Microsoft on John Billekens | Notes from the field

HowTo - Windows - Export certificate (pfx)

Wed, 18 Oct 2023 09:45:25 +0000

group: “Windows”

Certificates are an important part of a modern environment. They make communication safer by encrypting the traffic between the client and server. A safe way to move certificates between servers or store them safely is by exporting the certificate (private and public key) to an encrypted format. A commonly used format is “pfx” (Personal Information Exchange also known as PKCS#12). A pfx file can contain one or more certificates and is encrypted with a password. Without the correct password the pfx is useless. You commonly see that a pfx contains a (web) server certificate and one or more intermediate certificate(s) and a root certificate.

How to use FSlogix AppMasking on Intune managed devices

Sun, 05 Jul 2020 09:50:02 +0000

A while ago I was asked to apply FSLogix App Masking at a company to hide MS Office for certain users. Normally with just Active Directory that’s a done deal. But the targets were Intune managed. And since FSLogix Application Masking Is not yet supporting AzureAD we had to find other options.

Office Online apparently only supports TLS 1.0

Thu, 20 Sep 2018 19:57:00 +0000

Recently I had to configure a new ~~NetScaler~~ Citrix ADC for a new ~~ShareFile~~ Citrix Files deployment. Two Storage Zone Controllers load balanced via a Citrix ADC with a Content switch. Nothing out of the ordinary. It was when I activated the Office Online functionality on the Storage Zone Controller configuration page the error messages appeared. Each time as we tried to open an office document we got an error “Sorry, there was a problem and we can’t open this document. If this happens again, try opening the document in Microsoft Word.” for Word documents and “We couldn’t find the file you wanted. It’s possible the file was renamed, moved or deleted.” for Excel documents. I followed all the necessary checks as described in a Citrix Files Article. But everything turned out okay, it worked as expected. What could it be? As it turned out to be the NetScaler SSL configuration was configured to high!? I always want that A+ on SSL Labs, the same with this setup. It was when I reverted the Content Switch to it’s default SSL parameters (TLS1.0 and the default Cipher suite) that Office Online started functioning. It could not retrieve the documents from the Storage Zone Controllers and thus it gave me this error messages. Luckily I had a separate Content Switch for internal and external traffic. I only had to lower the SSL settings on the internal Content Switch, this is the Content Switch the Office Online server was communicating with. So I hope Microsoft will add support for TLS 1.2 in Office Online (and give it some updates)

Spontaneously changing default printer

Sat, 18 Mar 2017 13:53:21 +0000

Yesterday I was at a Customers location and they had an issue with their printers on the XenDesktop VDI environment. Some users are using Exact to print all kinds of labels, in this case a Zebra label printer. And while they were printing labels, the label printer was set automagically as default. They started noticing this because when they wanted to print other (A4) reports, the layout was wrong and some information fell of the report. They could change the default printer back to the MFP, but when they printed labels again, you’ll get it right? I recently helped them move from Windows 10 LTSB 2015 (1507) to Windows 10 LTSB 2016 (1607) and they started noticing this issue after the switch to the new Windows version. So what could it be? Turned out to be a setting in Windows… After changing this, the issue was gone. You can change it in “Settings”, “Devices”, “Printers & Scanners” and change the setting “Let Windows manage my Default printer” to off. Or you can set the following registry key:

Windows 10 LTSB 2016 (Build 1607) stuck at Other User while logging in

Fri, 27 Jan 2017 13:57:48 +0000

While testing with the latest Windows 10 LTSB 2016 version I found out in 9 of 10 logins failed, it was stuck on the message “Welcome other user”… I used the same deployment steps as with LTSB 2015 and not working, what was wrong? After reading the Citrix forum I found out that more users were experiencing this issue. After some testing I found out that my issue was caused by a disabled Service named “Device Association Service”. This is one of the optimizations in the “Technical Note – Optimize Windows 10” guide from Citrix. Don’t disable this service but leave it on Automatic. Since I found out I haven’t seen this issue since.

