Windows OS Hub for SysAdmins
رفتن به کانال در Telegram
Windows System Admin's Blog 🌐https://woshub.com ▶️ https://www.youtube.com/@woshub ⚙️ Detailed guides cover Windows Server, Active Directory, GPO, PowerShell, Exchange, Microsoft 365, VMware, Linux and more.
نمایش بیشتر995
مشترکین
اطلاعاتی وجود ندارد24 ساعت
+17 روز
+130 روز
در حال بارگذاری داده‌ها
کانال‌های مشابه
ابر برچسب‌ها
هیچ داده‌ای
مشکلی وجود دارد؟ لطفاً صفحه را تازه کنید یا با مدیر پشتیبانی ما تماس بگیرید.
اشارات ورودی و خروجی
---
---
---
---
---
---
جذب مشترکین
اکتبر '26اکتبر '26
اکتبر '26
+618
در 0 کانال‌ها
سپتامبر '260
در 0 کانال‌ها
Get PRO
اوت '260
در 0 کانال‌ها
Get PRO
ژوئیه '260
در 0 کانال‌ها
Get PRO
ژوئن '260
در 0 کانال‌ها
Get PRO
مه '260
در 0 کانال‌ها
Get PRO
آوریل '260
در 0 کانال‌ها
Get PRO
مارس '260
در 0 کانال‌ها
Get PRO
فوریه '260
در 0 کانال‌ها
Get PRO
ژانویه '260
در 0 کانال‌ها
Get PRO
دسامبر '250
در 0 کانال‌ها
Get PRO
نوامبر '250
در 0 کانال‌ها
Get PRO
اکتبر '250
در 0 کانال‌ها
Get PRO
سپتامبر '250
در 0 کانال‌ها
Get PRO
اوت '250
در 0 کانال‌ها
Get PRO
ژوئیه '250
در 0 کانال‌ها
Get PRO
ژوئن '250
در 0 کانال‌ها
Get PRO
مه '250
در 0 کانال‌ها
Get PRO
آوریل '250
در 0 کانال‌ها
Get PRO
مارس '250
در 0 کانال‌ها
Get PRO
فوریه '250
در 0 کانال‌ها
Get PRO
ژانویه '250
در 0 کانال‌ها
Get PRO
دسامبر '24
+12
در 0 کانال‌ها
Get PRO
نوامبر '24
+51
در 0 کانال‌ها
Get PRO
اکتبر '24
+48
در 0 کانال‌ها
Get PRO
سپتامبر '24
+276
در 0 کانال‌ها
| تاریخ | رشد مشترکین | اشارات | کانال‌ها | |
| 16 اکتبر | +1 | |||
| 15 اکتبر | +2 | |||
| 14 اکتبر | 0 | |||
| 13 اکتبر | +6 | |||
| 12 اکتبر | 0 | |||
| 11 اکتبر | 0 |
پست‌های کانال
🛠 How to Install Microsoft Office LTSC 2024
Office LTSC 2024 is a perpetual, volume-licensed Office edition designed for organizations that do not need a Microsoft 365 subscription and may operate in environments with limited internet access. This Office release designed for organizations with specific long-term servicing and deployment requirements.Microsoft Office LTSC 2024 can be deployed using the Office Deployment Tool (ODT), which provides administrators with control over installation, configuration, and Office deployment without relying on the standard interactive installer. In this guide, we cover the deployment process, from preparing the installation files to installing Office using the command line. 📌 What’s covered: 🔹Downloading the Office Deployment Tool 🔹 Configuring the Office deployment using DeployOffice2024LTSC.xml 🔹 Specifying the Office edition, update channel, language, and installation options 🔹 Using XML configuration to standardize deployments across multiple computers You can only downlow the installation files from the Microsoft CDN:
setup.exe /download DeployOffice2024LTSC.xml
Or immediately install the Office LTSC 2024 on a computer:
setup.exe /configure DeployOffice2024LTSC.xml
📺 Video tutorial: https://www.youtube.com/watch?v=1EaLVyP-rtI
📖 Step-by-step guide: https://woshub.com/install-microsoft-office-ltsc-2024/| 2 |  📚 Rclone on Windows: Automate backup and sync files with Google Drive and other cloud storage providers.
