fixing some DHCP scopes

Came across some mis-configured DHCP scopes and needed to resolve. They were working independently duplicate leases and reservations not matching. This was causing issues with WIFI AP's

Backup

mkdir C:\tools\dhcpbackup

cd C:\tools\dhcpbackup

Export-DhcpServer -Leases -File "C:\tools\dhcpbackup\WC-DC03-leases.xml" -Force

Get-DhcpServerv4Reservation -ComputerName WC-DC03 -ScopeId 10.66.33.0 | Export-Csv "C:\tools\dhcpbackup\WC-DC03-reservations.csv" -NoTypeInformation

In a maint window.

Moved all reservations to DC03

Deleted scope on DC04

Setup scope on DC03 as a failover scope and selected DC04 as partner

This will take care of leases

Need to sync reservations manually (can setup a scheduled task to run a script)

$LogFile = "C:\tools\dhcpbackup\dhcp-sync-log.txt"

Invoke-DhcpServerv4FailoverReplication -ComputerName WD-DC03 -ScopeId 10.65.33.0 -Force -ErrorAction Stop

script to gather network information on windows

.bat script to gather network information on windows, you can add or remove things as needed

Set > %userprofile%\downloads\_Set.txt

echo %logonserver% > %userprofile%\downloads\_logonserver.txt

whoami  > %userprofile%\downloads\_whoami.txt

hostname  > %userprofile%\downloads\.txt

ipconfig /all  > %userprofile%\downloads\_ipconfig_all.txt

ipconfig /displaydns > %userprofile%\downloads\_displaydns_post.txt

route print  > %userprofile%\downloads\_routeprint.txt

tracert -d 192.168.2.100  > %userprofile%\downloads\_tracert_2_100.txt

ping 192.168.2.100  > %userprofile%\downloads\_ping_2_100.txt

nslookup cust.url.com > %userprofile%\downloads\_nslookup.txt

wmic NIC where NetEnabled=true get Name,Speed  > %userprofile%\downloads\_NICSpeed.txt

gpresult /V >> %userprofile%\downloads\_gpresult.txt

add static route on windows OS

 had a strange case where I needed to reach 169.254.x.x but the windows OS was not forwarding traffic for it out its network card

Run cmd as admin

route print (to get GW x.x.x.x)

route -p add 169.254.0.0 MASK 255.255.0.0 x.x.x.x

setup duo with RDP on windows server

1 - Make sure you have a windows username who is enrolled/activated in duo and has phone number attached, good idea to test logging in with this user on your working duo install. I would say ensure you have a back way in. Physical console or VMware console and a local user setup.

2 - Docs/instructions are here www.duo.com/docs/rdp

4 - Log into duo portal on the PC you are going to protect so you can download files and copy paste some details

5 - Log into duo portal -> applications -> protect and app. Select MS RDP

Record details

• ikey
• skey
• api

6 - Run the installer, fill in the recorded details. In my case I chose to only protect RDP not windows logins.

7 - After install is complete test logging in with RDP, make sure to use RDP (MSTSC) and not local console you have been working on.

DHCP scope full of BAD_ADDRESS Entries

This one comes up a lot. I've come across the following causes:

1 - Malware just filling up your DHCP scope to break it. 

2 - Rouge DHCP server

3 - Broken NIC on some device, never completes the DHCP steps and keeps taking IP's (some times fixed with driver update)

3 - Proxy arp issue. Similar to above. The client gets DHCP offer but before it accepts it will arp the IP to see if anyone is using it. The firewall responds to the arp so the client rejects the IP and starts DHCP request again multiple clients fill up the DHCP rules. Check NAT rules and make sure they have "no-proxy-arp" even if the NAT rule matches different traffic. Look for any any nat rules.

You can look in DHCP logs on the DHCP server

Check arp -a and wireshark looking for dhcp request/offers on the DHCP server.

If the DHCP is being forwarded by an IP helper you'll need to take the capture on the LAN and can check arp on the device that is doing the IP helper

If its just one mac address a quick work around is to make a reservation for that MAC so it always gets the same IP. That way it won't fill up your DHCP scope. Then clear out the DHCP scope.

