Windows OS Hub for SysAdmins

🔐 OpenVPN is a lightweight, easy-to-deploy, open-source VPN solution that can be used to implement secure VPN connections in small organizations and home networks. The OpenVPN Server can run not only on Linux but also on Windows machines A common use case is securing remote access to Windows VDS/VPS hosts when you don't want to expose an unprotected RDP port directly to the Internet. One of the major changes in OpenVPN 2.7 is the complete removal of the Wintun driver (due to licensing restrictions imposed by its developer and conflicts with other VPN clients). OpenVPN 2.7 on Windows now uses ovpn-dco-win driver (OpenVPN Data Channel Offload) by default. It moves traffic processing and encryption into the Windows kernel, delivering significantly better performance. 📚 The article has been completely updated for OpenVPN 2.7 and covers: 🔹 PKI generation using Easy-RSA 3 🔹 Using ovpn-dco-win instead of Wintun driver 🔹 Using tls-crypt instead of tls-auth 🔹  NAT and routing configuration 🔹  Certificate revocation 🔹 Pushing LAN routes to VPN clients 🔹 Configuring redirect-gateway

💡 You can deploy an OpenVPN server not only on Windows Server but also on desktop editions including Windows 10 and 11.

✅ This guide will show you how to set up an OpenVPN server on a Windows 11 workstation and how to connect to it remotely from another Windows computer.     How to Install and Configure OpenVPN Server on Windows

👥 In large enterprise environments, where the same infrastructure servers can be managed by multiple administrators or support teams, it sometimes happens that someone accidentally removes a specific app or agent from a management host. To investigate such incidents and identify the exact user who installed or uninstalled a specific app, you can search for the app installation and removal events in the Windows Event Viewer.   📝 Events relating to the installation or removal of classic Windows apps via the MSI installer are logged in the Event Viewer: 📥 11707 – event code for successful installation of the MSI application. 🗑 11724 – event code for uninstalling the MSI-based app   You can open the Event Viewer log console (eventvwr.msc) and enable filtering for event IDs 11707 and 11724 for the Application log, or use a simple PowerShell script to find the related events. For example, the following PowerShell script returns information about who installed or uninstalled the Zabbix agent on a Windows host and when this occurred:

$app_name='*Zabbix*'
Get-WinEvent -FilterHashtable @{LogName="Application"; ID=11707,11724; ProviderName='MsiInstaller'}| Where-Object { $_.Message -like $app_name }| Select TimeCreated, @{Name='Username'; Expression={(New-Object System.Security.Principal.SecurityIdentifier($_.userid)).Translate([System.Security.Principal.NTAccount]).Value}}, Message

  How to Detect Which User Installed or Removed a Program on Windows using Event Viewer

📚 How to Fix a Temporary User Profile in Windows (Including RDS)   Logging in with a temporary user profile is a well-known failure that affecting both Windows workstations and Windows Server RDS hosts, when the User Profile Service fails to load the user's authentic profile. The user gets the banner We can’t sign in to your account, an empty desktop, and the warning that all changes will be lost after sign-out. You can check profile path was actually used for user sign-in using the command: $env:USERPROFILE If the temporary profile is used, the command will return something like this: C:\Users\TEMP.yourHOSTNAME. To find out the user SID and the name of the folder where the user's actual profile is stored, run:

whoami /user
Get-CimInstance Win32_UserProfile | Select LocalPath, Loaded, SID

Then check the Event Viewer (Windows Logs > System) for User Profile Service events, which usually contain information about the source of the problem. For example, look for Event IDs: 🔹 1511 - signed in with a temporary profile 🔹 1502 or 1508 — permissions or corrupted NTUSER.DAT 📚 The post walks through the common scenarios: missing profile directory, changing the profile path in the registry, ACL issues, antivirus locking NTUSER.DAT, and cleanly creating a new profile with data migration. We Can’t Sign In to Your Account: Fix Temporary User Profile in Windows