As an alternative to official cloud clients, you can use Rclone a small command-line tool often described as rsync for the cloud. It supports Google Drive and many other cloud storage providers, including S3-compatible object storages, allowing you to automate the synchronization of local folders with the cloud using scripts.
Install Rclone on Windows using winget:
winget install Rclone.Rclone
Run the interactive configuration wizard to connect to Google Drive:
rclone config
One-way folder copying to cloud storage:
rclone copy "C:\Backup" gdrive:MyPCBackup --progress
Mirror a local directory to a cloud (one-way sync). This makes the destination identical to the source by copying new files and deleting removed ones:
rclone sync "C:\Backup" gdrive:MyPCBackup --progress
⚠️ Be careful with sync! If you delete a file from the source directory, it will also be deleted from the cloud during synchronization. If you want to use the copy in the cloud storage as a backup, consider using the --backup-dir option to move older versions of modified or deleted files into an archive.
💡 What else can you do with Rclone?
🔹 Automate cloud backups with simple scripts
🔹 Mount cloud storage as a regular network drive with a drive letter assigned (WinFSP required).
🔹 Migrate data between cloud providers
🔹 Encrypt files transparently before uploading them to cloud using the rclone crypt command
Rclone, unlike official cloud clients, doesn't sit in the system tray and consume system resources. It is highly versatile, makes switching cloud providers easier, and is ideal for scripting and automation tasks.
📚 The article covers Rclone installation and configuration on Windows, how to connect to cloud storage (Google Driver in this example), using copy and sync commands, scheduled backups, and data encryption.
It also includes a simple PowerShell script that:
🔹 Syncs selected local folders with Google Drive
🔹 Copies deleted and modified files to the cloud archive
🔹 Automatically removes old file versions
🔹 Runs on a schedule via Windows Task Scheduler
✅ rclone on Windows: Sync and Backup Files to Google Drive and Other Clouds | 251 |
| 3 |  ⚠️ UAC prompt with missing “Yes” button
A classic case that still confuses many admins and users: you right-click an app to run it elevated → Run as administrator and the User Account Control dialog appears… but there’s only a No button. The Yes button is completely missing in UAC.
This behavior means there are no enabled local administrator accounts left on the computer that can approve the elevation request. The currently signed-in account has lost membership in the local Administrators group and is now just a regular standard user.
✅ Fix: UAC Yes button missing in Windows 11 | 342 |
| 4 |  ⌨️ The built-in Windows Keyboard Filter feature allows administrators to prevent users from using specific keyboard shortcuts. This can be useful for devices operating in kiosk mode, as well as for operator workstations, terminals and other computers with restricted user interfaces.
For example, you can deny the use of standard keyboard shortcuts such as Alt+Tab, Alt+F4, Ctrl+Alt+Del, Ctrl+Shift+Esc, Ctrl+C/Ctrl+V, as well as custom key combinations or individual keys.
This feature can be installed using the following PowerShell command:
Enable-WindowsOptionalFeature -Online -FeatureName Client-KeyboardFilter
The registry key HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter contains a list of predefined Windows keyboard shortcuts. To block one of them, simply change the value of the corresponding registry item to Blocked.
To block the Alt+Tab shortcut, for example, change this registry entry:
reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter" /v "Alt+Tab" /t REG_SZ /d "Blocked" /f
A custom key combination can be added under CustomFilters:
reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\CustomFilters" /v "Ctrl+C" /t REG_SZ /d "Blocked" /f
An individual key can be blocked by its scan code. For example, to block the left Windows key:
reg add "HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\CustomScancodes" /v "E05B" /t REG_SZ /d "Blocked" /f
📚 The article also covers how to create custom filters for individual keys and combinations, block keys by scan code, and check active policies using Event Viewer and PowerShell.
