Microsoft EndPoint Protection - Failed to open the local machine Group Policy

Erros: 0x8007000D / 0x80004005

1. Uninstall Endpoint from Client Computer (add/remove).
2. Uninstall SCCM agent on the computer: c:\windows\ccmsetup\ccmsetup.exe /uninstall
3. Rename current registry.pol at C:\Windows\System32\GroupPolicy\Machine to registry.old
4. Install SCCM client via SCCM / \\sccmserver\sms_sma\Client\ccmsetup.exe SMSSITECODE=AAA FSP=SCCMServer
5. Let it install the agent and Endpoint and it will automatically recreate registry.pol
6. Now, Antimalware Policy should be back.

Troubleshooting Windows Defender or Endpoint Protection client

- Rename the Software Distribution folder on your computer

1. Stop the Automatic Updates service
   1. Click Start and search for services.msc, and then click OK.
   2. Right-click the Automatic Updates service, and then click Stop.
   3. Minimize the Services snap-in.
2. Rename the SoftwareDistribution directory as follows:
   1. Click Start and search for cmd, and then click OK.
   2. Type cd %windir%, and then press Enter.
   3. Type ren SoftwareDistribution SDTemp, and then press Enter.
   4. Type exit, and then press Enter.
3. Start the Automatic Updates service as follows:
   1. Maximize the Services snap-in.
   2. Right-click Automatic Updates service, and then click Start.
   3. Close the Services snap-in window.

- Reset the Microsoft antivirus update engine on your computer

1. Click Start and search for cmd, and then click OKand then right-click Command Prompt, and then select Run as administrator.
2. In the Command Prompt window, type the following commands and press Enter after each command:
   Cd\
   Cd program files\windows defender
   Mpcmdrun -RemoveDefinitions -all
   Exit
3. Restart your computer.
4. Open Windows Defender or
   Endpoint Protection, click the Update tab, and then click Update.
5. If the issue persists, proceed to the next step.

- Manually install the virus and spyware definition updates

• If you are running a 32-bit Windows operating system, download the latest updates manually at http://go.microsoft.com/fwlink/?LinkID=87342 (http://go.microsoft.com/fwlink/?LinkID=87342).
• If you are running a 64-bit Windows operating system, download the latest updates manually at http://go.microsoft.com/fwlink/?LinkID=87341 (http://go.microsoft.com/fwlink/?LinkID=87341).
• Click Run. The latest updates are manually installed on your computer.

Material completo -> https://docs.microsoft.com/en-us/sccm/protect/deploy-use/troubleshoot-endpoint-client

Zabbix UserParameter Check - SpeedTest

http://www.bernardolankheet.com.br/userparameter-utilizando-speedtest-cli-junto-ao-zabbix/

Como alterar facilmente a sub-rede do escopo de um DHCP Server.

Você precisará salvar essas informações:
- IPs excluídos
- Reserva (s)
- Opção (ões) do escopo do DHCP

Existe uma maneira fácil de fazê-lo com NETSH, execute o comando:

     netsh dhcp server \\"Server" scope "ip_of_scope" dump > c:\dhcp.txt

Edite o arquivo dhcp.txt e altere a linha:
     dhcp Server \\"Server" add scope 192.168.0.0 255.255.255.0 "Pool DHCP" ""

Salve o arquivo e quando estiver pronto, apague o escopo DHCP e executar o comando:
    netsh exec c: \ dhcp.txt

Boas Praticas após clone de VM Linux

Best Practices Linux VMWare Clonning

After you clone the VM login and...

1) rm -rf /etc/ssh/ssh_host_*
2) Edit the hostname in /etc/sysconfig/network
3) rm -rf /etc/udev/rules.d/70-*
4) Remove the HWADDR line and UUID line from /etc/sysconfig/network-scripts/ifcfg-eth* file(s). Also change the IP address in this/these files
5) If you'd like, delete all the logs from /var/log and build logs from /root

Reboot VM

Windows 2008 - Domain Controller - Blue Screen - Recovery NDTS

Windows 2008 x86, erro, tela azul, Domain Controller, Directory Services Restore Mode, event id 1003 e 1168

