When Watchguard EPDR will not reinstall
article #1555, updated 425 days ago

You’ve installed it and removed it, and need to reinstall, the reinstall fails. Here are items:

  • If there are files named RAVDG.TMP and/or RAVPA.TMP in %WINDIR%, the uninstall is still running. Reboot and check again.
  • Make sure folder Panda Security does not exist under %ProgramData% or %ProgramFiles(x86)%.
  • Delete everything in %TEMP%.
  • Reinstall.

Categories:      

==============

New Microsoft firewall needs
article #1553, updated 445 days ago

A new needs page has been put up. Major changes. If you have a strict firewall, try opening all of these up. IPv6 is listed within the required sections, not clear how much that is true.

learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

Categories:      

==============

Sign-in Event Log for Microsoft 365
article #1552, updated 456 days ago

A nice tool:

entra.microsoft.com/#view/Microsoft_AAD_IAM/SignInEventsV3Blade?Microsoft_AAD_IAM_legacyAADRedirect=true

Categories:      

==============

Forensic drive data extraction: free imager, cross-platform
article #1551, updated 458 days ago

Highly recommended by the indefatigable Bruce Blackman:

www.geeksforgeeks.org/how-to-create-a-forensic-image-with-ftk-imager/

Categories:      

==============

Delete User Profiles in Windows 11
article #1549, updated 463 days ago

Run this:

sysdm.cpl

Then go to the Advanced tab, and click the Settings button in the middle under User Profiles.

This works great under 10 also, but is a lot more hidden in 11.

Categories:      

==============

WIM utilities
article #1548, updated 464 days ago

See:

wimlib.net

Amazing piece of work. wimverify may be immediately useful if you are using WIMs.

Categories:      

==============

Purge/Delete Deleted Users and Mailboxes in Office 365
article #1481, updated 471 days ago

First we connect to Exchange Online via Powershell. First we install or update the MSOnline module.

#Install
Set-Executionpolicy RemoteSigned -Scope Process
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
#Update
Set-Executionpolicy RemoteSigned -Scope Process
Update-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

Then we connect:

Connect-MsolService

Now get a list of deleted users:

Get-MsolUser -ReturnDeletedUsers

And here’s how we permanently purge all of them. Do this ONLY if you are certain. There is no going back after this.

Get-MsolUser -ReturnDeletedUsers | Remove-MsolUser -RemoveFromRecycleBin -Force

Categories:      

==============

Connect Powershell to Exchange Online
article #804, updated 471 days ago

There are different methods for 365/Azure. But to get directly to Exchange Online from Powershell running on Windows, a current update of longstanding methods is as follows.

To install the module:

Set-Executionpolicy RemoteSigned -Scope Process
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

To update the module:

Set-Executionpolicy RemoteSigned -Scope Process
Update-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

To connect:

Connect-ExchangeOnline -UserPrincipalName admin@domain.com

Current reference, including methods for MacOS and Linux as well:

learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2

Categories:      

==============

A Basic Power Management Setup
article #1547, updated 473 days ago

This one is a good basic, it prevents unwanted sleep and sets other helpful parameters. Not a performance setting, not a power-paranoia setting either! It does alter the current power scheme.

# General
powercfg /change monitor-timeout-ac 0
powercfg /change monitor-timeout-dc 15
powercfg /change standby-timeout-ac 0
powercfg /change standby-timeout-dc 120
powercfg /change hibernate-timeout-ac 0
powercfg /change hibernate-timeout-dc 180
powercfg /change disk-timeout-ac 0
powercfg /change disk-timeout-dc 60

# Exposes and zeroes hidden "System unattended sleep timeout"
# which can cause problems
powercfg -attributes SUB_SLEEP 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 -ATTRIB_HIDE
powercfg -setacvalueindex scheme_current sub_sleep 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 0

# Disable hybrid sleep both AC powered and DC
powercfg -setacvalueindex scheme_current sub_sleep 94ac6d29-73ce-41a6-809f-6363ba21b47e 0
powercfg -setdcvalueindex scheme_current sub_sleep 94ac6d29-73ce-41a6-809f-6363ba21b47e 0

# Reapply current power scheme
powercfg -setactive scheme_current

Categories:      

==============

GeoIP (Geolocation) lookup of servers on the Internet
article #1545, updated 479 days ago

This one works very well:

www.iplocation.net/ip-lookup

Categories: