Windows Server RRAS Static Filters with NAT

It is possible to use both NAT and Static Filters together on one RRAS server. even though RRAS Static Filters are stateless and NAT requires stateful firewall.

If you view the NAT Session Mappings (right-click>view Mappings) while a NAT session is active, you'll see 3 IP addresses per session: public, private, and remote.  I added both the public ip and private ip/range to a "Drop all  packets except..." Inbound Static Filter on my "public" RRAS interface(s).

Inbound static filters on "public" NAT interface(s) in RRAS "General" section:
1: Source: Any, Destination: "public" ip, 255.255.255.255 subnet (to isolate to single IP address)
2: Source: Any, Destination: "private" ip/range (10.10.10.0, 255.255.255.0 for /24 subnet for example)

This appears to allow NAT (Any > Public) and forwarding (Any > Private) to occur, and excludes other undesired routing.

Seems would be able to set the second filter as public>private, but this didn't work for me, I needed     Any>Private

How to prevent access to console session (Session 0) WITHOUT disabling Interactive Services Detection (UI0Detect)

I have a server running an interactive service.  This service's GUI can only be accessed through Microsoft's Interactive Services Detection (UI0Detect) service.  I wanted Administrators to be able to access the GUI but not by anyone in the Remote Desktop Users group.  Initially i had some Logon/Logoff and Task Scheduler scripts running to automatically stop/disable the UI0Detect service when it was not needed but this was less than elegant and not foolproof.  So I found a better way via WMI!.  This disables access to the ‘Console’ session (session 0) by members of the ‘Remote Desktop Users’ group.  Took me a bit of googling and trial/error to figure out how to compose the command properly, but it works!  The UI0Detect GUI window no longer displays on Remote Desktop User sessions.  The commands can be customized as needed!  See helpful links below  

You’d think Microsoft would have this configured as a setting somewhere in group policy or security policy but I didn’t find it!

wmic RDAccount where "TerminalName='Console' and AccountName like '%Remote Desktop Users%'" call delete

in case you want to un-do this setting, the command is:

wmic RDPermissions where "TerminalName='Console'" call AddAccount "BUILTIN\Remote Desktop Users", 1

http://serverfault.com/questions/481411/restrict-rdc-console-session-for-administrator-only-in-windows-2003-server
http://web.archive.org/web/20130616045724/http://ts.veranoest.net/ts_faq_administration.htm#console_permission
http://support.microsoft.com/kb/290720/EN-US

Run separate explorer window as Admin

This can be accomplished in 2 ways:

1. best, most reliable method, uses undocumented /separate switch, launches explorer in a separate process

runas /u:domain\username "explorer.exe /separate"

2. Per-user setting, but can be set in default user profile so that it works for all users

in an explorer window: Folder Options>View tab>Advanced Settings>Launch folder windows in a separate process.
If this setting is enabled, then the command below will work (without the /separate switch)

runas /u:domain\username explorer.exe

Change Windows 7 critical battery level

POWERCFG -SETDCVALUEINDEX a1841308-3541-4fab-bc81-f71556f20b4a e73a048d-bf27-4f12-9731-8b2076e8891f 9a66d8d7-4ff7-4ef9-b5a2-5a326ca2a469 1

POWERCFG -SETACVALUEINDEX a1841308-3541-4fab-bc81-f71556f20b4a e73a048d-bf27-4f12-9731-8b2076e8891f 9a66d8d7-4ff7-4ef9-b5a2-5a326ca2a469 1

Power Scheme GUID: a1841308-3541-4fab-bc81-f71556f20b4a (Power saver)
Subgroup GUID: e73a048d-bf27-4f12-9731-8b2076e8891f (Battery)
Power Setting GUID: 9a66d8d7-4ff7-4ef9-b5a2-5a326ca2a469 (Critical battery level)
Current DC Power Setting Index: 1 (1%)

Google Chrome prevents Windows 7 from sleep

see http://www.google.com/support/forum/p/Chrome/thread?tid=3b1d41b0663a4d40&hl=en

in a command window:
powercfg -requestsoverride PROCESS chrome.exe awaymode display system

to remove the override:
powercfg -requestsoverride PROCESS chrome.exe

source:
http://download.microsoft.com/download/7/E/7/7E7662CF-CBEA-470B-A97E-CE7CE0D98DC2/AvailabilityRequests.docx.

more far-reaching fix if you have a 'Pro' version of windows 7 - editing local group policy:
start>Run>gpedit.msc
Computer Configuration>Administrative Templates>System>Power Management>Sleep Settings>

Set
Allow Applications to Prevent Automatic Sleep (On Battery)
and
Allow Applications to Prevent Automatic Sleep (Plugged In)

to disabled.

but this applies to ALL applications, not just chrome.

