▶️ (Video): Using Offline PowerShell Repository in Disconnected Environments

https://www.youtube.com/watch?v=FwJ1wp7H4eY

📚 Viewing Active TCP Connections and Open Ports with PowerShell

As an alternative to the classic netstat CLI command, PowerShell provides the Get-NetTCPConnection cmdlet for viewing active TCP sessions and open ports and the Get-NetUDPEndpoint for UDP protocol endpoints.

Unlike Netstat, which returns plain text that requires parsing with text filters, PowerShell returns structured objects. This makes it much easier to filter, sort, group, and automate the analysis of network connections with PowerShell pipelines 💪.

🔹 View listening TCP ports:

Get-NetTCPConnection -State Listen

🔹 Display TCP sessions with a specific local port:

Get-NetTCPConnection -LocalPort 443 | Format-Table -AutoSize

🔹 Count the number of active TCP sessions.

(Get-NetTCPConnection -LocalPort 443 -State Established).Count

🔹 Display the name of the process that is listening on a specific TCP port and the name of the user running the process:

Get-Process -Id (Get-NetTCPConnection -LocalPort 8080).OwningProcess -IncludeUserName

🔹 The top 10 remote IP addresses, ordered by the number of active connections:

Get-NetTCPConnection -State Established |
    Group-Object RemoteAddress |
    Sort-Object Count -Descending |
    Select-Object -First 10 Count, Name

🔹 Continuous monitoring of connections to a specific port:

while ($true) {
    Clear-Host
    Get-NetTCPConnection -LocalPort 443 -State Established
    Start-Sleep -Seconds 5
}

✅ The article covers these and other practical examples of using Get-NetTCPConnection to view active TCP sessions, enumerate open ports, and identify the processes responsible for network activity in Windows.

➡️ Exploring the Powershell Alternative to NetStat: Get-NetTCPConnection & Get-NetUDPEndpoint

⌛️ Windows Sandbox: Built-in Sandboxed Environment in Windows 11

Windows 11 includes Windows Sandbox, a native feature utilizing containerization technology to operate a lightweight virtual machine within an isolated environment. The sandbox environment leverages a Dynamic Base Image that references the host's existing system files, thereby achieving significantly reduced disk space and resource consumption compared to traditional virtual machines.

✅ Windows Sandbox is ideal for running untrusted or unknown software, testing application behavior, and validating deployment scripts in a clean environment. A Hyper-V NAT virtual switch is automatically generated on the host system, permitting the Sandbox to access the network and the Internet.

⚠️ Any modifications made within the sandbox are discarded upon closure. Each time Windows Sandbox is launched, it initializes from a clean, pristine state.

To enable Windows Sandbox, run rhe following PowerShell command:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online

📚 The sandbox window behaves much like an RDP session. Clipboard redirection is supported, local folders can be mapped into the sandbox, and GPU acceleration can be enabled.

✅ Only one Windows Sandbox instance can run at a time. However, by using WSB configuration files, you can create multiple sandbox profiles with different settings and environments. The article includes a sample WSB configuration file and startup scripts for automatically installing WinGet and any other required applications upon sandbox launch.

Windows Sandbox in Windows 11: How to Enable and Configure It

Device Lockdown with Unified Write Filter (UWF) in Windows

📚 Unified Write Filter (UWF) is a built-in feature available in the Enterprise editions of Windows 10 and Windows 11 that can protect a protect a partition against write accesses and therefore unintentional system changes. When UWF is enabled, all changes to files and folders are redirected to a virtual overlay stored in RAM (or on disk). This works because the UWF driver intercepts all write operations to the file system and transparently redirects them to the overlay. Any changes made during a user session are discarded after a reboot when the overlay is cleared.

Add the UWF feature in Windows using PowerShell:

Enable-WindowsOptionalFeature -Online -FeatureName "Client-UnifiedWriteFilter" –All

UWF is managed through the uwfmgr.exe command-line tool.

