Monitor user logons to domain

Again, thanks to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

• Configure logons auditing: Run gpedit.msc → Create a new GPO → Edit it: Go to "Computer Configuration" → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff: Audit Logon → Define → Success And Failures.
• Adjust size of security logs: Go to Event Log → Define: Maximum security log size to 4gb Retention method for security log to "Overwrite events as needed".
• Link GPO: Link the new GPO to OU with Computer Accounts: Go to "Group Policy Management" → right-click the defined OU → choose Link an Existing GPO → choose the GPO that you created.
• Apply GPO: Force the group policy update: In "Group Policy Management" right click on the defined OU → click on "Group Policy Update".
• Check Security logs: Open Event viewer and search Security log for event id’s 4648/4624 (Audit Logon). It's also possible to use powershell to dig logs.

Detect who deleted file from file server

Thanks for this tip goes to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

•  Configure File System Auditing: Navigate to the required file share, right-click it and select "Properties" Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" button: Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, subfolders and files"; Select the following "Advanced Permissions": "Delete subfolders and files" and "Delete".  
• Configure Audit Policy: Run gpedit.msc, edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings → Go to Local Policies → Audit Policy: Audit object access → Define → Success and Failures. Configure Advanced Audit Policy: Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access: Audit File System → Define → Success and Failures Audit Handle Manipulation → Define → Success and Failures.  
• Configure Event Log Size: Go to Event Log → Define: Maximum security log size to 4gb. Retention method for security log to Overwrite events as needed.  
• Check Security log: Open Event viewer and search Security log for event id 4656 with "File System" or "Removable Storage" task category and with "Accesses: DELETE" string. "Subject: Security ID" will show you who has deleted a file.

Listing all installed software in Windows

A handy trick for listing all software instlled in Windows, from PS or cmd, run:

wmic
/output:C:\InstallList.txt product get name,version

PowerShell Grep Equivalent

Select-String is a cmdlet in PowerShell that allows searching of files, piped input, objects, etc for a pattern (by default a regular expression). Some examples:

PS C:\>events = get-eventlog -logname application -newest 100
PS C:\>$events | select-string -inputobject {$_.message} -pattern "failed"

This searches for the string "failed" among the last 100 events in the Application log in Event Viewer.

PS C:\>get-childitem c:\windows\system32\*.txt -recurse | select-string -pattern "Microsoft" -casesensitive

This searches all .txt files in the \system32 folder for the case-sensitive string "Microsoft".

PS C:\>get-childitem c:\ -include *.txt -recursive | select-string -pattern "password"

Similar but searches for all .txt files on the C:\ drive.

PS C:\>select-string -path process.txt -pattern idle, svchost -notmatch

This searches the process.txt file for lines that DO NOT include "idle" or "svchost".


More on Select-String at Technet.

Rescue data from a failed Synology NAS

A great article over at Anandtech.com on rescuing data from a failed Synology NAS. Note that the NAS itself failed, the drives all appear to be in perfect working order.

Trust relationship between machine and AD failed

I've run into this problem only a couple of times and Technet has quite a few possible solutions - the one that worked for me was using Netdom.

AuthRequired for Exchange 2007 distribution groups

When creating distribution groups in Exchange 2007 'Require that all senders are authenticated' is on by default (under Properties/Mail Flow Settings/Message Delivery Restrictions) leading to 550 5.7.1 RESOLVER.RST.AuthRequired errors.

More at TechNet.