File System links in Windows Vista/7

MKLINK.exe

no argument: FILE symbolic link (like a shortcut but not stored as a .lnk file)
/D: DIRECTORY symbolic link (like a shortcut but not stored as a .lnk file)
/H: FILE junction (hard link) (think of data deduplication; only one physical FILE but multiple logical locations)
/J: DIRECTORY junction (hard link) (think of data deduplication; only one physical DIRECTORY but multiple logical locations)

I've only ever used /J for directory links.

Directory Linker, a nifty GUI for creating symbolic links: http://dirlinker.codeplex.com/

NOTE: The first two methods use 'symbolic links' which may fail when used across network drive mappings. ("The symbolic link cannot be followed because its type is disabled") In this case, the fsutil utility may need to be used to enable the various symbolic link 'types': R2R, L2L, L2R, R2L.

fsutil behavior set SymlinkEvaluation L2L:1 R2R:1 L2R:1 R2L:1

"fsutil.exe" can be made to show what arguments it takes by simply running:

fsutil behavior set /?
The symbolic-link resolution behavior is set on the machine that accesses a given link, not the machine that hosts it.

The behavior codes for "fsutil.exe", namely "L2L", "L2R", "R2L", and "R2R", mean the following:

"L" stands for "Local", and "R" for "Remote" (who would've thunk?)
The FIRST "L" or "R" - before the "2" - refers to the location of the link itself (as opposed to its target) relative to the machine ACCESSING the link.
The SECOND "L" or "R" - after the "2" - refers to the location of the link's target relative to the machine where the LINK itself is located.
Thus, for instance, enabling "R2L" means that you can access links located on a remote machine that point to targets on that same remote machine.

More Info:
stackoverflow.com

Adobe Flash download URL (No Adobe DLM)

http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

Wireless Key Registry Location

Windows XP: The wireless keys are stored in the Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\[Interface Guid].

Windows Vista: The wireless keys are stored in the file system, under c:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\[Interface Guid]. The encrypted keys are stored in .xml file.

Using ShellRunas to run programs 'as different user' in Windows 7 without shift+right clicking

Download Sysinternals ShellRunas from http://technet.microsoft.com/en-us/sysinternals/cc300361.aspx, save it in C:\Windows\System32 (or %systemroot%\system32), and then prefix the 'Target' field in the application's shortcut with %systemroot%\System32\ShellRunas.exe.

Example:
%systemroot%\System32\ShellRunas.exe "C:\Program Files (x86)\testprogram\test.exe"

alternative method using the old 'runas' command:
runas.exe /user:Domain\Username "C:\Program Files (x86)\testprogram\test.exe"

you can throw /savecred when using runas to save the credentials the first time the shortcut is run, and then to launch using those saved credentials thereafter.

credit: http://social.technet.microsoft.com/Forums/en/w7itproui/thread/bb1480cf-c920-4d83-b889-4654f5713c8f

Accessing XP/Server 2003 network shares from Windows 7/Vista

The Windows 7/Vista LAN Manager Authentication Level must be changed to allow communication with the older NT/XP systems.

Start>Run>secpol.msc>Local Policies>Security Options>
set 'Network Security: LAN Manager Authentication level' to 'Sent LM & NTLM - use NTLMv2 session security if negotiated'

This can also be accomplished via the registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"LmCompatibilityLevel"=dword:00000001

Do not automatically make redirected folders available offline

gpedit.msc>User>Administrative Templates>System>Folder Redirection>Do not automatically make redirected folders available offline>On

Methods to disable Autorun and/or AutoPlay

Autorun: the execution of autorun.inf files on removable media. Windows XP allows automatic autorun.inf execution at media insertion and as the default double-click action for the media icon. Vista/7 disables automatic autorun.inf execution at media insertion, but allows autorun.inf execution as default double click action for the media icon.

AutoPlay: dialog box that presents options when mounting removable media/devices. In Vista/7, the dialog box includes an option corresponding to the autorun.inf file on the mounted media.

-Disable AutoPlay AND Autorun-
Group Policy Editor method:(available in XP/Vista/7 Professional editions and above)

XP: start>run>gpedit.msc, Computer/User Configuration\Administrative Templates\System\Turn off Autoplay, click enable, choose 'All Drives' from the combo box.

