passwordreq

先前於公司建立Windows Server 2008 AD in VM

要建立AD時系統告訴我要強制使用Administrator的密碼

因此必須於command line 使用下列指令才有辦法繼續裝domain

net user Administrator  /passwordreq:yes

特此留底紀錄

AutoIT 自行定義程式

Ctrl + F7 (Must install full version with AutoIt Script Editor (SciTE4AutoIt3))

#AutoIt3Wrapper_Res_Comment=Your comment here
#AutoIt3Wrapper_Res_Description=Your description here
#AutoIt3Wrapper_Res_Fileversion=1.2.3.4
#AutoIt3Wrapper_Res_LegalCopyright=Copyright © 2009 author
#AutoIt3Wrapper_Res_Field=Made By|author
#AutoIt3Wrapper_Res_Field=Email|some@email.com
#AutoIt3Wrapper_Res_Field=AutoIt Version|%AutoItVer%
#AutoIt3Wrapper_Res_Field=Compile Date|%date% %time%

新增移除程式 點選 新增/移除元件出現 msgrocm.dll & 0x7e 錯誤

前往 C:\WINDOWS\ServicePackFiles\i386

將這三份檔案複製 msgrocm.dll, ocmsn.dll, msnmsn.inf

複製於以下路徑 C:\WINDOWS\SYSTEM32

微軟作業系統 取消開機登入的方式

請修改電腦註冊碼，請前往以下路徑

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\DefaultUserName

1. 欲修正自動登入請修正下列機碼數值

AutoAdminlogin=0

2. 欲修正記憶的帳號請修正下列機碼數值

DefaultUserName

Windows Login Type

Windows Logon Type

工作需要 總是會要記一堆東西...

Logon type 2 Interactive 本地登錄。最常見的登錄方式。
Logon type 3 Network 網絡登錄- 最常見的是訪問網絡共享文件夾或打印機。 IIS的認證也是Type 3
Logon type 4 Batch 計劃任務
Logon Type 5 Service 服務
某些服務是用一個域帳號來運行的，出現Failure常見的情況是管理員更改了域帳號密碼，但是忘記重設Service中的帳號密碼。
Logon Type 7 Unlock 解除屏幕鎖定
很多公司都有這樣的安全設置：當用戶離開屏幕一段時間後，屏保程序會鎖定計算機屏幕。解開屏幕鎖定需要鍵入用戶名和密碼。此時產生的日誌類型就是Type 7
Logon Type 8 NetworkCleartext 網絡明文登錄-- 通常發生在IIS 的ASP登錄。不推薦
Logon Type 9 NewCredentials 新身份登錄-- 通常發生在RunAS方式運行某程序時的登錄驗證。
Logon Type 10 RemoteInteractive 遠程登錄-- 比如Terminal service或者RDP方式。但是Windows 2000是沒有Type10的，用Type 2。 WindowsXP/2003起有Type 10
Logon Type 11 CachedInteractive 緩存登錄
為方便筆記本電腦用戶，Windows會緩存前10次成功登錄的登錄。

以上是簡字翻成繁體我快昏倒..還好有找到以下原文

附原文：
The logon/logoff category of the Windows security log gives you the ability to monitor all attempts to access the local computer. In this article I’ll examine each logon type in greater detail and show you how some other fields in Logon/Logoff events can be helpful for understanding the nature of a given logon attempt.

Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff and all the other events in this category identify different reasons for a logon failure. However, just knowing about a successful or failed logon attempt doesn’t fill in the whole picture. Because of all the services Windows offers, there are many different ways you can logon to a computer such as interactively at the computer’s local keyboard and screen, over the network through a drive mapping or through terminal services (aka remote desktop) or through IIS. Thankfully, logon/logoff events specify the Logon Type code which reveals the type of logon that prompted the event.

Logon Type 2 – Interactive
This is what occurs to you first when you think of logons, that is, a logon at the console of a computer. You’ll see type 2 logons when a user attempts to log on at the local keyboard and screen whether with a domain account or a local account from the computer’s local SAM. To tell the difference between an attempt to logon with a local or domain account look for the domain or computer name preceding the user name in the event’s description. Don’t forget that logon’s through an KVM over IP component or a server’s proprietary “lights-out” remote KVM feature are still interactive logons from the standpoint of Windows and will be logged as such.

Logon Type 3 – Network
Windows logs logon type 3 in most cases when you access a computer from elsewhere on the network. One of the most common sources of logon events with logon type 3 is connections to shared folders or printers. But other over-the-network logons are classed as logon type 3 as well such as most logons to IIS. (The exception is basic authentication which is explained in Logon Type 8 below.)

Logon Type 4 – Batch
When Windows executes a scheduled task, the Scheduled Task service first creates a new logon session for the task so that it can run under the authority of the user account specified when the task was created. When this logon attempt occurs, Windows logs it as logon type 4. Other job scheduling systems, depending on their design, may also generate logon events with logon type 4 when starting jobs. Logon type 4 events are usually just innocent scheduled tasks startups but a malicious user could try to subvert security by trying to guess the password of an account through scheduled tasks. Such attempts would generate a logon failure event where logon type is 4. But logon failures associated with scheduled tasks can also result from an administrator entering the wrong password for the account at the time of task creation or from the password of an account being changed without modifying the scheduled task to use the new password.

