Tachytelic.net

Windows Server 2016

Remote Desktop “CredSSP encryption Oracle remediation” quick fix 5/5 (1)

by Leave a Comment

This is a quick credssp registry fix for the following error when trying to connect to a machine using RDP (Remote Desktop):

Image showing RDP CredSSP Authentication Error when connecting to a host with RDP
An authentication error has occurred. The function requested is not supported

This is because the server you are connecting to is not patched up to date, and the machine you are connecting from is. Modify the registry to allow your machine to connect to it:

  1. Open Regedit.
  2. Navigate to the following registry key, or create it if it does not exist: 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
  3. Create a new DWORD value called “AllowEncryptionOracle“
  4. Set the new registry entry to have a value of 2:

    Image showing AllowEncryptionOracle registry entry being set to a value of 2
    Set the value of AllowEncryptionOracle to 2
  5. Connect to the server that you were unable to connect to before.

Run this from an elevated command prompt to achieve the same result:

REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2

This registry entry is a temporary workaround until you have patched your server, when you have done that, remove the setting with this command.

REG Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle

How to use Group Policy to defer Windows Quality and Feature updates 5/5 (1)

by Leave a Comment

Sometimes feature updates can cause issues with the base operating system or third party applications. This post explains how to defer either Quality updates or Feature updates to Windows 10 or Windows Server 2016 in a domain environment.

Defer Updates with Group Policy

  1. Open Group Policy Editor.
  2. Create and link a new policy or edit an existing one if appropriate.
  3. Navigate to:
    • Computer Configuration
    • Polices
    • Administrative Templates
    • Windows Components
    • Windows Updates
    • Defer Windows Updates
      Image showing group policy settings to defer Windows Quality and Feature updates

Defer Feature Updates

Feature updates tend to cause more issues than quality updates. Microsoft have an update branch called “Current Branch for Business”. This branch is not deployed until Microsoft considers the feature update safe for enterprise deployment. You can choose this option only, or introduce a further delay if required.

Defer Feature updates as follows:

  1. Double click on “Select when Feature Updates are received”.
  2. Click on “Enabled”.
  3. In the Branch readiness drop down, select “Current Branch for Business”.
  4. Enter the period for which you want to delay the deployment of this update:Image showing how to defer Windows Feature updates
Feature updates can be deferred for up to 365 days.

Defer Quality Updates

Quality updates can be deferred for a maximum of 30 days.

Defer Quality updates as follows:

  1. Then double click “Select when Quality Updates are received”.
  2. Click on “Enabled”.
  3. Enter the amount of days that you want to defer for.

It might seem risky to defer quality updates, but there have been many occasions when these have also caused severe problems. I recommend that you have a subset of computers that receive updates first (which do not have these policy settings defined).

A customer using Cyberark EPM on Windows 10 had to defer update 1809, which at the time of writing has compatibility issues.

If you found this post helpful, I’d really appreciate it if you left a rating.

How to install telnet client on Windows Server 2019, 2016 or 2012

by 1 Comment

Telnet is not installed on Windows Server by default. I don’t understand why, because it is a useful tool and uses little space. It is however, easy to enable telnet on Windows Server 2016 or 2012. If you do not have telnet installed you will see this message from the command line:

Image showing telnet not available in Windows Server
Telnet is not recognized as an internal or external command.

 

Install Telnet Client on Windows Server 2019, 2016 or 2012 using the command line

The command line is the quickest way of installing the telnet client, very simply just type:

dism /online /Enable-Feature /FeatureName:TelnetClient

Image showing how to install telnet client on Windows Server 2016

 

Install Telnet Client on Windows Server 2016 using Server Manager

You can use Server Manager to install the telnet client, but it is a much longer process than doing it via the command line, here is a short video of the correct options to select.

Check that Telnet is installed

To check if your installation was successful, just go into a command prompt and type “telnet” and you should come to the interactive telnet prompt, like this:

Image showing successful installation of Telnet client on Windows Server

Check Ports with Telnet

Now that you have got telnet installed, you can use it to test open ports ports and connect to remote machines.

Change network from public to private on Windows Server 2016 5/5 (1)

by Leave a Comment

  1. Open Powershell
  2. Type Get-NetConnectionProfile
    Image showing Powershell to get the current network profile
  3. If you have only one network connection you can change the profile to private by typing: 
    Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

    Image showing how to change network profile on Windows Server 2016 from Public to Private

  4. If you have multiple network interfaces and would like to change a specific adapter use the Interface Index Property like this: 
    Set-NetConnectionProfile -InterfaceIndex 3 -NetworkCategory Private
  5. You can then verify the change has taken place by running Get-NetConnectionProfile again:
    Image showing Windows Server 2016 Network Connection with a Private Profile

How to change network profile to public

The same command also works to switch back to a public profile

Set-NetConnectionProfile -InterfaceIndex 3 -NetworkCategory  Public

If you found this post helpful, I would really appreciate it if you left a rating.

Disable Server Manager when logging in to Windows Server 2016 5/5 (1)

by Leave a Comment

When logging in to Windows Server 2016, Server Manager starts automatically. Here are four ways to disable Server Manager at startup:

Method One: Disable Server Manager using server manager properties.

  1. In Server Manager click on manage and then “Server Manager Properties”:
    Image showing how to access Server Manager Properties to disable startup of Server Manager when logging into Windows Server 2016
  2. Now tick the box that says “Do not start Server Manager automatically at logon”:
    Image showing how to disable server manager at logon on Windows Server 2016 using Server Manager Properties.

Method Two: Use Group Policy Editor (All users)

  1. Run gpedit.msc to edit the either the policy of the local machine or change your domain group policy settings.
  2. Go to Computer Configuration -> Administrative Templates -> System -> Server Manager:
    Image showing how to disable server manager at startup using group policy

Method Three: Disable Server Manager from Task Scheduler

  1. Open Task Scheduler
  2. In the left navigation pane,  go to Task Scheduler Library -> Microsoft -> Windows -> Server Manager
  3. Right Click on the “ServerManager” Task and choose disable:
    Image showing how to disable Server Manager in Windows Server 2016 using the Task Scheduler Library

Method Four: Use PowerShell to disable the Server Manager Scheduled Task

  1. Run Windows PowerShell
  2. Enter the command:
Get-ScheduledTask -TaskName ServerManager | Disable-ScheduledTask -Verbose

You should see output like this:
Image Showing how to disable Server Manager using Windows Powershell

 

So many methods to achieve the same result. Depending on how many servers you are looking after will determine which is the best option for you.

If you found this post helpful, I’d really appreciate it if you rated it.