📹 (Video): Repair Windows with DISM and SFC: The Correct Order Explained https://www.youtube.com/watch?v=tz8ftJ5rTSE SFC (System File Checker) and DISM (Deployment Image Servicing and Management) are both built-in Windows command-line repair tools used to fix corrupted system files, but they operate at different levels of the operating system. 🔹 DISM (System Image Level): Repairs the underlying Windows component store (WinSxS) and system image. 🔹 SFC (File Level): Scans protected individual operating system files and replaces damaged or missing ones using the local component store

Set Up SSH Key Authentication for Windows OpenSSH 📟 The built-in OpenSSH server in Windows supports SSH key-based authentication, enabling you to perform remote logins without entering a password, which is useful for performing various remote administration and automation tasks. To set it up, generate an SSH key pair on the client machine as usual. Then, add the public key to the authorized_keys file on the Windows machine running the OpenSSH server.

However, there’s a Windows-specific quirk that often catches administrators out: the location of the authorized_keys file depends on whether or not the user is a member of the local Administrators group.

⚠️ On Windows, the location of the file containing the public keys depends on the account's privileges. The default locations differ: 🔹 Regular (non-admin) users: C:\Users\%username%\.ssh\authorized_keys 🔹 Members of the local Administrators group: C:\ProgramData\ssh\administrators_authorized_keys The following option in the sshd_config file enables this behaviour by default:

Match Group administrators
    AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

If you comment out this block in sshd_config, the override no longer applies. Unless a different location is specified in another sshd option, OpenSSH will use the standard ~/.ssh/authorized_keys file in the user's profile,  including for local administrators. 📚 The article covers configuring key-based SSH authentication on Windows 10/11 and Windows Server, including: ✅ Generating SSH keys on the client machine ✅ Adding public keys on a Windows host running the OpenSSH server ✅ Configuring the sshd_config file on the server side ✅Auditing OpenSSH auth logs   How to Configure SSH Key-Based Authentication in Windows

🛠 How to Install Microsoft Office LTSC 2024

Office LTSC 2024 is a perpetual, volume-licensed Office edition designed for organizations that do not need a Microsoft 365 subscription and may operate in environments with limited internet access. This Office release designed for organizations with specific long-term servicing and deployment requirements.

Microsoft Office LTSC 2024 can be deployed using the Office Deployment Tool (ODT), which provides administrators with control over installation, configuration, and Office deployment without relying on the standard interactive installer. In this guide, we cover the deployment process, from preparing the installation files to installing Office using the command line. 📌 What’s covered: 🔹Downloading the Office Deployment Tool 🔹 Configuring the Office deployment using DeployOffice2024LTSC.xml 🔹 Specifying the Office edition, update channel, language, and installation options 🔹 Using XML configuration to standardize deployments across multiple computers You can only downlow the installation files from the Microsoft CDN: setup.exe /download DeployOffice2024LTSC.xml Or immediately install the Office LTSC 2024 on a computer: setup.exe /configure DeployOffice2024LTSC.xml 📺 Video tutorial: https://www.youtube.com/watch?v=1EaLVyP-rtI 📖 Step-by-step guide: https://woshub.com/install-microsoft-office-ltsc-2024/

📚 Rclone on Windows: Automate backup and sync files with Google Drive and other cloud storage providers. As an alternative to official cloud clients, you can use Rclone a small command-line tool often described as rsync for the cloud. It supports Google Drive and many other cloud storage providers, including S3-compatible object storages, allowing you to automate the synchronization of local folders with the cloud using scripts. Install Rclone on Windows using winget: winget install Rclone.Rclone Run the interactive configuration wizard to connect to Google Drive: rclone config One-way folder copying to cloud storage: rclone copy "C:\Backup" gdrive:MyPCBackup --progress Mirror a local directory to a cloud (one-way sync). This makes the destination identical to the source by copying new files and deleting removed ones: rclone sync "C:\Backup" gdrive:MyPCBackup --progress

⚠️ Be careful with sync! If you delete a file from the source directory, it will also be deleted from the cloud during synchronization. If you want to use the copy in the cloud storage as a backup, consider using the --backup-dir option to move older versions of modified or deleted files into an archive.

