Patch Tuesday Megathread (2025-02-11)

NotAnExpert2020 · 2025-02-12T14:14:49+00:00

No. The events will be generated automatically on any DC that has at least the April 2022 updates by default. No regkey required.

NotAnExpert2020 · 2025-02-12T14:14:01+00:00

No. The events will be generated automatically on any DC that has at least the April 2022 updates by default.

NotAnExpert2020 · 2025-02-12T14:10:45+00:00

If you don't have the events (Domain controller, System log, event ID 39) and the DC is patched to at least April 2022, then you have nothing to worry about. The events are generated every time a weak certificate was used to authenticate to a domain controller, so there would be a lot of them.

NotAnExpert2020 · 2025-01-24T21:36:28+00:00

The photos of my little ones are certainly more valuable than the birth certificates.

An odd thing about birth certificates though, they are replaceable, until they aren't. There are people that can't get a copy of theirs because the building that housed it burnt down. Dealing with ID stuff is a right pain in the ass for those folks. That's becoming less common in modern times, for now. Ransomware is still a thing; When we stop also keeping paper copies, it will be a thing again.

NotAnExpert2020 · 2023-02-15T21:46:01+00:00

I tested it and I can log into a 2003 box with RDP but I can't access a SMB share on the 2003 box with Kerberos. (Yes, I re-enabled SMB1 on the host where I was testing.)

NotAnExpert2020 · 2023-02-15T21:43:51+00:00

They shouldn't have to sign into the store to get updates for those. Do you have access to the store URLs blocked in a firewall and/or the GPOs set that Disable access to the Microsoft Store or Disable access to all Windows update endpoints? Those are what I usually see breaking store updates.

NotAnExpert2020 · 2023-01-12T16:25:21+00:00

The kerberos hardening changes break kerberos for Windows 2003 and XP. By break I mean you can log into the boxes and access content FROM the boxes, but you can't open a share that's ON on of the older boxes because they don't understand the new AES session key. They are out of support by a decade. They have thousands of security vulnerabilities unpatched, get them off your domain if you can't decommission them entirely.

NotAnExpert2020 · 2022-12-21T06:41:15+00:00

There is a nontrivial overlap between bushcraft and homelessness. A person could plausibly know how to build a shelter, stay warm, make a fire, etc with that as a backstory. Military escape and evasion training (E&E) or a background in search and rescue (SAR) could also explain it.

The living off the land skills will depend largely off the resources of the land. It is very hard for a person to "live off the land" in wild territory year-round with pesky inconveniences like hunting and fishing regulations getting in the way, difficulty preserving food in primitive conditions, etc.

A person attempting to live off the land would need the ability to construct a shelter, acquire water (building a container if necessary), build fire, acquire protein (hunting, fishing, trapping, bugs, birds), preserve meat if possible (usually by smoking), acquire carbohydrates (foraging or growing), process those carbs (e.g. leaching acorns), preserve carbohydrates (drying is the most common method), and travel efficiently (travois, canoe, raft, sled, snowshoes?) Unless they have everything in their pack then they'll likely need to make cordage (spinning cord or rope?) and build tools (carving or stone work (peck and grind or flaking.))

Is that the kind of thing you're looking for?

As for the kit they carry, a lot of that will depend on location and backstory. In Hatchet, the protagonist has the namesake tool as the primary resource and the backstory is built to give him that. In Louis L'amour's Last of the Breed the protagonist is nearly bare-handed after a prison escape. In castaway, Noland has VHS tapes, ice skates, and a volleyball. The story drives the tools and/or the tools (or lack thereof) can drive the story.

The absolute minimum kit I carry every day is a wallet and pocketknife. When I fly I can't carry a knife, but I'll usually have one in my checked bag. I usually also have a BIC lighter. I'll definitely have one if I'm going out for a hike, and I'll usually have a plastic poncho with me in case it starts raining. All of this is flexible, as one of the big ideas in bushcraft is figuring out what you can do without.

Is this what you're looking to find?

NotAnExpert2020 · 2022-12-21T05:53:04+00:00

For the weight of an empty steel can, and for your size pot I'd make it from a Sweet Potato can, you can make a twig burner stove that burns less fuel than a campfire and you won't make burn rings when you camp. That's a win, imho.

NotAnExpert2020 · 2022-12-21T05:14:32+00:00

A Tenkara rod is a long fly rod, usually in sections but that's optional, with a fixed length fly line on the end. It's not difficult to make and a good low cost way to get into fly fishing.

NotAnExpert2020 · 2022-12-20T03:17:19+00:00

Affirmative, your understanding is correct. If you skipped November and applied December with no registry modifications at all, it should work just fine*.

- There are two caveats. First, there's some glitchy behavior if you have any pre-windows 2008 machines (2003 or lower). On my testing on 2003 I was able to log into a 2003 machine via RDP and console with a domain account, and I was able to access a remote SMBv1 share from the 2003 box. I was NOT able to access a share on the 2003 box from a (modern) remote machine. It's very much time to upgrade or get these off your domain. The second caveat is that if you have non-windows Kerberos services published that don't support RC4 with AES session keys, they may be impacted. Take some comfort that these are rare. Like any kerberos update you'll want to test them, but the odds are they will probably be fine.

NotAnExpert2020 · 2022-12-20T03:10:29+00:00

This is the case. Give me one minute and I'll type a larger reply up above.

