HOW-TO: Import Out of Band Updates to WSUS using Microsoft Edge Chromium IE Mode and PowerShell
----- I recommend using https://www.powershellgallery.com/packages/Import-WSUSUpdate Full instructions to install the module are located here - https://www.ajtek.ca/blog/the-new-way-to-import-updates-into-wsus/ ----- History: 09/12/2023 - adding PowerShell method to the OP 07/30/2023 - please follow the latest comments for the updated approach using PowerShell. The method in the OP has become obsolete 01/13/2022 - update links and clarification to prevent an error "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS", added Troubleshooting and Q&A section. 02/11/2021 - initial version PREREQUISITES: Windows 10 / 11 / Windows Server 2016 or later with WSUS RSAT Tool installed. latest Microsoft Edge installed, version 97 as of time of writing. Internet Explorer (mode) is installed in Settings > Apps > Optional Features or equivalent location in Windows 11 HOW-TO: - Open Edge 97 or later - Open Microsoft Edge Options > Default Browser - Change "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow' - Add links to add to Microsoft Edge IE Mode - Remove all other links in the scope of *.catalog.update.microsoft.com, only these shall remain for the catalog.update.microsoft.com page. https://catalog.update.microsoft.com/ https://catalog.update.microsoft.com/v7/site/Home.aspx see screenshots below for better illustration. - Close Edge and all catalog tabs if there were any open, especially if you use "Open tabs from the previous session" feature - Open WSUS MMC and right click Updates from the tree > Import Updates - The link in Edge should open in IE mode, there are several indicators on this the open tab to point to https://catalog.update.microsoft.com/v7/site/Home.aspx?SKU=WSUS&Version=10.0.xxxxx.xxxx&ServerName=YOURSERVER.CONTOSO.LOCAL&PortNumber=8531&Ssl=True&Protocol=1.20 NOTES 1.When the link opened in importing updates from WSUS MMC does not contain the "v7/site/" part or does contain a https://www.update instead of https://catalog.update your configuration is wrong. 2. The "Default" setting will not be sufficient to allow the installation and use of the ActiveX plugin. Go back to your update catalog tab, Install the ActiveX if you have not done on this box already. Check if you have not setup restrictions to execute or install ActiveX plugins in IE directly or via group policy. 3. Edge now has the ability to an IE Mode button. Also it has a new feature to automatically add pages to the exception list. Do not use this ability as shown in the picture for this use case as it might add wrong exceptions to the list. 4. When there are wrong exceptions in the exception list for IE mode it might not work correctly and cause a missing but very important redirection, which ultimately cause the import to fail. More troubleshooting assistance below. LINKS STARTING FROM DECEMBER 2021 / JANUARY 2022: Links to add to Microsoft Edge IE Mode https://catalog.update.microsoft.com/ https://catalog.update.microsoft.com/v7/site/Home.aspx TROUBLESHOOTING: Q 1: Microsoft Edge does not allow me to configure any IE Site Mode links (greyed out). A: Either you have not enabled "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow', or your enterprise has set policies to prevent that. This should be clearly indicated by a lock and message in the Edge settings tab. Q 2: I have followed this guide or a previous version. I can see the cart to import into WSUS but cannot import any or just specific updates. Others fail with a message "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS". A: This is a "known" issue and the guide has been updated to reflect this issue and a potential change on the server-side. Please make sure only the two links are included in your IE mode list. They may not include www in the link name. You need to include both links, not just one or the other as in the previous version of this guide. Q 3: May I use the new Edge feature in Settings > Appearance > Internet Explorer Mode button A: I would recommend to refrain using this feature, as the mechanism between WSUS update import and the browser is extremly picky. It would not work if you just copy the same link into a browser tab. The feature of the cart to import into WSUS will be likely missing and you can just download to the Download folder instead. Q 4: Edge offers me to restart this tab in IE mode next time. A: you should not receive this message, otherwise the exceptions as stated in the guide are invalid or you have more than the stated links in place. Go through the guide again and double-check. Do not use this otherwise nice feature. It will cause to add more catalog links to the exception list which will cause an issue to import updates to WSUS, as described in Q #2. Thanks for the hint Eric_VanAelstyn, thanks to abbodi1406 for additional hints after this guide got invalid a redirection change in December 2021 / January 2022. cc AriaUpdated MissyQ cc for the other teams as I did not want to repost it in Edge and Servicing communities, unless you insist š
Hostname Character Limit
Still being limited to 15 characters for hostnames in 2019 is very upsetting. In an age where we are deploying servers in multiple data centres, whether that be on premise or in the cloud and having multiple environments as well means trying to come up with sensible hostnames in just 15 characters is basically impossible. Iām sure I am not the only person who is frustrated by this limit and would very much like it if Microsoft was to revisit this limit and increase it to bring it in line with the wonderful limit our Linux friends enjoy.
