Eng. Alessandro Mazzanti: January 2022

Freeware - Blue Screen View tool #Nirsoft

Blue screen view è un’utile strumento che permette di consultare i report generati dagli errori delle BSOD (Sleep of Death), cioè le famose schermate blu di blocco tipiche dei computer Windows che compaiono quando il sistema operativo va in crash per qualche motivo.

Con l’ausilio di questo programma sarà possibile capire la natura del problema e successivamente di porvi rimedio se possibile.

BlueScreenView Nirsoft

https://www.nirsoft.net/utils/blue_screen_view.html

-------------------

Blue screen view is an useful tool that allows you to browse reports, generated by BSOD, that is O.S. windows typical screen appearing when computer crashes.

This tool will give you an aid determining root problem cause (and fix it)

BlueScreenView Nirsoft

https://www.nirsoft.net/utils/blue_screen_view.html

Security - RemotePotato0 0-Day vulnerability

There is 0-day a vulnerability that affect all Windows versions permitting to gain Domain Admin permissions.

This attack use NTLM (old authentication protocol that was substituted by Kerberos), Microsoft suggest to disable NTLM (or configure servers to block NTLM relay). For the moment no patches are available (and it is not clear if Microsoft will never release it)

Meanwhile you can create 0patch account and install their patches.

Consider that O.S./SW no longer supported could benefits 0Patch platform patches/fixes

https://blog.0patch.com/2022/01/free-micropatches-for-remotepotato0.html

[original article]

https://www.hwupgrade.it/news/sistemi-operativi/falla-0-day-remotepotato0-su-windows-cos-e-e-come-risolvere-temporaneamente_103969.html

https://www.securityinfo.it/2022/01/14/microsoft-non-si-muove-patch-ufficiosa-per-la-falla-remote-potato0

Tutorial - How to download and convert Youtube Video with VLC

If we are interested to download and convert a Youtube Video we can follow the above screenshot.

It's very fast and easy.

The original article, instead, it's at the following link:

http://download.html.it/articoli/scaricare-e-convertire-con-vlc-i-video-di-youtube-4/

VLC

Later the relative download will happen while you view the video going on the screen.

Website - Radio Frequence website and SATSAGEN Windows application that allows you to use an SDR device as a Spectrum Analyzer.

Today I would like to share this website mainly for radio-amateur

https://www.albfer.com/

On website you can find SATSAGEN software mention. Consider that it is a Windows application that allows you to use an SDR device as a Spectrum Analyzer.

SATSAGEN is provided free of charge to the HAM Radio community, with the hope that SATSAGEN can be appreciated as a useful tool for our radio experimentation.

This is a latter post about SATSAGEN version 0.5.3.4

https://www.albfer.com/en/2021/04/27/satsagen-0-5-3-4/

Here it is software overview

SATSAGEN news:

https://www.albfer.com/en/satsagen-news/

Download SATSAGEN from this link:

https://www.albfer.com/satsagen-download-page/#content

There is a latter interesting video that give you a software overview

Exchange - Recover Offline/dismounted/corrupted EDB files #HOW TO #Stellar Repair For Exchange

During previous years I worked hard on Exchange environment too.

https://www.alessandromazzanti.com/search/label/Exchange

Today I would like to mention Stellar Repair For Exchange

(Trial version here available https://cloud.stellarinfo.com/StellarRepairforExchange.exe)

Here they are products features highlights that I would like to share on this blog article:

It supports Exchange Server 2019/2016/2013/2010/2007/2003/2000, and 5.5.
Exports complete EDB file directly to live Exchange and Office 365.
Recover Offline/dismounted/corrupted EDB files.
Exchange Database Recovery
https://www.stellarinfo.com/support/kb/index.php/article/how-to-recover-corrupt-inaccessible-exchange-mailboxes
This tool is is the combination of five Exchange tools - Exchange Recovery, Mailbox Extractor, OST to PST Converter, Exchange Backup Extractor, and Password Recovery.
The 5-in-one Toolkit mounts and repairs the Exchange database and enables you to export mailboxes to PST, live Exchange, and Office 365.
https://www.stellarinfo.com/email-tools/exchange-toolkit.php
Selective Mailbox Recovery

The Exchange database recovery software provides an enhanced preview of mailboxes and its items. The selective mailbox recovery feature allows users to repair the desired mailboxes or items and save them in multiple formats. The users can select or unselect individual or multiple mailboxes and mail items as per their recovery needs.

