Anton Romanyuk

Anton Romanyuk

Sunday, 22 October 2017 18:44

Thoughts on the TPM Vulnerability ADV170012

image

In a desperate effort to make this blog post worth reading and not go through the indignity of having to write about Windows 10 1709, I have turned to the headline-generating festival currently ongoing on the net: the vulnerability in Trusted Platform Module (TPM) produced by Infineon Technologies AG which could allow security feature bypass.

Friday, 20 October 2017 19:27

Removing Quick Assist App Using MDT

image

Quite a few of my blog posts start off with a customer engagement - this one is no different. This week I held another Windows 10 deployment workshop in Munich where I emphasized how Microsoft Deployment Toolkit is a powerful OS deployment tool which allows a high grade of Windows 10 golden image customization. One of the questions was "Is it possible to remove the "Quick Assist" application from a Windows 10 "Fall Creators Update" (1709) image using Microsoft Deployment Toolkit? The answer was a resounding "yes" because #PowerShellIsKing

Tuesday, 10 October 2017 12:49

Re-Enable SMBv1 in Windows 10 1709 Using MDT

image

In case you have not heard, you should stop using SMB1. Not only is it 30 years old and was publicly deprecated back in 2014, it was also superseded by SMBv2 all the way back in 2007. In Windows 10, version 1709 (Fall Creators Update) and Windows Server, version 1709 (RS3), the Server Message Block version 1 (SMBv1) network protocol is no longer installed by default. The full removal has begun.

There is a caveat: while there are few valid use cases left in modern enterprises where SMB1 is still required, you may still be running a product that explicitly requires SMBv1. In my personal experience, an attempt to get rid of an outdated product, may hit a snag and the conversation with the CEO may go like this:

Security Officer: "Microsoft removed SMBv1 in the latest edition of Windows 10 because it is an older protocol and it has known security issues regarding ransomware and other malware."
CEO: "Is it possible to reinstall it?"
Security Officer: "Yes, but Microsoft strongly recommends that we do not reinstall it as SMBv1 was the main attack vector for the recent WannaCry outbreak."
CEO: "You do know I am the CEO, right?"

Case and point, SMBv1 is bad, really bad and you should never, ever reinstall it. But - if this is your only option - it is very easy to enable SMB1 in your environment during OSD. Simply add an Install Roles and Features step in your task sequence and select SMB 1.0/CIFS File Sharing Support feature.

Alternatively, run this simple PowerShell script:

# Determine where to do the logging 
$tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment 
$logPath = $tsenv.Value("LogPath")  
$logFile = "$logPath\$($myInvocation.MyCommand).log"

# Start the logging 
Start-Transcript $logFile
Write-Host "Logging to $logFile"

# Start Main Code Here

Write-Host "Enabling SMB1 optional feature."
Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart

# Stop logging 
Stop-Transcript

EnableSMBv1.ps1

Thursday, 28 September 2017 07:12

Disabling SMBv1 in WinPE through MDT

image

As a reader of this blog, I suspect that you, like me, are a frequent visitor to TechNet forums. Yesterday, a user posted a question on the Microsoft Deployment Toolkit (MDT) forum asking for guidance on how to disable Version 1 of the Server Message Block (SMB) protocol in MDT generated Windows PE boot images. Version 1 of the Server Message Block (SMB) protocol was developed in the early days of personal computer networking, and as Ned Pyle wrote in a blog post in September of 2016 Stop using SMB1 there are many reasons to cease using it on your networks as it is vulnerable to a man-in-the-middle attack.

Monday, 25 September 2017 17:56

The Case of Duplicate Firmware Objects in BCD

image

A few months ago a customer complained that on a Dell Optiplex 7040 MiniTower the boot menu contained multiple entries for the "Windows Boot Manager". Given that we were in the process of deploying Windows 10 client and the importance of the customer, I immediately started troubleshooting. This particular case is especially interesting because it might affect a large number of users and the vendor was not aware of the issue.

image

In my last blog post, I discussed clearing Trusted Platform Module (TPM) using PowerShell and MDT. This time I’m turning my attention to another issue: field upgrading TPM from 1.2 to 2.0 specification on HP and Dell systems which support discreet TPM switching.

Systems that shipped with Windows 7 from the factory will have TPM 1.2, however, most modern systems feature a firmware based component running in a trusted execution environment on a general purpose SoC, which allows discrete TPM mode switching in real time. Customers I worked with in the past couple of months and which roll out Windows 10 intend to make use of important security advantages of TPM 2.0 specification including greater crypto agility by being more flexible with respect to cryptographic algorithms, newer algorithms, which can improve drive signing and key generation performance, a more consistent experience across different implementations and a consistent dictionary attack protection guarantee.

Friday, 15 September 2017 23:40

How to Clear the TPM Chip Using MDT

image

Before a Trusted Platform Module (TPM) can be used for advanced scenarios it must be provisioned. Windows 10 automatically provisions a TPM, but if you are planning to reinstall the operating system, you may have to clear the TPM before reinstalling so that Windows 10 can take full advantage of the TPM. In today's blog post, I will take a closer look how to clear the TPM ownership using WMI in Microsoft Deployment Toolkit (MDT), allowing Windows 10 to automatically take ownership of the TPM on the next boot (TPM AutoProvisioning). Clearing the Trusted Platform Module (TPM) cancels TPM ownership and invalidates cryptographic materials created by the previous owner.

Thursday, 14 September 2017 13:17

The Case of Existing Email Address

image

This case is my favorite kind of case, one where I get to learn something new to solve a problem. The other day I was creating a couple of users in my Office 365 environment and assigning Exchange Online licenses when I was interrupted with a message that informed me that "The email address "This email address is being protected from spambots. You need JavaScript enabled to view it." is already being used by contact (Christopher Blair) This email address is being protected from spambots. You need JavaScript enabled to view it.. Use a different email address.".

Wednesday, 06 September 2017 09:22

Group Policy Changes in Windows 10 1709 Preview

image

As Windows 10 Fall Creators Update development winds down, it’s the grandiose time to examine updated and new Group Policy settings. There is no official documentation from the Group Policy team at this point, frankly there still might (or will) be a few changes to Group Policy settings. Still, it can't hurt to poke around current ADMX files because there are truly several things duller in our line of work than comparing thousands lines of text. Right?

Tuesday, 05 September 2017 12:08

Add .NET Framework Offline Using MDT

image

If you’ve read any of my tweets, you know that I emphasize how Microsoft Deployment Toolkit and ConfigMgr are powerful OS deployment tools which allow a high grade of customization. This blog post is another demonstration of MDT flexibility. It also shows how a small PowerShell script can quickly lead to a solution.

Page 2 of 4

Recent Posts