Vista/7: start>run>gpedit.msc, Computer/User Configuration\Administrative Templates\Windows Components\AutoPlay Policies\Turn off Autoplay, click enabled, choose 'All Drives' from the combo box

The above procedures set the "NoDriveTypeAutoRun" registry key, which can be manually set in the absence of Group Policy Editor (XP/Vista/7 Home/Basic editions)

Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff - xp/vista requires patch to work properly (see first link)
"NoAutorun"=dword:00000001 - vista/7 - disables autorun on device insert/connection, but double clicking device still executes autorun.inf


The following updates are required for the above method to work properly (see first link)
**To disable the Autorun functionality in Windows Vista or in Windows Server 2008, you must have security update 950582 installed (security bulletin MS08-038).

To disable the Autorun functionality in Windows XP, Windows Server 2003, or Windows 2000, you must have security update 950582, 967715, or 953252 installed.**


-Other less ideal methods-

-Disables display of the AutoPlay option that corresponds to the autorun.inf file, but allows autorun.inf execution as default double click action for the media icon-
Vista/7: start>run>gpedit.msc, Computer/User Configuration\Administrative Templates\Windows Components\AutoPlay Policies\Default behavior for AutoRun, click enabled, choose 'Do not execute any autorun commands' from the combo box

The above procedure sets the "NoAutorun" registry key (see above), which can be manually set in the absence of Group Policy Editor (XP/Vista/7 Home/Basic editions)


-Disables AutoPlay dialog on media insertion in Vista/7,but allows autorun.inf execution as default double click action for the media icon-
Control Panel\All Control Panel Items\AutoPlay, uncheck "Use AutoPlay for all media and devices"

-Disables AutoPlay dialog in XP, but does not disable autorun.inf execution on media insertion or as default double click action for the media icon-
In 'My Computer', right-click on the desired device, select 'AutoPlay' and select 'Take no Action

-Disables Autorun by way of disabling MCN (Media Change Notifications) on the optical disk drive(s) only, also known as Auto Insert Notification, can cause other issues. (see links)-
[HKLM\SYSTEM\CurrentControlSet\Services\Cdrom]
"Autorun"=dword:00000000
"AutoRunAlwaysDisable"=hex: - (see links)

-Disables parsing of autorun.inf files-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

-Disables AutoPlay notifications per drive letter-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveAutoRun"=dword: - (set by tweakui in XP, not set by group policy, see links)

-Disables "notifications for AutoPlay hardware events"-
start>run>services.msc, stop and disable the 'Shell Hardware Detection' service

Links:
http://support.microsoft.com/kb/967715
http://support.microsoft.com/kb/953252
http://www.insidetheregistry.com/regdatabase/viewvalue.aspx?valueid=172
http://technet.microsoft.com/en-us/library/cc976182.aspx
http://technet.microsoft.com/en-us/library/cc960238.aspx
http://technet.microsoft.com/en-us/library/cc959387.aspx
https://www.kb.cert.org/vuls/id/889747
http://www.us-cert.gov/cas/techalerts/TA09-020A.html
http://www.annoyances.org/exec/forum/winxp/1151603426
http://www.dslreports.com/forum/r21106365-Autorun-vs-Autoplay
http://ask-leo.com/how_do_i_really_disable_autoplay_in_windows_xp.html
http://ask-leo.com/is_autorun_really_that_evil_and_if_so_how_do_i_turn_autorun_off.html
http://www.howtogeek.com/howto/windows/disable-autoplay-of-audio-cds-and-usb-drives/

Isn't Windows frustrating?!?!

Must enable 'accept third party cookies' in firefox for GMarks to work

Must enable 'accept third party cookies' in firefox for GMarks to work

MBR and Bootsector tools

boosect.exe - configures bootsectors/BCD stores
bootrec.exe - repairs MBR/bootsectors/BCD stores

http://neosmart.net/blog/2007/bootsectexe-modifies-the-bootsector-not-the-mbr/

Bypass local CSC cache (Offline Files) when browsing network shares

Simply append the server name with $NOCSC$: \\servername$NOCSC$\share\folder

Enable X-Mouse in Win 7

from:
http://www.jan-olof-lindqvist.se/windows7_and_vista/windows-7-and-vista-mouse-focus-on-window-without-raising-the-window/
and
http://www.sevenforums.com/general-discussion/9000-how-mouse-hover-makes-window-active.html


Start regedit and go to:
[HKEY_CURRENT_USER\Control Panel\Desktop]
For full X-Mouse, add +41h to the first number stored in binary key “UserPreferencesMask”.
If you only want “focus follows mouse,” add +1h.

