Windows OS Hub for SysAdmins

🔒 The Safely Remove Hardware icon in the system tray can display not only the usual USB flash drives, but also other devices that you don't want to see there at all. Such as NVMe/SSD/SATA drives, disk controllers, NICs, GPUs, monitors, etc. ♆ To remove a particular device from the Safely Remove Hardware and Eject Media list, you must determine its device ID and change the value of the Capabilities parameter in its registry key to 60 (HEX). This value is reset every time you restart your computer, so you need to change it manually each time you restart Windows. 🔹 Let's automate this using a scheduled task:

schtasks /create /tn "Hide_Device_From_Safe_Removal" /sc ONSTART /ru SYSTEM /rl HIGHEST /tr "reg.exe add 'HKLM\SYSTEM\CurrentControlSet\Enum\USB\VID_2357&PID_010C\00E04C0001' /v Capabilities /t reg_dword /d 0x00000060 /f" 

✅ The device will no longer appear in the Safely Remove list. Remove (hide) a specific device from the Safely Remove Hardware list

🔄 Although Microsoft has removed the requirement to periodically change user passwords from its security baselines, a policy that specifies the maximum age of user passwords is enabled in most on-premises Active Directory domains. 🤦‍♂️ Users often forget to change their expired passwords in time, resulting in unnecessary calls to IT support. ✅ This post explains how to find out when a user account password in a domain will expire and how to remind users to change their password by using the built-in Windows reminder, a PowerShell script, or by sending an e-mail notification. How to notify AD users when their password is about to expire

🖨 There is no need to connect to the user's desktop to perform typical printer management tasks on Windows computers. Most of the operations can be performed remotely by using the printmanagement.msc console or by using PowerShell. 📱 For example, creating a new printer on a remote computer in a PowerShell session might look like this: 🔹 Use PowerShell Remoting to connect to the user's computer:

Enter-PSSession -ComputerName Comp123

🔹 Add a printer driver from an INF file to the Windows Driver Store:

pnputil.exe -i -a "\\fs01\Drivers\Kyocera\OEMsetup.inf" 

🔹 Install the printer driver:

Add-PrinterDriver -Name "Kyocera Classic UniversalDriver PCL6" 

🔹 Create an IP Print Port to connect a network printer:

 Add-PrinterPort -Name "IP_192.168.100.16" -PrinterHostAddress "192.168.100.16" 

🔹 Create a new printer:

Add-Printer -Name "Ricoh M2540" -DriverName "Kyocera Classic UniversalDriver PCL6" -PortName "IP_192.168.100.16" -Verbose 

How to use PowerShell to perform typical print management tasks on Windows computers

📁 The Server Message Block (SMB) 1.0 file-sharing protocol is disabled by default in the latest versions of Windows 11/10 and Windows Server 2019/2022.This version of the SMB protocol is deprecated, insecure, contains many easily exploitable vulnerabilities, and is not recommended for use. Most modern operating systems and hardware firmware support more secure versions of the SMB protocol (2.x and 3.x). 🏛 SMB v1 may only be necessary if you have legacy devices on your network. Such as: computers running Windows XP/2003, old versions of NAS devices, old network scanners with only SMBv1 support, devices running outdated versions of Samba, etc. 🕵🏻‍♀️ Windows Audit Policies can be used to identify devices on your network that use SMBv1 to connect to a file server. ✅ It is strongly recommended to update the OS or firmware on such devices to a version that supports the more secure SMBv2 or SMBv3 protocol versions. If this is not possible, you can enable SMB1 support on an individual server or client device. Configure the firewall to block access from all but a minimal list of trusted IP addresses to secure this device. How to detect, enable and disable SMBv1 in Windows 10/11 and Windows Server

📜A sample PowerShell script lists the install/remove events for MSI packages, Microsoft Store (UWP) apps, and Windows Updates that have been installed in the last 7 days, including the usernames that perform the software installation or removal.

$DaysAgo = (Get-Date).AddDays(-7)
$RealiabilityFilter= "TimeGenerated > '$DaysAgo' and (SourceName='Microsoft-Windows-WindowsUpdateClient' or SourceName='MsiInstaller')"
Get-CimInstance -ClassName Win32_ReliabilityRecords -filter $RealiabilityFilter|Select TimeGenerated,ProductName,User,message |Out-GridView

✅ The script retrieves data from the Windows Reliability Monitor logs. It comes in handy when you need to quickly find out about the latest operating system changes. View software installation and removal history in Windows

