Andy M

 In the past few years I've done some analysis on GOOTLOADER malware. Check them out below: Welcome to Goot Camp: Tracking the Evolution of GOOTLOADER Operations | Mandiant | Google Cloud Blog Finding Malware: Detecting GOOTLOADER with Google ... - Google Cloud Community

DUO RDP login has a convenient deployment mode where you can use GPOs to push out the Integration key, Secret key (SKEY), and API hostname settings. However, if you follow their documentation (as least today 2021-01-29) all authenticated users on the domain will be able to read the SKEY. This could allow attackers to generate the 2FA codes themselves .  All users would be able to access the key through any of the steps below: Open GPMC Pull the registry.pol file from the SYSVOL share I informed DUO of this issue and they will be updating their documentation. Remediation: If you intend to keep deploying the DUO settings through GPO then the steps below should keep the SKEY safe(r). Instead of allowing "Authenticated Users" to read the GPO, we will be restricting it to Domain Computers. This would still allow an attacker to read the SKEY GPO if they compromise a computer, but I don't think it's an issue since they would be able to pull it from the registry anyway.  Make...

This guide will show you how to create shims that allow regular users to run applications that normally require local admin. Shims should only be used as a measure of last resort. In many cases simply granting users to certain folders or reg keys eliminates the need to create a shim. You can use LUA Buglight to identify what those reg keys/files are.   How it works The shim will force the application to use "RunAsInvoker" when it is launched. RunAsInvoker tells the application to open with the privilege level of whatever launched it. For example, if a regular user opens the application through explorer.exe (a non admin process) then the application will open with regular user permissions.  Things to keep in mind: Shims should be installed after the application Shims might need to be re-installed if an application is updated Not all apps play well with shims. Make sure to test the application before putting it into production Pre-Requisites Install the Microsoft Applicati...

Note: The steps below are not recommended by Microsoft . Verify that modern authentication is enabled before moving forward. When an Exchange users is migrated to Office 365 they may get constant credential prompts. Even if the user enters the correct credentials the prompt will come back in a few minutes. The user might also lose the ability to access shared mailboxes and public folders.  The fix is to set all of the reg keys below to 1 , doing so will enable modern authentication. Office 2013: HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\EnableADAL HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\Version Office 2016: HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Identity\EnableADAL All versions 2013+ Create this even if you are on 2016 where it is enabled by default HKEY_CURRENT_USER\Software\Microsoft\Exchange\AlwaysUseMSOAuthForAutoDiscover Restart Outlook and the prompts should go away.  https://docs.microsoft.com/en-us/exchange/troubleshoot/modern-authentication/...

I got the error below when trying to connect to an remote desktop gateway.  Event ID 304 The user "DOMAIN\User", on client computer "0.0.0.0", met connection authorization policy and resource authorization policy requirements, but could not connect to resource "remote.example.com". Connection protocol used: "HTTP". The following error occurred: "23005". The solution was to create the internal DNS record pointing "remote.example.com" to the gateway. Looks like this item was accidentally skipped during setup.

I ran into an issue where the Window search service would constantly crash. The Event viewer showed the error below, and the crashdumps folder has a ton of SearchProtocolHost.exe.21580.dmp files. Faulting application name: SearchProtocolHost.exe, version: 7.0.9600.19660, time stamp: 0x5e4586a5 Faulting module name: mso20win32client.dll, version: 0.0.0.0, time stamp: 0x5e8a785b Exception code: 0x0241938e Fault offset: 0x00196a44 Faulting process id: 0x24a4 Faulting application start time: 0x01d617e35d974e4f Faulting application path: C:\windows\sysWow64\SearchProtocolHost.exe Faulting module path: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso20win32client.dll Report Id: b5c9d48f-83d6-11ea-80fa-000c290a7afd Faulting package full name:  Faulting package-relative application ID:  Analyzing the crash dumps pointed to MSPST32.DLL but none of the users had PSTs loaded. I found this article , but it did not resolve the issue. Eventually the f...

