Security Benchmarks for Workstations, Servers and Applications

We've all had to lock down a workstation, server or application for security/audit purposes and wondered where to start.  I recently stumbled across the Center for Internet Security (CIS) Benchmark program which provides vendor agnostic advice and tools on accessing and improving the security of servers and applications.   The CIS program can help public and private organisations to meet compliance standards for FISMA, PCI, HIPAA and a lot more.

Behind the scenes of CIS there is a group of IT security experts who give their time and knowledge to help provide the information and tools that can help to benefit the rest of the IT community.

The CIS provide a Java based assessment tool that you can run on your workstations or servers to assess the potential security holes within them.

Once you download the tool from their website and run it you are confronted by a list of current benchmark standards you can run against your device.  In this case I am running the tool against my Windows 10 workstation.

The next screen in the wizard is what profile you want to run against the device.  These are security profiles that you can choose from depending on what level of security you are looking to achieve. 

The next screen that you encounter is relating to how you would like the results reported to you.  You have several options to choose from, I've found the HTML report to be the most useful so far. 

Depending on what benchmarks and profiles you've asked to run the tool may take several minutes to generate. Once it has you will have a report that contains information on what your device has passed or failed on and what the implications of any failures are as well as some useful tips on how to resolve. 

For more information pop on over to the CIS website at https://www.cisecurity.org/

KEMP load balancer forgotten password

I recently started to use my home lab after 6months of not having any time to use it and unfortunately I had completely forgotten what I had set the password to on my KEMP Loadbalancer.  Thankfully I haven't changed deleted the bal account and was able to use a simple method to get into it again... 

1. Log into the KEMP console using the username pwreset

2. Use the password 1pwreset

3. The console will now indicate that the password for the bal account has been reset to 1fourall which you can now use to gain access to your loadbalancer again

Running Configuration Manager 2012 Remote Control standalone

In some instances you might not want to roll out the full SCCM console but still allow the user to run the Remote Control SCCM tool.

Here is how to do it:

1. Find the directory where the AdminConsole is installed, example: C:\Program Files(x86)\Microsoft Configuration Manager\AdminConsole\bin\i386, copy the following directory and files:
0000049
CmRcViewer.exe
RdpCoreSccm.dll

2. Copy the whole directory and the files to the computer you want to run Remote Control from. You can create a folder anywhere on the computer, i.e My Documents\Remote Control

3. Then simply launch the CmRcViewer.exe file and that is you!

Shrink the SQL Server Reporting Services log database used by ConfigMgr 2012

So today I came across an issue with my SCCM database server running low on disk space. On investigation I found the ReportServer_log.ldf file had grown to over 320GB in size!

It would appear this is a known issue and some simple configuration changes to your database setup can resolve this.

Change the recovery model
1. Log onto SQL Management Studio and connect to the SCCM instance
2. Expand Databases and right click on ReportServer (your name may vary depending on your installation)
3. Go to Options
4. Change the recovery model from Full to Simple
5. Click OK to save the changes

Shrink the file
1. Log onto SQL Management Studio and connect to the SCCM instance
2. Expand Databases and right click on ReportServer (your name may vary depending on your installation)
3. Select Tasks > Shrink > Files
4. Under File type select Log and click OK
5. This should reduce the size of the LDF file to a more modest size, you may have to repeat the shrink step two or three times for it to complete successfully

Change the Maximum File Size
1. Log onto SQL Management Studio and connect to the SCCM instance
2. Expand Databases and right click on ReportServer (your name may vary depending on your installation)
3. Select Properties
4. Select Files
5. In the Database files field, scroll until you see the Autogrowth column.
6. Click on the ellipsis button (…) for ReportServer_log (again this name may vary slightly depending on your installation)
7. Change the value of the Restrict File Growth (MB) field to a suitable amount for your environment.
8. Click OK to save the changes

This should now resolve your issue and not see it reoccur.

Patch ConfigMgr 2012 x64 clients during a task sequence using the PATCH property

We recently updated our SCCM version to the latest cumulative update and I wanted to update our task sequence so that new clients were deployed with the latest SCCM agent version.

In order to do this I completed these steps (please note we only deploy 64 bit clients so this tutorial only deals with these):

1. Open your task sequence

2. Within your Partition Disk 0 - BIOS/Partition Disk 0 - UEFI steps ensure the main partition has the following variable set OSDTargeSystemDrive

3. Create a command line step directly before the "Setup Windows and ConfigMgr" step

4. Within the command line enter the following text: cmd /c xcopy *.* %OSDTargetSystemDrive%\windows\CCMHotfixes /E /H /C /I /Q /Y and select the package that your patch resides in

This step copies the file from your SCCM server to the machine being imaged

5. Within your "Setup Windows and ConfigMgr" step enter the following within Installation properties: PATCH="C:\windows\CCMHotfixes\configmgr2012ac-r2-kb3054451-x64.msp"
You will need to change the filename as appropriate based on the update you are applying.