Today-challenge n.3 : offending patches and SCCM 2012

Hi mates,
I had a big issue during the previous days with a specific Microsoft Patch. The 12 of September MS released an update for Office (KB4011089).
One of my clients had in production SCCM 2012 R2 to install automatically this kind of patches.
The day after a lot of users started calling the helpdesk telling that the cannot open attachments on archived emails . They use a product that is not famous on the market, as we say a "niche" product.
Anyway after investigating a lot we identified the "offending" patch (yes I know that usually patches must be  distributed in a test environment before anything). I wrote  "a lot" because this is a very dinamyc environment : they apply GPO, update and so on everyday, so you have to understand which single change may have had a specific impact.
So at this point two tasks were assigned to me :

Powershell --> Powerquick : retrieve event viewer settings and/or search for locked user account

Hi mates,
quick and useful : check event viewer settings as record count, state (full or....) file size and so on.
Additionally below you can find a separate script that allows you to query Event Viewer searching for locked out users.
Nothing more, it's easy to understand and adapt to your needs.
Here you are :



Hope this help.
Bye

Brute Force/Random password for an Excel protected file : embryonic Powershell exercise

Hi Mates,
only a brief exercise in Powershell.
I would like to know if it is possible to crack Excel password with this scripting language.
Theoretically YES. Practically this is only another opportunity to learn it better.
You can improve it for sure but it's only a good point from which to start and , maybe, go deeper.....
With more diligence you could be able to convert this script to compare some hash.
This is a random password generator ...it's up to you to decide what is the best approach : if you know some information about the secret you can sight better your target and modify the script to exclude some useless calculation. Otherwise you will have to check N passwords /2.....at least (consider it the average).

Powershell --> Powerquick : force active directory replication from a specific domain controller to the remaining others

Hi Mates,
quick and useful : how many times you needed to replicate an Active Directory change to the entire domain ?.....quickly, without waiting the system times.
The GUI is pretty clear but open the administration tool, expand, right click......and so on.....too long sometime....clearly too long
It happens me every day : someone call me from another site/plant and ask me to make some changes. YES I know that we have some replication priority inside AD, it depends on the value that you are going to change.

Powershell --> Powerquick : move disabled users from a group to another

Hi Mates,
quick and useful : how many times you needed to have a clean group because to this specific group there was associated a software usage/number of licenses ?
It happened to me but my need was also to have a trace of the users that were members of this group.
So I started creating a group that hosts all disabled user account that TODAY are not using the software "attached" to the main group, but tomorrow I could need to know if a "returning" user had right to be a part of it......a sort of history.

Today challenge n.2 : Windows 7 issue with profile

Hi Mates,
this is the second appointment with this new section that wants to describe, briefly, what happens every day in my technical-sysadmin life.
Sometimes what happens is really interesting, other time is not......I would try to give you the most interesting things.
In this article I'll give you an alternative solution, not easy to find on the web, related to Windows 7. An early formatted computer, joined to an active directory domain, was not able to build the user profile. An administrator, instead, could login without any kind of issue.
Most of the articles that you find surfing the web are inherent to a corrupted profile that must be deleted from the GUI interface and from the registry too.
In my case the end user was not able to login THE FIRST TIME......so no profile was created, no registry keys and so on.

The error was similar to the screenshot posted below :

Today challenge : Domain Password policies and Fine-Grained P.P.

Hi Mates,
this is a new section that wants to describe, briefly, what happens every day in my technical-sysadmin life.
I don't want to bore you with complicate concepts but only to focus on a simple "adventure" that every day "stole" me sometime  (leaving also on me something that I had forgotten or that I didn't know).
Today I had to face up with a GPO in a customer Active Directory domain (Windows 2008 R2). Practically the customer told me that even if the value of the parameter "Minimum password age" was set to 0 she was not able to change repeatedly her password.
The core of the issue was that being her a SysAdmin she was added in a group (Shadow) part of the Fine-Grained Password Policy.