I have been dealing with an issue where a user's outlook would switch to online mode at random. The only way to resolve the issue was to log the user out of the computer and back in. Re-creating the account resolved the issue, but it came back the next day. Procmon and ProcExp didn't point to any clear causes. Eventually I was able to find the root cause by looking at the permissions of the mailboxes. The two mailboxes had Full Access to each other and auto mapping (never use auto mapping!) was enabled. This resulted in a situation where the mailboxes were fighting for who would be the primary mailbox, and who would be the secondary. Removing the permissions resolved the issue and both mailboxes worked correctly inside of Outlook. 

Have an issue you can't solve? I offer consulting engagements and can be reached here: consulting[а 𝐭 ]amorales[․]org This article will cover some common issues I have ran into, and steps on how to resolve them. The guide should be followed  in order  since most of the advanced items are usually not the cause of a problem. If you just set up FSLogix, make sure that you followed every step under  Deploying FSLogix Office 365 Containers  and  Deploying FSLogix Profile Containers Terminology ODFC = Office Data File Containers This is there Office (Outlook, Teams, Licensing) data is stored This can be used in conjunction with UPDs FSL Profiles Replacement for UPDs User profiles are stored here (Office data is stored in the ODFC) Cannot  be used in conjunction with UPDs Non-Issues The items below should be ignored when troubleshooting Local_ files under C:\Users If FSLogix profiles are enabled, these folders can be ignored. They...

KB4541329 Appears to be the cause of this issue. Uninstalling it should permanently fix the issue. Just ran into an issue where a user kept getting a "COM Surrogate has stopped working" every time they tried to print from Windows Photo Viewer. They also kept running into an issue where Excel, Word, and RDP connections would crash when launched. Analyzing the crash dump that was generated (dllhost.exe) revealed the issue. The application was not able to find the default printer. Trying to set the default through Devices and Printers in control panel resulted in another crash. The fix was to run the command below: (New-Object -ComObject WScript.Network).SetDefaultPrinter('PRINTER NAME') The crashes went away once the default printer was set.

After a bad activation of BitLocker a Dell computer started giving a "no boot device found" error. I tried to re-image the computer but kept getting the error below: Windows Deployment Services Encountered an Error 0xc0000225 Resetting all BIOS settings and clearing the TPM didn't do anything. Eventually I found that Dell computers have an option to wipe all drives. After enabling the option and wiping the drive the laptop was able to boot into WDS again.

Just ran into an issue where Office apps would not open any documents saved in my OneDrive folder.  I would get the "Starting..." screen and then it would just close. Opening those same files from other locations like the desktop worked fine. The event log had some errors, but they didn't really point to a specific item: SettingSyncHost (14848) An attempt to open the file "C:\windows\system32\edbtmp.log" for read / write access failed with system error 5 (0x00000005): "Access is denied. ".  The open file operation will fail with error -1032 (0xfffffbf8). SettingSyncHost (14848) {9842A2DC-6CA6-48E2-924F-3ECFD7461AD8}: Database recovery/restore failed with unexpected error -1216. SettingSyncHost (14848) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032. Running ProcMon revealed that Excel and Word did not have access to %l...

I recently ran into an issue where I did not have the option to delete an Organizational unit. I made sure to uncheck "Protect Object From Accidental Deletion", and I had the appropriate permissions on the security tab. Attempting to delete from ADSI edit resulted in the error below: Operation failed. Error code: 0x20ce The requested delete operation could not be performed.  000020CW: SvcErrL DSID-0315370F, problem 5003 (WILL_NOT_PERFORM), data 0 The solution was to use redircmp to redirect new PCs to a different OU. redircmp "OU=Servers,OU=Computers,DC=example,DC=com" Restart Active Directory Users and Computers, and the delete option should be available for the OU.