Exchange config for the NetScaler with AAA Authentication

Sat, 21 Feb 2015 20:20:55 +0000

Below is the NetScaler configuration for an Exchange environment. You need an Enterprise licence to activate AAA.

#--- Replace the text below with the actual data---#

#Domain Controller hostname and IP
<DC01.DOMAIN.LOCAL>
<DC01IP>
<DC02.DOMAIN.LOCAL>
<DC01IP>
#Exchange server hostname and IP
<EXCH01.DOMAIN.LOCAL>
<EXCH01IP>
<EXCH02.DOMAIN.LOCAL>
<EXCH02IP>
#Active Directory data
<LDAPPATH>
<LDAPREAD@DOAMIN.LOCAL>
<LDAPREADPASSWD>
#Client subnet marked save for private profile
<CLIENTSUBNET>
#AD group for always use of the private profile
<ADEXCHPRIVATEGRP>
#AAA Server FQDN and IP
<AUTHVIPFQDN>
<AUTHVIPIP>
#Content Switch IP
<CSVIPIP>
#Domain FQDN
<DOMAIN.LOCAL>
#Certiicatename as installed in the NetScaler
<CERTIFICATE>
#Test user for the POP monitor
<POPTESTUSER>
<POPTESTPASSWD>

#--- NS Config below this line ---#

enable ns feature LB CS CMP SSL AAA REWRITE RESPONDER

set ns httpProfile nshttp_default_profile -dropInvalReqs ENABLED

add server Srv_<EXCH01.DOMAIN.LOCAL> <EXCH01IP>
add server Srv_<EXCH02.DOMAIN.LOCAL> <EXCH02IP>

add serviceGroup SvcGrp_exchange_owa SSL -CMP YES -comment "Outlook Web Access"
add serviceGroup SvcGrp_exchange_oa SSL -CMP YES -comment "Outlook Anywhere or RPC over HTTPS"
add serviceGroup SvcGrp_exchange_ews SSL -CMP YES -comment "Exchange Web Services"
add serviceGroup SvcGrp_exchange_eas SSL -CMP YES -comment "ActiveSync Service for Mobile Mail clients"
add serviceGroup SvcGrp_exchange_ecp SSL -CMP YES -comment "Exchange Control Panel"
add serviceGroup SvcGrp_exchange_oab SSL -CMP YES -comment "Offline Address Book"
add serviceGroup SvcGrp_exchange_autodiscover SSL -CMP YES -comment "Autodiscover Service"
add serviceGroup SvcGrp_exchange_pop3 TCP-cltTimeout 9000 -svrTimeout 9000
add serviceGroup SvcGrp_exchange_imap4 TCP -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -cltTimeout 9000 -svrTimeout 9000

add authentication ldapAction AuthLdapSrv_<DC01.DOMAIN.LOCAL> -serverIP <DC01IP> -ldapBase "<LDAPPATH>" -ldapBindDn <LDAPREAD@DOAMIN.LOCAL> -ldapBindDnPassword <LDAPREADPASSWD> -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN
add authentication ldapAction AuthLdapSrv_<DC02.DOMAIN.LOCAL> -serverIP <DC02IP> -ldapBase "<LDAPPATH>" -ldapBindDn <LDAPREAD@DOAMIN.LOCAL> -ldapBindDnPassword <LDAPREADPASSWD> -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN

add tm formSSOAction AaaSsoPro_exchange_public -actionURL "/owa/auth.owa" -userField username -passwdField password -ssoSuccessRule "HTTP.RES.SET_COOKIE.COOKIE("cadata").VALUE("cadata").LENGTH.GT(70)" -nameValuePair "flags=0&trusted=0" -responsesize 60000 -submitMethod POST
add tm formSSOAction AaaSsoPro_exchange_private -actionURL "/owa/auth.owa" -userField username -passwdField password -ssoSuccessRule "HTTP.RES.SET_COOKIE.COOKIE("cadata").VALUE("cadata").LENGTH.GT(70)" -nameValuePair "flags=4&trusted=0" -responsesize 60000 -submitMethod POST