Enable UWF protection and protect a volume from writes:

uwfmgr.exe filter enable

uwfmgr.exe volume protect c:

 View the current UWF configuration and status:

uwfmgr.exe get-config

You can add specific files, folders, or registry keys to the UWF exclusion list. Changes to these objects will persist across reboots:

Uwfmgr.exe file add-exclusion c:\labs\report.docx

If you need to permanently commit changes to a specific file without disabling UWF:

uwfmgr file commit C:\Labs\MyApp.log

Disable UWF protection:

uwfmgr.exe volume unprotect C:

uwfmgr.exe filter disable

 

The UWF is not suitable for continuous operation (24/7). The overlay will grow continually up to the maximum preset size even in excluded areas. If the overlay run full the system will automatically be restarted by Windows.

✅ UWF allows you to "freeze" the state of a Windows device while still permitting normal operation. Any files, settings, or changes made by users are automatically removed after a restart. Typical use cases include public kiosks, training labs, embedded systems, and shared computers that need protection from accidental misconfiguration or unwanted user changes.

Unified Write Filter (UWF): Disk Write Protection for Windows

⚙️ iVentoy is a lightweight PXE deployment server that can be used to install virtually any operating system, whether Windows or Linux, from an ISO image over the network. It includes everything required for PXE booting (DHCP, TFTP, and NBD) in a single package. Compared to traditional enterprise OS deployment solutions, iVentoy is significantly simple to install and configure. It is available for both Windows and Linux.

🔹 Setup is straightforward: simply launch iVentoy on a machine and copy (or create symbolic links to) the ISO images you want to deploy into the iVentoy directory.
🔹 When iVentoy starts, it automatically opens its web management interface at http://127.0.0.1:26000, where you can configure basic server settings, including network parameters and the built-in DHCP service, or specify that an external DHCP server is being used.
🔹 Once configured, any computer on the LAN configured to boot via PXE will receive a menu of available ISO images.
🔹 You can install an operating system directly from any ISO image stored in iVentoy directory or boot into a Live CD Environment.
🔹 With iVentoy, you can eliminate the need for bootable USB installation media when deploying operating systems. The free edition supports up to 20 concurrent PXE clients.

✅ Deploy and Boot Operating Systems from ISO Images over the Network with iVentoy

🛡 CrowdSec is often considered a modern, high-performance alternative to Fail2Ban for protecting servers against network attacks such as password brute-force attempts and port scanning. Although it is widely associated with Linux, CrowdSec also provides native support for Windows. A typical Windows deployment includes of two main components: the Security Engine, which analyzes logs, and the Windows Firewall Bouncer, which automatically blocks malicious IP addresses by changing Windows Defender Firewall rules.
 

📚 This article covers the simplest deployment scenario, in which all CrowdSec components, the log analyzer, Local API (LAPI), and Windows Firewall Bouncer, run on a single Windows host. With the default configuration, CrowdSec can already detect and block password brute-force attacks against common Windows services such as RDP and SMB.

 Install the CrowdSec Security Engine, the Windows Firewall Bouncer, and the .NET 6 Desktop Runtime: 

winget install CrowdSecurity.CrowdSec, CrowdSecurity.CrowdSecWindowsFirewallBouncer, Microsoft.DotNet.DesktopRuntime.6

Enable auditing of failed logon attempts:
secpol.msc →Local Security Policy → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff → Audit Logon → Enable Failure events auditing.
Run the services:

Get-Service Crowdsec, cs-windows-firewall-bouncer| Start-service -verbose

Verify that the crowdsecurity/windows collection is installed::

cscli collections list

Also verify that the crowdsecurity/windows-bf detection scenario is enabled. This scenario detects password brute-force attacks by monitoring failed logon events in the Windows Event Log and supports RDP, SMB, and Outlook on the Web (OWA) authentication.

When CrowdSec detects a brute-force attack (by default, 5 failed logon attempts within 1 minute),the Windows Firewall Bouncer automatically creates a firewall rule named crowdsec-blocklist-<ID> and adds the attacker's IP address to it. By default, the IP address is blocked for 4 hours.