Windows Server OSConfig and DSCv3
Introduction I wanted to formalize putting a post out here to get some discussion going on the attempts at modernization of Windows configuration, and importantly, infrastructure-as-code. Hopefully this is a healthy discussion that others can engage in. Much of what I'm going to try and post about is stuff we already are aware of, but I want to highlight how this is an ongoing concern with the Windows Server platform that makes it difficult to encourage people to even consider Windows in their environment other than for extremely legacy purposes. I want Windows Server to be the best it can be, and I encourage others to join in on the conversation! Problem Statement Windows Server needs a modernized configuration-as-code system. Must be capable of orchestrating without cloud tools (offline orchestration) Must provide for regular validation and attestation Ideally should be easily available to 3rd party configuration tools. Since Microsoft appears to have little interest in building their own modernized system that isn't Azure-based, this means that this MUST be orchestrated easily and securely by 3rd party tools. Should be as robust as GPO at maintaining and enforcing state. Security configurations in Windows are a right pain to manage with any 3rd party tooling, with the closest coming to it being the SecurityDSC module which wraps secedit.exe and security policy INFs. Why is OSConfig not the answer? OSConfig doesn't provide for me, as an engineer, to clearly define what the state of my machines are based on my company's business requirements. While the built-in Microsoft policy recommendations are great, there are reasons to deviate from these policies in a predictable and idempotent manner. Applying an OSConfig Baseline -> Then changing settings as-needed with special PowerShell commands This is not the answer. This is a bunch of imperative code that serves nobody. And it makes implementing this feature extremely challenging in today's modern world of Kubernetes, Docker, etc. I encourage the Windows Server team to engage with the PowerShell team on DSC 3.0. I think that team has it right, but they are a small group of people and do not have the resources to implement everything that would make DSC 3.0 a first-class configuration as code platform on Windows. And this is where the Windows team should come in. Steve Lee and crew have done a bangup job working on DSC 3.0, including taking feedback from folks to leverage Azure Bicep language for configuration. Security Policy Challenge The way to access security policies need to change. Even if I were to take DSC 3.0 I'd end up having to create a similar security policy INF file to import into Windows. It just seems so silly to me to have to write all of that out when Windows really should just provide an interface for doing this. In fact, security policy remains to be one of the largest problems to getting a good platform stood up. Windows Firewall Policy and GPO - The reason why host-based firewalling is painful to manage at scale in a Windows environment. GPO is definitely not the right place to be managing Windows firewall policy at scale. Particularly when you often have a core set of management rules you want to implement and application-specific needs. Making robust changes becomes a challenge since each policy is separate, preventing you from doing things like inheriting rules for higher level policies. While this is an inherent limitation of Group Policy, it highlights the need to get off of GPO as the core policy configuration tool for Windows. My recommendations I'd like for the Windows team to implement DSC 3.0-compatible resources for managing all core functionality of Windows. If you can do it in a GPO, you should be able to do it with Configuration as Code. Please stop relying on the community to make this work. All of this should be first party to the platform itself. Furthermore, I'd like to recommend that Microsoft either work with 3rd party configuration systems (Chef, Ansible, Puppet, Octopus, etc.) OR to also provide a way to hit the ground running. Perhaps something that integrates visually into Windows Admin Center would be nice. Conclusion This is a huge problem in the Windows world and continues to seem to fall on some deaf ears somewhere in the organization. While I no doubt am confident that the engineers on all of these teams very well know these issues and maybe even have discussed fixing them, clearly there's a breakdown somewhere.Active Directory Advanced Threat Hunting - Compare GPOs with the Security Compliance Toolkit
