) play a crucial role in maintaining network security and compliance. Advanced Hunting, an advanced technique for monitoring and analyzing these settings, is an indispensable tool for administrators. This method makes it possible to gain in-depth insights into the configuration and security situation of Windows networks. By using specific tools and scripts, professionals can detect security vulnerabilities, identify configuration errors and ensure that all group policies meet the highest security and compliance requirements. This article introduces the concept of Advanced Hunting for Group Policy settings and how it can transform management and security in IT infrastructures. Do we now need additional software and/or expensive tools? No, all we need is a little time, curiosity and the "Security Compliance Toolkit", which Microsoft is making available to us free of charge (thanks to Microsoft at this point). But first let's take a closer look at the MITRE techniques and the relevant Windows Event IDs. Before we start analyzing the group policy settings. We start with a list of MITRE techniques: Domain Policy Modification https://attack.mitre.org/techniques/T1484/ Domain Policy Modification: Group Policy Modification https://attack.mitre.org/techniques/T1484/001/ Group Policy Discovery https://attack.mitre.org/techniques/T1615/ Domain Policy Modification: Domain Trust Modification https://attack.mitre.org/techniques/T1484/002/ Unsecured Credentials: Group Policy Preferences https://attack.mitre.org/techniques/T1552/006/ The Windows Event ID's for the MITRE techniques: Domain Policy Modification 4739(S): Domain Policy was changed https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4739 Group Policy Discovery Appendix L: Events to Monitor https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor Domain Policy Modification: Domain Trust Modification 4716(S): Trusted domain information was modified https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4716 Compare the Default Domain Controllers Policy with the security baselines using the Policy Analyzer! So that we can compare the Default Domain Controllers Policy, we create a backup: Security Compliance Toolkit and Baselinescan be downloaded here: https://www.microsoft.com/en-us/download/details.aspx?id=55319 We need the necessary tools and baselines: Extract the files: From the Windows-Server-2022-Security-Baseline-FINAL folder, copy the following file: Paste the file in the Policy Analyzer folder: Open the Policy Analyzer: NOTE:If you have a low screen resolution you may not be able to see the bottom part of the application. It is important that you see the bottom part so that you can adjust the path to the policy rule sets (see red marker). Now we have to add the default domain controller policy: Click on the import button: Give it a name and then click on safe: Now you can compare the policy with the security baseline: HAPPY COMPARING! If you want to examine your Active Directory with PowerShell, you will find a "small" compilation of various PowerShell scripts in the following link: https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting/tree/main/PowerShell NOTE:Before using these scripts, make sure that you have the necessary authorizations. This should always be in writing. Although the scripts do not change any settings or manipulate the system, it is your responsibility how you use these scripts! I hope that this information is helpful to you and that you have been given a good "little" foundation. This article/information is by no means complete and exhaustive. But I still hope that this information is helpful to you. Thank you for taking the time to read the article. Happy Comparing and Hunting, Tom Wechsler P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechsler
Increasingly Issues with Windows Updates
As a Microsoft Partner we're patching the Windows Servers of our customers on a monthly basis. During the past months we recognized more and more issues with the updates (CU's) we wanted to deploy during the maintenance window (either via SCCM or directly through the web). The updates become bigger and bigger and the quality seems to drop š Just wanted to let you know. Regards, Philipp
Hostname Character Limit
Still being limited to 15 characters for hostnames in 2019 is very upsetting. In an age where we are deploying servers in multiple data centres, whether that be on premise or in the cloud and having multiple environments as well means trying to come up with sensible hostnames in just 15 characters is basically impossible. Iām sure I am not the only person who is frustrated by this limit and would very much like it if Microsoft was to revisit this limit and increase it to bring it in line with the wonderful limit our Linux friends enjoy.Understanding Windows Update Services product categories for Windows Server 2022 and Azure Stack HCI