You also have the option of setting the DHCP lease times down lower. You can get a script/scheduled task to stop/start the DHCP service (clearing down the scope). If you have scripting skills you can look for "BAD_IPADDRESS" entries and delete those with a script.

The longer/better fix is to find the device(s) that are causing the issue and sort them out. 

You may also have the option to enable DHCP snooping on your switch. You can configure the switch ports to your DHCP servers so they are the only ones allow to respond to DHCP requests.

https://www.petenetlive.com/KB/Article/0001651

can't RDP to server authentication error due to CredSSP encryption oracle remediation

The server is using this update but the client is not

Update both hosts to latest

On client gpedit.msc -> computer conf -> admin templates -> system -> credential delegation

Set Encryption oracle remediation
to enabled
drop down to vulnerable

https://weblogs.asp.net/dixin/remote-desktop-connection-authentication-error-due-to-credssp-encryption-oracle-remediation

run powershell script as scheduled task

https://community.spiceworks.com/how_to/17736-run-powershell-scripts-from-task-scheduler


program = powershell.exe
arg = C:\scripts\myscript.ps1

set execution policy

get public ip from cmd on windows

nslookup myip.opendns.com resolver1.opendns.com

You can also use this script to write it to a file. Then you can use bginfo to display it on the desktop.

'<script language="vbscript">

' Set the URL where we can get the public IP
const URL = "http://ifconfig.me/all.xml"
set xmldoc = CreateObject("Microsoft.XMLDOM")
xmldoc.async=false
xmldoc.load(URL)

' Loop to get the public IP from the XML
for each x in xmldoc.documentElement.childNodes
 if x.NodeName = "ip_addr" then
  myip = x.text
 end if
next

' echo for testing
'wscript.echo myip

'Output IP to file so bginfo can read it
Set objFSO=CreateObject("Scripting.FileSystemObject")
outFile="P:\Users\jack\Documents\scripts\ext-ip.txt"
Set objFile = objFSO.CreateTextFile(outFile,True)
objFile.Write myip
objFile.Close

get dell serial number from cmd prompt

wmic bios get serialnumber

simple ftp program for windows

http://smallftpd.sourceforge.net/

Using NPS / RADIUS for logins on network (and other devices)

https://aaronwalrath.wordpress.com/2010/06/22/install-windows-2008-r2-nps-for-radius-authentication-for-cisco-router-logins/


Check user has allow remote access (dial-in tab)  AD users and computers
Check user is a member of the right  AD group if using one in your RADIUS pol

NPS server setup both DC1 + DC2
NPS radius clients match and password matches
NPS policy setup and match
NPS server install wireshark
NPS server enable auditing.
NPS server registered in AD

After adding new RADIUS clients stop/start the NPS server

Side note - Upgraded a 3750E to 15.2 and it broke Radius
Change to calling the Group

Turn aaa on 
aaa new-model

Setup radius servers
radius server NPS-1
address ipv4 172.16.35.63 auth-port 1812 acct-port1813
pac key **********
!
radius server NPS-2
address ipv4 172.16.35.43 auth-port 1812 acct-port 1813
pac key ********
!

Setup radius group
aaa group server radius RADIUS-GROUP
server name NPS-1
server name NPS-2

Set source interface
ip radius source-interface

Force PEAP (otherwise we need to enable PAP in NPS server which is not secure)

I found I had to use PAP, wasn't able to get peap working

radius-server vsa send authentication

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

Other NPS setup notes

Policies conn

Shared secrets 

create template 

radius-clients

enter pw

Radius clients

Add switch IP's here

Enter name

enter IP

select secret templat

Con request policy

NAS IPv4 > 192.168.100.123

1812 / 1813

event viewer > server roles ? network policy server

nps.msc

MAPI tool

http://mfcmapi.codeplex.com

https://support.microsoft.com/kb/2679568

tail for windows

https://logexpert.codeplex.com/documentation

Logexpert

issues with winRM and windows remote assist

Having some issues with it just storing some information here

Remote assist uses DCOM it must be enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
EnableDCOM = Y

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
AllowTSConnections = 1

If you enable this policy you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running

Windows vista and later
Enable the Remote Assistance exception for the domain profile. The exception must contain:
Port 135:TCP
%WINDIR%\System32\msra.exe
%WINDIR%\System32\raserver.exe

Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1)

Port 135:TCP
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
%WINDIR%\System32\Sessmgr.exe

For computers running Windows Server 2003 with Service Pack 1 (SP1)

Port 135:TCP
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
Allow Remote Desktop Exception

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
fAllowUnsolicited = 1
fAllowUnsolicitedFullControl = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
davies\domain admins = davies\domain admins

WinRM

Configuring WinRM using Microsoft Group Policy

If running winrm quickconfig on every XenApp server is not efficient for your site, you can configure WinRM using Microsoft Group Policy.
Note: Settings configured by Group Policy overrides the configuration changes made by the installer or configuration changes made locally on the desktop.
 

Complete the following procedure to configure WinRM using Group Policy:

1. Set the WinRM service to auto start:
   a.    In the Group Policy Editor, navigate to Computer Configuration> Policies > Windows Settings > Security Settings> System Services.
   b.    Double-click Windows Remote Management (WS-Management) and set it to Automatic.
   
   
2.   Create the WinRM listener:
   a.    In the Group Policy Editor, navigate to Computer Configuration >Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM  Service.
   b.    Double-click Allow automatic configuration of listeners and configure the IPv4 filter to *.
    
3. Create a firewall exception for WinRM:
   a.    In the Group Policy Editor, navigate to Computer Configuration> Policies > Windows Settings > Security Settings> Windows Firewall with Advanced Security.
   b.    Create an Inbound Rule for WinRM for port 5985.
4. After configuring the preceding three group policies, restart the server to update the group policies and start the WinRM service.

built in command line diff on windows

fc file1 file1

for binary file

fc /b file1 file2

fc /? for more info

reboot command on windows

shutdown -r -f -t 0

shutdown /i (brings up the GUI where you can set a messages etc)

script to ping a subnet and look for a mac address on windows

Quick and dirty way to find which IP a mac address is associated with

for /l %i in (1,1,254) do ping -n 1 -w 1 192.168.1.%i
arp -a | find "aa-bb-cc-dd-ee-ff"

This assumes you network is 192.168.1.0 /24

arp-ping tool for windows

http://www.elifulkerson.com/projects/arp-ping.php

Rogue DHCP Server detection tool for windows

http://blogs.technet.com/b/teamdhcp/archive/2009/07/03/rogue-dhcp-server-detection.aspx

Base software to install on windows servers

Latest version of powershell and powershell ISE
http://windirstat.info/ - Disk usage report
http://www.7-zip.org/ - Opens lots of archives
http://www.wireshark.org/ - Network traffic capture
http://technet.microsoft.com/en-us/sysinternals/bb842062 - Sysinternals Suite lots of very useful tools
http://technet.microsoft.com/en-us/library/cc771275(v=ws.10).aspx - Telnet client
Your backup or monitoring agent if required
Your AV solution
Configure NTP
Configure Logging
Right click -> Computer -> Properties -> Advanced -> Startup and Recovery -> Settings -> Kernel memory dump

http://getgreenshot.org/ - screenshots

http://www.nirsoft.net/ - suite of tools bluescreen view being popular

RSAT - remote admin tools for windows server etc (install and then appwiz to add them)
ASDM - for Cisco
filezilla - transfering files
foxit reader - PDF
google chrome - web browser
java - required for asdm and maybe other aps
mRemoteNG - saving connections, ssh rdp, vnc, webpage external app
remote desktop connection manager (might not be needed if you have above)
keepass - password store
zenmap - gui for nmap

portqueryui - good for checking open ports and a nice screenshot

openssl (sclient) W32openssl

openssl s_client -connect www.google.com:443

openssl can convert certs too

sublime text or notepad++
sublimetext editor
winscp
grep for windows
dig for windows
my traceroute (https://winmtr.en.uptodown.com/windows)

sysinternals suite 

maybe microsoft powertoys for admins

psexec can be replaced by powershell PSSessions or Invoke-command. Psexec is still great because it runs locally on the target system. Can run as local system account.

NTRadping - Radius testing
https://community.microfocus.com/t5/OES-Tips-Information/NTRadPing-1-5-RADIUS-Test-Utility/ta-p/1777768