Support Archive Mailboxes Recovery

The Exchange recovery tool also supports archive mailbox recovery. The software can repair corrupt or damaged archive mailboxes and save them to PST, MSG, EML, RTF, HTML, or PDF format. You can also export the archive mailboxes to Office 365 or live Exchange server directly.

Enhanced Mailbox Preview for Precise Recovery
Exports Recovered Contacts to CSV
Exports Recovered Files to Office 365
https://www.stellarinfo.com/support/kb/index.php/article/exchange-to-office-365-migration
Saves Recovered Exchange Mailboxes in Various Formats
https://www.stellarinfo.com/support/kb/index.php/article/save-mailboxes-msg-eml-html-rtf-pdf
Deleted Exchange Mailbox Recovery
https://www.stellarinfo.com/support/kb/index.php/article/recover-deleted-exchange-mailboxes

If you want to have a quick product tour you can review below video:

How to Repair and Restore Exchange Database - Stellar Repair for Exchange || Alternative to ESEUTIL

Specifications:

https://www.stellarinfo.com/edb-exchange-server-recovery.htm

Resources

https://www.stellarinfo.com/edb-exchange-server-recovery.htm

Reviews

https://www.stellarinfo.com/edb-exchange-server-recovery.htm

FAQ

https://www.stellarinfo.com/edb-exchange-server-recovery.htm

Scripting - Get-ADComputer - How to retrieve computer last logon date

There is an easy and quick way to get .TXT file with all AD computer names and relativse last logon dates.

You must execute Powershell module with Administrative rights.
Import-Module activedirectory
Get-Help Get-ADComputer
Get-ADComputer -Filter * -Properties * | Sort LastLogonDate | FT Name, LastLogonDate -Autosize | Out-File C:\Temp\ComputerLastLogonDate.txt

Alternative approach could be:

$DaysInactive = 90
$time = (Get-Date).Adddays(-($DaysInactive))
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Properties Name, OperatingSystem, SamAccountName, DistinguishedName
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Properties Name, OperatingSystem, SamAccountName, DistinguishedName | Export-CSV “C:\Temp\StaleComps.CSV” –NoTypeInformation

[original articles]

https://www.oxfordsbsguy.com/2014/04/28/powershell-get-adcomputer-to-retrieve-computer-last-logon-date-part-1/

https://blog.netwrix.com/2017/07/20/how-to-find-inactive-computers-in-active-directory-using-powershell/

https://www.solutionviews.com/how-to-find-active-directory-users-computers-last-logon-time/

Windows 10 - Quick assist a free Teamviewer alternative

There is an interesting built in feature inside Windows 10 that permit to receive and give remote assistance (inside and externally your organization).

This feature is named "Quick Assist" and is easily usable finding it in yours Windows 10 device (secondly you need to authenticate using your Microsoft account):

Relative usage is well explained in below articles:

https://www.thewindowsclub.com/quick-assist-windows-10

https://www.windowscentral.com/how-use-windows-10-quick-assist

In present article I would like to share how to give remote assistance and execute applications, on remote client, that needs administrative rights.

Key point is necessity to create a proper GPO (or change client gpedit.msc settings) as below.

What I suggest is to make some changes in your GPO on how the UAC presents itself but does not turn it off.

Computer Configuration/Windows Settings/Security Settings//Local Policies/Security Options

Policy	Setting
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop	Enabled
User Account Control: Switch to the secure desktop when prompting for elevation	Disabled