💡 What else can you do with Rclone? 🔹 Automate cloud backups with simple scripts 🔹 Mount cloud storage as a regular network drive with a drive letter assigned (WinFSP required). 🔹 Migrate data between cloud providers 🔹 Encrypt files transparently before uploading them to cloud using the rclone crypt command Rclone, unlike official cloud clients, doesn't sit in the system tray and consume system resources. It is highly versatile, makes switching cloud providers easier, and is ideal for scripting and automation tasks. 📚 The article covers Rclone installation and configuration on Windows, how to connect to cloud storage (Google Driver in this example), using copy and sync commands, scheduled backups, and data encryption. It also includes a simple PowerShell script that: 🔹 Syncs selected local folders with Google Drive 🔹 Copies deleted and modified files to the cloud archive 🔹 Automatically removes old file versions 🔹 Runs on a schedule via Windows Task Scheduler ✅ rclone on Windows: Sync and Backup Files to Google Drive and Other Clouds

⚠️ UAC prompt with missing “Yes” button A classic case that still confuses many admins and users: you right-click an app to run it elevated → Run as administrator and the User Account Control dialog appears… but there’s only a No button. The Yes button is completely missing in UAC. This behavior means there are no enabled local administrator accounts left on the computer that can approve the elevation request. The currently signed-in account has lost membership in the local Administrators group and is now just a regular standard user.     ✅ Fix: UAC Yes button missing in Windows 11

⌨️ The built-in Windows Keyboard Filter feature allows administrators to prevent users from using specific keyboard shortcuts. This can be useful for devices operating in kiosk mode, as well as for operator workstations, terminals and other computers with restricted user interfaces. For example, you can deny the use of standard keyboard shortcuts such as Alt+Tab, Alt+F4, Ctrl+Alt+Del, Ctrl+Shift+Esc, Ctrl+C/Ctrl+V, as well as custom key combinations or individual keys.   This feature can be installed using the following PowerShell command:

Enable-WindowsOptionalFeature -Online -FeatureName Client-KeyboardFilter

The registry key HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter contains a list of predefined Windows keyboard shortcuts. To block one of them, simply change the value of the corresponding registry item to Blocked.   To block the Alt+Tab shortcut, for example, change this registry entry:

reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter" /v "Alt+Tab" /t REG_SZ /d "Blocked" /f

A custom key combination can be added under CustomFilters:

reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\CustomFilters" /v "Ctrl+C" /t REG_SZ /d "Blocked" /f

An individual key can be blocked by its scan code. For example, to block the left Windows key:

reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\CustomScancodes" /v "E05B" /t REG_SZ /d "Blocked" /f

📚 The article also covers how to create custom filters for individual keys and combinations, block keys by scan code, and check active policies using Event Viewer and PowerShell.

⚠️ Unfortunately, Keyboard Filter is only supported in the Enterprise, Education, IoT Enterprise and LTSC editions of Windows. Also, the filter does not work in RDP sessions.

How to Block Specific Keyboard Shortcuts in Windows with Keyboard Filter

🔐 How to Extract Saved Passwords from Windows Credential Manager Using PowerShell In this new video, we focus specifically on extracting passwords saved in Windows Credential Manager using PowerShell. We cover: 🔹 Listing stored Credential Manager entries 🔹 Identifying the target credential 🔹 Using PowerShell to retrieve the saved password 🔹 How Windows DPAPI protects stored credentials 🔹 Why the extraction must be performed in the same user's security context that originally saved the credential 🔹 Why running the commands as SYSTEM, another user, or after a forced password reset may result in an empty password or access error 🎥 Watch the video: https://www.youtube.com/watch?v=eBbUa6_aLjI 📖 Full guide: https://woshub.com/saved-passwords-windows-credential-manager/

🕐 Synchronizing Active Directory Domain Time with an External NTP Time Server In an Active Directory domain, a strict hierarchical time synchronization scheme is used: 🔹 The PDC Emulator in the root domain is the primary time source for the domain 🔹 Other domain controllers (DCs) synchronize their time from the PDC Emulator 🔹 Domain-joined workstations and member servers get their time from the nearest domain controller ⚙️ By default, the PDC syncs its time with the local CMOS (hardware) clock of the physical server (or the hypervisor CMOS if it's running in a VM). If the hardware clock is inaccurate, it can cause problems with authentication and interaction with external systems.

