The Windows Error Reporting service (WER) is used to collect the debug information about system and third-party app failures and send error reports to Microsoft servers. This information should be…
The version of Active Directory in Windows Server 2016 introduces an interesting feature that allows you to temporarily add a user to an AD security group. This feature is called…
You can use RDS Drain Mode to maintain terminal hosts in a Remote Desktop Services farm. If you enable Drain Mode for your RDS server, you can prevent the server…
You can use the built-in iCACLS tool to manage NTFS permissions on Windows. The icacls.exe command line tool allows you to get or change Access Control Lists (ACLs) for files…
The Just Enough Administration (JEA) feature is available starting from PowerShell version 5.0 and allows you to delegate administrative privileges to anything you can manage with PowerShell. The main purpose…
Microsoft Security Baseline contains recommended settings Microsoft suggests for Windows workstations and servers to provide secure configuration and protect domain controllers, servers, computers, and users. Microsoft has developed reference Group…
If you are using mapped network drives, you probably noticed that they are not showing in the apps running with administrator privileges (including cmd and PowerShell). The default User Account…
The broadcast protocols NetBIOS over TCP/IP and LLMNR are used in most modern networks only for compatibility with legacy Windows versions. Both protocols are susceptible to spoofing and MITM attacks.…
Information security best practices require the computer screen to be locked when the user is inactive (idle) for a period of time. A Windows user can lock the computer screen…
When you install Internet Information Services (IIS) on Windows, an empty “Default Web Site” is created by default and listens on the standard web HTTP port – TCP 80. In…