manage local GPO on remote machine

利用指令開啟遠端機器的本機GPO

gpedit.msc /gpcomputer: machine

http://technet.microsoft.com/en-us/library/cc978269.aspx

利用mmc嵌入方法管理遠端本機GPO

當current user的權限不足時~~可用runas利用對方管理者群組的等同帳號密碼,啟動一條cmd的session去執行即可~~

ie: 遠端欲管理電腦kido_client , 管控端kido_controller

kido_client中administrators群組成員帳號kido, kido_controller的current user kido_member

於kido_controller中建立一帳號kido,並且密碼與kido_client中的kido相同~~

接著runas /user:kido cmd

於新啟動的cmd session中進行遠端控制即可~~

default share permission change

基於資訊安全原則,我們不想讓everyone出現在預設的分享權限中,所以必須對系統作微調
機碼位置
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity]
"SrvsvcDefaultShareInfo"

由於這各機碼值是不容易讀取的,所以必須藉由tweak-ui去作調整

事後的部署

在AD的環境下~~可透過GPO來安裝~~

Computer Configuration --> Windows Settings --> Scripts (Startup/Shutdown)

regedit /s xxx.reg

在workgroup的環境下可透過psexec,wmi,reg add,powershell來補正


for windows vista and/or higher version
Once you apply default share permission onto your system. All the other machines access either root share or adminitravtive share until you apply below setup onto your machine.

reg add HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters /v Level2Compatibility /f /t REG_DWORD /d 1
restart server service to apply the setup to system immediately
net stop server /y
net start server /y

http://support.microsoft.com/kb/971277/en-us?sd=rss&spid=14019

Below artical instructs you how to customize your default share
all your share permission setup can be found at below path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Shares\Security\
customize permission for specific folder and then import the setup to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity\SrvsvcDefaultShareInfo

http://www.sepago.de/d/helge/2010/07/23/how-to-modify-default-share-permissions-and-other-tweaks
 

group permission control via GPO

利用GPO管理用戶端群組設定
1:于電腦物件所在之OU下新增一GPO以利管理

2:于Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups 新增物件

3-1:新增原則(修改群組物件屬性) ie:替換本機local admin群組成員 -> 新增群組(以用戶端群組為命名方式) -> 將欲套用之成員加入群組

3-1:新增原則(修改群組物件屬性) ie:替換本機Administrators群組成員 -> 新增群組(以網域群組為命民方式) -> 將網域成員加入該群組

forwarding through ssh tunnel

架構解說:
A <-B-> C
B端點為bridge~~可以連通A與C~~
預設狀態A與C不可互通~~
是故我們要建立tunnel~~讓資料可以直接在AC對傳~~而非暫存至B然後再轉送到C

1: 于端點建立tunnel: issue# ssh -T username@B -L local_port:C:port_number_of_c
說明:當資料送到local的local_port後,他其實是傳到C指定的port去
2: 透過scp進行資料傳送: issue# scp -P local_port file account_on_c@localhost
透過rsync的ssh option: issue# rsync -avz -e "ssh -p local_port" file account_on_c@localhost

注意:原本要送到遠端server的部分需改為localhost~~因為我們要利用建立好的通道幫你送資料~~

x11forwarding

利用既有SSH通道傳送X畫面

ssh -X -v username@server

監控FS存取狀態

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colShare = objWMIService.ExecNotificationQuery("Select * From __InstanceCreationEvent Within 10 Where TargetInstance ISA 'Win32_ServerConnection'")

Do While True
Set objShare = colShare.NextEvent
If Right(objShare.TargetInstance.ShareName,1) <> "$" Then
Wscript.echo objShare.TargetInstance.ShareName
Wscript.echo objShare.TargetInstance.ComputerName
Wscript.echo objShare.TargetInstance.UserName
Wscript.echo objShare.TargetInstance.NumberOfFiles
Wscript.echo objShare.TargetInstance.ActiveTime
End If
'ShareName
'ComputerName
'UserName
'上述三者為pk,當比對不到資料時進行DUMP
Loop

重整user本機群組

可以在AD上透過此script來達成修改本機群組的需求

Set WshShell = WScript.CreateObject("WScript.Shell")
HostName = WshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")
set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set oADsSysInfo = CreateObject("ADSystemInfo")

'get domain dns name
'Set GroupSetup = objWMIService.ExecQuery("select Domain from Win32_ComputerSystem where PartOfDomain = True")
'For Each objGroupSetup in GroupSetup
' LocalDomain = objGroupSetup.Domain
'Next

'convert domain from dns name
'If Trim(LocalDomain) <> "" Then
' RegKey = """HKLM\Software\Microsoft\Windows nt\CurrentVersion\Winlogon\DomainCache""|find/I """ & LocalDomain & """"
' Result = WshShell.Exec("%ComSpec% /c reg query " & RegKey ).StdOut.ReadAll
' For Each tmp in Split(Result,vbCrLf)
' If Trim(tmp) <> "" Then
' Data = Split(Tmp,vbTab)
' If UCASE(data(2)) = UCASE(LocalDomain) Then
' Domain = UCase(Trim(data(0)))
' End If
' ENd If
' Next
'End If
Domain = oADsSysInfo.DomainShortName


set colGroup = objWMIService.ExecQuery("select * from Win32_Group where ((SID = 'S-1-5-32-544') and (Domain = '" & HostName & "')) or ((SID like 'S-1-5-%-512') and (Domain = '" & Domain & "'))")
For Each objGroup in colGroup
If UCase(objGroup.Domain) = UCase(HostName) Then
LocalAdminGroup = objGroup.name
Else
DomainAdminGroup = objGroup.name
End If
next


set colAccount = objWMIService.ExecQuery("select * from Win32_UserAccount where SID like 'S-1-5-%-500' and Domain = '" & HostName &"'")
For Each objAccount In colAccount
LocalAdminUser = objAccount.name
next


'remove account from local administrators
' Set objGroup = GetObject("WinNT://" & HostName & "/" & LocalAdminGroup)
' Set memberlist = objGroup.members
' For Each member In memberlist
' Tmp = Split(member.Parent,"/")
' If UCase(Tmp(UBound(Tmp))) = UCase(HostName) Then 'local account
' If UCase(member.Name) <> UCase(LocalAdminUser) Then
' objGroup.Remove(member.AdsPath)
' End If
' Else 'Domain Account
' If UCASE(member.AdsPath) <> UCASE("WinNT://" & Domain & "/" & DomainAdminGroup) Then ' Keep domain admins in the local administrators group
' objGroup.Remove(member.AdsPath)
' End If
' End IF
' next

'change local admin password
' set objUser = GetObject("WinNT://" & HostName & "/" & LocalAdminUser)
' objUser.SetPassword("Password")