Logon Type 5 – Service
Similar to Scheduled Tasks, each service is configured to run as a specified user account. When a service starts, Windows first creates a logon session for the specified user account which results in a Logon/Logoff event with logon type 5. Failed logon events with logon type 5 usually indicate the password of an account has been changed without updating the service but there’s always the possibility of malicious users at work too. However this is less likely because creating a new service or editing an existing service by default requires membership in Administrators or Server Operators and such a user, if malicious, will likely already have enough authority to perpetrate his desired goal.

Logon Type 7 – Unlock
Hopefully the workstations on your network automatically start a password protected screen saver when a user leaves their computer so that unattended workstations are protected from malicious use. When a user returns to their workstation and unlocks the console, Windows treats this as a logon and logs the appropriate Logon/Logoff event but in this case the logon type will be 7 – identifying the event as a workstation unlock attempt. Failed logons with logon type 7 indicate either a user entering the wrong password or a malicious user trying to unlock the computer by guessing the password.

Logon Type 8 – NetworkCleartext
This logon type indicates a network logon like logon type 3 but where the password was sent over the network in the clear text. Windows server doesn’t allow connection to shared file or printers with clear text authentication. The only situation I’m aware of are logons from within an ASP script using the ADVAPI or when a user logs on to IIS using IIS’s basic authentication mode. In both cases the logon process in the event’s description will list advapi. Basic authentication is only dangerous if it isn’t wrapped inside an SSL session (i.e. https). As far as logons generated by an ASP, script remember that embedding passwords in source code is a bad practice for maintenance purposes as well as the risk that someone malicious will view the source code and thereby gain the password.

Logon Type 9 – NewCredentials
If you use the RunAs command to start a program under a different user account and specify the /netonly switch, Windows records a logon/logoff event with logon type 9. When you start a program with RunAs using /netonly, the program executes on your local computer as the user you are currently logged on as but for any connections to other computers on the network, Windows connects you to those computers using the account specified on the RunAs command. Without /netonly Windows runs the program on the local computer and on the network as the specified user and records the logon event with logon type 2.

Logon Type 10 – RemoteInteractive
When you access a computer through Terminal Services, Remote Desktop or Remote Assistance windows logs the logon attempt with logon type 10 which makes it easy to distinguish true console logons from a remote desktop session. Note however that prior to XP, Windows 2000 doesn’t use logon type 10 and terminal services logons are reported as logon type 2.

Logon Type 11 – CachedInteractive
Windows supports a feature called Cached Logons which facilitate mobile users. When you are not connected to the your organization’s network and attempt to logon to your laptop with a domain account there’s no domain controller available to the laptop with which to verify your identity. To solve this problem, Windows caches a hash of the credentials of the last 10 interactive domain logons. Later when no domain controller is available, Windows uses these hashes to verify your identity when you attempt to logon with a domain account.

Conclusion
I hope this discussion of logon types and their meanings helps you as you keep watch on your Windows network and try to piece together the different ways users are accessing your computers. Paying attention to logon type is important because different logon types can affect how you interpret logon events from a security perspective. For instance a failed network logon on a server might now be surprising since users must access servers over the network all the time. But a failed network logon attempt in a workstation security log is different. Why is anyone trying to access someone else’s workstation from over the network? As you can see, it pays to understand the security log.

Windows Live Messenger 2009 Service Port

http://support.microsoft.com/kb/960820

Teamviewer Block

今日閒來無事，抓了一下 Teamviewer 此套好用工具的網路封包。

因此將此軟體服務 Port 加入防火牆鎖定。

其 Port 為 TCP 5938 將此加入防火牆阻擋清單即可。

一開始原本是想要利用 IP 的方式阻擋，但是檔了一個軟體換跳一個。一整個被耍...