That's why you should configure the PDC to synchronize with a reliable external NTP time source and disable synchronization with the local hardware clock/hypervisor.

✅ In this article, we look at how to properly configure time synchronization in an Active Directory domain and what to do if something isn't working correctly. Configuring Time Synchronization in an Active Directory Domain

🕐 Resource-intensive jobs in Windows launched via Task Scheduler can run significantly slower than when started manually. I encountered an issue with a Robocopy backup task launched via Task Scheduler on a high-load server. The scheduled task failed to complete overnight, but it finished in just a couple of hours when the backup script was run manually.

The reason: by default, Windows Task Scheduler creates tasks with priority 7 (Below Normal). As a result, on high-load hosts, processes launched by Task Scheduler receive less CPU time than processes running at normal priority.

⚙️ The classic way to change a scheduled task's priority, which works on all versions of Windows, is to export the task to an XML file, open the file in a text editor, and change the Priority value from 7 (the default for all Task Scheduler tasks) to either  5 (Above Normal) or 6 (Normal). Then, the original task needs to be deleted and re-imported from the XML file with the new settings. However, if the task's settings are later changed through the graphical taskschd.msc console, its priority will be reset to its original value (7). ⚙️ Change the task priority with PowerShell ✅ Therefore, it is better to use the PowerShell cmdlets from the built-in ScheduledTasks module to change task priorities. Check the current task priority:

$myTask = "py_Inspect"

(Get-ScheduledTask -TaskName $myTaskName).Settings.Priority

Set it to 5 (Above Normal):

Set-ScheduledTask -TaskName $myTask -Settings (New-ScheduledTaskSettingsSet -Priority 5)

📖 How to Set Task Priority in Windows Task Scheduler

⚠️ Microsoft Excel updates released in September 2026 can break basic copy-and-paste functionality, fill operations by dragging, and cell drag-and-drop. They can also make it impossible to copy worksheets within the same Excel workbook. The issue affects both classic MSI versions of Microsoft Excel (2016 and 2019) and Click-to-Run (C2R) versions of Excel 2019, 2021, and 2024. 🔹 MSI versions of Excel 2016 In Microsoft Excel 2016 MSI, the problem appears after installing security update KB5002914 (September 8, 2026). There is currently no official fix, so for now the workaround is to uninstall the update: wusa /uninstall /kb:5002914 /quiet /norestart Or: msiexec.exe /package Product_GUID /uninstall Update_GUID /qn

For example: Product_GUID Office 2016 Professional x64 — {90160000-0011-0000-1000-0000000FF1CE} Office 2016 Professional x86 — {90160000-0011-0000-0000-0000000FF1CE} Office 2016 Standard x64 — {90160000-0012-0000-1000-0000000FF1CE} Update_GUID {27882596-A8ED-4382-9C71-6CD2DD19F732}

You can retrieve the complete UninstallString for the installed Office update directly from the registry:

Get-ItemProperty `
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" ,
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" `
  -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -like "*KB5002914*" } |
Select-Object DisplayName, UninstallString

🔹 Click-to-Run Office versions With Office C2R, KB5002914 cannot be uninstalled as an individual patch in the same way as with MSI versions. Instead, you need to roll back to a previous Office build using officec2rclient.exe. 1️⃣ First, temporarily disable Office updates so the problematic build isn't installed again. You can do this through: File → Account → Update Options → Disable Updates Or via the registry:

reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "EnableAutomaticUpdates" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "HideEnableDisableUpdates" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v "UpdatesEnabled" /t REG_SZ /d "False" /f