🔒 Let's Encrypt is a non-profit Certificate Authority that provides Domain Validation TLS сertificates that are valid for 90 days. This is the most popular CA for obtaining free, trusted certificates for websites and services. 🛠 To issue, install and renew Let's Encrypt certificates on Windows, you can use the open source WACS client (Windows ACME Simple). This is a console tool for managing Let's Encrypt certificates interactively and in unattended mode using command line arguments. 🔃 With WACS, you can automate the process of validating domain ownership, issuing, installing and renewing expiring certificates. ✅ This guide shows how to issue a Let's Encrypt certificate and bind it to an IIS website on Windows Server, and how to use this TLS certificate to secure connections to the Remote Desktop Gateway (RDGW) service. How to Install Let's Encrypt Certificates on Windows with Autorenew

👥 Dynamic security groups, which can automatically include users (computers) that meet certain criteria, are not supported by the on-premises Active Directory (unlike the cloud directory service Entra ID, ex-Azure AD). For example, all users in a particular OU, all users whose Department attribute is set to Marketing, all employees in a branch, etc. </> To implement dynamic groups in on-premises ADDS, you can use PowerShell automation. Using a simple script, you can configure rules to select users to automatically add or exclude from a particular security group. Then schedule a task on the domain controller to run your script, which will automatically add or remove users from the target security group depending on the current values of their attributes. ✅ How to implement dynamic user groups in Active Directory using PowerShell

📚 To automate some tasks, administrators often need to write scripts and run them through the Task Scheduler on a schedule or when a specific event occurs. This is not a difficult task, but there are some nuances. ✅ This post explains how to properly configure Task to run a PowerShell script on a schedule in Windows. Automate PowerShell Scripts with Task Scheduler

🧾 Graylog is a simple and powerful open source stack that allows to quickly deploy a centralized logging system for collecting, storing and processing logs from all your servers, network devices, and apps. 🔹 Unlike the ELK stack, Graylog is much easier to understand and learn, uses fewer resources, has simpler functionality and an interface designed for basic log collection tasks. 🔹 The Graylog stack is based on MongoDB and OpenSearch. It allows logs from hundreds or thousands of hosts to be collected and searched simultaneously. 🔹 Graylog can be horizontally scaled and clustered to meet centralized monitoring requirements from small infrastructures to large industrial networks. ✅ This step-by-step guide explains everything you need to get started with Graylog, including installation, configuration, collecting logs from multiple sources, searching logs and responding to events. Centralized Log Management: A Comprehensive Guide to Graylog

👻 Often sysadmins need to create a pre-configured user account that works with fixed profile settings. These profiles are called Mandatory User Profiles. Settings commonly defined in a mandatory profile include (but aren't limited to) icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. 🚫 Any changes made by the user with the assigned mandatory profile during the session are not saved and are only valid for the current session. 🎓Back in the day, mandatory profiles were fairly popular. They were often used in educational institutions or kiosk environments, or wherever it was necessary to discard changes to the user's profile at log-out. ⚙️ How to create a mandatory (unchangeable) user profile in Windows

📰 If you are using Windows 11, you may have noticed the widget or weather icon in the bottom left corner of the taskbar. The widget board pops up when you hover mouse over the icon, showing you the latest news, stocks, weather and more. 🤦‍♂️Some users complain that the widgets.exe main process and its child processes (msedgewebwebview2.exe) increase the average CPU load and use a lot of RAM, even when the computer is not in use. 🔹 It is possible to hide widgets from the taskbar in Windows 11 by making a change to the registry:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d "0" /f

🔹 or via GPO через GPO: Computer Configuration -> Administrative Templates -> Windows Components -> Widgets -> Allow Widgets -> Disable 🚫 However, the widgets will continue to run in the background. Deleting the UWP app is the only way to completely disable widgets in Windows 11. From the current user's profile:

winget uninstall "windows web experience pack" 

If you have more than one user profile on a computer, use the Remove-AppxPackage and Remove-AppxProvisionedPackage cmdlets to remove the MicrosoftWindows.Client.WebExperience app from each user profile. ✅ How to completely uninstall Widgets feature on Windows 11

🔎The Windows.edb file (Windows.db in Windows 11) contains the Windows Search index database. The search index allows users to quickly search for files, emails in PST files and other content on local and network drives. If you have a large number of files on indexed drives, the size of the Windows.edb file can grow to tens of GB or even hundreds of GB, taking up all the free space on the system drive. ✅ This post describes how to rebuild, reset, move, or defragment the search index of the EDB database file using the esentutl command (familiar to Exchange Server admins). How to reduce Windows.edb huge file size

🔄 Group Policy settings are updated on Windows client when : ✅ computer boots ✅ user signs in ✅ automatically in the background (at a random interval between 90 and 120 minutes). 📚 When the Group Policy Client (gpsvc) service detects that the policy version has changed, it performs a background update of the GPO settings (the GPO version number is stored on the domain controller in the \\<dcName>\SYSVOL\<domain>\Policies\<guid>\gpt.ini file). 💨 If you need to apply new GPO settings to a remote computer immediately, you can use the 🔹 Domain Group Policy Management Console (gpmc.msc) – right-click on OU and select Group Policy Update 🔹 PowerShell command:

Invoke-GPUpdate –Computer PC01 -RandomDelayInMinutes 0

How to Refresh (Update) Group Policy Settings on Windows

ℹ️ Kiosk mode is used to run Windows in a special, restricted mode in which it is only allowed to run one or more approved apps. Access to other operating system functions is blocked. Kiosk mode is intended for use on publicly accessible computers, information terminals, or self-service devices. ✅ This guide explains both the simplest way to run a browser (single-app mode) and a more complex multi-app kiosk scenario, which is used to create an isolated workspace for running multiple allowed apps in Windows 11 Kiosk Mode ✅ How to enable and configure Single or Multi-App Kiosk Mode on a Windows 11 device

⚙️In some cases, VMware ESXi virtual machines don’t respond to the normal shutdown or stop commands from the vSphere Client web interface. ✅ To avoid a reboot of the entire ESXi host, you can manually stop the process of an unresponsive VM from the ESXi console. Connect to the ESXi host via SSH and list the registered VMs:

$ esxcli vm process list

Gives the VM process a chance to shut down cleanly (like kill -SIGTERM) by its WorldID:

$ esxcli vm process kill --type=soft -w=987654321 

Or use the Hard or Force option to forcibly kill a VM process. 🚫 Forcibly shutting down a virtual machine might result in guest operating system data loss and is similar to pulling the power cable on a physical machine. ✅ Or you can also use the esxtop console command to display a list of running VM processes and stop the specific process. How to force an unresponsive virtual machine to stop in VMware ESXi

🕒 There is a known bug (or perhaps a feature) in Windows Server 2019 and 2022 that prevents the administrator from changing the computer's time zone from the GUI. When a user with local administrator privileges tries to change the time zone using the Classic Control Panel (timedate.cpl) or from the modern Settings panel, an error is displayed stating that the required privileges are missing 🙈. In this case, change the timezone from the command prompt: ✅ using the tzutil command

 tzutil /s "Central Europe Standard Time"

✅ or via PowerShell

Get-TimeZone -ListAvailable|? DisplayName -like "*Amsterdam*"|Set-TimeZone

✅ Or run the timedate.cpl applet in Run as Administrator mode. How to change time zone settings on Windows

⚙️ There are two main ways to run Docker containers on Windows 10 and 11. 🔹Use the native Win app Docker Desktop for Windows (requires Hyper-V role and separate Linux VM with Docker) 🔹or install the Docker Engine in a Linux distribution running in the Windows Subsystem for Linux (WSL2) environment. 📦 If you only plan to use Linux containers, it is preferable to run the Docker Engine inside the WSL image. In my tests, it allows to reduce the memory consumption (five times less) when running Docker inside WSL without Docker Desktop. This guide covers the basics of installing and using Docker Engine on Windows Subsystem for Linux (WSL2) environment. https://woshub.com/install-docker-windows-wsl2/

🔀 If you plan to change the name of the Windows Server host, you can add an additional (alternate) name on the server to ensure smooth migration of clients to a new name. This allows clients to be gradually reconfigured to the new name without losing access under the old name. ✅ To add an alternate computer name in Windows Server, use the netdom command:

netdom computername fs01 /ADD new-fs01.woshub.loc 

This command will automatically create a CNAME (alias) for the new name in DNS and update the Service Principal Name (SPN) of the computer account in AD. 🚫 The netdom command isn't available in Windows 10 and 11, so you'll need to manually add the new hostname to the DNS, edit the AlternateComputerNames registry parameter, and update the computer's SPN. Adding multiple alternate hosnames for a Windows computer

⚠️ Critical vulnerability in the TCP/IP stack in all supported versions of Windows - CVE-2024-38063 (CVSS score of 9.8). An attacker can use specially crafted IPv6 packets to remotely execute arbitrary code (RCE) on affected devices (without user interaction or authentication) 🤯. 🔐 Windows security updates that fix this vulnerability were released on 13 August and are available for download https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063 ⛑ As a temporary workaround, Microsoft recommends disabling IPv6 protocol if not business critical to reduce this attack surface. However, this can cause problems with some system components (especially on Windows Server).

🖥 The Hyper-V virtualization feature in Windows 10 and 11 is only supported in Pro, Enterprise and Education editions. However, there is a simple trick to enabling Hyper-V in Home editions of Windows. 📝To install the Hyper-V role from the WinSxS component store on Windows Home, use the following batch script:

pushd "%~dp0"
dir /b %SystemRoot%\servicing\Packages\*Hyper-V*.mum >hyper-v.txt
for /f %%i in ('findstr /i . hyper-v.txt 2^>nul') do dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%%i"
del hyper-v.txt
Dism /online /enable-feature /featurename:Microsoft-Hyper-V -All /LimitAccess /ALL

✅ How to Enable Hyper-V on Windows 11/10 Home