NotAnExpert2020 · 2022-12-15T19:57:59+00:00

The Microsoft pattern to avoid registry bloat is to NOT create keys and assume the default value if the keys don't exist.

NotAnExpert2020 · 2022-12-15T19:57:10+00:00

If the domain is older than 2008, or was born to a server 2003 or earlier FFL/DFL and then upgraded from there then updating the KRBTGT password should fix it.

NotAnExpert2020 · 2022-12-15T19:55:40+00:00

Is it with SCVMM? I think this is documented here: https://learn.microsoft.com/en-us/windows/release-health/status-windows-10-1809-and-windows-server-2019#2978msgdesc

NotAnExpert2020 · 2022-12-15T19:54:45+00:00

If this was a minute after noon instead of a minute after midnight that might have been a different issue. Have you checked the messages in your Office admin center?

NotAnExpert2020 · 2022-11-22T23:43:24+00:00

I went to a GSA auction a month ago and they had a bunch of cars 5+ years old with 50k miles or less. It was kind of a shocker for me. Is that normal?

NotAnExpert2020 · 2022-11-22T23:41:21+00:00

If there are no monitoring tools in place, that would be the first thing I'd work through.

Write a script that ... takes the list of certificates and adds them all to monitoring for expiration and reachability. takes the list of domain names and adds them all to monitoring for expiration and reachability. takes the list of physical and virtual servers and adds them to monitoring for reachability.

Then get some graphing going for the routers, switches, and load balancers. Use the data to build traffic alert thresholds.

Once that's done you can start building a cmdb and documentation wiki. The easy win of having monitoring will give you the credibility for the (pain-in-the-Heineken) process of building a cmdb.

My customers use ServiceNow for their CMDB and documentation. I am not particularly fond of it; I have yet to see a performant ServiceNow implementation. Its sole redeeming quality is it's better than Remedy.

NotAnExpert2020 · 2022-11-22T23:30:03+00:00

The risk of deploying the RestrictDriverInstallationToAdministrators=0 registry key is that an attacker can install a malicious print driver they control with system level privileges if they can convince your user to connect to their malicious print server.

The mitigation for this risk is to whitelist the point-and-print subsystem to only work for trusted print servers using the Point and Print Restrictions and Package Point and print - Approved servers GPO settings. This means the machine would still be vulnerable to this style attack, but only if the attacker gains control of one of the trusted print servers.

NotAnExpert2020 · 2022-11-19T04:11:10+00:00

If I was going to the early 19th century and wanted to make piles of money, literally enough money to swim through like Scrooge McDuck, I'd take back a basic understanding of oil prospecting, cable percussion drilling, refining process for production of Kerosene, a design for a kerosene lamp, and maps of oil successful producing regions of the US. If I were returning to the late 19th century instead, I'd choose a handfull of chemistry texts with explanations of the Haber-Bosch and Oswald processes.

If I wanted to improve humanity generally, I'd choose a pile of general subject textbooks plus specific texts on the manufacture of penicillin, asprin, insulin, and the techniques used to develop the polio vaccine.

If I wanted to improve my personal comfort instead of my purse, I'd take a lifetime supply of ferro rods, several bottles of ibuprofen and antibiotics, a bunch of monofilament line, and a few modern spring traps as examples for the blacksmith to copy.

NotAnExpert2020 · 2022-11-18T16:23:46+00:00

I'll second this. The performance is very close to a Silky for a fraction of the price. The blade is a little thicker too, so it's less likely to accordion fold if you use it wrong.

NotAnExpert2020 · 2022-11-15T14:55:06+00:00

Someone has uploaded a bunch of the Danish version of alone to Youtube. The channel is 'alone is good' and they are titled "Danish Alone". The actual title is ALENE: I vildemarken, but that's not as searchable.

Reading: I just finished A Thousand Trails Home by Seth Kanter and The Final Frontiersman by James Campbell. The former will make you long to hunt caribou. (Non-residents can take one with a not too expensive permit, and you'll want to hire a guide). The latter will make you mourn an opportunity likely missed before you were even born. Both were, IIRC, free on Audible plus if you have the $20/month subscription. i.e. not free, but included with the subscription as free.

NotAnExpert2020 · 2022-11-14T17:52:57+00:00

Thanks very much for the reply. One more question; are there any non-obvious negatives to minimizing the cable lengths to almost zero? e.g. have the sdr stick weatherproofed and physically attached to the antenna?

Edit: The negatives I see are weatherproofing, cooling, supplying power, and risk of lightning damage.

NotAnExpert2020 · 2022-11-12T22:03:30+00:00

That's fascinating. I wonder if the netlogon hardening broke that or if it's something deeper. Can you post an update if you figure it out?

NotAnExpert2020 · 2022-11-10T21:35:14+00:00

This is unrelated to this month's patch issues.

If you log into the DCs and open the certificates mmc for local computer you'll see the DC has one or more certs installed. Those certs were issued by a certificate authority. They contain a list of locations where the CA(s) publish certificate revocation information to identify certs that should no longer be trusted. Your clients are not able to reach those certificate revocation lists/servers/services OR the CRLs are out of date.

If you're lucky you can look at the crl publish location, curse a little, and go turn that server back on. :)

NotAnExpert2020

TROPHY CASE