Tech Blog

UmbreCrypt RansomWare Hits Terminal Server

This one scares me to read about. A new variant of ransomware called UmbreCrypt RansomWare is out there that is getting into business networks via hacking of terminal servers. This is even more reason to use the best practice of connecting to a Virtual Private Network (VPN) before connecting to your company terminal server. Please take the time to read this article from BleepingComputer.com to find out the frightening details. Feel free to call or email us to discuss how to proactively protect your business computer network with managed antivirus and offsite backups. Schedule a full network security audit to determine just how vulnerable your systems are and to determine what can be done to mitigate the risks.

Farmhouse Networking goes HTTPS

We undertook the task of complying with Google HTTPS-Everywhere on the web standards that are incentivising the move to HTTPS by increasing search rankings for those that comply. The first step in this process was acquiring an SSL certificate for our websites domain name from a provider. We went the cheap route and went with StartSSL using their Level 1 certificate that is good for one year and FREE. The process was not for the faint of heart as it included encryption keys, decryption of public keys, downloading of several certificates and importing them properly into our webhost. As you can see it is just a basic certificate with no verification information, so no green bar in the browser as some other sites have:

Farmhouse Networking HTTPS Certificate

If you need to acquire a SSL certificate (especially those with wildcards or extended validation) or looking for help getting your SSL certificate configured on your website, just drop an email and I would be happy to help.

The next step in the process was to change the .htaccess file in the public_html folder on the webserver (this is for Linux hosts and is different for Windows IIS users as they will be editing web.config file). Once this is done the server will start automatically sending people to the same pages you already have on the server but will use https:// instead of http:// to display them. This is universal if you put it in the public_html folder, so be careful. I had some non-relative, absolute links on my pages that were causing issues with displaying them – had to go through each link to my own pages and update them to either be relative or the correct absolute values (this does not apply to any external links). As you can see things are running great now in SSL mode on our site.

File Server Audit Logging via Group Policy

Recently going through the HIPAA compliance standards and dealing with “accidentally” deleted items on a file share has lead to a need for a standard file server audit logging policy that can be deployed to all servers via Group Policy Object (GPO). Here is the summation of my research:

File Server Audit Logging Policy GPO

1. Create a GPO and name it File Server Audit Policy
2. Set the following settings to enable advanced features and disable shutdown:

[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\]
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings – Enabled
Audit: Shut down system immediately if unable to log security audits – Disabled

3. Move down the tree structure to the following and edit these various auditing settings:

[Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\]
Account Logon: Credential Validation – Success and Failure
Account Management: Computer Account Management – Success
Account Management: Other Account Management Events – Success and Failure
Account Management: Security Group Management – Success and Failure
Account Management: User Account Management – Success and Failure
Detailed Tracking: Process Creation – Success
Logon-Logoff: Logoff – Success
Logon-Logoff: Logon – Success and Failure
Logon-Logoff: Special Logon – Success
Object Access: File System – Success
Policy Change: Audit Policy Change – Success and Failure
Policy Change: Authentication Policy Change – Success
Privilege Use: Sensitive Privilege Use – Success and Failure
System: IPsec Driver – Success and Failure
System: Security State Change – Success and Failure
System: Security System Extension – Success and Failure
System: System Integrity – Success and Failure

4. Change the following Maximum Log Size (KB) settings according to http://support.microsoft.com/kb/957662:

[Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security\]

5. Open the Properties of the shared folder needing Auditing, click on Security tab and then on the Advanced button
Folder Security Properties Page
6. Click on the Auditing tab, if there is UAC prompt then click Continue and then click on the Add button

Folder Advanced Security Settings
7. Click on Select Principal, search for the Everyone security group and then click on the OK button
8. Change the Type to All, click on Show advanced permissions, check the boxes next to “Delete subfolders and files” and “Delete” and then click on the OK button
File Server Audit Logging Entry
9. Put a check next to “Replace all child object auditing with inheritable auditing from this object then click on the OK button
If your company is using a Windows Server for network file access and need help getting the File Server Audit Logging setup property for HIPAA compliance, then contact us for assistance.

Terminal Server Lockdown Group Policy

Recently have had to setup a couple terminal servers and wanted to create a list of standard lock downs that can be added via a Terminal Server lockdown Group Policy Object (GPO).

Terminal Server Lockdown Preparation

1. Open Active Directory Users & Computers
2. Create Organizational Unit (OU) for Terminal Server.
3. Move all terminal servers to this OU.
4. Create Security Group in this OU for users who will use Remote Desktop Host (i.e. Terminal Server Users).
5. Add all users who will use the terminal server as members of this security group. 6. Open Group Policy Management, right click the new Terminal Server OU and “Create a GPO in this domain, and Link it here” (i.e. Terminal Server Lock Down).
7. In Security Filtering delete Authenticated Users, add Terminal Server Users security group created in previous step.

