September 2015 – A Geeks World

Geek Week – Building Datacenter and Private Cloud

Yours truly and @mikael_nystrom are teaching a 5 day training called “Geek Week – Building Datacenter and Private Cloud“.
It’s a quite cool concept, where we are always at least 2 teachers (Mike and me, and sometimes members from our team) with a lot of real-life experience, teaching students how to build a Software Defined Private Cloud/Datacenter on Microsoft Technology in just 5 days. We have been doing this training about 4 times so far and each time got top score !

The training is covering things like; Software Defined Storage, Networking Compute, Bare Metal Deployment, SCVMM, SCOM, SCOR, Powershell(!), Azure Pack, Backup/Restore, Operational Insight, AD Design for your Fabric, GPO’s, Patch Management and a lot more!

So instead of just learning one product, you will learn the full stack, the concept, how to design, build and of course manage it.

We’ve made a short promo video with details here:

https://youtu.be/_PjRHv84VgM

You will of course also keep the Lab Server and all the scripts!
We are both staying at the same hotel as the students, so you will have – almost 24h access to our knowledge, experience and brains during breakfast, daytime and in the bar in the evenings, Sunday-Friday.

We have delivered the training only in Sweden so far, due to the huge hardware requirements, but have had participants from several other countries, including students from US (and doing the training in English than).

Unfortunately, for you but great for us, the next training in October, is SOLD OUT!
The next opportunity will probably be in February or March in Sweden, so talk to your manager and sign up while there are seats left.
http://www.labcenter.se/Labs#!lab=Geek_Week_-_Building_Datacenter_and_Private_Cloud (Unfortunately only in Swedish)

Send me a mail if you have any questions: markus . lassfolk at truesec . se

Working with Virtual NIC’s in Windows

At times when I’m for example at a customer and need to connect my Laptop to different VLAN’s it’s really nice to add new virtual Network Cards (vNIC’s) on the fly, and be connected to multiple networks at the same time.

By transforming the Network Cards in your computer, into a virtual switch, and then add Virtual Network Cards connected to that switch, it’s possible to do a bit of network magic.

Here is a part of the script that I run each time I reinstall my PC’s to create the vNIC’s that I need and use the most. The script is also installing the software I need and doing some other minor changes (always a work in progress).

Pre-Requisits: Hyper-V Role installed

# Create a Switch for Ethernet Network 
Get-NetAdapter -Name "Ethernet" | New-VMSwitch -Name "Uplink Switch" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "External LAN" -verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "External LAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME 

# Create a Switch for WiFi Network 
Get-NetAdapter -Name "Wi-Fi" | New-VMSwitch -Name "Uplink Switch WiFi" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch WiFi" -Name "External WLAN" -verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "External WLAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN11 on Physical Network Card
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 11 -VMNetworkAdapterName "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "VLAN11" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN800 on Physical Network Card
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 800 -VMNetworkAdapterName "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "VLAN800" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Create a Switch for Ethernet Network

Get-NetAdapter -Name "Ethernet" | New-VMSwitch -Name "Uplink Switch" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "External LAN" -verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "External LAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Create a Switch for WiFi Network

Get-NetAdapter -Name "Wi-Fi" | New-VMSwitch -Name "Uplink Switch WiFi" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch WiFi" -Name "External WLAN" -verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "External WLAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN11 on Physical Network Card

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 11 -VMNetworkAdapterName "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "VLAN11" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN800 on Physical Network Card

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 800 -VMNetworkAdapterName "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "VLAN800" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

Thanks to my friend and colleague Mikael Nyström who showed me this a few years ago.

List all expiring certificates on all domain joined servers

A colleague asked me if I could list all expiring certificates on all Domain Joined servers in the environment.
– Sure!

A few minutes later, a script that will connect to all Servers and list certificates that will expire in less than 90 days. I’m sure there are a thousand of scripts out there who does the same, and here is script number 1001.

Invoke-Command -ComputerName (get-adcomputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*)(!serviceprincipalname=*MSClusterVirtualServer*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" -Property name | sort-object Name).Name -Command {
   get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90  
  }

Invoke-Command -ComputerName (get-adcomputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*)(!serviceprincipalname=*MSClusterVirtualServer*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" -Property name | sort-object Name).Name -Command {

get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90

}

The script will get all Windows Server Computer Accounts, that are not expired and is not a virtual object (like a Cluster Service).
It will then connect to those servers and list all Certificates that will expire in less than 90 days.

Short and easy to use, and we did find 2 certificates that need to be replaced ASAP!