⚠️ Unfortunately, Keyboard Filter is only supported in the
Enterprise, Education, IoT Enterprise and LTSC editions of Windows. Also, the filter does not work in RDP sessions.
How to Block Specific Keyboard Shortcuts in Windows with Keyboard Filter | 407 |
| 5 | 🔐 How to Extract Saved Passwords from Windows Credential Manager Using PowerShell
In this new video, we focus specifically on extracting passwords saved in Windows Credential Manager using PowerShell.
We cover:
🔹 Listing stored Credential Manager entries
🔹 Identifying the target credential
🔹 Using PowerShell to retrieve the saved password
🔹 How Windows DPAPI protects stored credentials
🔹 Why the extraction must be performed in the same user's security context that originally saved the credential
🔹 Why running the commands as SYSTEM, another user, or after a forced password reset may result in an empty password or access error
🎥 Watch the video:
https://www.youtube.com/watch?v=eBbUa6_aLjI
📖 Full guide:
https://woshub.com/saved-passwords-windows-credential-manager/ | 478 |
| 6 |  🕐 Synchronizing Active Directory Domain Time with an External NTP Time Server
In an Active Directory domain, a strict hierarchical time synchronization scheme is used:
🔹 The PDC Emulator in the root domain is the primary time source for the domain
🔹 Other domain controllers (DCs) synchronize their time from the PDC Emulator
🔹 Domain-joined workstations and member servers get their time from the nearest domain controller
⚙️ By default, the PDC syncs its time with the local CMOS (hardware) clock of the physical server (or the hypervisor CMOS if it's running in a VM). If the hardware clock is inaccurate, it can cause problems with authentication and interaction with external systems.
That's why you should configure the PDC to synchronize with a reliable external NTP time source and disable synchronization with the local hardware clock/hypervisor.
✅ In this article, we look at how to properly configure time synchronization in an Active Directory domain and what to do if something isn't working correctly.
Configuring Time Synchronization in an Active Directory Domain | 485 |
| 7 |  🕐 Resource-intensive jobs in Windows launched via Task Scheduler can run significantly slower than when started manually.
I encountered an issue with a Robocopy backup task launched via Task Scheduler on a high-load server. The scheduled task failed to complete overnight, but it finished in just a couple of hours when the backup script was run manually.
The reason: by default, Windows Task Scheduler creates tasks with priority 7 (Below Normal). As a result, on high-load hosts, processes launched by Task Scheduler receive less CPU time than processes running at normal priority.
⚙️ The classic way to change a scheduled task's priority, which works on all versions of Windows, is to export the task to an XML file, open the file in a text editor, and change the Priority value from 7 (the default for all Task Scheduler tasks) to either 5 (Above Normal) or 6 (Normal). Then, the original task needs to be deleted and re-imported from the XML file with the new settings.
However, if the task's settings are later changed through the graphical taskschd.msc console, its priority will be reset to its original value (7).
⚙️ Change the task priority with PowerShell
✅ Therefore, it is better to use the PowerShell cmdlets from the built-in ScheduledTasks module to change task priorities.
Check the current task priority:
$myTask = "py_Inspect"
(Get-ScheduledTask -TaskName $myTaskName).Settings.Priority
Set it to 5 (Above Normal):
Set-ScheduledTask -TaskName $myTask -Settings (New-ScheduledTaskSettingsSet -Priority 5)
📖 How to Set Task Priority in Windows Task Scheduler | 571 |
| 8 |  ⚠️ Microsoft Excel updates released in September 2026 can break basic copy-and-paste functionality, fill operations by dragging, and cell drag-and-drop. They can also make it impossible to copy worksheets within the same Excel workbook.
The issue affects both classic MSI versions of Microsoft Excel (2016 and 2019) and Click-to-Run (C2R) versions of Excel 2019, 2021, and 2024.
