The story

I got a new game on Steam and got set to downloading it.
For some reason, Steam and Windows have decided that it's better to save some electricity and put my computer to sleep, rather than finish my game.
Today I discovered that instead of playing my game …

I recently took over managing some config files from my dev colleagues. I was extremely annoyed to be reminded that Notepad (Windows' text editor) does 2 major Unix-incompatible things:

1. CRLF line ending (\r\n and not \n)
2. No newline at the end of file, which is something of a nicety …

I found the script we were using to disable authenticode on our machines, a feature that causes great suffering (and dll-loading-delays) to workstations not connected to the Internet when using various Microsoft products (i.e. SQL Management Studio, SharePoint).
Note the line at the end - the script tries to find …

As part of a security audit, I was asked to help in finding all accounts marked with "Trusted for Delegation"

What is "Trust for Delegation"

You can try reading the TechNet Article, but in short - delegation (also known as kerberos double-hop) is allowing a service to impersonate clients in order …

I recently had to improvise some network scanning using PowerShell. The security guys got somewhat excited, so I decided to upload these snippets.
I think all of them require PowerShell v2+

Checking ping for one IP address

Test-Connection $target -count 1 -quiet

Checking if a TCP port is listening

function …

I use this script to see all GP extensions that my computer can process:

ls 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions' | select `
    @{name='Guid';expression={[guid]$_.pschildname}}
    @{name='Name';expression={$_.GetValue('')}}
    @{name='DllName';expression={$_.GetValue('DllName')}}
    @{name='ProcessWhenNoChanges';expression={!$_.GetValue('NoGPOListChanges')}}
    @{name='IsUserPolicy';expression …

Today I found out that the command I use to find duplicate SPNs, setspn -x

is case sensitive, meaning that the following SPNs don't count as duplicates:

HOST/bla
HOST/BLA

This makes sense when using UNIX systems for TGS creation.
However, Active Directory Domain Controllers, being Windows systems, are …

The Story

If you thought about deploying BitLocker in your enterprise, you probably came across the recovery issue - if you lose the encrypting smart card, corrupt the key file, forget the password or the TPM breaks down - how can you access the data?
For small organizations, manual recovery can be …

Whenever I use Remote Desktop to connect to an NT6+ (Windows Vista / Windows Server 2008 and later) machine, I use Network Level Authentication, meaning that authentication with the server is performed before session is created (contrary to first connecting to the server and using its GUI to enter the credentials …

The Story

Since Event Log Subscription doesn't have a module or a .NET class, interacting with its settings and status has to be done either via UI or the command line utility, wecutil.exe
I was especially interested in getting the computers runtime status, to see which machines are failing …