Windows tips, howtos, scripts
Hi,
by default Bitlocker could only activated when a TPM chip is physically present.
If you want to use Bitlocker without a TPM module you must change your (local) policy. Open the Group Policy Object Editor (gpedit.msc), navigate to
Continue reading Windows: Enable Bitlocker without a TPM module
Hi,
here are the code snippets to list all members of an Active Directory Group.
Some constants
# Define LDAP search root, the Global catalog of the domain $sLDAPSearchRoot="LDAP://yourDomain.com:3268" # The Groupname to looking for $sGroupName="USR_GRP_IN_AD"
Continue reading Powershell: List members of an Active Directory Group
Hi,
if you want to list all Users which are currently logged on to the box use the query command.
List all sessions
c:\> query session
SESSIONNAME USERNAME ID STATE TYPE DEVICE
services 0 Disc
console 1 Conn
>rdp-tcp#0 user1 2 Active rdpwd
rdp-tcp 65536 Listen
Or list all users
c:\> query user
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
>user1 rdp-tcp#0 2 Active . 21.02.2015 19:42
You can also list the processes of the user
c:\> query process
USERNAME SESSIONNAME ID PID IMAGE
>user1 rdp-tcp#0 2 6076 taskhost.exe
>user1 rdp-tcp#0 2 6592 rdpclip.exe
>user1 rdp-tcp#0 2 4840 dwm.exe
>user1 rdp-tcp#0 2 4680 explorer.exe
>user1 rdp-tcp#0 2 7092 vmtoolsd.exe
....
Michael
Hi,
for deeper inspection of Windows it is sometimes necessary to get a memory dump of the machine to analyse these output with tools like volatility .
There are several ways to provoke windows to write a dump.
Continue reading Windows: Initate a kernel memory dump
Hi,
in WinPE it is possible to read bitlocker encrypted drives.
Check state
manage-bde -status c:
If the drive is only protected by a password use
manage-bde -unlock c: -pw
Continue reading Windows: Read Bitlocker encrypted drive in Windows PE