user3271408's questions

I have seven Server 2019 systems that I maintain that do not have a connection to the internet or an MECM or WSUS. So far, I have been patching them with a WSUS Offline tool that I found that pulls down updates and zips it up. You run an executable of the tool and it checks your system to see what you need and installs. It works good for monthly Windows patches. It does not work good for dotNet Framework or Windows Defender.

The next thing I did to try to get dotNet patched was I went to Download .NET Framework | Free official downloads and downloaded the "NDP48-x86-x64-AllOS-ENU.exe". I get that over to the server. First, I uninstall the current version:

# Uninstall:
NDP481-x86-x64-AllOS-ENU.exe /passive /uninstall

The uninstall completes successfully.

Then I try to install the patched version. I first try:

# Install:
NDP481-x86-x64-AllOS-ENU.exe /passive /promptrestart

That didn't work, so I removed the switches and tried this:

NDP481-x86-x64-AllOS-ENU.exe /log .\dotnet.log

Here are screenshots of how the installation goes:

I go to the log file (which happens to be an html file). The log file says it cannot find object or property of a specific CAB file. But you can see in this next screenshot that the CAB file is there:

I next go to that CBS.log file that the dot net log file mentions (the CBS log file is over 101K lines). In that CBS.log file, it sees that CAB file and extracts files from it:

It then goes through many of lines like these, the only difference being this highlighted part. But it is the specified KB number from the original error. I know that screenshot is cut off. Here is the full line:

Plan: Package: Package_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Update: 4486153-1679_neutral_PACKAGE, current: Installed, pending: Default, start: Installed, applicable: Installed, targeted: Superseded, limit: Installed, selected: Default

After each line that starts with "Plan:", it has a bunch of "Appl:" lines:

This goes on for about 20 iterations. But then it gets to this one and it cannot find the parent package:

2024-12-05 07:27:56, Info                  CBS    Plan: Package: Package_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Update: 4486153-1685_neutral_PACKAGE, current: Installed, pending: Default, start: Installed, applicable: Installed, targeted: Superseded, limit: Installed, selected: Default
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: no parent found, go absent
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-ServerCore-SKU-Foundation-WOW64-onecore-Package~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: parent found: Microsoft-Windows-ServerCore-SKU-Foundation-WOW64-onecore-Package~31bf3856ad364e35~amd64~~10.0.17763.1, state: Installed
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-CloudEdition~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: no parent found, go absent
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-CloudNEdition~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: no parent found, go absent
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-CoreCountrySpecificEdition~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: no parent found, go absent
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-CoreEdition~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present
2024-12-05 07:27:56, Info                  CBS    Appl: detectParent: no parent found, go absent
2024-12-05 07:27:56, Info                  CBS    Appl: detect Parent, Package: Package_6_for_KB4486153~31bf3856ad364e35~amd64~~10.0.1.2919, Parent: Microsoft-Windows-CoreNEdition~31bf3856ad364e35~amd64~~10.0.16299.15, Disposition = Detect, VersionComp: EQ, BuildComp: GE, RevisionComp: GE, Exist: present

After that, I get more stuck. I don't know where it is looking for those files, so I am unable to verify it or dig deeper into that specific file issue.

I've rebooted the system multiple times.

Edit: I believe I am using the correct version of dot Net Framework to patch. I do not have a desire or intent to change the version except to patch security vulnerabilities/CVEs.

I used this to check the version:

> Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse | Get-ItemProperty -Name version -EA 0 | Where { $_.PSChildName -Match '^(?!S)\p{L}'} | Sort-Object -Property Version | Select PSChildName, version

PSChildName                      Version
-----------                      -------
v2.0.50727                       2.0.50727.4927
v3.0                             3.0.30729.4926
Windows Communication Foundation 3.0.4506.4926
Windows Presentation Foundation  3.0.6920.4902
v3.5                             3.5.30729.4926
Client                           4.0.0.0
Client                           4.8.03761
Full                             4.8.03761

> (Get-ItemProperty "HKLM:SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full").Release
528049

> (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe -version)[4]
4.8.3761.0

That looks to me like I should be trying to use the 4.8 version to patch. But if I'm mistaken, please enlighten me.

If anyone can offer any suggestions or help, that would be greatly appreciated.