The new Server 2022 LTSC has arrived. And it is a great release. Some customers still struggle to find their SA benefits and ISOs / licenses and RDSH licenses in VLSC, but it is officially released. If you fail to find it contact VLSC support via phone. The Microsoft Teams have written excellent and brief blogs about the news in Storage, SMB, Security and other topics you can find on techcommunity.microsoft.com. Unrelated to this topic, links to somekey improvements of Windows Server 2022 LTSC: Windows Server 2022 Security Baseline - Microsoft Tech Community Enabling HTTP/3 support on Windows Server 2022 - Microsoft Tech Community Storage Innovations in Windows Server 2022 - Microsoft Tech Community SMB over QUIC is now in public preview! - Microsoft Tech Community SMB Compression in Windows Server 2022 and Windows Insider - Microsoft Tech Community OPS104 Securing SMB from within and without - Microsoft Tech Community What's not yet published is changes to WSUS. "Hey Karl, do you speak about this legacy stuff to deploy Updates for on-premises?" Yes, it still exists and is still needed for SMB and SMC and bigger organizations, while latter might use ConfigMgr or MEMCM or ISV solutions, where WSUS is often a needed requirement. Technically we cannot expect anything new in WSUS? Why? The rule to not update any legacy MMCs is in place with Windows Server 2022 LTSC, so also there are no improvements or additions to any MMC consoles, Server Manager, or Active Directory Administrative Center (DSAC).An exception to this rule was an important bug in DSAC that got caught in Windows Server 2022. - Ultimately the issues with detection of WU client OS strings - since Windows Server 2016 and Windows 10 is not fixed in the WU database either. While it possible, there is a paid solution doing this for you to make your reporting great again. - Windows Admin Center support for Windows Update Services is not on the horizon either. I hope for Ignite 2021. So what has changed? Product Categories, naming, that one need to learn and understand. But before we get into let us recap about the history and where we come from. Over the past decades, naming of product categories was rather simple. - Windows Client had its own category per major release - Windows Server had its own category per major release - SQL Server had its own category per major release etc. With the era of Windows 10 OS, which applies to Server and Client OS alike, as these are very similar to the core, this has game changed a bit. At first all Windows 10 versions have been assigned to "Windows 10" category. Later, thankfully, the team added new categories per release. I will explain why this was important. What changed with Windows 10? With Windows 10 1903 Microsoft introduced "1903 and later" category which I supposed and promoted the idea to have one category for 1903 and 1909 as these share the binary same updates. Well, that did not happen. 1903 and later now includes updates for the following: 1903, 1909, 2004, 20H2 and 21H2, where 1903 and 1909 aswell as 2004-21H2 share the same binary updates. So how about Windows Server, Windows Server product like SQL Server etc? Simple as that one category for each release: Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019 SQL Server each release had an own category from 2000 through 2019. So far so good and simple. Another OS emerged called Azure Stack HCI,got it's own product category. But only for the initial release. Another OS emerged for those with Software Assurance rights, calledWindows Server version xxxx aka Windows Server SAC, while xxxx follow the Windows 10 OS naming of YYMM so 1903 for March 2019 release - or more precisely end of development cycle (branch), as release happened sometimes later. Windows Server version will no longer be available after version 2004. Microsoft noticed hindsight putting Azure Stack HCI, which is a SaaS product - same to Windows Server version (SAC) and has a similar release schedule - in one product category was an unfortunate design decision. Why is one product category for any SAC product an unfortunate decision? It means that the limitation Windows 10 versions having all releases in one product category repeats with Windows 11 and you face the same problem. If you place all SAC products into one category, it makes it ultimately harder for an IT Pro using WSUS to automatically approve specific version and decline SAC versions that are no longer in use across the organization. This is because SAC products do have an intended and short support period and will be replaced in production and so will play no further role but bloat up your database and metadata and compliance lists (WSUS reports) with unneeded versions. From this perspective, it would have been wise to not repeat the same mistake name it Azure Stack HCI from the start but Azure Stack HCI, version 20H2. Same as Microsoft factually did separate for Windows Server version, xxx in WSUS product categories. Well that did not happen, did it? To the core of this article. What's next? Starting with Windows Server 2022and all 21H2 releases this familiar game will change rules. Windows Server 2022 will not see an own product category called "Windows Server 2022" as we would assume and how it is officially named. Azure Stack HCI OS will not be included into Azure Stack HCI OS category, except the first release version 20H2. Both updates will be included in a new category named "Microsoft Server operating system-21H2" Does this break any naming convention and former logic? Does it bother? You decide. How about the driver and servicing drivers categories? That's still complicated. see: https://www.urtech.ca/2016/12/solved-what-do-the-windows-10-product-names-mean-in-wsus/ How about Windows Server 2022 Azure Edition and neat Hotpatch feature? You would assume that due to the naming convention you might find it in the near of Microsoft Server 2022 Azure Edition as a seperate product