我們公司又沒有採買 App Filter 所以由軟體執行 Port 去做阻擋就對啦。

小弟公司最近有小朋友要遠端回來的需求，因此利用此鎖定加上防火牆 Schedule 即可。

會用這套是因為...傻瓜也會用 就不用再次做教育訓練的必要 XD

帳號權限變更後導致軟體無法使用之處理辦法

當某台電腦安裝各軟體時裡用 administrators 權限

當主機回收或者是要縮減權限時，會導致權限問題讓有些軟體無法使用或者是出錯

處理方式如下

開始 \ 執行 \ regedit \ HKEY_LOCAL_MACHINE \ SOFTWARE

找尋需要使用的軟體名稱資料夾，點選滑鼠右鍵設定其「使用權限」

如何刪除 執行 or IE 中曾經輸入被記憶的文字？

「開始」上按右鍵 \ 「內容」 \ 「自訂」，切換到「進階」頁，按「清除清單」即可 

若是傳統開始功能表，按「自訂」後，按「清除」即可

如果是 IE 的話更簡單

工具 \「網際網路選項」 \ 「一般」 \ 「刪除」 \ 「全部刪除」 (IE 7.0) 即可

Windows Live Message 關於勾選記憶密碼一事

最近Msn 病毒又開始猖獗起來

有些人會和我說

為什麼已經修改了密碼，還是會傳奇奇怪怪的網址給清單上的人

這是一定的

1. 您中MSN的病毒並沒有完全清除掉

2. 您就算改了密碼有時候還並沒有用

當然大多數的人都是第一項

第一項我想就要對症下藥依網路上提供的方式處理您自身的電腦

才算真正完全的處理好

為什麼我會說其二點呢？

因為Windows Message 為了要方便使用者...方便過頭了

當您在使用Msn勾選記憶密碼後

當您的Msn已經勾選記憶密碼，Msn Server會告訴您的電腦，此勾選密碼是我所允許的

而允許所產生的檔案就會在您的電腦內

下次您執行Msn，軟體其實已經不會去確認密碼是否正確或是錯誤

而是信賴此次的連線，也就是去Call那份檔案

當您勾選記憶我的密碼 這是非常危險的事情

假設您的電腦不幸中了木馬，而您的Msn密碼就這樣傳遞出去

另外的電腦也勾選了記憶密碼

您可能會在偶然的時候發現的您的Msn有另外的電腦登入

常人應該是將不是您所登入的位置踢離線，然後前往Msn網站變更自身的密碼

重點來了

如果另一台電腦依然勾選記憶您的密碼

他 還 是 可 以 登 入 的

您的Msn密碼換句話說就是

有 改 等 於 沒 改

不信邪？

自己試看看吧....

Windows Live Messenger 無法使用英文外其它字元

這個問題會發生在 Windows Live Messenger 的最新版本 (第 14 版)。

這個問題會發生在下列情況中：

• 在 Windows Live Messenger 中，在連絡人上按兩下以開啟聊天視窗。
• 在 Windows Live Messenger 聊天視窗中，切換輸入模式來使用輸入法 (IME)。例如，您切換輸入模式來使用中文輸入法的新注音模式。
  注意此時您還能如預期般輸入非英文字元。
• 您將系統焦點切換至另一個視窗。
• 您關閉了 Windows Live Messenger 主視窗。
• 您將系統焦點切換回聊天視窗以繼續聊天。

此時您會無法繼續在聊天視窗中使用原本的輸入法。而只能輸入英文字母。

安裝更新之後，必須重新啟動電腦。

如果要使用這個更新，您不需要對登錄進行任何變更。

處理方式：KB961503

處理「該記憶體不能為read或written」辦法

常常在使用者新增或移除不完全某些軟體，又或是操作上及系統上的錯誤

會造成這種情況，再來使用該軟體時常常會出現一個警告視窗

告訴你，「該記憶體不能為read或written」然後只有個確定可以點選

點選確定後發生錯誤的軟體就消失啦。

在此提供一個小方法可以請大家嘗試看看

開始 \ 執行 \ 輸入 cmd \ 確定

命令提示字元出來的時候

將以下參數貼上並執行 ( Enter給它按下去 )

for %1 in (%windir%\system32\*.dll) do regsvr32.exe /s %1

軟體安裝的時候會將它所屬的DLL註冊到電腦

讓電腦知道這個軟體在執行的時候需要去讀(Call)哪一些DLL檔案

當系統發生錯誤或是使用者不當操作時，往往會造成軟體毀損

這個參數應該可以解決掉不少問題。

What is DLL ?

DLL

動態連結程式庫 (DLL) 是具有函式的共用程式庫功能的可執行檔。動態連結提供一種方法，讓處理序 (Process) 呼叫不是可執行程式碼部分的函式。函式的可執行程式碼位於 DLL 裡，它包含一或多個已編譯、連結的函式，並且儲存在與使用它們的處理序不同的地方。DLL 也有助於共用資料和資源。多個應用程式可以同時存取記憶體中 DLL 單一複本的內容。

動態連結與靜態連結的不同處在於，前者允許可執行模組 (.DLL 或 .EXE 檔) 只包含在執行階段時用來找出 DLL 函式可執行程式碼的所需資訊。在靜態連結中，連結器 (Linker) 會從靜態連結程式庫取得所有參考函式，並且將它與您的程式碼一起放入可執行檔。

不使用靜態連結而改用動態連結可提供許多優點。DLL 節省記憶體、降低交換、節省磁碟空間、較容易升級、提供售後支援、提供擴充 MFC 程式庫類別機制、支援多種語言程式和簡化國際版本的建立。

※以上文字來自微軟MSDN※

顯示桌面的快捷不小心刪除怎麼辦？

開始 / 執行

然後輸入

regsvr32 /n /i:u shell32

再將滑鼠游標移到最下方工具列空白處點擊滑鼠右鍵

工具列 / 重新啟動

原本就會有打勾，再取消在勾選一次

刪除的桌面小快捷就會回來了~