wrieedx's questions

I would like to push "Never saved" websites to users' Chromium Edge settings. The goal is to disable password saving for these particular websites/domains.

The method doesn't matter, only the end result. In this way, solutions that use Group Policy, registry change, script, etc. are all okay if they work. (Of course, adding the settings manually is no good).

NOTE: I have searched the Group Policy settings and I don't think that there is a relevant policy for this (I could be wrong).

I tried adding the following registry setting but it didn't seem to have any effect:

KEY: HKCR\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\<website>
NAME: (Default) 
TYPE: REG_DWORD 
DATA: 0x28 (40) 

The "Never saved" websites section can be found if you open Edge and look in:

Settings → Profiles → Passwords → Never saved

Here is a screenshot of the setting location:

Your ideas are appreciated!

I'm not sure if this is possible, and if it is possible surely it is frowned upon but... is it possible to perform dynamic translation of an IP address on a Cisco 3650 L3 router?

Here is the scenario:

• Multiple clients exist on subnets 10.0.1.0/24 to 10.0.100.0/24.
• Clients transmit data to server 10.101.0.1/24.
• The server's IP address will change to 10.201.0.1/24.
• The clients must continue to transfer data to the server, but the server IP setting cannot be changed on the client (i.e. clients will continue to send data to 10.101.0.1/24).
• Routing between these three networks is carried out by a Cisco 3650 L3 router.
• The clients do not have DNS configured.
• Basically, the client settings cannot change.

I am thinking that maybe there is some funky layer three magic could happen at the Cisco switch that would allow for dynamic translation between 10.101.0.1 and 10.201.0.1 so that clients would be able to continue to send data to the server without modifying any client settings.

Is this scenario possible? If it is, what specific Cisco configuration would be needed, and what strange drawbacks/ramifications could be expected?

I have a few old office installs haven't updated in a long time.

Looking at the Office executables, it looks like they were ALL last updated in 2014 (Office versions are 15.0.4420.1017, 15.0.4454.1503, etc.).

For various reasons, I can only fiddle with these machines remotely using the command line. I've tried running the following psexec command, which I've had success with in the past:

psexec.exe -i -s \\remotecomputer "c:\Program Files\Microsoft Office 15\Data\ClientUpdateDir\officec2rclient.exe" /update user updatepromptuser=false displaylevel=false

However, the command returns '-1' and Office is not updated. I think that there is a shared problem between these machines, and I think that it is strange that they all haven't been updated since 2014 (all other office installations are up to date so there is a big installation gap between 2014 and 2020). It is not a permissions issue because I have administrative rights.

Any ideas how I can force these office installs to update remotely? Maybe some sort of a patch or update needs to be installed manually in order for normal updates to work...

Additional information:

• All clients are updating from an internal WSUS server.
• All clients are up to date with Windows OS updates; the problem is with Office only.
• All Office 2013 installations are click-to-run (i.e. bypass WSUS).
• The problem Office 2013 installations are old ones from 2014; more recent Office 2013 installations are updating normally.

Log file information:

• I've enabled verbose logging.
• integratedoffice.exe_c2dll*.log, integratedoffice.exe_ruidll*.log, integratedoffice.exe_streamserver*.log are being created sporadically but contain no errors or warnings.
• FireFly*.log is being created sporadically but contains no errors or warnings.
• When I run office2rclient.exe the log *.log is created in %windir%\temp. However, it doesn't seem to contain any useful information.

Example contents of MachineName*.log

Timestamp   Process TID Area    Category    EventID Level   Message Correlation
02/13/2020 09:30:10.098 OFFICEC2 (0x1de0)   0x7dc       Click-To-Run Telemetry  aqkhc   Medium  {"MachineID":"d56e358e82cbf8499eb26bb86dae583a","SessionID":"86e1c15b-dc4d-4bf2-bb60-6438a5f30a9e","GeoID":"122","Ver":"0.0.0.0","ExeVer":"15.0.5119.1000","SecuritySessionId":"1","ModulePath":"c:\Program Files\Microsoft Office 15\Data\ClientUpdateDir\officec2rclient.exe","CommandLine":"/update user updatepromptuser=false displaylevel=false","Bitness":"32","IntegrityLevel":"0x4000"}    
02/13/2020 09:30:10.128 OFFICEC2 (0x1de0)   0x7dc       Click-To-Run Telemetry  aqkhe   Medium  {"MachineID":"d56e358e82cbf8499eb26bb86dae583a","SessionID":"86e1c15b-dc4d-4bf2-bb60-6438a5f30a9e","GeoID":"122","Ver":"0.0.0.0","OSVersion":"6.1","SP":"1","ProductType":"1","ProcessorArch":"0","Locale":"1041"}  
02/13/2020 09:30:11.128 OFFICEC2 (0x1de0)   0x7dc       Click-To-Run Telemetry  amebh   Medium  ClientExe complete. {"MachineID":"d56e358e82cbf8499eb26bb86dae583a","SessionID":"86e1c15b-dc4d-4bf2-bb60-6438a5f30a9e","GeoID":"122","Ver":"0.0.0.0","Action":"1","Result":"-1"}
02/13/2020 09:30:11.128 OFFICEC2 (0x1de0)   0x7dc       Logging Liblet  aqc99   Medium  Logging liblet uninitializing.  

