Primary domain controller (PDC) emulator cannot be contacted
Hi and thank you in advance, Migrate DC from windows server 2008 r2 (Physical) to windows 2012 server R2 (Virtual), transfer the FSMO roles, everything to perfection, but when I try to access Domains and trust, I get the error: primary domain controller (PDC) emulator can not be contacted Run a dcdiag and in it I do not pass the locatorcheck test, because it throws the result: PDC_REQUIRED call failed ... And spent hours investigating, without any results, disable the synchronization with VM Tools and configure the server with the pdc role to synchronize the time with an external NTP server. Check the DNS settings to see if there is something that does not match and I really do not find anything strange. Someone who can help me, I would appreciate it for life.
Remote Desktop Webcam redirection
In mstsc.exe, under Local Resources > More.. there is an option for Video capture devices. Which lists my webcam and Devices that I plug in later. I have determined that this option the an RDP file is the string camerastoredirect:s:* So what I have done is ran the following command on my Connection Broker so that this line will be added to rdp file generated by the feed. Set-RDSessionCollectionConfiguration -CollectionName $CollectionName -CustomRdpProperty "camerastoredirect:s:*" When I run Get-RDSessionCollectionConfiguration I see the value has been added to CustomRdpProperty along with "use redirection server name:i:1" which seems to be a default on all collections. If I strip the signing info from a downloaded rdp file from the feed source and manually add camerastoredirect:s* my cameras are redirected. Instructing my users to do this in order to use their cameras that do not work with RemoteFX USB redirection is not a direction I want to go. What I am trying to solve is, why does my custom RDP property not apply to the RDP files that are downloaded.
Windows Server 2019 Cannot Install .NET 3.5
I am running Windows Server 2019 (Version 1809, Build 17763.4499) and I cannot install .NET Framework 3.5. Below is the current installation status of the feature on my machine: PS > Get-WindowsFeature -Name NET-Framework-Features,NET-Framework-Core,NET-HTTP-Activation,NET-Non-HTTP-Activ Display Name Name Install State ------------ ---- ------------- [X] .NET Framework 3.5 Features NET-Framework-Features Installed [ ] .NET Framework 3.5 (includes .NET 2.0 and 3.0) NET-Framework-Core Removed [ ] HTTP Activation NET-HTTP-Activation Removed [ ] Non-HTTP Activation NET-Non-HTTP-Activ Removed Through hours of searching online I have not been able to discover a resolution to the issue I am seeing. I followed the installation steps in https://woshub.com/how-to-install-net-framework-3-5-on-windows/ as this was the most complete guide. None of the suggested installation methods worked. Via Server Manager: Add roles and features -> Features -> .NET Framework 3.5 Features -> .NET Framework 3.5 (includes .NET 2.0 and 3.0 ); Using DISM: DISM /Online /Enable-Feature /FeatureName:NetFx3 /All Using DISM: DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Source:D:\sources\sxs /LimitAccess With PowerShell: Install-WindowsFeature -Name NET-Framework-Core With PowerShell: Install-WindowsFeature -Name NET-Framework-Core -Source D:\Sources\SxS With DISM: DISM /online /Add-Package /PackagePath:D:\Sources\SxS\microsoft-windows-netfx3-ondemand-package~31bf3856ad364e35~amd64~~.cab I also tried using the offline packages from my installation media without success. And when trying to use GPO to force installation from / prohibit installation from Windows Update (non-WSUS) I did not see any results. Regardless which method I use, I end up getting the same 0x800f0800 error. I've only come across https://social.technet.microsoft.com/Forums/windowsserver/en-US/5be0b03c-f499-4530-837d-76eacb4f1473/net-framework-35-cannot-install when trying to install a Windows feature, but their resolution was just rebuilding their server. This is not a viable option for my scenario. The full error from PowerShell is displayed below: PS> Install-WindowsFeature -Name NET-Framework-Core -Source D:\Sources\SxS Install-WindowsFeature : The request to add or remove features on the specified server failed. Installation of one or more roles, role services, or features failed. Error: 0x800f0800 At line:1 char:1 + Install-WindowsFeature -Name NET-Framework-Core -Source D:\Sources\SxS + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (@{Vhd=; Credent...Name=localhost}:PSObject) [Install-WindowsFeature], Exception + FullyQualifiedErrorId : DISMAPI_Error__Failed_To_Enable_Updates,Microsoft.Windows.ServerManager.Commands.AddWind owsFeatureCommand Any help on this issue is greatly appreciated! Crosspost: https://serverfault.com/questions/1134449/windows-server-2019-cannot-install-net-3-5Windows Server 2019: The component store has been corrupted. Error 0x80073712
Hi all, I'm trying to install the Server Backup feature on our 2019 Server, but it results in this error: Any ideas on what may have caused this, and how to solve it? The server was installed about 5 months ago, and the installation is basically stock, not much changes made. Thanks in advance.Advanced threat hunting within Active Directory Domain Services - Knowledge is power!
