Spat's WebLog (Steve Patrick)

So I go to remote into my machine via RDP tonight and up comes a black screen and the popup error: Hrmm so I click OK and now all I have is a black screen. Gahhhh. I actually had some serious work to do from home tonight. A quick search shows...

In a recent post I outlined a number of ‘challenges’ to implementing smartcards. I also asked about people who were hitting slow logons after implementing smartcards. Well I had a few responses as well as some interest in how RDP redirection works...

Smartcards, password elimination projects ... etc... all good fun. Well, I got around to compiling a number of challenges which may arise should you decide to get rid of passwords and move to smartcards only. I dont claim that this list is complete...

This was an example of setting WMI security via a script - the specific question was: “Is there a way I can change the permissions on WMI (need to grant remote enable access) so I can grant a service account read access to certain machines via Group Policy...

I recently worked on an issue which combined a number of the things I enjoy about my job. New technology, interesting problem and satisfied customers. Here was the problem. A country in the EU is rolling out national identity cards. They want to use these...

Kinda a one off odd one.. but I’ve seen it more than once… so it gets a blog entry. Failure to install any items digitally signed. My most recent experience was with a chap who was getting this error and f ailed to install MDAC update...

In this new age of the internet... You now can obtain a hotfix without having to interact with a single soul ( no phone calls etc.. ) Easy and convenient. Take for example my previous post for the netlogon DCR - 928576 which doesnt even have a public...

ADinsight from the sysinternals toolset is a great tool , but I seem to have problems with it at times. Specifically on Server 2008 & Vista (maybe due to the way it hooks wldap32.dll) On Vista OS and beyond, there is built in client ldap tracing...

First off let me say that I am not a “SQL guy” nor am I an “IIS guy” .. I am primarily a platforms OS kinda guy. However, I can wing my way thru some of those two technologies. This series of posts may not exactly follow best practices when it comes...

Kerberos is well… Kerberos. And NTLM is NTLM right? Right. Most of the time. This post is from a recent hotfix I worked on where it was made painfully clear that this isn’t always true. Here is a cool overview stolen from msdn And...

Continuing on my "neat SP1 list".... There are a lot of new niftyola fixes\features, and one of them is the new Credential Roaming feature otherwise known as Digital Identity Management Service or (DIMS) One note here - it does require a schema...

How do we convince you something is by design? This is very hard for me. I can definitely empathize with those who run into “ issues ” ( I kinda hate using that word, almost as bad as “ super excited ” or “ leverage ” ) due to product behavior,...

I just wanted to make sure folks realized that Vista and XP EFS files aren't exactly compatible... Here was a snip from a recent question: " I’m asking this question on behalf of another colleague. He’s having problems accessing encrypted...

A few friends have lost data from HD crashes recently - important items like music collections and wedding photos ... so I thought I should probably begin backing up my items in the interest of self-preservation ( from my wife should I lose all of our...

So when we left off, we were talking about DIMS as a new feature for 2003 SP1. The overview was brief , so here are some details. DIMS takes advantage of another new feature in SP1 for confidential attributes, actually this attribute feature was...

I spend a lot of my time debugging LSASS or Winlogon due to what I specialize in ( Active Directory \ Security \ PKI \ GPO’s ) As of XP and greater I have historically done a kernel debug to get at LSASS. If you try to debug it from usermode on the...

Pre Win2k3 SP1 we actually had a hardcoded list of null session pipes + the registry key to come up with the complete list of allowed NULL session pipes. PRE SP1 hard coded list: =========== L"netlogon", L"lsarpc", L"samr", L"browser", L"srvsvc", L"wkssvc...

MaxConcurrentAPI.. what is it? It is referenced a few places: Netlogon reg entries IAS Best Practices How to configure your ISA Server for a very large number of authentication requests Edit 11/21/2011 NOTE: Please see http...

During the installation of Windows Server 2008 (2k8) certificate services ( ADCS ) the installation fails with the following error: The installation debug logs under \windows\certocm.log will show something similar to the following: ...

So the scenarios is pretty simple. Forest trust like so: Basic problem. User tried to access sharepoint and fails to use Kerberos. So we can review the end to end process ( still at a high level ) 1. User logs on 2...

Coming from support, I have seen many different causes for crashes and hangs, memory leaks and BSOD’s. Of course, again I am colored by my experiences and it reflects in the title of my blog “When things go wrong.. “ I only see the bad side of things. But, I have long held the opinion that Windows is a stable OS for the most part, and I know for a fact that many many root causes of cases I saw were 3rd party applications and drivers. Anyway, to the point. I was rebooting my Samsung Epix ( again ) the other day and was quite frustrated with the experience. I started to think, maybe I have too many applications running. ...

This post will discuss how to disable UPN mapping for certifcate to user mapping during smartcard logon.

...

When we last left off, we had just installed SQL. Also my standard disclaimer for this series: First off let me say that I am not a “SQL guy” nor am I an “IIS guy” .. I am primarily a platforms OS kinda guy. However, I can wing my way...

I was cleaning out the garage a while back and finally tossed out my 1541 drive. I almost kept it, but have long since lost track of the C64 I had when I was a kid. I remember making “double sided disks” with my Mom’s hole puncher and making sure that...

Supportability is a topic near and dear to my heart. Vista has made great leaps and bounds in this area with more logging than any prior OS, as well as a great help file and improved errors. However, the other day I was playing with Vista's UAC features...