Dear Microsoft Active Directory friends, Even in the age of digital transformation, group policy settings (still) play a crucial role in maintaining network security and compliance. Advanced Hunting, an advanced technique for monitoring and analyzing these settings, is an indispensable tool for administrators. This method makes it possible to gain in-depth insights into the configuration and security situation of Windows networks. By using specific tools and scripts, professionals can detect security vulnerabilities, identify configuration errors and ensure that all group policies meet the highest security and compliance requirements. This article introduces the concept of Advanced Hunting for Group Policy settings and how it can transform management and security in IT infrastructures. Do we now need additional software and/or expensive tools? No, all we need is a little time, curiosity and the "Security Compliance Toolkit", which Microsoft is making available to us free of charge (thanks to Microsoft at this point). But first let's take a closer look at the MITRE techniques and the relevant Windows Event IDs. Before we start analyzing the group policy settings. We start with a list of MITRE techniques: Domain Policy Modification https://attack.mitre.org/techniques/T1484/ Domain Policy Modification: Group Policy Modification https://attack.mitre.org/techniques/T1484/001/ Group Policy Discovery https://attack.mitre.org/techniques/T1615/ Domain Policy Modification: Domain Trust Modification https://attack.mitre.org/techniques/T1484/002/ Unsecured Credentials: Group Policy Preferences https://attack.mitre.org/techniques/T1552/006/ The Windows Event ID's for the MITRE techniques: Domain Policy Modification 4739(S): Domain Policy was changed https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4739 Group Policy Discovery Appendix L: Events to Monitor https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor Domain Policy Modification: Domain Trust Modification 4716(S): Trusted domain information was modified https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4716 Compare the Default Domain Controllers Policy with the security baselines using the Policy Analyzer! So that we can compare the Default Domain Controllers Policy, we create a backup: Security Compliance Toolkit and Baselines can be downloaded here: https://www.microsoft.com/en-us/download/details.aspx?id=55319 We need the necessary tools and baselines: Extract the files: From the Windows-Server-2022-Security-Baseline-FINAL folder, copy the following file: Paste the file in the Policy Analyzer folder: Open the Policy Analyzer: NOTE: If you have a low screen resolution you may not be able to see the bottom part of the application. It is important that you see the bottom part so that you can adjust the path to the policy rule sets (see red marker). Now we have to add the default domain controller policy: Click on the import button: Give it a name and then click on safe: Now you can compare the policy with the security baseline: HAPPY COMPARING! If you want to examine your Active Directory with PowerShell, you will find a "small" compilation of various PowerShell scripts in the following link: https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting/tree/main/PowerShell NOTE: Before using these scripts, make sure that you have the necessary authorizations. This should always be in writing. Although the scripts do not change any settings or manipulate the system, it is your responsibility how you use these scripts! I hope that this information is helpful to you and that you have been given a good "little" foundation. This article/information is by no means complete and exhaustive. But I still hope that this information is helpful to you. Thank you for taking the time to read the article. Happy Comparing and Hunting, Tom Wechsler P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechsler
Increasingly Issues with Windows Updates
As a Microsoft Partner we're patching the Windows Servers of our customers on a monthly basis. During the past months we recognized more and more issues with the updates (CU's) we wanted to deploy during the maintenance window (either via SCCM or directly through the web). The updates become bigger and bigger and the quality seems to drop š Just wanted to let you know. Regards, PhilippUnderstanding Windows Update Services product categories for Windows Server 2022 and Azure Stack HCI