Is it possible to not cache windows updates on the WSUS server AT ALL (because updates take up so much disk space) and have clients retrieve them from internet based update servers (updates will be cached on clients using Delivery Optimization) while at the same time specifying which updates clients can or cannot install by approving/declining updates on the WSUS server? If so, what group policy settings must be set to make this happen?

I started seeing the following error in my Windows Server 2012 event application logs somewhat recently, possibly after installing some Windows updates.

Log Name:         Application
Source:           Microsoft-Windows-Perflib
Date:             2018/11/11 14:02:21
Event ID:         1008
Task Category:    None
Level:            Error
Keyword:          Classic
Explanation:
The Open Procedure for service Remote Access in DLL "C:Windows\System32\rasctrs.dll" failed. 
Performance data for this service will not be available. 
The first four bytes (DWORD) of the Data section contains the error code
Event XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
    <EventID Qualifiers="49152">1008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-11T05:02:21.000000000Z" />
    <EventRecordID>35760</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>COMP1.TEST.LOCAL</Computer>
    <Security />
  </System>
  <UserData>
    <EventXML xmlns="Perflib">
      <param1>RemoteAccess</param1>
      <param2>C:\Windows\System32\rasctrs.dll</param2>
      <binaryDataSize>8</binaryDataSize>
      <binaryData>0200000000000000</binaryData>
    </EventXML>
  </UserData>
</Event>

There is also a similar error for the BITS (bitsperf.dll) service.

I want to get rid of this error and have tried the entering the following commands (which are commonly mentioned in other forums and websites). However, they do not seem to have any effect.

C:\Windows\system32\lodctr.exe /R
C:\Windows\SysWOW64\lodctr.exe /R
C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF
lodctr /T:TermService

In the registry I've also checked the read permissions in HKLM\SYSTEM\CurrentControlSet\Services\ but they are the same as the other services.

I've also seen recommendations that people disable the performance counters for the above services. But to me this feels like it isn't really solving the error insofar as it is hiding it?

I should also mention that the server is in a closed environment (no internet access).

Is there anything else I can do to get rid of this error?

As you probably know, it is now not possible to pick and choose specific updates to approve or decline in WSUS for older Windows operating systems. For servers, generally speaking there are now only two types: a roll up for the month's security updates, and a comprehensive rollup that includes all security and "quality" updates.

For servers, I am only interested in evaluating and approving security updates, and I will decline all "quality" updates. However, quality and security updates seem to be lumped together under the same class and MSRC classification categories. The only way to distinguish between the two appears to be the the update title itself (i.e. whether or not the update title includes "quality" or not).

Because the names of the quality and security updates are very similar, and there is no easy way that I can see to completely separate them each other in the WSUS view, I am afraid that eventually either I or somebody else will get careless and approve a quality update by mistake. The best way to alleviate the problem is to simply automatically decline all quality updates.

Does anybody know how to do this? An alternative solution could be to find a view in WSUS that makes it easier to discern between quality and security updates, or not having server quality updates show up in WSUS in the first place.

The WSUS server is Windows 2008 R2 and WSUS version is 3.2.7600.226.

Recently a user unplugged their company PC from the network and used USB tethering with their Android phone to bypass the company network entirely and access the internet. I don't think I need to explain why this is bad. What would be the best way, from a zero-cost (i.e. open source, using scripting and group policy, etc.) and technical standpoint (i.e. HR has already been notified, I don't think that this is a symptom of some sort of deeper underlying corporate culture problem, etc.), to detect and/or prevent something like this from happening again? It would be nice to have a system-wide solution (e.g. by using group policy), but if that is not possible then doing something specific to this person's PC could also be an answer.