🔹 MSI versions of Excel 2016
In Microsoft Excel 2016 MSI, the problem appears after installing security update KB5002914 (September 8, 2026).
There is currently no official fix, so for now the workaround is to uninstall the update:
wusa /uninstall /kb:5002914 /quiet /norestart
Or:
msiexec.exe /package Product_GUID /uninstall Update_GUID /qn
For example:
Product_GUID
Office 2016 Professional x64 — {90160000-0011-0000-1000-0000000FF1CE}
Office 2016 Professional x86 — {90160000-0011-0000-0000-0000000FF1CE}
Office 2016 Standard x64 — {90160000-0012-0000-1000-0000000FF1CE}
Update_GUID
{27882596-A8ED-4382-9C71-6CD2DD19F732}
You can retrieve the complete UninstallString for the installed Office update directly from the registry:
Get-ItemProperty `
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" ,
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" `
-ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -like "*KB5002914*" } |
Select-Object DisplayName, UninstallString
🔹 Click-to-Run Office versions
With Office C2R, KB5002914 cannot be uninstalled as an individual patch in the same way as with MSI versions. Instead, you need to roll back to a previous Office build using officec2rclient.exe.
1️⃣ First, temporarily disable Office updates so the problematic build isn't installed again.
You can do this through: File → Account → Update Options → Disable Updates
Or via the registry:
reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "EnableAutomaticUpdates" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "HideEnableDisableUpdates" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v "UpdatesEnabled" /t REG_SZ /d "False" /f
2️⃣ Then roll back to the previous build:
officec2rclient.exe /update user updatetoversion=<build number>
You can find available build numbers in Microsoft's Update History for the corresponding Office product.
For example:
"C:\Program Files\Common Files\microsoft shared\ClickToRun\officec2rclient.exe" /update user displaylevel=true updatetoversion=16.0.14334.20848
3️⃣ Once Microsoft revokes the problematic update or releases a fix, re-enable Office updates:
reg delete "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "EnableAutomaticUpdates" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" /v "HideEnableDisableUpdates" /f
reg add "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v "UpdatesEnabled" /t REG_SZ /d "True" /f
✅ How to Roll Back Microsoft Office to a Previous Version After an Update | 584 |
| 9 |  📚 In Windows Server 2012 R2 and earlier, administrators can configure an application to run automatically when a user logs on to a terminal session by specifying the path to the executable on the Environment tab of the user’s domain or local account properties.
Starting with Windows Server 2016, this behavior no longer works by default because the Remote Connection Manager (RCM) no longer queries these user properties during logon. The assigned application is ignored, and a full desktop session is opened instead. Microsoft recommends an alternative approach to the one previously used: publishing programs on RDS as RemoteApps or configuring a program to launch automatically when a user logs on to a terminal session via Group Policy.
⚙️ You can restore the legacy Remote Connection Manager behavior to the way it worked in Windows Server 2008 R2/2012/2012 R2.
To do this, create fQueryUserConfigFromDC registry values and set them to 1:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fQueryUserConfigFromDC /t REG_DWORD /d 1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v fQueryUserConfigFromDC /t REG_DWORD /d 1
Restart the terminal server host to apply the changes.
This will force the Remote Connection Manager service on terminal server to query the Active Directory for user configuration settings during a Remote Desktop login.
✅ How to Run a Program Automatically at RDP/RDS Logon | 561 |
| 10 |  📚 DISM /Cleanup-Image /RestoreHealth and SFC /ScanNow: Check and Repair Windows System Files and the Component Store
The DISM and SFC commands can help fix a wide range of problems with corrupted or missing system files in Windows. They’re two built-in Windows tools that have saved me more times than I can count.
⚠️ The order of these commands matters: first check and, if necessary, repair the Windows component store using DISM. Then run the System File Checker (SFC), which uses the component store as the source of the original system files. If the component store itself is corrupted, SFC may not be able to find healthy copies of the system files it needs to restore.