I have a Server 2019 server that I configured Windows Event Collector on. I have six systems successfully sending logs to it (specifically AppLocker logs). I'd like to expand this to to about 20 systems sending logs, plus I'd like to forward Security, Application and Setup logs. But I don't want all the logs from the four event logs, from every server going to Forwarded events. I'd like to create new event logs on the Collector server to fit my needs. But I cannot seem to find a way to do this. I tried using powershell New-EventLog. While I could get the powershell command to complete successfully, I couldn't see the created event log in Event Viewer or when creating a subscription.

Is there a way to do this? Or is there some other way people solve this? Thanks in advance.

I am configuring a Cisco MDS 9148T. It is running system: version 8.4(2d) (system image file is: bootflash:///m9148-s6ek9-mz.8.4.2d.bin). I wanted to make use of the "reload in" command where you set a timer for when the switch will reload in case you accidently block yourself from access (I was implementing a ACL on the management interface). The "reload in" command appears to work on Cisco Nexus switches and Cisco Catalyst switches, but not MDS switches: MDS-TOP# reload ascii module system
MDS-TOP# reload in ? ^ % Invalid command at '^' marker. MDS-TOP# reload in

Does anyone know a way to do this on Cisco MDS switches?

Thanks in advance.

I created an SVM with the intentions of delegating administration to just that SVM (my first time doing this). I created an aggregate for it, created an SVM, assigned the aggregate to the SVM, created a separate account for the SVM and assigned it a management LIF. I can access the SVM via SSH and that seems to be working fine. But the web interface for the SVM gives a 404 error: Not Found The requested URL /sysmgr was not found on this server.

When I check the services of the vServer, it does not have a "sysmgr" service like the SVM for cluster management. But none of the data SVMs in the cluster have that service either. I can't find a way to add that service to the particular vServer.

Is it possible that when you delegate administration of an SVM only (as opposed to the whole cluster) that it is only administrable via SSH? Any ideas on what I'm missing? Thanks in advance.

In Group Policy Management, when I click on an existing GPO, I get an Internet Explorer Enhanced Security Configuration messaged that "about:security_mmc.exe" is not a trusted site.

It happens every time I click a different GPO. I read to add this to the trusted site list, which I did. I confirmed it is in the policy when I do gpresult.

But I'm still getting this message. Anything else I need to do so this doesn't keep popping up?

I have been tasked with standing up a new NetApp FAS 9000 and moving off our older 8040. I've done a few things within OnTap before and troubleshot a couple problems when the primary person was out of town, but I haven't done much more than that. I want to start by documenting the existing LUNs/CIFS shares and NFS mounts being used on the current 8040. Is there an easier way to do this rather than manually copying paths and names and such? Thanks in advance.

I am writing a script that will grab the audit settings of all GPOs in my Active Directory forest. I get most of what I need with this:

Get-Gpo -All |
    ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit |
        Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit,AccessToString,sddl} | 
            select GPO,AuditToString,AccessToString,sddl | 
                Format-list |
                    out-file C:\Users\scott\Desktop\gpo_acl.txt

The output from this looks like this:

GPO           : Server 2019
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)

GPO           : Computer Quarantine
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)

(I truncated the Sddl output because it would make information public that I didn't want public.) What I'm now trying to accomplish is to make that Sddl output more human readable. I can manually copy the Sddl output into a command like this:

ConvertFrom-SddlString -sddl "PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)" -type ActiveDirectoryRights |
Select-Object -ExpandProperty DiscretionaryAcl

And it gives me output that looks nicer, like this:

NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

I'm trying to get that nicer output within the for-each loop I posted in the beginning. A colleague suggested adding this hashtable at the end of the select-object:

Get-Gpo -All |
    ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit |
        Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit,AccessToString,sddl @{n="SDDLString";e={ConvertFrom-SddlString($_.sddl)}}} | 
            select GPO,AuditToString,AccessToString,sddl | 
                Format-list |
                    out-file C:\Users\scott\Desktop\gpo_acl.txt

but it prints the name of the object instead of the content. Ideally, I'd like the output to look something like this:

GPO           : Server 2019
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

GPO           : Computer Quarantine
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

Any suggestions would be very appreciated.

