Windows Recovery Environment

When creating of rescue disk is impossible (information like We can't create a recovery drive on this PC. Some required files are missing):

reagentc /disable

reagentc /setreimage /path \\?\GLOBALROOT\device\harddisk0\partition1\Recovery\WindowsRE

reagentc /enable
Disk number and partition should be customized but on systems with single disk/partition it should work.

Baremetal backup Windows 10 from command line

wbadmin start backup -backuptarget:V: -allcritical -vssfull -quiet
Backup baremetal Windows 10

ADAM - LDS - how to authenticate/create accounts

Just for remember - every account created in ADAM/LDS is disabled by default. There is the dedicated attribute ms-DS-User-Account-Disabled which should be - if we want to use this account to login/authenticate - switch from default 'true' to 'false'. I spent too many hours to guess why I've got strange LDAP errors 49 with strange codes and sometime message said that is something wrong with account.

Monitoring LDAP querries

Enable Field Engineering - HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → NTDS → Diagnostics. Set '15 Field Engineering' to '5'

Event ID 1643: No. of LDAP searches.

event ID 2889: unsecure ldap bind

event ID 2887: daily unsecure ldap binds

event ID 1644: recent ldap query

event ID 1535: error from ldap server

event ID 1317: ldap timeout
HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → NTDS → Parameters
Inefficient Search Results Threshold, REG_DWORD - default 1000 - how many entries should be returned to treat is like inefficient,
Expensive Search Results Threshold, REG_DWORD - default 10000 - like inefficients
Search Time Threshold (msecs), REG_DWORD - default 30000 - how long query must take to be stored in event log as 1644 event id

How to copy transfrom rules, issuance rules between Application Groups, party trusts - ADFS

How to copy rules between relying party trusts

$rules = (Get-ADFSRelayingPartyTrust "Src Party Trust").IssuanceTransformRules

Set-ADFSRelyingPartyTrust "Dst Party Trust" -IssuanceTransformRules $rules






How to copy between application grups

$rules = (Get-ADFSApplicationGroup "src group").Applications[1].IssuanceTransformRules

Set-AdfsWebApiApplication "https://some-uri-for-dest-app" -IssuanceTransformRule $rules



But - is there any powershell cmdlet for Web Application?

wpad.dat and wspad.dat

Autoconfiguration on Windows clients with Winsock Proxy client - ISA firewall client, TMG firewall client looks for wspad.dat so if You have wpad configured in local DNS be aware that wspad.dat is required in this case.

SSLCertificateSHA1Hash by registry

I can't set from command line so the only way is through registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Value name: SSLCertificateSHA1Hash
Value type: REG_BINARY
Value data:

Thumbprint:

“SSLCertificateSHA1Hash"=hex:42,49,e1,6e,0a,f0,a0,2e,63,c4,5c,93,fd,52,ad,09,27,82,1b,01

And the reason is: missing Server Authentication in certificate template. I had template with only 1.3.6.1.4.1.311.54.1.2 without Server Authentication. When I set value by registry - value disappeared after creation.