Check the health of the component store:
DISM /Online /Cleanup-Image /ScanHealth
Repair the component store:
DISM /Online /Cleanup-Image /RestoreHealth
By default, DISM uses Windows Update as the repair source, so an internet connection is required. If the Windows Update service is unavailable, you can specify an offline Windows installation image (install.wim or install.esd) containing the corresponding Windows version as the repair source:
DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:6 /LimitAccess
After repairing the component store, run the System File Checker:
SFC/ScanNow
SFC verifies protected Windows system files and, if necessary, replaces corrupted or missing files with healthy copies from the component store. As mentioned above, SFC’s repair source is DISM’s repair target. Do not run anything that requires a system restart before, between, or alongside those two.
✅ The article provides a detailed overview of DISM and SFC, including component store health checks and repair, restoring Windows system files and component store from a local WIM/ESD image, and offline repair scenarios.
Using DISM and SFC to Check and Repair System Files in Windows 11/10 | 648 |
| 11 |  ⚙️ By the way, I found a useful PowerShell script that can simplify Windows machine migrations to Proxmox for both P2V and V2V scenarios. The load-virtio-scsi-on-boot.ps1 script should be run on the source Windows machine before migration to Proxmox: https://github.com/croit/load-virtio-scsi-on-boot
The script prepares Windows for migration to KVM/Proxmox helping to prevent unnecessary reboots and the INACCESSIBLE_BOOT_DEVICE BSOD, when the system disk is connected via a native VirtIO SCSI storage controller:
powershell.exe -ExecutionPolicy Bypass -File .\Downloads\load-virtio-scsi-on-boot.ps1
⚠️ How it works: The script uses the Win32 API to create a temporary (phantom) VirtIO SCSI storage device. The appropriate VirtIO driver is installed from the INF file using the pnputil tool. Windows associates the driver with the phantom storage SCSI device, creates the required service configuration in the registry, and sets the driver to Boot Start. Both VirtIO SCSI (vioscsi) and VirtIO Block (viostor) are supported.
✅ As a result, the migration process no longer requires workarounds such as temporarily attaching the disk through an IDE/SATA controller or creating dummy SCSI disks just to get the VirtIO storage driver installed.
🅱️ How to Migrate an Existing Windows Machine into a Proxmox VM | 639 |
| 12 | 📹 (Video): How to Publish EXE Installers via Group Policy Using ZAP Packages (No MSI Required)
In this video tutorial, you’ll learn how to use ZAP (Zero Administration Package) files to deploy EXE-based applications via GPO in an Active Directory environment.
Although Group Policy Software Installation is designed primarily for Windows Installer (MSI) packages, ZAP files provide a simple way to publish certain legacy or third-party EXE installers to domain users. This video walks through the complete process, from creating a ZAP file to publishing the application for users and installing it on a client computer.
https://www.youtube.com/watch?v=p5JzeFoHn2E | 752 |
| 13 |  📚 Windows Group Policies let you centrally deploy applications to domain‑joined computers via Computer Configuration -> Policies -> Software Settings -> Software installation (for machine‑targeted installs) or User Configuration -> Policies -> Software Settings -> Software installation (for user‑targeted installs). However, this feature is rarely used in practice because it is primarily designed to work with software that is packaged as MSI installers, which limits its applicability to many modern apps. The process of customizing software installation parameters typically involves creating an MST (transform) file for the MSI package, which modifies default properties and settings before deployment via GPO.
❓ What many administrators forget is that Group Policy can also be used to deploy any software with an EXE installer. To do this, you can create a text-based Zero Administration Package configuration file with the .ZAP extension. In essence, a ZAP file uses a structure similar to an INI file.
1️⃣ For example, to deploy the Obsidian client using an EXE installer, create the following ZAP file:
[Application]
FriendlyName = "Obsidian - Markdown editor "
SetupCommand = "\\mun-fs01\Install\Obsidian-1.13.1.exe" /S
DisplayVersion = 1.13.1
Publisher = "Dynalist"
2️⃣ The ZAP file defines the network path to the software installer and the command-line parameters used to install it. In this example, the /S switch used to perform a silent installation without displaying a graphical interface.