View active blocking decisions:

cscli decisions list

View the history of detected attacks: 

cscli alerts list

✅ Install CrowdSec on Windows: Step-by-Step Guide From Installation to Threat Blocking

📚 One of the most valuable, yet frequently overlooked, features of SMB file servers (whether Windows or Samba) is Access-Based Enumeration (ABE).

✅ When ABE is enabled for a shared folder, users can only see the files and subfolders for which they possess NTFS read permissions (at a minimum). All other files and folders are hidden from the shared folder view. This feature is particularly beneficial for large file shares containing departmental or project folders, ensuring users only view resources to which they are authorized to access.

🔹 Enable Access-Based Enumeration on a Windows file share using Server Manager or PowerShell:

Get-SmbShare Public | Set-SmbShare -FolderEnumerationMode AccessBased 

🔹 On Samba, add the following option to smb.conf: 

hide unreadable = Yes

To also hide shares that users cannot access when browsing the network, enable: 

access based share enum = Yes

 
✅ Learn how to hide files and folders for which users do not have permissions using Access-Based Enumeration (ABE) on Windows and Samba file servers.
 
https://woshub.com/enable-access-based-enumeration-in-windows-server/

📶 Windows' built-in netsh command can be used to export saved Wi-Fi (WLAN) profile configurations, including passwords, to XML files, which can then be imported on other computers. This is useful for backing up saved Wi-Fi networks, migrating clients to new devices or SSIDs, and deploying wireless profiles in advance without having to configure each machine manually.

List all saved WLAN profiles on a machine:

netsh wlan show profile

Export a specific WLAN profile to a directory (including the saved Wi-Fi password in plain text):

netsh wlan export profile name="woshub" key=clear folder="C:\backup"

Export all saved WLAN profiles:

netsh wlan export profile folder=C:\backup key=clear

Each WLAN profile is saved as a separate XML file. You can copy the file to another computer and import it:

netsh wlan add profile filename="C:\backup\Wi-Fi-woshub.xml"

Or import all WLAN profiles from a directory using PowerShell:

Get-ChildItem C:\backup\ | foreach {$fname=$_.Fullname;netsh.exe wlan add profile filename=$fname}

✅ Export and Import Wi-Fi Profiles in Windows Using Netsh

🖥 RemoteApp is a technology used to deliver apps installed on a Remote Desktop Session Host (RDSH) directly to a user's desktop through Remote Desktop Services (RDS). RemoteApp applications behave as if they are running locally on the client computer. Instead of displaying the entire remote desktop, only the published application's window is streamed to the client. The window can be resized, appears on the local desktop taskbar with its own icon, and provides a seamless user experience.

▶️ A standard RemoteApp deployment requires Windows Server with the Remote Desktop Session Host role, along with an RDS Licensing Server and valid RDS CALs. However, it's also possible to run any app in RemoteApp mode on Windows 10 and Windows 11 desktop editions. This is particularly useful when you use RDP to access a remote PC for just one or two applications instead of an entire desktop session.
 
1️⃣ To enable the RemoteApp feature on desktop versions of Windows, enable the Allow remote start of unlisted programs policy, or create the registry value fAllowUnlistedRemotePrograms and set it to 1.
2️⃣ Then edit the *.RDP connection file and add the required RemoteApp parameters, specifying the path to the application you want to launch in RemoteApp mode.

remoteapplicationmode:i:1
RemoteApplicationName:s:Remote_Notepad
RemoteApplicationProgram:s:"%windir%\notepad.exe"
DisableRemoteAppCheck:i:1
Alternate Shell:s:rdpinit.exe

✅ How to Run Any App in the RemoteApp Mode on Windows 11 Without a Windows Server

🔄 Windows Server Update Services (WSUS) is traditionally used in corporate networks for centralized deployment of security updates and patches for Microsoft products such as Windows and Office. However, user workstations also run many third-party applications (such as web browsers, PDF readers, archivers, and other tools) that require regular updates and patch management.

📦 WSUS Package Publisher (WPP) is an open-source extension for WSUS that lets you create and publish custom update packages for virtually any third‑party apps, and deploy them through your existing WSUS infrastructure.