1. Restart the server and press F8 key, select Directory Services restore mode.
2. Log in with the local administrator username and password
3. Type: cd \windows\system32
4. Type: NTDSUTIL
5. Type: activate instance NTDS
6. Type: files
7. If you encounter an error stating that the Jet engine could not be initialized exit out of ntdsutil.
8. Type: cd\
9. Type: md backupad
10. Type: cd \windows\ntds
11. Type: copy ntds.dit c:\backupad
12. Type: cd \windows\system32
13. Type: esentutl /g c:\windows\ntds\ntds.dit
14. This will perform an integrity check, (the results indicate that the jet database is corrupt)
15. Type: esentutl /p   c:\windows\ntds\ntds.dit
16. Agree with the prompt
17. Type: cd \windows\ntds
18. Type: move *.log c:\backupad   (or just delete the log files)

This should complete the repair.  To verify that the repair has worked successfully:

1. Type: cd \windows\system32
2. Type: ntdsutil
3. Type: activate instance ntds
4. Type: files        (you should no longer get an error when you do this)
5. Type: info       (file info should now appear correctly)

One final step, now sure if it’s required:

From the NTDSUTIL command prompt:

1. Type: Semantic Database Analysis
2. Type: Go

fonte: http://distefano.biz/blog/index.php/2013/01/22/windows-server-2008domain-controller-failed-to-start/

Dell T110 - Windows 2008 x86 - PERC S300, falha no boot após falta de energia

Baixar o driver da controladora PERC - Salvar em um pen-drive

Download File

http://www.dell.com/support/home/us/en/19/Drivers/DriversDetails?driverId=WPJ2J

Boot no servidor com mídia de instalação do S.O.

Selecionar o idioma

Selecionar "Modo de reparação"

Carregar o driver da controladora PERC

Selecionar a partição de sistema e Avançar

Prompt de comando

bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
x:\sources\recovery\StartRep.exe

Limpeza manual da "ConflictAndDeleted" no DFSR

Manually Clearing the ConflictAndDeleted Folder in DFSR

http://blogs.technet.com/b/askds/archive/2008/10/06/manually-clearing-the-conflictanddeleted-folder-in-dfsr.aspx

Cisco - DHCP reservar IP

show ip dhcp binding

-> selecionar o identifier/IP a reservar e executar o clear

clear ip dhcp binding "IP"

-> criar o escopo reservas e cadastrar os IP's / identifiers


conf t

ip dhcp pool RESERVA1
 host 192.168.1.1 255.255.255.0
 client-identifier 0154.04a6.822e.0d

ip dhcp pool RESERVA2
 host 192.168.1.2 /24
 client-identifier 0148.5b39.bb26.8d

ip dhcp pool RESERVA3
 host 192.168.1.3 /24
 client-identifier 01a4.badb.06e2.78

ip dhcp pool RESERVA4
 host 192.168.1.4 /24
 client-identifier 0174.867a.fa14.92

Windows, listar arquivos com caminho absoluto baseado em data (forfiles)

forfiles /S /M *.txt /D -21/7/2015 /C "cmd /c echo @path" > c:\temp\ost.txt

Configurar Linux para captura de Wireshark de Wireless

Sequencia de comandos, executado em uma distro Fedora

#listar as interfaces
ifconfig

#down na interface wireless
ifconfig wlp3s2 down

#alterar a interface para type monitor
iw dev wlp3s2 set type monitor

#up na interface
ip link set wlp3s2 up

#ajustar o canal a ser monitorado
iw dev wlp3s2 set channel 6

#carregar o wireshark selecionar o interface a ser monitorada
wireshark

Configurar / Fortigate / USB Modem 3G

Fortigate  / USB Modem 3G

#config system modem
#set status enable

This should get the modem showing up in the GUI

#set phone1 *99#
#set extra-init1 "at+cgdcont=1,\"IP\",\"broadband.windmobile.ca\""

If modem id needs to be added:

First get the USB device ID:

#fnsysctl cat /proc/bus/usb/devices

#config system 3g-modem custom
#edit 1
#set vendor "My Phone Company"
#set model "my phone model"
#set vendor-id "ff55"
#set product-is "88aa"
#end

Enable 4G/LTE:

#config system global
-----#set usb-lte enable
#set wimax-4g-usb enable
#end

Troubleshooting:

#diagnose sys modem detect wireless
#diagnose sys modem external-modem

Outros comandos

#config system modem
#set wireless-port {ttyusb0 | ttyusb1 | ttyusb2}
#end

#config system modem
#set mode standalone
#set auto-dial enable
#set idle-timer 2
#set redial 5
#end

#diagnose sys modem query


---------------------------------

Outra forma

Firstly, ensure that your modem is firmly plugged into a USB Port on the back of the Fortigate, and that you've power-cycled the unit to detect the modem. You'll need to enable the modem with the following command:

config system modem
set status enable
end

Next, try and detect the custom vendor and product IDs with the following command. Be sure to note it down, as you'll need it later!

FortiGate # diagnose sys modem wireless-id
vendor: 0x12d1, product: 0x1003, registered: yes

Next, we'll configure the modem settings in our FortiGate to activate the modem connection:

config system modem
set status enable
set status enable
set dial-on-demand enable
set connect-timeout 30
set wireless-custom-vendor-id 0x12d1
set wireless-custom-product-id 0x1003
set modem-dev1 pcmcia-wireless
set phone1 "*99#"
set username1 "3services" # Set this to your provider's APN
set altmode disable
end 

We're almost there! The last thing to do is to turn on debugging (to watch the progress of the dial), and to actually execute the dial:

diagnose debug enable
diagnose debug application ppp 255
diagnose debug app modemd 255

execute modem dial

Once you're done, don't forget to turn off your logging:

diagnose debug application modemd 0
diagnose debug application ppp 0
diagnose debug disable

Alterar a senha do Administrador da Farm SharePoint

No servidor de aplicação:

  On the computer running the Central Administration Web site, open the command line and navigate to the
Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN folder.

At a command prompt, type the following command, and then press ENTER:
stsadm -o updatefarmcredentials -userlogin <domain\username> -password <newpassword>
NoteNote:
userlogin is the server farm account.

You must restart the Web application pool for the changes to be saved.
At a command prompt, type the following command, and then press ENTER:
iisreset /noforce

Alterar a senha dos serviços do Windows

WMI reset failed

WMI reset failed

Resolução de vários problemas, tais como não instalar o cliente SCCM e desaparecendo namespaces cluster. Geralmente redefinir o WMI é um último recurso e só deve ser utilizado quando você já tentou todas as outras opções. por exemplo reiniciar o serviço WMI, reiniciar servidor.

O comando para redefinir o repositório WMI deve ser executado em um prompt de comando elevado:

winmgmt / resetrepository

No entanto, por vezes, esta falha com este erro:

C: \ Users \ adminuser> Winmgmt / resetrepository

C:\Users\adminuser>Winmgmt /resetrepository
WMI repository reset failed
Error code:     0x8007041B
Facility:       Win32
Description:    A stop control has been sent to a service that other running services are dependent on.

Embora seja possível contornar parando os serviços dependentes manualmente ou até mesmo editar o registro para que nada seja dependente deste, existe uma solução muito mais fácil.

1. Inicie um (admin) janela do PowerShell elevado.
2. Digite o comando a seguir.
Stop-Service winmgmt -Force; winmgmt / resetrepository
3. Reinicie o computador.

Liberar e bloquear tipos de extensões de anexo no OWA - Exchange 2013

Verificar o nome da politica do OWA padrão:

Acesse o Centro de Administração do Exchange > Permissões >  Politicas do Outlook Web App

Através do powershell:

Para verificar as extensões já liberadas

Get-OwaMailboxPolicy Default | select -ExpandProperty allowedfiletypes

Para verificar as extensões bloqueadas

Get-OwaMailboxPolicy Default | select -ExpandProperty blockedfiletypes

Remover extensão da lista de bloqueados: Ex.: xml

Get-OwaMailboxPolicy Default | Set-OwaMailboxPolicy -BlockedFileTypes @{Remove = “.xml”}

Get-OwaMailboxPolicy Default | Set-OwaMailboxPolicy -BlockedMimeTypes @{Remove = “text/xml”, “application/xml”}

Adicionar na lista de extensões permitidas

Get-OwaMailboxPolicy Default | Set-OwaMailboxPolicy –AllowedFileTypes @{Add = “.xml”}