category. Be disappointed. The naming convention does not apply to any extend. It is called Server 2022 Hotpatch category, yes the full name, not even Windows Server 2022 Hotpatch or sorts. Pardon me but seems like someone hotpatched the category name itself. I do not believe they will change this as this would stress to change the whole servicing and metadata and break things. Any other caveats? There are Windows Server categories for 2019 and other in the developer tools section. This happened due to a catalogue update error, which causes WSUS and ConfigMgr to sync any updates in 2021. These categories do contain any updates. So, make sure you do not check or bother with the Server Categories in the Developer Tools Products. TLDR: - do not use product categories for Windows Server in Developer tools. These are dead. - you will find Azure Stack HCI OS in the Azure Stack HCI product category, but only the initial version 20H2. No future ones. - you will find future Azure Stack HCI OS version 21H2 and Server 2022 LTSC in the category named Microsoft Server operating system-21H2. Source and kudos: Thank you Artem Pronichkin, for the excursion and your help on the topic. https://twitter.com/pronichkin/status/1435723832598224897 History: 01/13/2022 - added notes about Windows Server Azure Edition and Hotpatch, minor fixes, corrected name from ADAC to DSAC 09/24/2021 - typo / grammar corrections 09/10/2021 - more insight from Artem, see reply 09/10/2021 - formatting, typo / grammar corrections, added screenshot 09/09/2021 - formatting, correctionsExternal private IP addresses registering with DNS server
Hello all, I've been trying to fine-tune our NIDS configuration (which predates my employment here) and more specifically trying to figure out why certain IP addresses/ranges that we don't use, keep appearing in reports/logs. I think I've figured out the root cause, but I'm not sure of the best way to fix it: We have a number of remote users who connect to our network by VPN. As best I can tell, when their laptops connect to the network, they're sending updates to the DNS server running on the DC with both the IP address of their VPN interface (routable on our network) and their private IP address on their home LAN (obviously not routable) - if I do an nslookup on a domain machine, the DC returns two A records, one for each address. This has a slight ripple effect through the network - which manifests mostly with Windows Update Delivery Optimization, where the peer discovery process frequently gets the non-routable private IP somehow and then tries to download Windows updates from it. Long story short: what is the best way to prevent VPN'ed machines from registering external private IP addresses with the DNS server running on the DC?
Server 2025 - Forced Upgrade
There have been reports in the IT press in the past week about Server 2022 being forcible upgraded to 2025 without the user knowing or agreeing to it. However, these reports indicated that it only happened with third party updating services and was because Microsoft had misclassified the upgrade as a security update. I manage a number of 2022 servers (mostly VMs plus a few physical installs). Most of these use WSUS for updating, but there is one physical server which has local accounts and isn't domain joined, and updates directly from the Windows Update service (no update management system is in use). I logged into this one to check something yesterday, and while I was in there checked that it wasn't showing Server 2025 as pending, which it wasn't. It also wasn't even showing it as optional. Logged into it again this morning, and it has forcible upgraded itself to Server 2025. So it's now unlicensed, and I don't know whether the software on it will work properly on Server 2025 (the server was well down my list for an upgrade, so I've not even researched it yet). There doesn't seem to be a roll back option. I could reinstall it, but there seems little point when it will probably just upgrade itself again. I have tried to replicate the unwanted upgrade behaviour using a test VM, and I can't - that stays on 2022, and doesn't offer 2025 as even an optional upgrade. And I've just received a response fro the supplier of the main software installed on this server, saying that Server 2025 is not yet supported. Great. Anyone else experienced this?BLOG: What deprecation means in practical terms for Windows and Windows Server
Intro What deprecation / deprecated features means in practical terms? An important and careful read every time. Each release of Windows / Windows Server doesn't only come with enhanced features and fixes, but also deprecation notices you have to consider. Understanding the term It's a tag on a role or feature that longer under development. And it marks the start of getting stale or even being removed completely from the OS. Most of the time all deprecated features will become optional features, first. Karl, how do you deal with deprecated features? I personally try to consult customers to remove inbox Optional Features. In this case they may not accidently use these, or otherwise notice they are in use when missing in the first place. Feature removals are quite rare but that's exactly why you should really consider watching the space of deprecation notices. Are deprecated features generally removed? Clear no. But there's a risk of that. You should not build a business around