Windows OS Hub for SysAdmins

⚙️ The Settings Page Visibility GPO option, introduced in Windows 10, is designed to manage the visibility of individual pages within the Windows Settings app. ✅ By controlling visibility, you can streamline the user experience by ensuring they only see the settings they need, thus minimizing potential confusion or mistakes. How to hide or show specific Settings app pages on Windows 11

🗳 Windows Subsystem for Linux 2 supports attaching and mounting physical disks within WSL2. For example, you can connect an external hard drive with a file system not supported by Windows (such as ext4), mount a disk partition on the hard drive in WSL2, and access it from both WSL and Windows host OS. We've covered how to mount different types of hard drives in the WSL2: ✅ physical disks/partitions ✅ network drives (shared network folders) ✅ virtual disks (VHD/VHDX) Mount Physical, Network, and Virtual Drives in WSL2 (Windows Subsystem for Linux)

📶 When multiple active network adapters are available on a Windows host, the operating system automatically prioritizes network interfaces based on link speed. ⚙️ The higher the link speed, the higher the priority, which is reflected in a lower metric for routes through it in the routing table. ✅ You can manually set the priority of network adapters by changing the interface metric value using PowerShell. List network adapters and their priorities:

Get-NetIPinterface | where AddressFamily -eq "IPv4"

Increase Wi-Fi adapter priority:

Set-NetIPInterface -InterfaceAlias Wi-Fi -InterfaceMetric 31

Changing network adapter priority in Windows

🍻Today is the 25rd annual Sys Admin Day and it’s the perfect time to thank those in charge of keeping the technology side of your operations together! 😎 Maintaining a secure network, keeping computers running, assisting with computer issues, and putting out any IT fire is not an easy job – so let’s thank your Sys Admin or IT teams today!🎉 Happy SysAdmin Day! #SysAdminDay

☁️ Proxmox VE 8.2 (released in April 2024) now includes a built-in wizard for importing virtual machines directly from VMware ESXi hosts. During migration, most VM configuration settings are copied and the process itself is quite simple. The tool is particularly useful for those planning to migrate from VMware to alternative hypervisors as a result of Broadcom's innovations. ✅ The Import Wizard allows to mount a remote ESXi host (version 6.5 to 8.0) as a separate storage, select a VM and start the transfer. All tasks performed from the Proxmox web UI. Disadvantages: vSAN storage is not supported, poor performance when migrating VMs with snapshots and when migrating via vCenter (a direct connection to ESXi is preferable). 🛠 This post details how to migrate Windows VM from ESXi to Proxmox, remove VMTools, install VirtIO drivers, and modify virtual hardware settings for optimal performance. A Guide for Migrating VMs from VMWare ESXi to Proxmox VE

📚 Access-based Enumeration (ABE) is one of the useful, but for some reason rarely used, options for SMB file servers (available on both Windows hosts and Samba). ✅ If the administrator enables this option in the properties of a shared network folder, users will only see the directories and files that they are authorized to access (at least Read permission required). All other items in the directory will be hidden from the user. The ABE option is very useful when accessing shared folders with a large number of subdirectories (for example, shared departmental folders). The user only sees the folders he is allowed to see. 🔹 Access-based Enumeration can be enabled in the folder property using Server Manager or with PowerShell:

Get-SmbShare DEPTDOCS | Set-SmbShare -FolderEnumerationMode AccessBased 

🔹 If you are using Samba on Linux, change this option in smb.conf:

hide unreadable = Yes

How to use Access-based enumeration in Windows to hide folders that a user doesn't have permissions for

⏳ Microsoft recently announced that the upcoming Windows 11 24H2 update will enable the mandatory use of SMB packet signing when accessing shared network folders. SMB signing protects users from man-in-the-middle and NTLM relay SMB attacks. ⛔️ However, this security measure may cause problems accessing shared network folders on some NAS storages (Synology, ASUStor, QNAP). To reduce hardware load, SMB signing is disabled by default on most NAS devices. ✅ It is recommended that administrators test the availability of SMB signing support on the NAS storage side prior to the mass rollout of the 24H2 update (approx. September 2024). Analyze the CPU and memory usage on the NAS after enabling SMB signing. Windows 11 24H2 may blocks SMB connections to NAS (Network Attached Storage)