The new Server 2022 LTSC has arrived. And it is a great release. Some customers still struggle to find their SA benefits and ISOs / licenses and RDSH licenses in VLSC, but it is officially released. If you fail to find it contact VLSC support via phone. The Microsoft Teams have written excellent and brief blogs about the news in Storage, SMB, Security and other topics you can find on techcommunity.microsoft.com. Unrelated to this topic, links to some key improvements of Windows Server 2022 LTSC: Windows Server 2022 Security Baseline - Microsoft Tech Community Enabling HTTP/3 support on Windows Server 2022 - Microsoft Tech Community Storage Innovations in Windows Server 2022 - Microsoft Tech Community SMB over QUIC is now in public preview! - Microsoft Tech Community SMB Compression in Windows Server 2022 and Windows Insider - Microsoft Tech Community OPS104 Securing SMB from within and without - Microsoft Tech Community What's not yet published is changes to WSUS. "Hey Karl, do you speak about this legacy stuff to deploy Updates for on-premises?" Yes, it still exists and is still needed for SMB and SMC and bigger organizations, while latter might use ConfigMgr or MEMCM or ISV solutions, where WSUS is often a needed requirement. Technically we cannot expect anything new in WSUS? Why? The rule to not update any legacy MMCs is in place with Windows Server 2022 LTSC, so also there are no improvements or additions to any MMC consoles, Server Manager, or Active Directory Administrative Center (DSAC). An exception to this rule was an important bug in DSAC that got caught in Windows Server 2022. - Ultimately the issues with detection of WU client OS strings - since Windows Server 2016 and Windows 10 is not fixed in the WU database either. While it possible, there is a paid solution doing this for you to make your reporting great again. - Windows Admin Center support for Windows Update Services is not on the horizon either. I hope for Ignite 2021. So what has changed? Product Categories, naming, that one need to learn and understand. But before we get into let us recap about the history and where we come from. Over the past decades, naming of product categories was rather simple. - Windows Client had its own category per major release - Windows Server had its own category per major release - SQL Server had its own category per major release etc. With the era of Windows 10 OS, which applies to Server and Client OS alike, as these are very similar to the core, this has game changed a bit. At first all Windows 10 versions have been assigned to "Windows 10" category. Later, thankfully, the team added new categories per release. I will explain why this was important. What changed with Windows 10? With Windows 10 1903 Microsoft introduced "1903 and later" category which I supposed and promoted the idea to have one category for 1903 and 1909 as these share the binary same updates. Well, that did not happen. 1903 and later now includes updates for the following: 1903, 1909, 2004, 20H2 and 21H2, where 1903 and 1909 aswell as 2004-21H2 share the same binary updates. So how about Windows Server, Windows Server product like SQL Server etc? Simple as that one category for each release: Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019 SQL Server each release had an own category from 2000 through 2019. So far so good and simple. Another OS emerged called Azure Stack HCI, got it's own product category. But only for the initial release. Another OS emerged for those with Software Assurance rights, called Windows Server version xxxx aka Windows Server SAC, while xxxx follow the Windows 10 OS naming of YYMM so 1903 for March 2019 release - or more precisely end of development cycle (branch), as release happened sometimes later. Windows Server version will no longer be available after version 2004. Microsoft noticed hindsight putting Azure Stack HCI, which is a SaaS product - same to Windows Server version (SAC) and has a similar release schedule - in one product category was an unfortunate design decision. Why is one product category for any SAC product an unfortunate decision? It means that the limitation Windows 10 versions having all releases in one product category repeats with Windows 11 and you face the same problem. If you place all SAC products into one category, it makes it ultimately harder for an IT Pro using WSUS to automatically approve specific version and decline SAC versions that are no longer in use across the organization. This is because SAC products do have an intended and short support period and will be replaced in production and so will play no further role but bloat up your database and metadata and compliance lists (WSUS reports) with unneeded versions. From this perspective, it would have been wise to not repeat the same mistake name it Azure Stack HCI from the start but Azure Stack HCI, version 20H2. Same as Microsoft factually did separate for Windows Server version, xxx in WSUS product categories. Well that did not happen, did it? To the core of this article. What's next? Starting with Windows Server 2022 and all 21H2 releases this familiar game will change rules. Windows Server 2022 will not see an own product category called "Windows Server 2022" as we would assume and how it is officially named. Azure Stack HCI OS will not be included into Azure Stack HCI OS category, except the first release version 20H2. Both updates will be included in a new category named "Microsoft Server operating system-21H2" Does this break any naming convention and former logic? Does it bother? You decide. How about the