3️⃣ Then specify the path to the ZAP file in GPO settings and assign the policy to the OU containing the target users.
4️⃣ Users will see the application as available for installation from the network in the classic Control Panel (control appwiz.cpl,,1) and can install it whenever they need it. This option was not migrated to the modern Settings app, presumably because ZAP packages are considered legacy technology (which, to be fair, they probably are 🤷♂️).
⚠️ One important limitation: the installation runs in the security context of the current user. If the application requires administrative privileges, Windows will display a UAC elevation prompt. Therefore, this deployment method is suited for apps that install into the user's profile (under AppData) and do not require local administrator permissions.
Overall, this is still a simple and interesting way to create an on-demand software catalog: users can choose an app from a collection of published programs and install only what they need. 👌
Deploying Software (MSI and EXE) with Group Policy | 621 |
| 14 | 📹 (Video): How to Recreate EFI System Partition in Windows After Accidental Deletion
https://www.youtube.com/watch?v=m7OOEYm-eqE | 635 |
| 15 | 🛠 Accidentally deleted the EFI partition and Windows no longer boots?
A deleted EFI System Partition can render a Windows computer unbootable, even when the operating system and user data remain intact.
This guide covers a practical recovery procedure for rebuilding the EFI System Partition (ESP) and restoring the boot environment on a UEFI/GPT Windows machine. It includes:
🔹boot from Windows installation/recovery media
🔹recreate the EFI and MSR partitions with DiskPart
🔹format the EFI partition as FAT32
🔹restore UEFI boot files with bcdboot
🔹rebuild the BCD and get Windows booting again
👉 How to Repair a Deleted EFI Partition in Windows | 598 |
| 16 |  👥 Fast User Switching is a Windows feature enabled by default that allows multiple users to share the same computer without requiring the current user to sign out before another user can log in. Switching between users takes only a few seconds, while all open apps and documents in the previous session continue running in the background. Naturally, these disconnected user sessions continue to consume system resources.
⚙️ Although Windows doesn’t provide a way to completely disable multi-user functionality, you can hide the Fast User Switching entry points from the user interface. This can be done by enabling the Hide entry points for Fast User Switching GPO option under Computer Configuration -> Administrative Templates -> System -> Logon
Or, you can enable the corresponding HideFastUserSwitching registry value:
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "HideFastUserSwitching" /t REG_DWORD /d "1" /f
This policy hides:
🔹 Other user accounts from the Start menu
🔹 The list of users who are currently logged-in in from the Windows sign-in screen when the computer is locked
🔹 The Switch user option on the security screen opened with Ctrl + Alt + Del
✅ How to Turn Off Fast User Switching via Group Policy or Registry in Windows | 567 |
| 17 |  ⏳ If you need to copy large files (such as virtual machine disks or disk images) between Windows hosts over an unstable, slow, or bandwidth-constrained network connection, you can use the Background Intelligent Transfer Service (BITS) protocol.
⚙️ For example, run this PowerShell command to create an asynchronous background file transfer job using BITS. This task will dynamically adjust its bandwidth usage based on network conditions helping minimize the impact on other network apps and services:
Start-BitsTransfer -Source C:\VHDX\SRV1\srv1.vhdx -Destination \\SR1\c$\image -Asynchronous -Priority Low -DisplayName CopyVHDSR1
Check the transfer progress:
Get-BitsTransfer -Name CopyVHDSR1
Complete the transfer:
Get-BitsTransfer -Name CopyVHDSR1| Complete-BitsTransfer
✅ A BITS background transfer job supports automatic resume after a connection interruption or system reboot. BITS can be used to transfer files between hosts over SMB or to download files over HTTP from an IIS web server.