2️⃣ Then roll back to the previous build: officec2rclient.exe /update user updatetoversion=<build number> You can find available build numbers in Microsoft's Update History for the corresponding Office product. For example: "C:\Program Files\Common Files\microsoft shared\ClickToRun\officec2rclient.exe" /update user displaylevel=true updatetoversion=16.0.14334.20848 3️⃣ Once Microsoft revokes the problematic update or releases a fix, re-enable Office updates:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "EnableAutomaticUpdates" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "HideEnableDisableUpdates" /f
reg add "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v "UpdatesEnabled" /t REG_SZ /d "True" /f

✅ How to Roll Back Microsoft Office to a Previous Version After an Update

📚 In Windows Server 2012 R2 and earlier, administrators can configure an application to run automatically when a user logs on to a terminal session by specifying the path to the executable on the Environment tab of the user’s domain or local account properties.   Starting with Windows Server 2016, this behavior no longer works by default because the Remote Connection Manager (RCM) no longer queries these user properties during logon. The assigned application is ignored, and a full desktop session is opened instead. Microsoft recommends an alternative approach to the one previously used: publishing programs on RDS as RemoteApps or configuring a program to launch automatically when a user logs on to a terminal session via Group Policy. ⚙️ You can restore the legacy Remote Connection Manager behavior to the way it worked in Windows Server 2008 R2/2012/2012 R2. To do this, create fQueryUserConfigFromDC registry values and set them to 1: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fQueryUserConfigFromDC /t REG_DWORD /d 1 reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v fQueryUserConfigFromDC /t REG_DWORD /d 1 Restart the terminal server host to apply the changes. This will force the Remote Connection Manager service on terminal server to query the Active Directory for user configuration settings during a Remote Desktop login. ✅ How to Run a Program Automatically at RDP/RDS Logon

📚 DISM /Cleanup-Image /RestoreHealth and SFC /ScanNow: Check and Repair Windows System Files and the Component Store The DISM and SFC commands can help fix a wide range of problems with corrupted or missing system files in Windows. They’re two built-in Windows tools that have saved me more times than I can count.

⚠️ The order of these commands matters: first check and, if necessary, repair the Windows component store using DISM. Then run the System File Checker (SFC), which uses the component store as the source of the original system files. If the component store itself is corrupted, SFC may not be able to find healthy copies of the system files it needs to restore.

Check the health of the component store: DISM /Online /Cleanup-Image /ScanHealth Repair the component store: DISM /Online /Cleanup-Image /RestoreHealth By default, DISM uses Windows Update as the repair source, so an internet connection is required. If the Windows Update service is unavailable, you can specify an offline Windows installation image (install.wim or install.esd) containing the corresponding Windows version as the repair source: DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:6 /LimitAccess After repairing the component store, run the System File Checker: SFC/ScanNow SFC verifies protected Windows system files and, if necessary, replaces corrupted or missing files with healthy copies from the component store. As mentioned above, SFC’s repair source is DISM’s repair target. Do not run anything that requires a system restart before, between, or alongside those two. ✅ The article provides a detailed overview of DISM and SFC, including component store health checks and repair, restoring Windows system files and component store from a local WIM/ESD image, and offline repair scenarios. Using DISM and SFC to Check and Repair System Files in Windows 11/10

⚙️ By the way, I found a useful PowerShell script that can simplify Windows machine migrations to Proxmox for both P2V and V2V scenarios. The load-virtio-scsi-on-boot.ps1 script should be run on the source Windows machine before migration to Proxmox: https://github.com/croit/load-virtio-scsi-on-boot The script prepares Windows for migration to KVM/Proxmox helping to prevent unnecessary reboots and the INACCESSIBLE_BOOT_DEVICE BSOD, when the system disk is connected via a native VirtIO SCSI storage controller: powershell.exe -ExecutionPolicy Bypass -File .\Downloads\load-virtio-scsi-on-boot.ps1   ⚠️ How it works: The script uses the Win32 API to create a temporary (phantom) VirtIO SCSI storage device. The appropriate VirtIO driver  is installed from the INF file using the pnputil tool. Windows associates the driver with the phantom storage SCSI device, creates the required service configuration in the registry, and sets the driver to Boot Start. Both VirtIO SCSI (vioscsi) and VirtIO Block (viostor) are supported. ✅ As a result, the migration process no longer requires workarounds such as temporarily attaching the disk through an IDE/SATA controller or creating dummy SCSI disks just to get the VirtIO storage driver installed. 🅱️ How to Migrate an Existing Windows Machine into a Proxmox VM