A few details: The PC is Windows 7 joined to an Active Directory domain, the user has ordinary user privileges (not administrator), there is no wireless capabilities on the PC, disabling USB ports is not an option

NOTE: Thank you for the great comments. I added some additional details.

I think that there are a lot of reasons why one would want to disallow tethering, but for my particular environment I can think of the following: (1) Anti-virus updates. We have a local anti-virus server that delivers updates to network connected computers. If you are not connected to the network you cannot receive the updates. (2) Software Updates. We have a WSUS server and review each update to approve/disallow. We also deliver updates to other commonly used software programs such as Adobe Reader and Flash via group policy. Computers cannot receive updates if they are not connected to the local network (updating from external update servers is not permitted). (3) Internet filtering. We filter out malicious and, uh, naughty(?) sites. By using a tether you can bypass the filter and access these sites and possibly compromise the security of your computer.

More background information: HR was notified already. The person in question is a high level person so it is a little bit tricky. "Making an example" of this employee although tempting would not be a good idea. Our filtering is not severe, I'm guessing that the person may have been looking at naughty sites although there is no direct evidence (cache was cleared). He says he was just charging his his phone, but the PC was unplugged from the local network. I'm not looking to get this person in trouble, just possibly prevent something similar from happening again.

Using group policy I created a windows task that any user can run manually but that runs under a specific domain user (e.g. DOMAIN\task_user) that has been assigned very limited access privileges. This policy/task worked fine with Windows 7 PCs; however, it does not seem to work with Windows 10 PCs (if I try to run the task even as an administrator I see an access denied error).

I think that the reason for this is because Windows 10 does not seem to allow Windows tasks created via domain policy that run under a domain user where the password is saved. For example, within task scheduler if I export the problem task that was created on the local PC with group policy and then import it as new task (this involves manually re-entering the password for DOMAIN\task_user) and run it manually it works just fine.

As a solution to this problem I see that some people suggest that the task be run as the SYSTEM user instead. The reason being, there is no need to save a password for the SYSTEM user at the group policy level so the Windows task should run normally. However, this seems like a bad idea from a security perspective, since the SYSTEM user has access permissions comparable to a local administrator.

So my question is, how can I get around the password saving problem in group policy and create a task that anybody can run but that runs with very limited permissions?

Is it possible to disable HTTP Strict Transport Security in IE 11?

Example of why one would want to do this: A particular user group has filtered internet access through a proxy where only whitelisted domains and URLs are allowed. You want to allow access to http://www.xyzzy.com/hi/there but because the website uses HTTP Strict Transport Security users are being redirected to https://www.xyzzy.com/hi/there. In this situation, you'd be forced to allow access to all of https://www.xyzzy.com.

Lets say that when I install a particular program on a Windows client located on subnet 192.168.1.0/24 it creates a local firewall rule that allows inbound connections to port 1234 from ANY subnet. This is a common: anti-virus software, remote access software like VNC, etc. do this to avoid firewall headaches during deployment.

I want to create a more restrictive firewall rule set using group policy that only allows inbound connections to port 1234 from a specific remote subnet only (e.g. 192.168.101.0/24). So I add a new Windows firewall rule via group policy to allow inbound connections to port 1234 from network 192.168.101.0/24.

Currently in my environment Windows firewall rules for Windows clients that are set via domain group policy are configured to MERGE with local Windows firewall rules. The end result is that the more lenient local rules seem to take precedence over the firewall rule set using domain policy. Specifically, I can still access the client via port 1234 from any subnet, not only from 192.168.101.0/24.

If possible, I want to use group policy firewall settings to change, delete, or nulify the local firewall setting (and not use a startup script to delete the unwanted firewall rule). The simplest way I think to do this I think would be to specify some sort of firewall rule priority where the generic local rule is overruled the more specific domain rule. However, I am not sure that this is possible.

Any suggestions?

I was simply wondering if group policy settings configured using the Office 2010 Group Policy Administrative Template files (http://www.microsoft.com/en-us/download/confirmation.aspx?id=18968 ) apply to later versions of Office, such as Office 2013, or if I need to download new brand new template files (i.e. for Office 2013) and reconfigure the old settings from 2010 all over again with the new templates. If this is a case, is there any way to copy the settings over so I don't have to configure them manually again?