✅ In the article, we demonstrate how to create a custom WSUS update package for 7-Zip and centrally deploy it to user computers, including upgrading older versions, using the standard Windows Update mechanism. 

By leveraging WSUS Package Publisher, organizations can extend their existing patch management process beyond Microsoft products without introducing additional deployment tools.

➡️ Deploying and Updating Third-Party Apps via Microsoft WSUS (Windows Server Update Services)

🖨 A common issue with Windows Remote Desktop Services (RDS) hosts that have local printer redirection enabled is a large number of Inactive TS ports for redirected client printers that remain even after those clients disconnect. Over time, these orphaned print ports can degrade RDS Session Host performance, cause redirected printers to disappear from user sessions, and lead to other Print Spooler related issues. The problem is intermittent and is most noticeable on high load RDS hosts with a large number of concurrent user sessions (50+).

✅ Consider the following best practices to prevent printer-related issues on Windows terminal servers:
🔹 Redirect only the user's default printer into the RDP session (can be set via Group Policy). This significantly reduces the number of TS printer ports that are created.
🔹 Periodically remove inactive TS printer ports using a maintenance script.
🔹 Reboot the RDS Session Host to clear orphaned TS printer ports.

Cleaning Up Inactive TS Printer Ports on Windows RDS Servers

💬 You can use the built-in MSG command to send a pop-up message to a user's desktop on a local or remote Windows computer. Specify the target host with the /server parameter and the message text.

✅ Send a message to a specific user:
MSG k.fabian /server:MUN-SAP01 "Restart the SUPGUI client to apply the latest update!"
  
✅ Show a pop-up notification to all active user sessions on the server:
MSG * /server:MUN-SAP01 "The server will be restarted in 10 minutes. Please save your work and close all documents "

✅ If you need a more customized pop-up notification solution, you can use a simple PowerShell script such as RemoteSendToastNotification.ps1 (available on GitHub) to show a rich toast notification with an icon or image on a remote Windows computer.

How to Send a Pop-Up Notification to a User with PowerShell

 
🌐 Windows indicates the current Internet connectivity status using both the network icon in the system tray and the information shown in the Network settings interface. This is a convenient visual indicator that allows users to quickly determine whether a device has Internet access.

The Network Connectivity Status Indicator (NCSI) is a dedicated Windows component responsible for performing network connectivity checks. It performs two simple tests:

✅ DNS connectivity check
Windows verifies that the DNS query for dns.msftncsi.com returns the expected IP address:
IPv4: 131.107.255.255
IPv6: fd3e:4f5a:5b81::1
✅ HTTP connectivity check
If the DNS check fails, Windows additionally tests access to:
http://www.msftconnecttest.com/connecttest.txt
The service verifies that the text file is accessible and contains the expected string:
Microsoft Connect Test

📚The target addresses and expected responses used by NCSI can be customized via the registry HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
Available parameters include:
🔹 EnableActiveProbing : enables or disables NCSI Internet connectivity checks (0 disables active probing)
🔹 ActiveDnsProbeHost / ActiveDnsProbeHostV6 : DNS hostname used for connectivity testing
🔹 ActiveDnsProbeContent / ActiveDnsProbeContentV6 : expected IPv4 and IPv6 addresses returned by the DNS probe
🔹 ActiveWebProbeHost / ActiveWebProbeHostV6 : web servers used for HTTP connectivity checks (default: www.msftconnecttest.com and ipv6.msftconnecttest.com)
🔹 ActiveWebProbePath / ActiveWebProbePathV6 : path to the test file on the web server
(default: connecttest.txt)
🔹 ActiveWebProbeContent / ActiveWebProbeContentV6 : expected content of the HTTP response (default: Microsoft Connect Test)

⚙️ Administrators can override these registry values to redirect NCSI checks to internal corporate resources instead of external Microsoft endpoints, or completely disable active Internet connectivity testing for privacy and security reasons.

Corporate administrators can also configure a custom internal HTTP endpoint for NCSI checks, allowing them to log device activity (startup, shutdown, and connectivity status) through web server logs.