Configure users who can connect to the server remotely:

1. Log into the terminal Server
2. Open Control Panel, open System, click on Remote Settings then click on the Remote tab.
3. Click on Select Users, Remove any groups/users and then Add the Terminal Server Users security group.

Disable Server Manager Pop Up at user log on:

1. On Terminal Server open Task Scheduler.
2. Navigate to Task Scheduler Library\Microsoft\Windows\Server Manager.
3. Disable task “ServerManager” which triggers at log on of any user.

Configure Group Policy for Terminal Server Lock Down:

Loopback Processing:

[Computer Configuration\Policies\Administrative Templates\System\Group Policy]

Configure user Group Policy loopback processing mode: Enable – Merge

Disable Control Panel Items:

[User Configuration\Policies\Administrative Templates\Control Panel]

Hide specified Control Panel items: Enable

Add following items to the disallowed Control Panel items:
Microsoft.AdministrativeTools
Microsoft.AutoPlay
Microsoft.ActionCenter
Microsoft.ColorManagement
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.iSCSIInitiator
Microsoft.NetworkAndSharingCenter
Microsoft.NotificationAreaIcons
Microsoft.PhoneAndModem
Microsoft.PowerOptions
Microsoft.ProgramsAndFeatures
Microsoft.System
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WindowsFirewall
Microsoft.WindowsUpdate
Microsoft.DateAndTime
Microsoft.RegionAndLanguage
Microsoft.RemoteAppAndDesktopConnections
Install Application On Remote Desktop Server
Java
Flash Player

Remove Administrative Tools and Powershell:

Restrict access to Administrative tools:

1. Navigate to:

[Computer Configuration\Policies\Windows Settings\Security Settings]

2. Right click on File System, choose Add File… .
3. In the Add a file or folder window, type the following in the Folder field and click OK:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools


4. On the next window, Database Security, remove Users and check that Administrators have Full Access.

5. On the Add Object window choose Configure this file or folder then Propagate inheritable permissions to all subfolders and files then click OK.

6. Repeat the above steps for the PowerShell shortcut (in addition delete Creator Owner in database security):

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk

7. Repeat the above steps for the Server Manager shortcut:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk

File Explorer Configuration:

[User Configuration\Policies\Administrative Templates\Windows Components\File Explorer]

Enable – Restrict A, B, C and D drives only: Hide these specified drives in My Computer

Enable – Remove Hardware tab

Enable – Hides the Manage item on the File Explorer context menu

Enable – Remove Security tab

Disable Registry Modification:

[User Configuration\Policies\Administrative Templates\System]

Enable – Prevent access to registry editing tools

Configure Windows Installer and Windows Updates:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer]

Enable: Prevent users from using Windows Installer to install updates and upgrades

Enable Always: Turn off Windows Installer

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

Disable: Allow non-administrators to receive update notifications

Additional Policies:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits]

Enable (i.e. 30 minutes): Set time limit for disconnected sessions

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for logoff of RemoteApp sessions: Enable (i.e. logoff delay 1 hour)

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for active but idle Remote Desktop Services sessions: Enable ( i.e. 1 hour)

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Go to the desktop instead of Start when signing in or when all the apps on a screen are closed: Enable

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Remove the Action Center icon: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/Windows Update]

Remove access to use all Windows Update features: Enable (0 = Do not show any notifications)

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Remove CD Burning features: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Prevent access to drives from My Computer: Enable (choose the drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Credentials User Interface]

Do not display the password reveal button: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/AutoPlay Policies]

Turn off Autoplay: Enable (CD-ROM and removable media drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection]

Do not allow passwords to be saved: Enable

For detailed explanations of what each of these items does please see the notes in each individual Group Policy setting.

ScreenConnect Remote Access Tool

I have had the privilege of using a new remote support tool called ScreenConnect which was recently acquired. This tool has all the major features of other remote support tools including a built in screen annotation feature and OCR capability that feeds into the built in research tool. Looking forward to training and trying all the features of this wonderful new software.

Easily Transfer FSMO Roles Between DCs

To understand the need to transfer FSMO roles it is necessary to understand FSMO. As per Wikipedia – “Flexible Single Master Operations (FSMO) is a specialized domain controller (DC) set of tasks, used where standard data transfer and update methods are inadequate. Active Directory (AD) normally relies on multiple peer Domain Controllers, each with a copy of the AD database, being synchronized by multi-master replication. The tasks which are not suited to multi-master replication, and are viable only with a single-master database, are the FSMOs.”