I'm setting up rsyslog on a Red Hat 8 system. I have the the first part working, that being filtering based on source IP, putting logs in a specific file, like this:

if $fromhost-ip startswith '10.1.2.45' then /var/log/test_all.log

& ~

What I'd like to do, that I cannot figure out the correct syntax for, is if sourcing from a host IP and the authpriv facility, put it in a file. I know I need that statement before the one I listed above, but I can't get it to work. I also tried the local7 (boot logs) and that didn't work either. The next two examples are syntaxes I tried and did not work:

Example 1:

if $fromhost-ip startswith '10.1.2.45' and $syslogfacility-text == 'local7' then /var/log/test_boot.log

& stop

if $fromhost-ip startswith '10.1.2.45' and $syslogfacility-text == 'local10' then /var/log/test_secure.log

& stop

if $fromhost-ip startswith '10.1.2.45' then /var/log/test_all.log

& stop

Example 2:

if $fromhost-ip startswith '10.1.2.45' and $syslogfacility-text == 'authpriv.*' then /var/log/test_secure.log

& stop

if $fromhost-ip startswith '10.1.2.45' then /var/log/test_all.log

& stop

---End of Examples---

Any help would be greatly appreciated.

Is there a way to use an authentication key when configuring Windows Time to point to a NTP Server that is not part of my domain? My situation is that I'm setting up a new Active Directory forest and I cannot find a way to use an authentication key when configuring the Windows Time service. I've read a couple articles about Active Directory clients using Kerberos to provide authentication within a domain, but what about the authoritative source in the domain (the PDC emulator)? Thanks in advance.

I am trying to automate checking the audit settings on GPOs. In the GUI, to check one GPO, I'd open Group Policy Management Console, expand domains, the domain name, Group Policy Objects, select a GPO that I wanted to check, go to the delegation tab, choose advanced, advanced again on the setting window that opens, and finally select the Auditing tab. I want to add non-default settings here to all our GPOs and periodically check that those settings haven't been removed. I can query for GPOs with the "get-gpo" command, but that doesn't give me the information that I want. Any ideas how I could get the auditing information? I appreciate any help.

I am building a test Active Directory forest in a virtual environment. I will be part of a team in the future that will build a new Forest for our organization. I don't have experience managing a forest or domain in a production environment, but I am familiar with GPOs and working with them as a Sys Admin. I'm using Server 2019 and the Forest and Domain Functional levels are at Windows Server 2016 (that's the highest version available). I created a new GPO to add our security settings, linked the new GPO to the Domain Controllers OU, did gpupdate /force (this indicates it completes successfully), rebooted, its been a day or so and I go to verify some settings have been applied. gpresult shows the GPO is applied, but numerous settings that are set in the GPO, are not set in the gpresult output. Here are two examples: I have "Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" set in the GPO to audit success and failure. I also have the "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" enabled. But this isn't applied to the server at all. Running "AuditPol /get /category:*" and looking at the output confirms this. The second example is "Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy". I have it set to three, but it is not applied in the gpresult output.

In both of those examples, gpresult indicates that local policy is the winning gpo.

There are other settings that are missing. There are also settings in the gpresult that have applied from the GPO. Anything I could be missing? Thanks in advance.

I am setting up a new vSphere environment using 6.7. I have built the first ESX server and need to connect to an NFS mount to use as a datastore. The NFS share is on a NetApp running in Cluster mode, 9.1. We have an existing vSphere 6.0 environment that someone else set up that also uses the same NetApp for NFS datastores.

I created a new volume in the netapp, created a new export policy, added a rule to the export policy that allows the client IP (the ESX in this case), Unix style permissions, gives it read/write and superuser access. I have checked the existing export policy for vCenter and it appears the same. From the ESX command line, I can ping the netapp NFS interface (vmkping 192.168.X.X, zero packet loss). When I try to create the NFS share, it fails saying "The NFS server has denied access".

From the NetApp command line, I tried the following check-access -vserver -volume -client-ip 192.168.X.X -auth none -proto nfs3 -access-type read-write This says access denied, but when I check a known working export, it also says denied. Changing the auth type to "sys" shows policies that allow the proper access. I can find no way to change the auth type on the ESX side.