Windows Network Connectivity Check Explained: NCSI and Internet Access

⛑ Windows Safe Mode is a troubleshooting and recovery environment that loads the operating system with only the bare minimum of essential drivers and service, In this mode, Windows prevents third-party apps, services and drivers from startup when the computer boots up. Safe Mode is commonly used to remove software that cannot be uninstalled during a normal boot, or when Windows fails to start after installing incompatible software or drivers. Typical examples include antivirus software, firewalls, endpoint security agents, device management tools, and other enterprise applications.

⚠️ However, the Windows Installer service (MSIServer) is disabled by default in Safe Mode. This behavior is somewhat counterintuitive: although one of Safe Mode’s primary purposes is troubleshooting and recovery, it cannot natively uninstall MSI‑based apps.
 
If you try to uninstall an application either via the Control Panel or by running its MSI source package, Windows displays the following error: 

The Windows Installer Service is not accessible in Safe Mode.
Please try again when your computer is not in Safe Mode or you can use System Restore to return your machine to a previous good state.

 
✅ To enable the Windows Installer (MSIServer) service in Safe Mode, create the appropriate registry entry.

🔹 If Windows is running in Safe Mode with Networking: 

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer" /VE /T REG_SZ /F /D "Service"

🔹 If Windows is started in standard Safe Mode (without networking): 

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"

Then start the Windows Installer service using the command: 

net start msiserver

Once the service is running, you can uninstall applications that depend on the Windows Installer service directly from Safe Mode.

✅ How to Enable the Windows Installer Service in Safe Mode

🛠 This is a 'classic' Windows admin trick for resetting a local administrator password or regaining administrative privileges when the password has been lost or forgotten. 

Note: This method requires physical access to the computer and the ability to boot into the Windows Recovery Environment (WinRE) or from Windows installation media. It should only be used on systems you own or are authorized to administer.

1️⃣ Boot the computer into WinRE or from any Windows installation USB drive.
2️⃣ Open a Command Prompt by pressing Shift+F10.
3️⃣ Use DiskPart to identify the drive letter assigned to the partition containing the Windows installation.
4️⃣ Back up utilman.exe:
copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.exe.bak
Then replace it with cmd.exe:
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe /y
5️⃣ Restart the computer:
wpeutil reboot
6️⃣ At the Windows sign-in screen, click the Accessibility (Ease of Access) icon in the lower-right corner.
7️⃣ Instead of the accessibility tools, a Command Prompt will open with NT AUTHORITY\SYSTEM privileges.
8️⃣ From this elevated command prompt, you can perform local account recovery tasks, for example:
Reset the password of a local user:
net user localadm *
Re-enable a disabled account:
net user localadm /active:yes
Create a new local admin account:
net user newlocadm /add *
net localgroup Administrators newlocadm /add
9️⃣ After confirming that you can successfully sign in, boot back into WinRE or the installation media and restore the original utilman.exe file:
copy C:\Windows\System32\utilman.exe.bak C:\Windows\System32\utilman.exe /y
 

✅ This is a well-known recovery technique that provides a SYSTEM command prompt directly from the Windows sign-in screen without requiring authentication. Besides resetting local account passwords, it can also be used to re-enable administrator accounts, create a new local administrator, or perform offline recovery tasks such as disabling problematic services, removing incompatible software, resetting GPO settings, or reverting configuration changes that prevent Windows from booting normally.

📚 How to Reset a Forgotten Local Admin Password in Windows

🍻Today is the 27th annual SysAdmin Day, making it the perfect time to recognize and appreciate the people who keep your infrastructure stable, secure, and running smoothly! 😎

Maintaining a secure network, keeping systems running, assisting with user issues, and putting out IT “fires” is not an easy job, so take a moment today to thank your SysAdmin and IT teams for everything they do. 🎉

Happy SysAdmin Day!

#SysAdminDay

🖨 There is no need to connect to the user's desktop to perform typical printer management tasks on Windows computers. Most of the operations can be performed remotely using PowerShell.