driver and servicing drivers categories? That's still complicated. see: https://www.urtech.ca/2016/12/solved-what-do-the-windows-10-product-names-mean-in-wsus/ How about Windows Server 2022 Azure Edition and neat Hotpatch feature? You would assume that due to the naming convention you might find it in the near of Microsoft Server 2022 Azure Edition as a seperate product category. Be disappointed. The naming convention does not apply to any extend. It is called Server 2022 Hotpatch category, yes the full name, not even Windows Server 2022 Hotpatch or sorts. Pardon me but seems like someone hotpatched the category name itself. I do not believe they will change this as this would stress to change the whole servicing and metadata and break things. Any other caveats? There are Windows Server categories for 2019 and other in the developer tools section. This happened due to a catalogue update error, which causes WSUS and ConfigMgr to sync any updates in 2021. These categories do contain any updates. So, make sure you do not check or bother with the Server Categories in the Developer Tools Products. TLDR: - do not use product categories for Windows Server in Developer tools. These are dead. - you will find Azure Stack HCI OS in the Azure Stack HCI product category, but only the initial version 20H2. No future ones. - you will find future Azure Stack HCI OS version 21H2 and Server 2022 LTSC in the category named Microsoft Server operating system-21H2. Source and kudos: Thank you Artem Pronichkin, for the excursion and your help on the topic. https://twitter.com/pronichkin/status/1435723832598224897 History: 01/13/2022 - added notes about Windows Server Azure Edition and Hotpatch, minor fixes, corrected name from ADAC to DSAC 09/24/2021 - typo / grammar corrections 09/10/2021 - more insight from Artem, see reply 09/10/2021 - formatting, typo / grammar corrections, added screenshot 09/09/2021 - formatting, corrections
External private IP addresses registering with DNS server
Hello all, I've been trying to fine-tune our NIDS configuration (which predates my employment here) and more specifically trying to figure out why certain IP addresses/ranges that we don't use, keep appearing in reports/logs. I think I've figured out the root cause, but I'm not sure of the best way to fix it: We have a number of remote users who connect to our network by VPN. As best I can tell, when their laptops connect to the network, they're sending updates to the DNS server running on the DC with both the IP address of their VPN interface (routable on our network) and their private IP address on their home LAN (obviously not routable) - if I do an nslookup on a domain machine, the DC returns two A records, one for each address. This has a slight ripple effect through the network - which manifests mostly with Windows Update Delivery Optimization, where the peer discovery process frequently gets the non-routable private IP somehow and then tries to download Windows updates from it. Long story short: what is the best way to prevent VPN'ed machines from registering external private IP addresses with the DNS server running on the DC?Add Passkey support to Active Directory
Everyone, Please go to the feedback hub and upvote my suggestion to add passkey support to Active Directory Domain Services: https://aka.ms/AAw8z54 The reason I am recommending this is because there needs to be a standard way to use passkeys in an AD environment.
Windows Server 2025 Terminal Servers - start menu pinned icons
I'm designing the config for some terminal servers running Server 2025. I want to pin specific icons to the start menu. In Server 2022 (or Windows 10), this was simply a process of setting up the reference machine how I wanted it, then Export-StartLayout -Path "C:\Export\MStartMenuLayout.xml" to generate the config file, whcih was then applied using the GPO Computer Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Start Layout - this worked fine. On Server 2025 (and Windows 11), however, it appears that this doesn't work the same any more. Although the export command works, it generates a JSON file now rather than an XML. OK, so I saved the file with the JSON extension, and copied the old GPO, amending the name of the config file to point to the new one. However, it still doesn't work and this documentation: https://learn.microsoft.com/en-us/windows/configuration/start/layout?tabs=intune-10%2Cintune-11&pivots=windows-11 Would appear to indicate that it can only be done using Intune. If it was Windows 11 I could do that, but as this is Server 2025 it isn't an option - Intune cannot manage server OSs even if I wanted to do that. Can anyone suggest any alternative methods of doing this? All I want to do is configure a common set of pinned apps for all users - I'm not bothered about configuring any other aspects of the start menu as the defaults are OK. Thanks