Dear Microsoft Active Directory friends, What is this article about? Showing attacks, compromising domain controllers or even introducing and showing hacking tools? NO. It is about giving you a jump start on how to gather targeted information about attacks and threats in your Active Directory. Is this also a complete and accomplished listing, again no. But my goal is to give you a solid foundation to build on. Let's start with the different event ID's from the event viewer. This assumes, of course, that extended logging has been configured on your domain controllers. If not, this should definitely be done immediately. Event logs are best examined in a SIEM (Security Information and Event Management). Such a tool is not always available, which makes finding information somewhat more difficult. Event ID 4769 Search for attacks from user accounts used as service accounts (search for service accounts - with a login on a client system - IP address). https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769 Search for computer with "Trusted for Delegation": Get-ADComputer -Filter {TrustedforDelegation -eq $true} (Domaincontroller's are not interesting) Best practices: There's no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It's only relevant on domain controllers and stand-alone devices https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation Event ID 4624 Successful logins (search for users/service accounts that have logged in to systems that are TrustedforDelegation). https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 In ADUC (Active Directory Users and Computers) search in the properties of a user account in the Account tab, for "Account is sensitive and cannot be delegated". Not even the administrator has this configured by default. Sensitive accounts should be configured with this option. Event ID 4624 Type 3 - Network Logon (searching for logons from remote systems) Event ID 4611 (often generated by mimikatz) A trusted logon process has been registered with the local System authority. https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611 Event ID 4673 (often generated by mimikatz) When the tool tries to assign itself missing permissions. https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673 Event ID 4675 - SIDs were filtered https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4675 Note: If you have a SIEM at your disposal, just search for "mimikatz or rebeus" maybe the names of the tools were not changed because the attacker was too lazy. Note: Install Sysinternals "sysmon" for detailed information https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Protected Accounts and Groups in Active Directory Adminsdholder: The purpose of the AdminSDHolder object is to provide "template" permissions for the protected accounts and groups in the domain. AdminSDHolder is automatically created as an object in the System container of every Active Directory domain. Its path is: CN=AdminSDHolder,CN=System,DC=<domain_component>,DC=<domain_component>?. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory SDProp: SDProp is a process that runs every 60 minutes (by default) on the domain controller that holds the domain's PDC Emulator (PDCE). SDProp compares the permissions on the domain's AdminSDHolder object with the permissions on the protected accounts and groups in the domain. If the permissions on any of the protected accounts and groups do not match the permissions on the AdminSDHolder object, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory Securable objects use an access mask format in which the four high-order bits specify generic access rights. Each type of securable object maps these bits to a set of its standard and object-specific access rights. GenericAll - Full rights to the object (add users to a group or reset user's password) https://learn.microsoft.com/en-us/windows/win32/secauthz/generic-access-rights Let's let pictures do the talking at this point. Take a closer look at the "Dom" user account. This account has no elevated privileges, BUT a "GenericAll" connection. Now please take a close look at the following pictures. net group "domain admins" dom /add /domain Add-ADGroupMember -Identity "domain admins" -Members dom Using powerview: Get-ObjectAcl -SamAccountName delegate -ResolveGUIDs | ? {$_.ActiveDirectoryRights -eq "GenericAll"} Event ID 5136 (However, domain controllers must be configured to record this event.) A directory service object was modified https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 