add tm trafficAction AaaTrafPro_exchange_public -appTimeout 1 -SSO ON -formSSOAction AaaSsoPro_exchange_public -persistentCookie OFF -InitiateLogout OFF -kcdAccount NONE
add tm trafficAction AaaTrafPro_exchange_private -appTimeout 1 -SSO ON -formSSOAction AaaSsoPro_exchange_private -persistentCookie OFF -InitiateLogout OFF -kcdAccount NONE
add tm trafficAction AaaTrafPro_exchange_logoff_global -appTimeout 1 -SSO ON -persistentCookie OFF -InitiateLogout ON -kcdAccount NONE

add authentication ldapPolicy AuthLdapPol_<DC01.DOMAIN.LOCAL> ns_true AuthLdapSrv_<DC01.DOMAIN.LOCAL>
add authentication ldapPolicy AuthLdapPol_<DC02.DOMAIN.LOCAL> ns_true AuthLdapSrv_<DC02.DOMAIN.LOCAL>

add tm trafficPolicy AaaTrafPol_exchange_public "HTTP.REQ.URL.CONTAINS("owa/auth/logon.aspx") && CLIENT.IP.SRC.IN_SUBNET(<CLIENTSUBNET>).NOT" AaaTrafPro_exchange_public
add tm trafficPolicy AaaTrafPol_exchange_private "HTTP.REQ.URL.CONTAINS("owa/auth/logon.aspx") && CLIENT.IP.SRC.IN_SUBNET(<CLIENTSUBNET>) || HTTP.REQ.USER.IS_MEMBER_OF("<ADEXCHPRIVATEGRP>")" AaaTrafPro_exchange_private
add tm trafficPolicy AaaTrafPol_exchange_logoff_global "HTTP.REQ.URL.CONTAINS("owa/logoff.owa")" AaaTrafPro_exchange_logoff_global

add lb vserver LbVip_exchange_owa SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -AuthenticationHost <AUTHVIPFQDN> -Authentication ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Outlook Web Access"
add lb vserver LbVip_exchange_ews SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -authn401 ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Exchange Web Service"
add lb vserver LbVip_exchange_autodiscover SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -authn401 ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Autodiscover Service"
add lb vserver LbVip_exchange_ecp SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -AuthenticationHost <AUTHVIPFQDN> -Authentication ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Exchange Control Panel"
add lb vserver LbVip_exchange_eas SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -authn401 ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "ActiveSync Service for Mobile Mail clients"
add lb vserver LbVip_exchange_oab SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -authn401 ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Offline Address Book"
add lb vserver LbVip_exchange_oa SSL 0.0.0.0 0 -persistenceType SSLSESSION -cltTimeout 180 -authn401 ON -authnVsName AaaVip_<AUTHVIPFQDN> -comment "Outlook Anywhere or RPC over HTTPS"

add lb vserver LbVip_exchange_imap4 SSL_TCP <CSVIPIP> 993 -persistenceType SSLSESSION -cltTimeout 9000
add lb vserver LbVip_exchange_pop3 SSL_TCP <CSVIPIP> 995 -persistenceType SSLSESSION -cltTimeout 9000

add authentication vserver AaaVip_<AUTHVIPFQDN> SSL <AUTHVIPIP> 443 -AuthenticationDomain <DOMAIN.LOCAL>
add cs vserver CswVip_https_<DOMAIN.LOCAL> SSL <CSVIPIP> 443 -cltTimeout 180 -caseSensitive OFF -httpProfileName nshttp_default_strict_validation
add cs vserver CswVip_http_<DOMAIN.LOCAL> HTTP <CSVIPIP> 80 -cltTimeout 180 -caseSensitive OFF -httpProfileName nshttp_default_strict_validation

add cs action CswAct_ews -targetLBVserver LbVip_exchange_ews
add cs action CswAct_owa -targetLBVserver LbVip_exchange_owa
add cs action CswAct_ecp -targetLBVserver LbVip_exchange_ecp
add cs action CswAct_eas -targetLBVserver LbVip_exchange_eas
add cs action CswAct_oab -targetLBVserver LbVip_exchange_oab
add cs action CswAct_oa -targetLBVserver LbVip_exchange_oa
add cs action CswAct_autodiscover -targetLBVserver LbVip_exchange_autodiscover

add cs policy CswPol_ews -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/ews")" -action CswAct_ews
add cs policy CswPol_owa -rule "HTTP.REQ.HEADER("User-Agent").SET_TEXT_MODE(IGNORECASE).CONTAINS("Mozilla")" -action CswAct_owa
add cs policy CswPol_ecp -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/ecp")" -action CswAct_ecp
add cs policy CswPol_eas -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/Microsoft-Server-ActiveSync")" -action CswAct_eas
add cs policy CswPol_oab -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/oab")" -action CswAct_oab
add cs policy CswPol_oa -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/rpc")" -action CswAct_oa
add cs policy CswPol_autodiscover -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/AutoDiscover")" -action CswAct_autodiscover

add rewrite action RewAct_exchange_insert_pback_cookie_1 insert_http_header COOKIE ""PBack=0;""
add rewrite action RewAct_exchange_insert_pback_cookie_2 insert_after "HTTP.REQ.HEADER("COOKIE").INSTANCE(0).SUBSTR(":")" "" PBack=0;""

add rewrite policy RewPol_exchange_insert_pback_cookie_1 "HTTP.REQ.URL.CONTAINS("owa/auth/logon.aspx") && HTTP.REQ.COOKIE.COUNT.GT(2).NOT" RewAct_exchange_insert_pback_cookie_1
add rewrite policy RewPol_exchange_insert_pback_cookie_2 "HTTP.REQ.URL.CONTAINS("owa/auth/logon.aspx") && HTTP.REQ.COOKIE.COUNT.GT(2)" RewAct_exchange_insert_pback_cookie_2

bind rewrite global RewPol_exchange_insert_pback_cookie_2 100 END -type REQ_DEFAULT
bind rewrite global RewPol_exchange_insert_pback_cookie_1 110 END -type REQ_DEFAULT

add responder action ResAct_exchange_ToOwa redirect ""/owa""
add responder policy ResPol_exchange_ToOwa "HTTP.REQ.URL.STARTSWITH("/owa").NOT" ResAct_exchange_ToOwa

add responder action ResAct_ToHTTPS_301 respondwith q{"HTTP/1.1 301 Moved Permanentlyrn" + "Location: https://" + HTTP.REQ.HOSTNAME + HTTP.REQ.URL.PATH_AND_QUERY + "rnrn"} -bypassSafetyCheck YES
add responder policy ResPol_RedirToHTTPS true ResAct_ToHTTPS_301

add responder action ResAct_ToHTTPS_404 respondwith q{"HTTP/1.1 404 Not Foundrn"} -bypassSafetyCheck YES
add responder policy ResPol_RespondWith404 true ResAct_ToHTTPS_404

bind lb vserver LbVip_exchange_owa SvcGrp_exchange_owa
bind lb vserver LbVip_exchange_oa SvcGrp_exchange_oa
bind lb vserver LbVip_exchange_ews SvcGrp_exchange_ews
bind lb vserver LbVip_exchange_eas SvcGrp_exchange_eas
bind lb vserver LbVip_exchange_ecp SvcGrp_exchange_ecp
bind lb vserver LbVip_exchange_oab SvcGrp_exchange_oab
bind lb vserver LbVip_exchange_autodiscover SvcGrp_exchange_autodiscover
bind lb vserver LbVip_exchange_pop3 SvcGrp_exchange_pop3
bind lb vserver LbVip_exchange_imap4 SvcGrp_exchange_imap4