For example, the value for my registry hex key was “9E 3E 07 80 12 00 00 00″
I edited it to “9F 3E 07 80 12 00 00 00″ to get “focus follows mouse”
If I had wanted full X-Mouse, I’d have edited it to “D9 3E 07 80 12 00 00 00″

You can use the built in windows calculator if you like. In my case I would use 9E + 1 = 9F. Picture shows windows 7 calculator with programmer mode.

More from Hunter:

The "UserPreferencesMask" key value changes based on what 'Visual Effects' settings are selected in 'Performance Options' (System Properties>Advanced>Performance>Settings)

"ActiveWndTrkTimeout" controls the delay between cursor-hover-over and window activation, though it seems the default Win 7 key is "ActiveWndTrackTimeout" (Track instead of Trk) and thus changing this key's value has no effect. Rename the key to "ActiveWndTrkTimeout" to make it stick.

Disable Remote UAC via Security Policy

Windows 7 / Server 2008 R2 restrict local admin account permissions --when accessed both locally and remotely-- via the UAC mechanism, requiring elevation to gain true admin permissions. This means a person attempting to remotely access administrative shares (ADMIN$, IPC$, C$, etc) will be denied access even if they are using valid administrator credentials, because the local admin account token has been 'filtered' of its admin permissions.

Microsoft offers a registry tweak to 'fix' this: http://support.microsoft.com/kb/951016, but I don't like registry tweaks. I think this setting should be included in Windows' Security Policy, so here's how to make that happen.

first make a backup copy of %SYSTEMROOT%\inf\sceregvl.inf

edit %SYSTEMROOT%\inf\sceregvl.inf as follows:

under [Register Registry Values], add:

MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy,4,%LocalAccountTokenFilterPolicy%,0

and under [Strings] add:

LocalAccountTokenFilterPolicy = User Account Control: Disable Remote UAC

Save

Start>Run: cmd /c regsvr32 scecli.dll

DONE! - a new option 'User Account Control: Disable Remote UAC' will be available in Security Settings\Local Policies\Security Options

Note: May need to change the owner of sceregvl.inf and grant yourself full control, but be sure to set owner back to what it was (NT SYSTEM\TrustedInstaller in my case)

PureText - Paste only the text, and nothing but the text

I finally got fed up with the Windows clipboard's penchant for pasting rich-formatted/HTML text instead of JUST THE TEXT! In fact, I have never had a use for the 'feature', I always paste the rich formatted text into notepad, then Ctrl-A, Ctrl-C, and then open the destination program and Ctrl-V. This is a ridiculous amount of effort just to paste TEXT ONLY.

Enter PureText - http://www.stevemiller.net/puretext/

Problem solved!

the Official Excel Merge and Center Keyboard Shortcut

the Official Excel Merge and Center (Centre) Keyboard Shorcut

Alt+M.

(it really works, the text of the 'Merge and Center' button on the excel toolbar must be showing)

excerpted from http://www.1-on-1.biz/MicrosoftOffice/MicrosoftExcel/mergeandcentershortcut.asp

The shortcut for Merge and Centre is in fact [Alt] + [M] however it does not actually work when only the Merge and Centre shortcut button is shown on the screen.

It does work when you have the Image and Text showing on the screen as shown to the right .

When both the Image and Text are showing you can actually then use the Merge and Centre Shortcut [Alt] + [M] to merge and centre your Microsoft Excel Cells.

To customise your Formatting Toolbar so that you can see both the Image and the text of the Merge and Center Shortcut, first choose the Tools menu and then choose Customize from the drop down menu. In the Customize dialog box choose the Commands tab.
Now select the Rearrange commands button below the Categories and Commands List box.

In the Rearrange Commands dialog box, first choose from the Toolbar drop down box the Formatting toolbar option and then in the Controls list box Merge and Center.
The next step is to choose the Modify Selection button on the right hand side and the shortcut shown will be visible. The Default Style option will be chosen but you want to choose Image and Text. Once you have done that, press the Close button and then press Close for a second time.
If you now select a group of cells in your spreadsheet and go [Alt] + [M] you will then be able to Merge and Centre using a Merge and Center shortcut keystroke.