📹 (Video): How to Publish EXE Installers via Group Policy Using ZAP Packages (No MSI Required)

In this video tutorial, you’ll learn how to use ZAP (Zero Administration Package) files to deploy EXE-based applications via GPO in an Active Directory environment. Although Group Policy Software Installation is designed primarily for Windows Installer (MSI) packages, ZAP files provide a simple way to publish certain legacy or third-party EXE installers to domain users. This video walks through the complete process, from creating a ZAP file to publishing the application for users and installing it on a client computer.

https://www.youtube.com/watch?v=p5JzeFoHn2E

📚 Windows Group Policies let you centrally deploy applications to domain‑joined computers via Computer Configuration -> Policies -> Software Settings -> Software installation (for machine‑targeted installs) or User Configuration -> Policies -> Software Settings -> Software installation (for user‑targeted installs). However, this feature is rarely used in practice because it is primarily designed to work with software that is packaged as MSI installers, which limits its applicability to many modern apps.  The process of customizing software installation parameters typically involves creating an MST (transform) file for the MSI package, which modifies default properties and settings before deployment via GPO. ❓ What many administrators forget is that Group Policy can also be used to deploy any software with an EXE installer. To do this, you can create a text-based Zero Administration Package configuration file with the .ZAP extension. In essence, a ZAP file uses a structure similar to an INI file. 1️⃣ For example, to deploy the Obsidian client using an EXE installer, create the following ZAP file:

[Application]
FriendlyName = "Obsidian - Markdown editor "
SetupCommand = "\\mun-fs01\Install\Obsidian-1.13.1.exe" /S
DisplayVersion = 1.13.1
Publisher = "Dynalist"

2️⃣ The ZAP file defines the network path to the software installer and the command-line parameters used to install it. In this example, the /S switch used to perform a silent installation without displaying a graphical interface. 3️⃣ Then specify the path to the ZAP file in GPO settings and assign the policy to the OU containing the target users. 4️⃣ Users will see the application as available for installation from the network in the classic Control Panel (control appwiz.cpl,,1) and can install it whenever they need it. This option was not migrated to the modern Settings app, presumably because ZAP packages are considered legacy technology (which, to be fair, they probably are 🤷‍♂️).

⚠️ One important limitation: the installation runs in the security context of the current user. If the application requires administrative privileges, Windows will display a UAC elevation prompt. Therefore, this deployment method is suited for apps that install into the user's profile (under AppData) and do not require local administrator permissions.

Overall, this is still a simple and interesting way to create an on-demand software catalog: users can choose an app from a collection of published programs and install only what they need. 👌 Deploying Software (MSI and EXE) with Group Policy

📹 (Video): How to Recreate EFI System Partition in Windows After Accidental Deletion https://www.youtube.com/watch?v=m7OOEYm-eqE

🛠 Accidentally deleted the EFI partition and Windows no longer boots? A deleted EFI System Partition can render a Windows computer unbootable, even when the operating system and user data remain intact. This guide covers a practical recovery procedure for rebuilding the EFI System Partition (ESP) and restoring the boot environment on a UEFI/GPT Windows machine. It includes: 🔹boot from Windows installation/recovery media 🔹recreate the EFI and MSR partitions with DiskPart 🔹format the EFI partition as FAT32 🔹restore UEFI boot files with bcdboot 🔹rebuild the BCD and get Windows booting again 👉 How to Repair a Deleted EFI Partition in Windows