Explanation of 3GB-not-4GB RAm problem

A post at MSDN for future reference.

Add a trusted location in Windows

Because you usually want to leave UAC on in Windows, it's sometimes useful to add a trusted location:

1. Control Panel → Network and Intranet → Network and Sharing Center
2. Bottom left there is a 'See Also' section, click on 'Internet Options'.
3. Select Local intranet zone on the Security tab then click the Sites button
4. Click Advanced button
5. Enter file://[computer name]
6. Make sure 'Require server verification...' is unticked

Monitor user logons to domain

Again, thanks to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

• Configure logons auditing: Run gpedit.msc → Create a new GPO → Edit it: Go to "Computer Configuration" → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff: Audit Logon → Define → Success And Failures.
• Adjust size of security logs: Go to Event Log → Define: Maximum security log size to 4gb Retention method for security log to "Overwrite events as needed".
• Link GPO: Link the new GPO to OU with Computer Accounts: Go to "Group Policy Management" → right-click the defined OU → choose Link an Existing GPO → choose the GPO that you created.
• Apply GPO: Force the group policy update: In "Group Policy Management" right click on the defined OU → click on "Group Policy Update".
• Check Security logs: Open Event viewer and search Security log for event id’s 4648/4624 (Audit Logon). It's also possible to use powershell to dig logs.

Detect who deleted file from file server

Thanks for this tip goes to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

•  Configure File System Auditing: Navigate to the required file share, right-click it and select "Properties" Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" button: Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, subfolders and files"; Select the following "Advanced Permissions": "Delete subfolders and files" and "Delete".  
• Configure Audit Policy: Run gpedit.msc, edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings → Go to Local Policies → Audit Policy: Audit object access → Define → Success and Failures. Configure Advanced Audit Policy: Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access: Audit File System → Define → Success and Failures Audit Handle Manipulation → Define → Success and Failures.  
• Configure Event Log Size: Go to Event Log → Define: Maximum security log size to 4gb. Retention method for security log to Overwrite events as needed.  
• Check Security log: Open Event viewer and search Security log for event id 4656 with "File System" or "Removable Storage" task category and with "Accesses: DELETE" string. "Subject: Security ID" will show you who has deleted a file.

Listing all installed software in Windows

A handy trick for listing all software instlled in Windows, from PS or cmd, run:

wmic
/output:C:\InstallList.txt product get name,version

PowerShell Grep Equivalent

Select-String is a cmdlet in PowerShell that allows searching of files, piped input, objects, etc for a pattern (by default a regular expression). Some examples:

PS C:\>events = get-eventlog -logname application -newest 100
PS C:\>$events | select-string -inputobject {$_.message} -pattern "failed"

This searches for the string "failed" among the last 100 events in the Application log in Event Viewer.

PS C:\>get-childitem c:\windows\system32\*.txt -recurse | select-string -pattern "Microsoft" -casesensitive

This searches all .txt files in the \system32 folder for the case-sensitive string "Microsoft".

PS C:\>get-childitem c:\ -include *.txt -recursive | select-string -pattern "password"

Similar but searches for all .txt files on the C:\ drive.

PS C:\>select-string -path process.txt -pattern idle, svchost -notmatch

This searches the process.txt file for lines that DO NOT include "idle" or "svchost".


More on Select-String at Technet.

Rescue data from a failed Synology NAS

A great article over at Anandtech.com on rescuing data from a failed Synology NAS. Note that the NAS itself failed, the drives all appear to be in perfect working order.