🛠 SharePoint Online allows to access the document library from a Windows computer using WebDAV. This allows users to map the SharePoint Online document library as a network drive (manually or via GPO) and manage/upload/download/drag&drop files and folders in bulk using File Explorer. ⚠️ Before you get started, it's important to note that this is legacy technology. Microsoft recommends using the OneDrive sync client with "Files On-Demand" instead of directly mapping a drive using WebDAV. Also, mapping SharePoint Online as a network drive causes issues like loss of version history, advanced features like metadata, and alerts that will not be available. ✅ Map a SharePoint Online Document Library as a Network Drive Using WebDAV

🖨 Microsoft has changed the way the default printer is assigned starting with Windows 10 1511. Windows now automatically changes the user's default printer to the last one used at the current location. 😞 This is a problem for users who have different printers connected. In my case, a user has several printers connected: a label printer, a color printer, and an office printer. ✅ Do one of the following to prevent to prevent Windows from changing the default printer, implement one of the following: 🔹disable the Let Windows manage my default printer option in the Settings pane 🔹Create a registry item:

REG ADD "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" -v LegacyDefaultPrinterMode /t REG_DWORD /d 1 /f 

🔹 or enable the GPO option Turn off Windows default printer management under User Configuration -> Administrative Templates -> Control Panel -> Printers How to Fix Default Printer Keeps Changing in Windows 10 and 11

📂Shared network folders from a file server can be automatically mapped as network drives for all users using Group Policy Preferences (GPP). The article shows an example of mapping network drives to users based on the AD security groups to which they are added. 👥 This approach automatically connects a shared document folder to all department users. To do this, simply add the user to the department's security group in Active Directory. 🔹 In addition, GPO can be used to map a personal (home) drive with the user's personal documents. ✅ How to map network drives on Windows using Group Policy Preferences

⚡️ There are a number of online services available to check your internet speed. If you want to test the bandwidth of your provider's Internet connection from the command prompt, or send this data in the form of metrics to your monitoring, you can use Ookla's Speedtest console command. 📤 This tool tests your current download/upload speed and network latency to the nearest speedtest host. The speetest-cli will automatically determine the nearest point based on your public IP address, or you can select a specific city and provider from the list. ✅ The speedtest-cli command is available for both Linux and Windows. How to test the Internet connection speed on Windows from the command prompt or PowerShell

🕵️ File system auditing allows you to monitor access events to shared files and folders on a Windows file server. Auditing can be enabled for a specific file or folder with or without subfolders. With a properly configured audit policy, you can find out who deleted, changed or renamed a particular file in a shared folder. 👌 The audit policy should only be applied at a granular level to important folders and files. If you enable it for all file system objects and all events, a lot of redundant information will appear in the Event Viewer security log. File system audit in Windows - How to enable and apply an audit policy to a shared file or folder ✅ https://woshub.com/audit-policy-file-folder-access-windows/

⚙️ iVentoy is a lightweight PXE server for network deployment of Windows, Linux, VMware ESXi and other operating systems. iVentoy includes everything needed to boot a computer over the network using PXE (DCHP+TFTP+NBD) and install the OS from an ISO image. 🔹An administrator needs to run the iVentoy executable and copy ISO images of all the required operating systems into the iVentoy directory (or make a symlink) . 🔹 After this, any computer on the network when booting in PXE-LAN mode will receive a list of available ISO images for boot. 🔹 You can install the operating system from any ISO image or boot from the LiveCD. 🔹 With iVentoy, you can completely avoid the need to use a USB installation sticks to install the OSs. iVentoy supports up to 20 simultaneous PXE clients in the free edition. ✅ How to boot and install any operating system from an ISO image over a network using iVentoy

We have already talked about the Ventoy tool (by the same developer) which is used to create multiboot USB flash drives

📚 The Quick Access pane in File Explorer is designed to make frequently used and favorite folders easily accessible. 👌 In this guide, we'll look at how to use PowerShell and GPO to automate the process of adding favorite folders to the Quick Access list based on a user's assigned roles (user security groups in AD). ✅ Add favorite folders to the Windows Quick Access pane using PowerShell

📷 User photos can be stored in the attributes of user accounts in Active Directory. These photos can be used by applications like Outlook, Word, Excel, Lync, SharePoint to display the picture of currently logged-in user in their interface, or can be used as the account logon image on Windows clients. The photo is stored directly in the AD database, so it is not recommended to upload large images there. ✅ The recommended image size is 10 KB, 96x96 pixels. An administrator can use PowerShell to upload a user photo.