Get-OwaMailboxPolicy Default | Set-OwaMailboxPolicy -AllowedMimeTypes @{Add = “text/xml”, “application/xml”}

Referencia: http://technet.microsoft.com/en-us/library/dd297989(v=exchg.150).aspx

Comandos Exchange

Desabilitar IMAP do mailbox do usuário:
     Set-CASMailbox -Identity "usuario" -IMAPEnabled $false

Listar todos os usuários:
     Get-Mailbox | Sort database, name | Format-Table name, database

MessageTracking:
     Search-MessageTrackingReport -Identity ad\usuario.mailbox -sender "usuario.externo@contoso.com.br" -BypassDelegateChecking -DoNotResolve


     Search-MessageTrackingReport -Identity "ad\usuario.mailbox" -Sender "usuario.externo@contoso.com.br" -ByPassDelegateChecking -DoNotResolve | ForEach-Object { Get-MessageTrackingReport -Identity $_.MessageTrackingReportID -DetailLevel Verbose -BypassDelegateChecking -DoNotResolve -RecipientPathFilter "usuario.mailbox@minhaempresa.com.br" -ReportTemplate RecipientPath }

Implantar atualizações do System Center 2012 Endpoint Protection via Share UNC

Segue link referencia:

http://www.niallbrady.com/2013/02/22/how-can-i-deploy-system-center-2012-endpoint-protection-definition-updates-from-a-unc-file-shares/

YUM - Install epel and remi repositories

1. Install epel and remi repositories:
# wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
# wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
# sudo rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm

2. Enable remi repository:
# sudo vi /etc/yum.repos.d/remi.repo
In the [remi] section of the file, set the "enabled" option to 1.

Desativar Prompt's de segurança SAP GUI 7.30

32bits OS

HKEY_LOCAL_MACHINE\Software\SAP\SAPGUI Front\SAP Frontend Server\Security,

     Add 2 registry entries at the end of the install.

          DWORD key SecurityLevel with a value of 0 to deactivate

          DWORD key DefaultAction with a value of 0 to allow

64bits OS

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SAP\SAPGUI Front\SAP Frontend Server\Security

WINDOWS 7 NÃO INICIALIZA APÓS INSTALAÇÃO DE ATUALIZAÇÃO KB2823324 - 09/04/2013

Para a regularização parcial do problema, após entrar no prompt de comando do modo de reparação do windows, executem o comando.

- Na reinicialização pressione F8
- Utilizar o opção "Reparar seu computador"
- Selecione o Lay-out do teclado -> Avançar
- Informe a senha do administrador
- Escolha a opção "Prompt de comando"

Digitar o comando a seguir:

dism.exe /image:C:\ /cleanup-image /revertpendingactions

Lembrando que o C:\ pode ter outra letra dependendo de como sua instalação foi realizada, para isso acessa a unidade e confirme se o diretório do Windows se encontra na partição. ( Ex: C:\, D:\, E:\ ...)

Após a conclusão do procedimento, reinicie o computador.

Feito isso, execute novamente o update do windows mas desabilite e oculte a tualização para o seguinte update:

KB2823324 - Este é o update que esta causando todo esse problema:
Descrição do Update: http://support.micro....com/kb/2823324


Origem: http://www.babooforum.com.br/forum/index.php?/topic/766585-windows-7-não-inicia-depois-de-atualização/#ixzz2Q5CFEo7p

---------------------------

2º Opção


1 - Bootar a máquina com a mídia de instalação do windows;
2 - Entrar no console de recuperação;
3 - Abrir o notepad;
4 - Navegar até a pasta %windir%\system32\drivers e verificar se a versão do arquivo ntfs.sys que está instalada é a mesma do KB http://support.microsoft.com/kb/2823324;
5 - Se for o caso, renomear o arquivo ntfs.sys para ntfs.sys_old;
6 - Navegar até a pasta %windir%\winsxs e localizar um arquivo Ntfs.sys em uma vesão mais antiga. No meu caso era:  6.1.7601.17945;
7 - Copie o arquivo mais antigo para a pasta %windir%\system32\drivers.
8 - Reboote o sistema.