bind lb vserver LbVip_exchange_owa -policyName AaaTrafPol_exchange_private -priority 100 -gotoPriorityExpression END -type REQUEST
bind lb vserver LbVip_exchange_owa -policyName AaaTrafPol_exchange_public -priority 110 -gotoPriorityExpression END -type REQUEST
bind lb vserver LbVip_exchange_ecp -policyName AaaTrafPol_exchange_public -priority 100 -gotoPriorityExpression END -type REQUEST
bind lb vserver LbVip_exchange_ecp -policyName AaaTrafPol_exchange_private -priority 110 -gotoPriorityExpression END -type REQUEST

bind lb vserver LbVip_exchange_owa -policyName ResPol_exchange_ToOwa -priority 100 -gotoPriorityExpression END -type REQUEST
bind cs vserver CswVip_http_<DOMAIN.LOCAL> -policyName ResPol_RedirWebmailToHTTPS -priority 100 -gotoPriorityExpression END -type REQUEST
bind cs vserver CswVip_http_<DOMAIN.LOCAL> -policyName ResPol_RespondWith404 -priority 10000 -gotoPriorityExpression END -type REQUEST

bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_autodiscover -priority 100
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_eas -priority 110
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_ews -priority 120
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_oab -priority 130
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_oa -priority 140
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_ecp -priority 150
bind cs vserver CswVip_https_<DOMAIN.LOCAL> -policyName CswPol_owa -priority 160

set ns httpParam -dropInvalReqs ON

add lb monitor Mon_imap4 TCP-ECV -send "GET /" -recv "The Microsoft Exchange IMAP4 service is ready." -LRTM ENABLED -interval 30 -destPort 143
add lb monitor Mon_pop3 POP3 -scriptName nspop3.pl -dispatcherIP 127.0.0.1 -dispatcherPort 3013 -userName <POPTESTUSER> -password <POPTESTPASSWD> -LRTM ENABLED -interval 30

#Not needed for Exchange 2007-2010
add lb monitor Mon_owa TCP-ECV -send "GET /owa/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_ecp TCP-ECV -send "GET /ecp/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_ews TCP-ECV -send "GET /ews/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_eas TCP-ECV -send "GET /Microsoft-Server-ActiveSync/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_oab TCP-ECV -send "GET /oab/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_oa TCP-ECV -send "GET /rpc/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES
add lb monitor Mon_Autodiscover TCP-ECV -send "GET /Autodiscover/healthcheck.htm HTTP/1.1rnHost:<EXCHANGEWEBMAILURL>rnConnection:Closernrn" -recv 200 -LRTM ENABLED -retries 10 -secure YES

bind serviceGroup SvcGrp_exchange_owa Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_owa Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_owa -monitorName Mon_owa
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_owa -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_oa Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_oa Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_oa -monitorName Mon_oa
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_oa -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_ews Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_ews Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_ews -monitorName Mon_ews
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_ews -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_eas Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_eas Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_eas -monitorName Mon_eas
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_eas -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_ecp Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_ecp Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_ecp -monitorName Mon_ecp
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_ecp -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_oab Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_oab Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_oab -monitorName Mon_oab
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_oab -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_autodiscover Srv_<EXCH01.DOMAIN.LOCAL> 443 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_autodiscover Srv_<EXCH02.DOMAIN.LOCAL> 443 -CustomServerID ""None""
#Exchange 2013
bind serviceGroup SvcGrp_exchange_autodiscover -monitorName Mon_Autodiscover
#Exchange 2007-2010
#bind serviceGroup SvcGrp_exchange_autodiscover -monitorName https-ecv

bind serviceGroup SvcGrp_exchange_pop3 Srv_<EXCH01.DOMAIN.LOCAL> 110 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_pop3 Srv_<EXCH02.DOMAIN.LOCAL> 110 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_pop3 -monitorName Mon_pop3

bind serviceGroup SvcGrp_exchange_imap4 Srv_<EXCH01.DOMAIN.LOCAL> 143 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_imap4 Srv_<EXCH02.DOMAIN.LOCAL> 143 -CustomServerID ""None""
bind serviceGroup SvcGrp_exchange_imap4 -monitorName Mon_imap4

set ssl vserver LbVip_exchange_owa -ssl3 DISABLED
set ssl vserver LbVip_exchange_ews -ssl3 DISABLED
set ssl vserver LbVip_exchange_autodiscover -ssl3 DISABLED
set ssl vserver LbVip_exchange_ecp -ssl3 DISABLED
set ssl vserver LbVip_exchange_eas -ssl3 DISABLED
set ssl vserver LbVip_exchange_oab -ssl3 DISABLED
set ssl vserver LbVip_exchange_oa -ssl3 DISABLED
set ssl vserver LbVip_exchange_imap4 -ssl3 DISABLED
set ssl vserver LbVip_exchange_pop3 -ssl3 DISABLED
set ssl vserver AaaVip_<AUTHVIPFQDN> -ssl3 DISABLED
set ssl vserver CswVip_https_<DOMAIN.LOCAL> -ssl3 DISABLED

add tm sessionAction AaaSesPro_sso_exchange -sessTimeout 60 -defaultAuthorizationAction ALLOW -SSO ON -ssoCredential PRIMARY -ssoDomain Domain -httpOnlyCookie NO -persistentCookie ON -persistentCookieValidity 30
add tm sessionPolicy AaaSesPol_sso_exchange ns_true AaaSesPro_sso_exchange

bind tm global -policyName AaaTrafPol_exchange_logoff_global -priority 100

bind authentication vserver AaaVip_<AUTHVIPFQDN> -policy AuthLdapPol_<DC01.DOMAIN.LOCAL> -priority 100
bind authentication vserver AaaVip_<AUTHVIPFQDN> -policy AuthLdapPol_<DC02.DOMAIN.LOCAL> -priority 110
bind authentication vserver AaaVip_<AUTHVIPFQDN> -policy AaaSesPol_sso_exchange -priority 100

add ssl cipher HighSecurity
bind ssl cipher HighSecurity -cipherName TLS1-ECDHE-RSA-AES256-SHA
bind ssl cipher HighSecurity -cipherName TLS1-ECDHE-RSA-AES128-SHA
bind ssl cipher HighSecurity -cipherName TLS1-ECDHE-RSA-DES-CBC3-SHA
bind ssl cipher HighSecurity -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA
bind ssl cipher HighSecurity -cipherName TLS1-DHE-DSS-AES-256-CBC-SHA
bind ssl cipher HighSecurity -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA
bind ssl cipher HighSecurity -cipherName TLS1-DHE-DSS-AES-128-CBC-SHA
bind ssl cipher HighSecurity -cipherName TLS1-AES-256-CBC-SHA
bind ssl cipher HighSecurity -cipherName TLS1-AES-128-CBC-SHA
bind ssl cipher HighSecurity -cipherName SSL3-DES-CBC3-SHA

bind ssl vserver LbVip_exchange_owa -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_ews -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_autodiscover -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_ecp -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_eas -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_oab -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_oa -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_imap4 -certkeyName "<CERTIFICATE>"
bind ssl vserver LbVip_exchange_pop3 -certkeyName "<CERTIFICATE>"
bind ssl vserver AaaVip_<AUTHVIPFQDN> -certkeyName "<CERTIFICATE>"
bind ssl vserver CswVip_https_<DOMAIN.LOCAL> -certkeyName "<CERTIFICATE>"

unbind ssl vserver LbVip_exchange_owa -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_ews -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_autodiscover -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_ecp -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_eas -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_oab -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_oa -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_imap4 -cipherName DEFAULT
unbind ssl vserver LbVip_exchange_pop3 -cipherName DEFAULT
unbind ssl vserver AaaVip_<AUTHVIPFQDN> -cipherName DEFAULT
unbind ssl vserver CswVip_https_<DOMAIN.LOCAL> -cipherName DEFAULT

bind ssl vserver LbVip_exchange_owa -cipherName HighSecurity
bind ssl vserver LbVip_exchange_ews -cipherName HighSecurity
bind ssl vserver LbVip_exchange_autodiscover -cipherName HighSecurity
bind ssl vserver LbVip_exchange_ecp -cipherName HighSecurity
bind ssl vserver LbVip_exchange_eas -cipherName HighSecurity
bind ssl vserver LbVip_exchange_oab -cipherName HighSecurity
bind ssl vserver LbVip_exchange_oa -cipherName HighSecurity
bind ssl vserver LbVip_exchange_imap4 -cipherName HighSecurity
bind ssl vserver LbVip_exchange_pop3 -cipherName HighSecurity
bind ssl vserver AaaVip_<AUTHVIPFQDN> -cipherName HighSecurity
bind ssl vserver CswVip_https_<DOMAIN.LOCAL> -cipherName HighSecurity

Changing Microsoft ADCS from sha1 to sha256

Wed, 05 Nov 2014 13:34:14 +0000

When ADCS uses sha1 for their certificates, you might want to change it to sha254. NOTE: Make sure all your devices support sha256 sha1 sha256 To achieve this enter the following commands in an elivated DOS-box:

procmon remote monitoring

Wed, 27 Aug 2014 19:48:42 +0000

psexec \COMPUTERNAME -u domainuser -sd -i 0 “c:Procmon.exe” /accepteula /backingfile c:output.pml /nofilter /quiet Aanmelden met de gebruiker, en afmelden (kan wat langer duren door de logging) Daarna procmon stoppen (om de log file te sluiten) psexec \COMPUTERNAME -u domainuser -sd -i 0 “c:Procmon.exe” Terminate Sysinternals tools benodigd: psexec procmon

12 Steps to Remotely Manage Hyper-V Server 2012 Core

Sun, 08 Jun 2014 15:47:51 +0000

Install Hyper-V Server 2012 Core and log in to the console.

Configure date and time (select #9).
Enable Remote Desktop (select #7). Also select the ‘Less Secure’ option.
Configure Remote Management (select #4 then #1).

Nested Hypervisor on vSphere

Sun, 08 Jun 2014 08:43:14 +0000

VM Hardware version 9 or Higher VM Advanced settings add:

vhv.enable = “true”
hypervisor.cpuid.v0 = “FALSE” (Hyper-V)

And in vSphere Webclient enable “Expose hardware assisted virtualization to the guest OS” under CPU.

Active Directory RecycleBin

Sun, 23 Feb 2014 08:57:10 +0000

Requirements:

At least one Domain Controller running Windows Server 2012 with the Active Directory Administrative Center enabled.
All Domain Controllers (or servers running AD LDS) must be running Windows Server 2008 R2 or higher.
The Forest must be running at Windows Server 2008 R2 functional level.

Import the Active Directory modules in PowerShell

Via NETSH DHCP reserveringen toevoegen

Tue, 12 Nov 2013 02:58:41 +0000

netsh dhcp server mySRV scope 192.168.1.0 add reservedip 192.168.1.111 XXXXXXXXXXXX host.domain.local

AD Defragmentatie (Server 2012)