Also from the NetApp, I tried pinging to the ESX, but that does not respond. I turned the firewall off on the esx, but it still does not respond. I can ping from the netapp to other known working nfs IPs.

I've been reading through lots of things but cannot seem to find a solution or further troubleshooting.

Any assistance would be appreciated.

I am in a large organization with multiple domains in a forest and lots of OUs in each domain. The domain admins delegate administration of the OUs to IT personnel that work in the OU. I am one of those IT people. I can create and delete sub-OUs in our OU, we've been assigned the ability to manage GPOs that apply to us. etc. We have geographically separated groups that we've created separate sub-OUs for and delegated the ability to manage those OUs to personnel there.

At one of those sites, we have a group with full control of the OU they are in, but we are not able to modify any groups they have created. For instance, if I wanted to add an account to a group in the OU, I do not have that ability, even though I have full control of the OU it is in. I realize the security group has a list of ACEs in the security tab and I'm not granted permissions there.

Is there a way I can force a group of my choice to be added to the ACE list on all security groups under our OU?

I am building a SFTP server on Red Hat 6.9 (to be clear, I'm using the FTP extension of OpenSSH). I followed the following guide:

https://www.howtoforge.com/tutorial/how-to-setup-an-sftp-server-on-centos/

I configure everything exactly how it is described. The client OS I'm using is Windows 10. I've tested with Putty's SFTP client and WinSCP (I do not believe my problem to be a client related). When I attempt to connect, I get prompted for a username, then password. After entering my password, the session immediately closes. /var/log/secure shows these relevant messages:

Aug  2 14:30:28 SFTP_Server sshd[4087]: pam_unix(sshd:session): session opened for user scott.ftp by (uid=0)  
Aug  2 14:30:28 SFTP_Server sshd[4089]: fatal: bad ownership or modes for chroot directory "/sftp/scott.ftp/data"  
Aug  2 14:30:28 SFTP_Server sshd[4087]: pam_unix(sshd:session): session closed for user scott.ftp

To show the directory permissions match the tutorial:

[root@SFTP_Server data]# ls -alh / | grep sftp
drwxr-xr-x    4 root              root      4.0K Aug  2 12:37 sftp  
[root@SFTP_Server data]# ls -alh /sftp  
total 16K  
drwxr-xr-x   4 root root 4.0K Aug  2 12:37 .  
dr-xr-xr-x. 25 root root 4.0K Aug  2 12:35 ..  
drwxr-xr-x   3 root root 4.0K Aug  2 12:38 scott.ftp  

[root@SFTP_Server data]# ls -alh /sftp/scott.ftp/  
total 12K  
drwxr-xr-x 3 root              root      4.0K Aug  2 12:38 .  
drwxr-xr-x 4 root              root      4.0K Aug  2 12:37 ..  
drwxrwx--- 2 scott.ftp sftpusers 4.0K Aug  2 12:38 data  

[root@SFTP_Server data]# ls -alh /sftp/scott.ftp/data/  
total 8.0K  
drwxrwx--- 2 scott.ftp sftpusers 4.0K Aug  2 12:38 .  
drwxr-xr-x 3 root              root      4.0K Aug  2 12:38 ..  

I'm not sure what gave me this idea to try, but for troubleshooting, I changed permissions on the "." directory:

[root@SFTP_Server data]# pwd  
/sftp/scott.ftp/data  
[root@SFTP_Server data]# chown root:root .  
[root@SFTP_Server data]# ls -alh  
total 8.0K  
drwxrwx--- 2 root root 4.0K Aug  2 12:38 .  
drwxr-xr-x 3 root root 4.0K Aug  2 12:38 ..  

Now I try to connect again and I can successfully connect. But I cannot list directory or make directory or any other action. The error I get here is "permission denied". While still connected over SFTP, in an alternate SSH connection, I change the permissions back:

[root@SFTP_Server data]# chown scott.ftp:sftpusers .  
[root@SFTP_Server data]# ls -alh  
total 8.0K  
drwxrwx--- 2 scott.ftp sftpusers 4.0K Aug  2 12:38 .  
drwxr-xr-x 3 root              root      4.0K Aug  2 12:38 ..  

Now I can create directories and other actions in the SFTP session. I exit the SFTP session and try to connect and the login fails as described above.

Any help is greatly appreciated.