Finally, Microsoft has released their Threats and Countermeasures guide for Windows 7 and Server 2008 R2. It is a very lengthy document going into gory details on hundreds of security settings, mostly covered by GPOs. It's a great resource for understanding WHY Microsoft recommends a certain setting, and understanding implications...
Lately I've been working on a XenDesktop 5.0 Proof of Concept with Windows 7, and I wanted to make sure Windows 7 and Office 2010 were activated immediately when a VDI VM booted up. Normally after some period of time Windows 7 and Office 2010 will activate themselves, but this...
This post will show you how to configure Windows recovery environment VMware drivers. In a previous blog post here I described how to inject VMware pvscsi and VMNET3 mass storage drivers into your Windows Server 2008 or Windows 7 image. However, that did not cover injecting the same drivers into the...
I like to perform unattended installations of my operating systems, like Windows Server 2008 R2 or Windows 7 using autounattend.xml so that requires that the image have the required drivers to recognize critical devices like mass storage hardware. One of the performance optimizations that I always include in our Windows...
Today a colleague of mine asked me if I really thought one could tell what cipher strength is used during SSL transactions. I said sure! Piece of cake if you know what to look for. Just like in the movie Matrix, if you stare at the cipher text long enough...
As a standard practice in the environment I support we use WMI filtering on GPOs to ensure a GPO only gets applied to the right operating system type. This can prevent accidents such as applying a client GPO to a server, or a GPO for Server 2003 to a Server...
Recently the project I'm supporting is looking at RMS to provide information rights management (IRM) on some documents. Windows RMS provides two means to let users protect content. First, there is the ad hoc method that lets a user specify what protections they want to put on their content, and...
While journying down the whole cipher suite road this weekend, I put together a little one liner that reconfigures the cipher suite order that Windows will try and use. As I mentioned in a previous blog, you can configure this via GPO. But, maybe you want to build in the...
After many hours of digging around the Windows registry and experimenting with various keys to enable TLS 1.2 on Windows Server 2008 R2 and Windows 7 (see my blog post here), I found this free tool that gives you one click access to configuring your Windows Cipher Suites. The Harden...
Some industries, like Government, require the use of certain cryptography algorithms. One of the great features of Windows Server 2008 R2 and Windows 7 is the support for TLS 1.2Â ciphers. TLS 1.2 ciphers support AES-256 encryption with SHA-256 hashes. Unfortunately, Microsoft did not enable these protocols out of the box....