In ADUC and ADSI Edit under System, examine the AdminSDHolder object. If necessary, you should restore the permissions. The user "Dom" could add himself to the group "Domain Admins" because the security properties of AdminSDHolder were manipulated. Another topic is group policies. Examine the group policies in particular the permissions of the group policies. Get-GPO -All Get-GPPermission „nameofgpo“ -All How to give users access to Group Policy Objects: https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/give-users-access-group-policy-objects The next topic is SID History. Security assessment: Unsecure SID History attributes SID History: Get-ADUser -Filter * -Properties cn,memberof,sidhistory Get-ADUser -Properties sidhistory,memberof -Filter {sidhistory -like '*'} https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute DCSync is a legitimate Active Directory feature that domain controllers only use for replicating changes, but illegitimate security principals can also use it. Event ID 4662 An operation was performed on an object. https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 Domain controller synchronization, looking for the following GUIDs: ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" or "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" or "89e95b76-444d-4c62-991a-0facbeda640c") https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb Do you know all your domain controllers? If yes, no synchronization should have been started that does not originate from a domain controller. The synchronization should be executed only between the DC's you know. (The exception may be Azure AD Connect - this service generates similar events). Look for a synchronization that was not started by a domain controller. I hope that this information is helpful to you and that you have received a good "little" foundation. This is certainly not an exhaustive list. But I still hope that this information is helpful for you. Thank you for taking the time to read the article. Happy Hunting, Tom Wechsler P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechsler
How to see who is a member of schema admin and how to add a member in
Hi All, Im currently trying to install Sccm and need to link my SCCM server to DC but due to me getting the below error I cant go any further. Im currently on the Administrator account but it seems that I still need to put this account in the Schema admin group. I cant seem to access this group I cant see it in Users or anywhere - When I search for the account I have to search the Entire directory but then cant access the properties? How do I add a user or even the admin account into this group so I can carry on doing the necessary step to install SCCM? I get this message Please help! and thanks in advance!Windows Server 2022 Scheduled Task issue
I discovered yesterday that multiple scheduled tasks suddenly stopped working on a 2022 server. The tasks and the paths to the scripts they run have not changed in months. Last confirmed success was Feb 28th. The tasks run as an Active Directory account with permissions to run scripts on a network share, that hasn't changed either. I get the error code FFFD0000 as "Last Run Result" and in the History tab it also gives the exit code 4294770688. By extensive research online these codes mainly point to: * The script having an incorrect -File path. * The -File path to the script is relative. * The -File path does not include double quotes around it. * Then path to powershell.exe needs to contain the full path, not just the file name. None of these issues were affecting my tasks. What is weird is that it works if I select "Run only when user is logged in". But not when I select "Run wether user is logged in or not" and enter the password so that it is stored within the task. I have confirmed this with another high privilege AD account as well, on two separate 2022 servers, and it gives the same FFFD0000 and 4294770688 errors. Exporting a task to 2016 or 2019 servers, and running them = success Also: It works if I run a cmd prompt as the user and then run the same command line: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "\\my.domain\PathToScript.ps1" It works if I run PowerShell ISE as the user, browse to the scripts and run them. It also works if I move the script to the server locally, for example "C:\temp\script.ps1" Tasks running as SYSTEM on the 2022 servers also work. The 2022 servers are all patched with the March cumulative updates. Can anyone else confirm this?