Tue, 14 May 2013 10:16:42 +0000

Stop de ADDS Service

ntdsutil
activate instance ntds
files
compact to c:

copy "c:ntds.dit" "c:WindowsNTDSntds.dit"

del c:WindowsNTDS*.log

Start de ADDS Service

Profile Permissions

Mon, 18 Mar 2013 18:40:37 +0000

NTFS Permissions for Roaming Profile Parent Folder User Account : Minimum Permissions Required Creator Owner : Full Control, Subfolders and Files Only Administrator : Full Control (Microsoft actually recommends none but it simplifies things if you give admins full control) Security group of users needing to put data on share : List Folder/Read Data, Create Folders/Append Data - This Folder Only Everyone : No permissions Local System : Full Control, This Folder, Subfolders and Files Share level (SMB) Permissions for Roaming Profile Share User Account : Minimum Permissions Required Everyone : No permissions Security group of users needing to put data on share : Full Control

Send mail through telnet

Mon, 25 Feb 2013 12:04:13 +0000

hello smtp.server.nl mail from:<test@domain.nl> rcpt to:<to@domain.nl> data subject: This is a test mail to: to@domain.nl This is the text of my test mail. . quit

Exchange 2010 reconnect archive mailbox

Thu, 21 Feb 2013 15:43:36 +0000

Find (disconnected) mailbox: Get-MailboxServer | Get-MailboxStatistics | where { $_.DisconnectDate } | fl DisplayName, DisconnectDate Recconnect mailbox: Get-MailboxDatabase | Get-MailboxStatistics | Where-Object {$_.DisconnectDate –and $_.DisplayName –eq “Personal Archive - Tinnus Est”} | Connect-Mailbox –user T.Est –archive

Windows Icons: Full list with details, locations & images

Mon, 18 Feb 2013 09:55:06 +0000

Good quality icons and images, especially ones with an alpha transparency can be time consuming to make, and are often also hard to find. One source of lots of high quality icons in a range of sizes is Windows. Windows 7 includes lots of icons which can be useful as the majority are available in sizes from 16×16 up to 256×256, and come with alpha transparency. You may have noticed that we use some on our downloads page — they’re handy to quickly indicate file type. Windows stores most of its icons inside exe and dll files which makes them inaccessible to standard image manipulation applications like Photoshop. However, once they have been located they can easily be extracted with the freeware utility IcoFX. Tracking some of them down seems to be the trickier part. Below is a quick reference for the locations of many of the icons available on Windows 7. I will periodically add more details and any extra icon libraries I discover to this list.

How To Image, Sysprep and Deploy Windows 7 a Complete Guide – Using sysprep and Imagex

Tue, 04 Dec 2012 15:49:51 +0000

Getting Ready
#

Install Windows 7 from scratch on to your test machine. DO NOT upgrade from Windows XP, this needs to be a fresh install.
Customise Windows 7 with any software, security settings or general settings you wish. When you install from this image all the settings as well as user accounts will be installed by default.
Install WAIK for 7/2008 on the test PC. Download from here (1.7GB).

Create WINPE Disk
#

Right click command prompt run as admin

Change to directory “C:Program FilesWindows AIKToolsPETools”

run command “copype x86 c:winpe”

run command “imagex /mountrw c:winpewinpe.wim 1 c:winpemount”

copy imagex.exe from “C:Program FilesWindows AIKToolsx86imagex.exe” to “c:winpemountwindowssystem32″

Create wimscript.ini in “c:winpemountwindowssystem32″ with following inside

[ExclusionList]
ntfs.log
hiberfil.sys
pagefile.sys
"System Volume Information"
RECYCLER
WindowsCSC

[CompressionExclusionList]
*.mp3
*.zip
*.cab
WINDOWSinf*.pnf

Run Command “imagex.exe /unmount /commit c:winpemount”

Run Command “copy c:winpewinpe.wim c:winpeisosourcesboot.wim /y”

Run Command “oscdimg -n -h -bc:winpeetfsboot.com c:winpeiso c:winpewinpe.iso”

This will create an ISO in c:winpewinpe.iso.

Burn this and keep. Now we need to sysprep our machine. (You can remove WAIK and any files you don’t need, test your iso first!)

Sysprep Your Machine