or on deprecated features. Removals can occour quickly, usually are rather planned, when a security concern arises and no fix / remediation can be made, or a feature, by telemetry, is rarely used in the first place. Are deprecated features supported? It depends. Every feature in-box is under the support policy of the product. So far the rules. Do not expect up to par Microsoft support for deprecated features. Same as with OS versions outside the mainstream support (extended support), like Windows Server 2016 / 2019, both widely spread, at the time of writing. Keep an eye on the product support matrix and the support conditions. Microsoft used to call these Lifecycle Policies, of each product. Also other (Microsoft) products you are running on top of an OS. Speaking for the OS, the Microsoft support team might advice you to move on when for break / fix situation, no remediation can be found, and the product is deprecated or outside mainstream support. References Windows Server 2025 preview removed and deprecated features Windows 11 deprecated features Microsoft's terminology on deprecation and others Microsoft Lifecycle Policies and product support lookupBLOG: Guidance for Windows Recovery partition (WinRE) patching and why you would need it
This is an extended blog, which continues in comments. pardon for the inconvenience. Windows Client and Server should have this WinRE Partition. You want to enlarge the C (OS Partition) in a VM and WinRE partition is in the way. The most common advice is to delete the WinRE partition. And this is a bad advice imho. The WinRE partition enables you for different to access different options including uninstalling Updates *pre-boot* that prevent a system startup. This doesn't happen very often but it can happen. This feature has been added to WinRE starting with Windows Server 2022, and Windows 10 22H2 / Windows 11 22H2, or newer. It is quite unknown, though. You can do more like direct UEFI access, and troubleshooting GPT / UEFI required and recommended anyway for both Windows Server and Client. Proper location and number of WinRE partitions on a physical disk 1. WinRE should located right hand side to the C partition If you find that your WinRE it is located left of the OS boot drive (C) it has been installed by a bugged release (old ISO). I am sure it was Windows Server 2019 when we noticed that. Aka Windows 10 1809. See below why the certainty. When installing Windows or especially Windows Server always use the lastest ISO for fixes like this or for in-place upgrades. There is no such updated ISO for Windows Server 2016, very unfortunately. They started patching them on a monthly basis with Windows Server 2019. You can access your latest ISOs either via my.visualstudio.com (Dev / Test use only), or admin.microsoft.com for VLSC or CSP production use. 2. There could be more than two WinRE partitions to the right hand side of the C partition This often happened when the existing could not be enlarged during in-place upgrade. Maybe also a Bug. Haven't seen this long time. It was common before Windows 10 1809. It is common though if you are using more than one Windows Installation on one physical disk. This is known as side-by-side installation or more commonly "Windows OS multi-boot". Each OS will create and maintain its own WinRE Partition (by design). Multi-boot is common for people that use designated Windows Installation for specific use cases, like Windows Insiders to test different Insider branches on one physical machine and disk. More information can be found in the comment below. Patching Windows RE is important There is a 2024 CVE that needs to addressed. Please find more information in the comments below on the "How-to".patching the WinRE CVE and remediate the 01-2024 LCU failing. More information on how to actually fix this can be found in this comment below Relocate WinRE partition A WinRE Partition left of C (OS Partition) makes no sense as Windows still may not move partitions to the right or left (while technical possible).Windows can only shrink Partitions As such I don't get how one can at all shrink C (to the right only). Mind that if you change / delete WinRE partitions you need to inform Windows about it viareagentc.exe These are tools you have at hands: Windows Diskpart Settings App > Storage Settings > Advanced Storage Settings > Disks and Volumes Windows 10 22H2 / Windows 11 22H2 / Windows Server 2022 or newer. diskmgr.mmc all legacy OS Windows Key + X > Disk Management Trusted 3rd party tool for Home Use (Windows 10 / 11) or paid for Windows Server use: Minitools Partition Wizard (Free) Formerly recommended Minitools Partition Wizard but they now have a paywall. If you are ok I would still recommend it.These can do everything! Acronis Partition Wizard isn't nice too old code and slow. Not optimized for SSD / NVMe. Both recommendable tools are available through winget. Bonus: Use Paritioning tools for Windows Server / Expanding WinRE / Resize OS Drive Create a PAWS VM Client or Server on Azure Stack HCI, Azure, Hyper-V, VMware etc. Buy the Tool (aquire a license, required for Windows Server) Install the license on the PAWS Shutdown affected VM Attach affected virtual disk to the PAWS VM, do the resize job Attach modified disks back to the original VM Pro: easy and licensing costs savyy Cons: Downtime and manual task Hope this is helpful to you. Appreciate your likes, spreading the word.
