Process Mitigation / Exploit Protection

Process Mitigation (PM)
Win 10 Exploit protection settings are displayed/controlled in Update & Security_Windows Security_App & browser control_Exploit protection settings.

Depending on the GPOs used the settings may or may not be visible or changeable within the user interface.

The powershell cmdlet Set-ProcessMitigation -system can be used to control the settings.  The results of these commands modify a registry key value

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\MitigationOptions

Settings for applications are stored here
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<AppName.exe>\MitigationOptions

Using get-processmitigation -system
Many of the PM settings display as NOTSET.  This means that they are at the OS default settings and may be ON or OFF.  Using the -RegistryConfigFilePath to export the settings to an XML file will not include any default system settings, only ones that have been specifically set.

Once Set-ProcessMitigation is used for any settings e.g. to set ON for a given setting, the only way to return to the original NOTSET state is to delete the MitigationOptions key above.

Set-ProcessMitigation only enables or disables settings, it cannot be used to return to the original OS default setting state NOTSET

In Windows 10 1803 and 1809 these are the OS default settings

Control Flow Guard (CFG)
Use default (On)

Data Execution Prevention (DEP)
Use default (On)

Force randomization for images (Mandatory ASLR)
Use default (Off)

Randomise memory allocations (Bottom-up ASLR)
Use default (On)

High-entropy ASLR
Use default (On)

Validate exception chains (SEHOP)
Use default (On)

Validate heap integrity
Use default (On)

Windows 10 Pro Optional Features Missing

Attempting to apply the XPS Viewer feature to a non domain Windows 10 1903 Pro install logged in as a local user results in no features available to select.

Settings_Apps & Features_Optional Features

At this point UAC prompts for elevation, enter the admin account credentials.

Some Optional Features appear along with an Add a feature button.

Click "Add a feature" and again and enter the admin credentials at the UAC prompt.

No features to install appears but it looks optimistic because there are spinning spots which seem to indicate that any minute now the features you are looking for will appear for selection.

But no.  These are not the features you are looking for, user scum.

The spinning spots stop and there is nothing.  Move along.

The problem here seems to be the UAC hand over to the admin credentials.

If you interactively logon as the administrator and carry out the same procedure, the features you are looking for will appear for your selection and installation delight.

Note: The RSATs are Windows 10 optional features but also available for download here
https://www.microsoft.com/en-us/download/details.aspx?id=45520

Office 365 channel change

A normal Office 365 download will default to monthly channel but Semi-Annual channel may be preferable.  To change the channel to Semi-Annual, run the following commands

1. Run CMD as Admin
Search for CMD and then right click on Command Prompt > click on Run as Administrator
2. Type
cd C:\Program Files\Common Files\Microsoft Shared\ClickToRun
Press Enter.
Type
OfficeC2RClient.exe /changesetting Channel=Broad
Press Enter.
Type
OfficeC2RClient.exe /update user
Press Enter.


Channel identity notes

Channel Keyword in CMD or ODT
Monthly Channel (Targeted) Channel = "Insiders" or Channel = "FirstReleaseCurrent"
Monthly Channel Channel = "Monthly" or Channel = "Current"
Semi-annual Channel (Targeted) Channel = "Targeted" or Channel = "FirstReleaseDeferred"
Semi-annual Channel Channel = "Broad" or Channel = "Deferred"

information from
https://answers.microsoft.com/en-us/msoffice/forum/all/to-change-update-channel-office-365/c1b70a1f-4741-4940-9d49-32e6e5607769

Detection

SCCM Application Package Detection

I know what it is.  I can never remember this word for it !

Validation ?
Checking ?

what IS it ?

now it is in my blog I will not forget it.

Checkpoint Website catagories

Use this link to discover how Checkpoint categorises the target URL

https://urlcat.checkpoint.com/urlcat/main.htm

A free login account is required.

Adding AD attributes to SCCM user objects

Needed to create a user collection based on some custom AD attributes.

Thanks to Paul Smith for pinging this over to me.

https://www.systemcenterdudes.com/sccm-2012-custom-active-directory-attributes/

Check out the discovery methods in the Administration_Hierarchy Configuration_Discovery Methods

Epoch Converter

For converting the 18-digit Active Directory timestamps, also named 'Windows NT time format', 'Win32 FILETIME or SYSTEMTIME' or NTFS file time. These are used in Microsoft Active Directory for pwdLastSet, accountExpires, LastLogon, LastLogonTimestamp, and LastPwdSet. The timestamp is the number of 100-nanosecond intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC.


https://www.epochconverter.com/ldap