Copying large files between Windows hosts over unreliable networks using BITS | 554 |
| 18 |  📶 By default, Windows displays the names (SSIDs) of all Wi-Fi networks within range of the wireless adapter. An administrator can hide (block) specific SSIDs from the list of available wireless networks or, conversely, allow connections only to explicitly approved Wi-Fi networks while blocking all others.
The built-in WLAN filtering feature in Windows can be used to configure Wi-Fi blacklists and whitelists.
Two WLAN filtering modes are supported:
🔹 Blacklist: administrator specifies the Wi-Fi networks that should be hidden from discovery in Windows. All other WLAN networks remain available.
🔹 Whitelist: the administrator explicitly specifies the Wi-Fi networks users are allowed to connect to. Connections to all other wireless networks are blocked.
Hide a specific wireless network (blacklist):
netsh wlan add filter permission=block ssid="TP-Link3000" networktype=infrastructure
If users should only be allowed to connect to specific SSIDs, add those networks to the allow list and block all other networks (whitelist):
netsh wlan add filter permission=allow ssid="TP-Link1500" networktype=infrastructure
netsh wlan add filter permission=denyall networktype=infrastructure
By default, Windows users won't see networks that have been blocked by WLAN filters. This behavior can be changed using the command:
netsh wlan set blockednetworks display=show
View the configured WLAN filters
netsh wlan show filters
Remove a specific filter rule:
netsh wlan delete filter permission=allow ssid="TP-Link1500" networktype=infrastructure
Remove the rule that blocks all other networks:
netsh wlan delete filter permission=denyall networktype=infrastructure
✅ Windows Wi-Fi Network Filtering: Allow and Block Lists | 635 |
| 19 |  👨🏻💻 By default, the buit-in Windows Remote Desktop Connection client (mstsc.exe) uses screen caching to store portions of the remote desktop screen that rarely change. This improves performance and reduces network traffic. The RDP session cache is stored in the user's profile under:
C:\Users\[user]\AppData\Local\Microsoft\Terminal Server Client\Cache\*
📤 The RDP cache stores raw screen bitmap data as 64×64-pixel tiles. Portions of the RDP session screen can be extracted from the cache (*.BMC and *.BIN files) using tools such as RDP Cached Bitmap Extractor. The RDP cache is not automatically cleared by default, so it may contain a significant amount of potentially sensitive information.
🛡 Therefore, if you use the RDP client on an untrusted computer, it is recommended to disable bitmap caching in the client and clear the RDP history | 631 |
| 20 |  ⚙️ Following the widespread rollout of the Windows UEFI CA 2023 Secure Boot certificates, administrators have started encountering an unexpected issue on some devices.
⚠️ After the CMOS battery went flat (vacation season strikes again 🤷), a UEFI firmware update or a BIOS/UEFI reset, Windows may fail to boot on certain laptop models with the following error:
Secure Boot Violation
Invalid Signature Detected. Check Secure Boot Policy in Setup.
The issue occurs because the current Windows bootloader is signed with the Windows UEFI CA 2023 certificate, while the certificate itself is missing from the UEFI firmware's Secure Boot trusted certs database (db) after the firmware settings have been reset.
📚 In this article, we cover how to diagnose and resolve the issue:
🔹 Verify whether the Windows UEFI CA 2023 certificates are present in the Secure Boot database.
🔹 Check which certificate was used to sign the Windows bootloader (bootmgfw.efi).
🔹 Use Microsoft's official Secure Boot Recovery tool (SecureBootRecovery.efi) to install the Windows UEFI CA 2023 certificates to the Secure Boot db stored in the motherboard's UEFI NVRAM.
🔹 Learn how to prepare a bootable USB drive containing SecureBootRecovery.efi to perform an offline Secure Boot certificate update.
✅ Recovering Windows UEFI CA 2023 Secure Boot Certificates After a UEFI Reset
https://woshub.com/fix-invalid-signature-detected-check-secure-boot-policy | 794 |