Have an issue you can't solve? I offer consulting engagements and can be reached here: consulting[а 𝐭 ]amorales[․]org This is an extension of my FSLogix Office 365 container guide . All of the steps in that guide should be followed before continuing onto this one. Overview FSLogix profile containers allow you to easily roam user files and settings across multiple machines. A VHDX file will be created and it will store all user settings. This is similar to roaming profiles, but you do not have to deal with any login delays while files copy. Instead, the VHDX file is attached to the RDS server and the user's profile loads immediately. FSL Profiles vs UPDs Windows has a native solution called User Profile Disks, but it has some big limitations. With UPDs some applications will detect that data is being stored in a UNC path and malfunction. The best example of this is the inability to install Google Chrome extensions on UPDs. FSLogix drivers trick the OS into thinking that t...

Just had an issue where new Outlook profile creation would fail on a machine. Autodiscover was configured correctly and working, but new profile creations would fail. The error below would show up every time. Something went wrong. Something went wrong and Outlook couldn't setup your account. Please try again. If the problem continues, contact your email administrator. Eventually I noticed that the login prompt window was appearing for a fraction of a second and then disappearing. I set the registry key below, restarted Outlook and I was able to get the auth prompt which allowed the profile to get created. HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity DisableADALatopWAMOverride = dword:00000001 One the profile is created you can delete the reg key since the account is already authenticated. I have also used this reg key to activate office when it shows similar symptoms (login prompt appears for a split second then disappears). Enabling t...

I'm creating this guide because the instructions on the Dell website did not work for me. Download Files Got to https://www.dell.com/support Download the iDRAC service Module files that apply to the ESX host (should look like the item below) Copy Files to ESX Extract the ZIP you just downloaded and copy the .VIB and metadata.zip (not sure if this one is actually required) file to anywhere on the datastore Installation Shutdown all VMs and put the ESX host in maintenance mode SSH into the ESX host Run the commands below cd /vmfs/volumes/%datastoreName% we do this to easily get the GUID of the datastore esxcli software vib install -v /vmfs/volumes/%DataStoreGUID%/ISO/iDRAC/%iDRACFile%.vib -f Mine looked like this: esxcli software vib install -v /vmfs/volumes/54311fd8-70c2redc-78546-44398f869345/ISO/iDRAC/cross_oem-dell-dcism-esxi_3.4.0.1.ESX6i-live.vib -f If the install completes correctly you should see:  VIBs Installed: Dell_bootbank_dcism_3.4.0.1.ESXi...

One of the hurdles of UPDs and FSLogix is that they cause issues if they run out of space, and they don't alert users when they are out of space. In some cases you will waste time troubleshooting when you could have resolved it in a minute by just cleaning up the disk. I created the script below to address this issue. You can run it against your RDS servers and gateway, and you will not need to modify anything beyond the SMTP settings, thresholds, and exclusions. The script will do the following: Exit if it is not run on a server (you can comment this out if you use UPDs on Desktops) Query all collections on the RDG and scan all UPD paths *Must be run on the Gateway for this to work Query FSL Profile and ODFC paths *Must be run on computers with FSL enabled If low space disks are found the script will send you an email with a table of all the paths If nothing is found the script will exit. Known limitations: The script might report false positives/negatives if...

Multiple vendors have recommended logging out all users before restarting our RDS servers. Sadly I was never able to find a script that could do everything I wanted. I created the script below for Server 2012 + servers. The script will do the following: Logout all active users (even console users) Write errors and information into the Application event log You can find the script here:  https://github.com/andy2002a/PowerShell/blob/master/RDS/Disconnect-LoggedOnUsers.ps1 The script will not reboot the server, but you can always add a shutdown -r -t 0 at the end, or schedule your reboot script to run right after this one.

This guide will show you how to force add-ins to load in Office every single time. We will also prevent users and office from disabling/enabling add-ins*. *Outlook 2016* will sometimes disable add-ins any way, but we will apply a workaround for this. At the end of the guide, the add-ins you configure will look like this: Getting the ClassID of an add-in Find the ClassID of the Add-in. This is found in: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Office\application name\Addins HKEY_CURRENT_USER\Software\WOW6432Node\Microsoft\Office\application name\Addins It is usually in a format similar to Application.OutAddin Enforcing add-ins  We will now create a GPO that will enable or disable the add-ins that we configure. Create a GPO called Office Enforced Add-ins *Depending on the importance(compliance, auditing, etc) of this Add-in it migh...