📱 For example, installing a new network printer in a remote PowerShell session:

🔹 Connect to the user's computer via PowerShell Remoting (WinRM):
Enter-PSSession -ComputerName Comp123

🔹 Add the printer driver package to the driver store:
pnputil.exe -i -a "\\fs01\Drivers\Kyocera\OEMsetup.inf"

🔹 Install the printer driver:
Add-PrinterDriver -Name "Kyocera Classic UniversalDriver PCL6"

🔹 Create a TCP/IP printer port for the network printer:

Add-PrinterPort -Name "IP_192.168.100.16" -PrinterHostAddress "192.168.100.16"

🔹 Create the printer:
Add-Printer -Name "Ricoh M2540" -DriverName "Kyocera Classic UniversalDriver PCL6" -PortName "IP_192.168.100.16" -Verbose

✅ How to Install, Add, Remove and Manage Printers with PowerShell

⚠️ Following the July 2026 Patch Tuesday, many administrators reported a dramatic increase in WSUS synchronization times, synchronization timeouts, and higher IIS resource utilization.
 

The root cause was Microsoft's accidental publication of a large number of test Detectoid objects into the WSUS update catalog. The resulting spike in update metadata significantly increased the time required to synchronize and process the catalog. Windows clients may also experience Windows Update errors such as 0x80244010 (WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS), 0x80244022, 0x80072EE2, HTTP 503, and other update scan failures.

 
⚙️ Microsoft has already resolved the issue on the update service side, meaning that newly deployed WSUS servers are not affected. However, any existing WSUS servers that have synchronized invalid metadata must be cleaned up manually. The complete remediation procedure is explained in KB5121986.
 
✅ Recommended remediation steps:

1️⃣ Connect to the SUSDB database using SQL Server Management Studio (SSMS).
2️⃣ Backup the WSUS database.
3️⃣ Temporarily remove the MaxXMLPerRequest limit:
UPDATE tbConfigurationC SET MaxXMLPerRequest = 0;
This removes the default 5 MB limit on the XML metadata that clients can retrieve from WSUS in a single request.
4️⃣ Execute the SQL cleanup script published in KB5121986 to remove the incorrectly published Detectoid objects.
5️⃣ Restore the original MaxXMLPerRequest value:
UPDATE tbConfigurationC SET MaxXMLPerRequest = 5242880;
6️⃣ Restart the WsusPool application pool or restart IIS (iisreset)
7️⃣ If necessary, rebuild the SUSDB indexes and run the WSUS Server Cleanup Wizard.
 
✅ Microsoft recommends performing this procedure on all WSUS servers in your environment, including upstream and downstream servers and any replicas that have synchronized the metadata.

⚙️ Following the widespread rollout of the Windows UEFI CA 2023 Secure Boot certificates, administrators have started encountering an unexpected issue on some devices.

⚠️ After the CMOS battery went flat (vacation season strikes again 🤷), a UEFI firmware update or a BIOS/UEFI reset, Windows may fail to boot on certain laptop models with the following error:

Secure Boot Violation
Invalid Signature Detected. Check Secure Boot Policy in Setup.

The issue occurs because the current Windows bootloader is signed with the Windows UEFI CA 2023 certificate, while the certificate itself is missing from the UEFI firmware's Secure Boot trusted certs database (db) after the firmware settings have been reset.

📚 In this article, we cover how to diagnose and resolve the issue:
🔹 Verify whether the Windows UEFI CA 2023 certificates are present in the Secure Boot database.
🔹 Check which certificate was used to sign the Windows bootloader (bootmgfw.efi).
🔹 Use Microsoft's official Secure Boot Recovery tool (SecureBootRecovery.efi) to install the Windows UEFI CA 2023 certificates to the Secure Boot db stored in the motherboard's UEFI NVRAM.
🔹 Learn how to prepare a bootable USB drive containing SecureBootRecovery.efi to perform an offline Secure Boot certificate update.

✅ Recovering Windows UEFI CA 2023 Secure Boot Certificates After a UEFI Reset

https://woshub.com/fix-invalid-signature-detected-check-secure-boot-policy