$photo = [byte[]](Get-Content C:\PS\jkuznetsov_photo.jpg -Encoding byte)
Set-ADUser jkuznetsov -Replace @{thumbnailPhoto=$photo}

Uploading user photos in Active Directory

📚 Modern Windows versions allow you to passthrough a physical graphics card (GPU) from a Hyper-V host to a virtual machine. This can be used to take full advantage of 3D graphics and run apps in VMs that require direct access to GPU resources to execute workloads. ✅ Previously, RemoteFX technology was used to pass-through a GPU to a VM. RemoteFX is currently replaced by DDA (Discrete Device Assignment) feature on Windows Server 2022/2019 or GPUPartitioning on desktop versions of Windows 10/11. https://woshub.com/passthrough-gpu-to-hyperv-vm/

⬆️ There is an easy way to upgrade your Windows edition from Home to Pro or Enterprise without reinstalling the operating system, while keeping all your installed programs, documents and settings. 🖥 The built-in changepk.exe tool can be used to upgrade the edition in the desktop versions of Windows 10 and 11. For example, from Windows Professional -> Enterprise or Windows Home (Single Language)-> Pro.

changepk.exe /ProductKey xxxxx-xxxxx-xxxxx-xxxxx

Specify your license key or generic key as an argument (generic product key used to install Windows when the 'Skip key' option is selected during OS installation). ✅ How to upgrade Windows Home to Pro or Enterprise edition 🗄To upgrade from Windows Server Standard (or Evaluation) to Datacenter Edition, use the DISM command:

DISM /online /Get-CurrentEdition 
DISM /online /Get-TargetEditions 
DISM /online /Set-Edition:ServerDatacenter /productkey:xxxxxxxxxxxxxxxx /accepteula

✅ Upgrading Windows Server Evaluation edition to Standard or Datacenter

📚 Windows 10/11 image comes with a set of pre-installed UWP/APPX apps including Weather, News, Maps, Music, Video, Cortana, Mail, etc. List installed UWP apps for all users using PowerShell:

Get-AppxPackage -AllUsers | select Name,PackageFullName

Any app can be removed from all user profiles:

Get-AppxPackage *Weather* -AllUsers| Remove-AppPackage –AllUsers

And then remove it from the staged system package so that it is not installed for new users:

Get-AppxProvisionedPackage -online | ?{$_.PackageName -like "*Weather*"} | Remove-AppxProvisionedPackage -online

But in Windows 11, many control panels, system services, plugins, and extensions are UWP applications. For example, Settings app (modern Control Panel), Windows Security (Defender) GUI, etc. Such system apps should not be uninstalled without reason. List system UWP apps on Windows:

Get-AppxPackage| ? { $_.SignatureKind -eq "System" }

✅ How to remove preinstalled UWP (APPX) appx from Windows

📚To restrict the scope of the GPO in AD to specific users, groups, or computers with specific properties, several methods can be used: 🔹Security Filtering – a way to apply the GPO only to objects that are members of a specific AD security group. However, you will need to manually add and remove items to such a security group. 🔹 Item Level Targeting in Group Policy Preferences – allows you to select and combine the conditions for applying the GP Preference parameter from around 30 available options (OS version, bitness, OU, etc). However, this is only available for GPO settings in the Preferences section. 🔹GPO WMI filters – a query against the WMI namespace that the computer must run before applying the GPO, and check that it matches the specified condition. This is the most universal and flexible way to granularly apply GPO settings to clients, as you can get almost any information from WMI. ✅ How to scope Group Policy with WMI filters

⚙️ The following guide explains how to print from a Linux workstation to a shared printer on a Windows 10 machine. We have described how to use CUPS and smbclient in Linux to check the availability of a network printer on a Windows computer, find a printer driver, and print documents over the network. ✅ Connecting Windows Shared Printer in Linux via SAMBA https://woshub.com/connect-windows-shared-printer-on-linux/