When adding a new DC to a domain it often becomes the primary DC which means that a transfer FSMO roles will need to migrate. There are several ways to get this done, but this is by far the easiest I have found. Run the following PowerShell script from the new DC:

Move-ADDirectoryServerOperationMasterRole -Identity “[New DC Computer Name]” –OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster

That command came from and special thanks go out to The Lazy Admin Blog.

Fab-ulous New Software Experience

Big thanks go out to the fellows at the PodNutz Podcast for the recommendation of Fab’s AutoBackup Pro as this has been one of the best investments I have made in automating my business in recent years. I was hesistant at its expansive claims to basically grab everything from every profile on an old computer or even removed hard drive and automatically put it into the associated new profiles on a target computer. The claims are all true and really have to be experienced to be believed, so don’t do this kind of thing manually anymore as Fab’s will take care of all the heavy lifting. It will move the following:

Fab moves Personal folders:

  • Windows desktop’s content
  • Windows desktop’s wallpaper
  • Quick Launch toolbar’s shortcuts (for Windows XP and Vista : this tool bar has been removed from Windows since Windows 7)
  • Windows Start screen/menu Modern UI layout (only shortcuts, not applications)
  • My Documents
  • My Pictures
  • My Music
  • My Videos
  • Downloads folder (Windows Vista/7/8/8.1/10)

Fab moves Web browsers:

  • Windows Internet Explorer favorites
  • Windows Internet Explorer main start page
  • Windows Internet Explorer settings (proxy, security zones…)
  • Microsoft Edge favorites
  • Google Chrome profile
  • Chromium browser profile
  • Apple Safari profile
  • Opera profile
  • Firefox settings : bookmarks, extensions…

Fab moves Mail:

  • Outlook Express messages and settings (mail accounts, rules…)
  • Microsoft Office Outlook PST/OST files and email accounts (messages, address book and calendar are stored in)
  • Outlook signatures files
  • Microsoft Office Outlook typed email addresses history
  • Windows Mail messages and settings
  • Windows Live Mail messages and settings
  • Windows Address book, used by outlook Express or Windows Mail
  • Mozilla Thunderbird messages and settings
  • PostBox messages and settings
  • IncrediMail messages and settings
  • Opera Mail

Fab moves Misc :

  • Windows Vista’s calendar
  • Sticky Notes
  • Screen saver settings (enabled or not, password protected or not, delay before activation)
  • Documents templates
  • Skype data and settings
  • Trillian data ad settings
  • ICQ data and settings
  • Windows Gadgets (installed by user)
  • Network drives connections
  • Network places
  • Picasa (albums and database)
  • BlackBerry Desktop settings
  • BlackBerry devices backups
  • Logitech SetPoint settings
  • Microsoft IntelliType Pro settings
  • Microsoft IntelliPoint settings
  • Apple IOS devices iTunes backups (iPhone, iPod, iPad)

Fab moves Common items:

  • Common documents
  • Common desktop
  • Common pictures
  • Common music
  • Common videos
  • Public Downloads folder (Windows Vista/7/8/8.1/10)
  • Fonts (useful if you have installed some by yourself or bundled with software)
  • Microsoft Office XP, 2003, 2007 and 2010 activation files (Microsoft Office 2013 is not handled)
  • Modem settings file (fichier rasphone.pbk), except credentials
  • Intuit QuickBooks data (experimental)
  • NCH ExpressInvoice data
  • Steam (downloads)
  • Installed printers list

Fab moves User defined:

  • Additional files (manual selection or using wildcards search on selected operating system partition)
  • Additional folders

I cannot say enough good things about this software. Buy it and tell everyone you know about it too.

Missing Active Directory Attribute Editor Tab

Ran into this issue a couple times now while migrating Small Business Server (SBS) clients from on-premis Exchange to Office365. After setting up the DirSync tool on the server, to add an email alias to a user’s Office 365 account it needs to be setup in the Active Directory Attribute Editor tab under the proxyAddresses attribute. The easiest way to do this is add a record as follows:

Add the Active Directory Attribute Editor Tab in Small Business Server

smtp:[useralias@yourcompany.com]

into the proxyAddresses section of the Attributes tab:

Active Directory Attribute Tab

This is normally easy to do and then run a manual DirSync to add the alias to the user’s Office 365 account, but what if the Attributes tab is missing? It is time to break out the ADSIedit tool again to make the needed changes to the way these pages are displayed. Here are the steps to get it done:

  • open ADSIedit.msc
  • Right click on ADSIedit and choose “connect to”
  • Under connection point select “select a well known Naming context” and in that window choose “Configuration”
  • Under computer leave as “Default (Domain or server that you logged into)” then click OK
  • Expand CN=configuration, DC=[your domain], DC=local
  • Expand CD=DisplaySpecifiers
  • Click on CN=your language. (The language # can be found on http://support.microsoft.com/kb/324097 for example US English is 409, so CN=409)
  • In the right hand window locate CN=User-Display right click and choose properties
  • Locate AdminPropertyPages, highlight it and click “edit” and add the line

11,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

  • In the right hand window locate CN=Computer-Display right click and choose properties
  • ocate AdminPropertyPages, highlight it and click “edit” and add the line

12,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

  • In the right hand window locate CN= Default-Display right click and choose properties
  • Locate AdminPropertyPages, highlight it and click “edit” and add the line

4,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

Make sure to click on the View menu in Active Directory Users and Computers to choose the Advanced Features option if not already selected to see these newly added Active Director Attribute Editor Tab in the display.

Change Office 365 Distribution Group Restriction

If an Office 365 Distribution Group is being synced from on-premise Active Directory environment then you cannot receive emails to that group from an external source by default. If you try to change the setting in Office 365 the following error appears:

The action ‘Set-DistributionGroup’, ‘RequireSenderAuthenticationEnabled’, can’t be performed on the object ‘[Your Distribution Group]’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

Office 365 Distribution Group Error

This can be changed using the ADSIEdit tool. Navigate through the Active Directory hierarchy and find the Distribution Group then right click and choose Properties. Scroll down to “msExchRequireAuthToSendTo” and change the setting to FALSE. Run a manual DirSync to effect the changes in Office 365.

Office 365 Distribution Group - ADSI Edit

Google Apps SPF / DKIM setup

A Sender Policy Framework (SPF) record indicates mail servers that are authorized to send mail for a domain. Email recipient servers perform a check with DNS to see if the mail came from an authorized server. If not, then the email is most likely SPAM. SPF DNS records lets the recipient server perform this verification.

A DomainKeys Identified Mail (DKIM) record adds a digital signature to emails your organization sends. Email recipient servers perform a check with DNS for the to see if the DomainKey matches the sender. If so, then the email is considered unmodified and from a legitimate sender. DKIM DNS record lets the recipient server perform this verification.

Configure Google Apps SPF

If you use Google Apps for email, you’ll need access to your DNS provider to add an SPF record. In most cases, you simply login and create a new TXT record with the value of:

v=spf1 include:_spf.google.com ~all

Google provides detailed instructions on how this is done. Be sure to save your changes.

Configure DKIM for Google Apps

You’ll need access to your Google Apps control panel and your DNS records to set DKIM. This is a three step process:

1. Create the DKIM key

a. Login to your Google Apps Control Panel (e.g., https://www.google.com/a/cpanel/[yourdomain.com])

b. Navigate to the Gmail App Control Panel

c. Scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Your domain name should be displayed. Click on “Generate new record”. Leave the default selector prefix as “google”. Click “Generate”.

e. Leave this browser window open, and then create a new tab or browser window.

2. Create the DKIM DNS record

a. Login to your DNS provider.

b. Create a new TXT record. The name of the TXT record should be:

google._domainkey

This creates a domain that, fully resolved, looks like: google._domainkey.yourdomain.com.

c. The value for the DNS record will be a very long string of characters, something like:

v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCG5in7gQIDAQAB

The actual length of the string will be much longer than that above. I find it simplest to copy-and-paste the information from the Control Panel page displaying the information. Save the DNS record.

3. Start Authenticating

a. Wait 24-hours for your changes to propagate, and for Google’s servers to detect the changes.

b. Login to your Google Apps Control Panel (e.g., https://www.google.com/a/cpanel/[yourdomain.com])

c. Go to the “Advanced tools” tab, then scroll down to “Authenticate email” and click on “Set up email authentication (DKIM)”.

d. Click “Start authentication”.

As always, check Google’s detailed instructions if your setup is more complex.

Verify that SPF & DKIM are configured

Send an email from your Gmail account to check–auth@verifier.port25.com after you’ve completed the Google Apps SPF and DKIM setup. You’ll receive an email response in a few minutes. If everything is properly configured, you’ll receive a “PASS” for both the Google Apps SPF and DKIM settings. This means your email is now securely being delivered and can be verified as such.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2025 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10