Lately I had a lot of problems with TLS 1.0 standards, which have changed. For a lot of secure applications you have to disable TLS 1.0, if you want the connection to work.
Well, set settings for any user it makes no sense and the only acceptable way it is thru GPO settings. There is no real setting for change-enabled protocol (you have to do it in Internet Explorer settings). The only way I found was changing the registry value of SecuredProtocol, located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings.
But here is only a numerical value and I had to find how is it calculated. I found some values in an article and from here you can calculate the desired value. The basic numbers are:
0 = Do not use secure protocols
2 = PCT 1.0
8 = SSL 2.0
32 = SSL 3.0
128 = TLS 1.0
512 = TLS 1.1
2048 = TLS 1.2
If you want to enable more protocols, just sum the desired numbers. For example, to enable TLS 1.1, TLS 1.2 and SSL 3.0 is 512 + 2048 + 32 = 2592. This is a decimal value for a registry key SecuredProtocol. Deploy a registry value true GPO and the setting is done.
On January 4th, Intel processor vulnerability was published. It is a vulnerability that affects not only Microsoft systems, but also all other systems, including iOS, Android, Linux etc.
I won’t spend the same words as you can read them in many published articles about the vulnerability and how serious it is. I just want to share two links, where is it possible to find tools / patches for Microsoft systems:
https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution (PowerShell must be 5.1 or higher)
Some of my customers and friends had a problem: after installing KB4041676, VMs on Server 2016 didn’t boot. The problem is in update – Microsoft releases the update with a mistake and correct this update immediately the same afternoon, but in some cases the old update remained in cache on devices or WSUS servers. To be sure, that you have the right update, check this link and retrieve the right delta update.
What if you are already there and your VM is not booting?
To solve the issue, follow this steps:
- Start the VM from the media (DVD, ISO…)
- At the installation menu, select Repair computer and in Advanced options select Command prompt
- In command prompt, you have to execute this commands:
- reg load hklm\temp c:\windows\system32\config\software
- reg delete “HKLM\temp\Microsoft\Windows\CurrentVersion\Component Based Servicing\SessionsPending” /v Exclusive
- reg unload HKLM\temp
- After correcting the registry, we still need to remove the update with commands:
- Use dism /image:c:\ /get-packages to list all installed packages to check if the package is really installed
- When you find the package, you can uninstall with command: dism /image:c:\ /remove-package /packagename:packageidentity /scratchdir:c:\temp (package identity is an identity reported in output from previous command)
- Reboot the server
Hope it is helpful.
Well as I know many users are trying to find Windows key with some key viewer software. Nothing wrong, but this software is not always “nice” and can do something else than just show you a key. Of course, with Windows 8.1 and Windows 10 you have many times a key in BIOS, so there is no need to search for it.
Anyway, if you feel better when you have a key printed on a piece of paper, you can do that simply with one PowerShell cmdlet:
Get-WmiObject -query ‘select * from SoftwareLicensingService’
This will show you more than only a key. There are a lot of information on licensing, like KMS server, OS version, … In some cases it can be useful.
I recently bought Minix Z83 mini PC and the first think I did was to upgrade it to the latest version of OS. Unfortunately, I received immediately an upgrade error with a code 0xc1900200. This means that UEFI partition on the disk is too small. It should be at least 350MB, but deployed size is 64MB.
Well, no problem, you have just to resize the partition and this is very simple. I use a tool named EaseUS Partition Master, which gave me very good results everywhere. But there was a second disappointment: I was not able to move or resize the partition “Other” with size 16MB and in Minix forums there is no explanation what this partition is used for or if I can delete it.
I did some research what to do with current file system, why we have an additional partition and finding some answers I decided to delete this 16MB partition.
So, my steps to solve the problem were:
- Install and start EaseUS Partition Master
- Resize the system partition (C:) in a way to reduce size for 270MB and apply free space in a front of partition
- Restart the computer (EaseUS needs to restart a computer to apply changes on system partition)
- Start EaesUS Partition Master again
- Delete the partition with the size 16MB
- Resize UEFI partition to 350MB
- Apply all changes (You can see the final situation on the image)
- Close EaseUS Partition Master and restart the computer
- Update Windows with Windows 10 Upgrade Assistant.
This step will guarantee you to upgrade your OS to the latest version and avoid problems in the future. The steps are valid also for other systems and other configurations, but be careful when you have more than only needed partitions. Any additional partition is there for some reason and is better to find why before you remove or resize it.