By default Squid logs all access information including 'successes' and 'failures'. I'm interested in logging only 'failures'. In other words, I want to do something like log only Squid DENIED result codes, or, alternatively, don't log successful HTTP transactions. Regardless of how I define 'success' and 'failure', I need to be able to define more specifically what sort of access information Squid will write to the log file. Does anybody know how to do this?

I want to apply windows proxy settings on a computer/location/OU basis using group policy (IE version for the moment is 8, but will be upgrading sooner or later). Presently, I have user objects and computer objects separated out in different OU's in my Active directory tree, and these OU's are subdivided further by category (e.g. computers/PhysicalLocation1, computers/PhysicalLocation2, users/BusinessUnit1, users/BusinessUnit2, etc.).

I think that the typical solution for the above problem is to use group policy loopback processing with the GPO security filter. However, the catch is that I want to have it so that ONLY when users access the network from a specific computer/location, regardless of user, everyone goes through the proxy. When the same users access the network from a different location/OU they do not go through the proxy.

If I use the GPO security filter to pin point where the group policy loopback processing is to be applied it seems that I need to specify user objects (i.e. the object associated with the person logging into the PC with the proxy settings) along with computer objects (i.e. the computer where the proxy settings are applied). The problem with this is that when the user uses a different PC in a location where I do NOT want proxy settings to be applied, because the user is in the GPO security filter the proxy settings end up being applied.

Is there any easy way to pinpoint proxy settings per computer?

I'm doing some tests with a domain join script/program (which also does profile mapping), which means that I've been repeatedly joining/unjoining this test server to the domain (and in the process mapping local profiles to domain accounts).

The problem: I just unjoined the server from the domain (again). The server is in a workgroup. There are no other local accounts beside the local administrator account. I want to logon with the local administrator account, but the local administrator account is not being displayed at the signin screen. Specifically, there is only one signin name showing, and it is under my domain account's display name for some reason (e.g. "Smith John"). Since the server is not joined to a domain, this does not make sense.

It occurred to me that since I am doing some profile mapping tests, maybe the display name from my domain account was mapped to the local administrator account. However, if this is the case, I should be able to logon with this account using the local administrator password, but I cannot. For the record, I am unable to logon using the domain account's password as well.

I am thinking that if can manually specify/type in using the keyboard the administrator logon name (i.e. MACHINENAME\ADMINISTRATOR) I should be able to login. But I see to obvious option to do this.

So I guess there are two questions here. 1) What is going on here? 2) Is there a "trick" to manually specify/type in a logon name when there is no obvious way to do so (e.g. press some key combination to force a text field to appear that allows you to input the logon name)?

Also, a side thought, is there a chance that the local administrator account has been disabled? Would this account for the incorrect/weird signin display name?

Here are some some screenshots to give you a better idea of what is going on:

This is the screen that I see when I first access my local console. It is prompting me to press Ctl+Alt+Del to sign in.

This is the screen that I see after I press Ctl+Alt+Del. There is an input box for a password. Above the input box is the display name (not the netbios name) for the domain account that I logged in with after performing the domain joins. The server is currently in a workgroup (i.e. not in a domain). As you can see, there are no visible options to log in with any other account (unlike the screenshots posted below). There are no visible options to manually specify/type in a logon name.

I want to be able to configure IE 11 group policy settings from my Win 7 client. I have IE 11 installed on this client. The client has been joined to a mixed Windows Server 2003/2008R2 domain. When I open the policy object from my Win 7 client and navigate to "User Configuration"->"Basic Settings"->"Control Panel" and right click on "Internet Settings" I can only see the option to add group policy settings for IE 5, 6, 7, and 8.

I tried downloading the ADMX templates for IE 11 (https://msdn.microsoft.com/en-us/library/bb530196.aspx) and installing them in %systemroot%\policyDefinitions on the client but nothing seems to change.

I read in a different thread (Internet Explorer 9 & 10 Group Policy Preferences missing) that I need Windows 8 or Server 2012 to accomplish what I want to do, but this seems strange to me. There are no Windows 8 or Server 2012 machines in my domain, and purchasing/acquiring one is an impossibility right now. Also, as an aside, all my servers have IE 8 installed, including the domain controllers, and upgrading to IE 11 is not possible right now (I don't know if this is an important point or not).

There has to be a way to accomplish what I am try to do. Can anybody lend a hand?