Microsoft Defender - out of the darkness into the light

Often customers ask me for advice in regards of Antivirus. The next I explain in general is the difference between user-mode and kernel-mode. To make a long story short. Antivirus solutions use in general kernel-mode filter drivers. When you do there a mistake then you will see a bluescreen. Internal studies for reasons of bluescreens reveal 70% bugs in filter drivers from 3rd parties.

There are some AV vendors out there with a very poor code quality in filter drivers. I will not blame here specific vendors. The users of these vendors often raise complaints to me about them. Unfortunately these vendors have extra ordinary enterprise management capabilities. So you see pros and cons.

On the other side I hear often the "old" stories about Microsoft Windows Defender in terms of AV scanning results. Its absolutely true that these results were in the past - before June 2015 - very bad (specifically the tests from independent AV-test.org (how independent they are in reality I can neither proof nor deny!)). 

MS did a complete rewrite of the code and structure they are using. Combining with new technologies like block on first sight, machine learning and many more. This brought up a very good AV solution right now.

In the past I used for example AVIRA for my personal computer. But now I can state there is no other paid AV solution necessary for me. I started also in trusting Microsoft Windows Defender and its companion SystemCenter Endpoint Protection (actually the same engine. Only the management plugin makes the defender enterprise ready.)

To get the full story also checkout this blog entry from Brad Anderson.
https://cloudblogs.microsoft.com/microsoftsecure/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise/

Revised Windows 7 Skylake support by Hardware Vendors

Recently customers pressured us to accelerate Windows10 projects as they are loosing Windows 7 Skylake supported devices. And there are good news but as still it depends.

1. Windows 7 support is only given until Skylake (Intel 6th Generation). If you want to go with newer processors then you have to speed up with your Windows 10 migration.

2. If you are willing to stay with Skylake then you will receive Windows Support until January 2020.
"New Skylake devices on the supported list will also be supported with all applicable security updates for Windows 7 and Windows 8.1 through the end of support dates. During the support period, these systems should be upgraded to Windows 10 to continue receiving support after the period ends. Be aware that all support for Windows 7 ends on January 14, 2020 for all devices and support will end for Windows 8.1 on January 10, 2023."
According to: FAQ: What is the support policy for Windows 7/8.1 devices with Intel’s sixth generation of processors (also known as Skylake) that was released in late 2015?

3. Many of the hardware vendors extended the availability of certain Skylake systems until end of 2019. Also here its a decision of the hardware vendor how long they will support.

DELL

This slide is from the Dell Client Solutions Roadshow 2018. I recommend to attend this roadshow for more information's. And/or contact your Dell representative! 

HP, Lenovo and others are extending as well. For more Information's visit: 

https://support.microsoft.com/en-us/help/11675/windows-7-windows-8-1-skylake-systems-supported

SCCM automated driver management

Its always a pain to handle driver updates with each new release of Windows 10. The most simplest way to fix this is simply use Microsoft Surface products. Drivers and Bios Updates are deployed simply through Windows Update and all major headaches are gone. :-)

But unfortunately the world is not that simply. And as always there is a solution too.

Simply use the Driver Automation Tool

Thanks to Maurice Daly (MVP)
https://gallery.technet.microsoft.com/scriptcenter/Driver-Tool-Automate-9ddcc010

The Driver Automation Tool is a GUI developed in PowerShell which provides full automation of BIOS and driver downloads, extraction, packaging and distribution with Dell, HP, Lenovo & Microsoft client hardware.
The intuitive GUI provides you with a full list of models from the supported manufacturer, allowing you to select one or many models, it also will detect Dell and Lenovo models matched against the WMI models known to ConfigMgr.

How Does It Work?
When the tool is opened, you have the option to select your manufacturer and OS of choice. When you click on the Find Models button, the tool initiates a download of XML content from the selected manufacturer, reads in the XML and displays a full list of models for selection. Clicking on the Add to Import List adds each of these models for processing and once you click on the Start Download and Import Process button the tool starts the full process to automatically download and package the content.

MDT Support
Although primarily designed for use with ConfigMgr, the tool also supports MDT. Here you will find the ability to select your deployment shares as well as dynamic creation of folder hierarchies based on total control naming methods

FEATURES: ConfigMgr

• Site server selection
• Automatic site code discovery
• Distribution point and distribution point group selection
• Binary differential replication
• Distribution priority
• Clean up of unused drivers
• Removal of superseded driver packages
• Removal of source download packages
• Driver & BIOS piloting
• Driver & BIOS deployment state management (production, pilot, retired)

FEATURES: MDT

• Auto or manual selection of the MDT PS module
• Deployment share listing
• Folder structure naming

FEATURES: Settings
All settings are saved into an XML file open close, and read back into the tool upon launch.

Windows 10 servicing cycle revised for the better

I just want to mention you do not miss this article which explains the revised Windows 10 servicing.

Actually its for the better. So MS extended the mainstream support for another 6 months in terms of servicing and support. Plus another 6 month paid servicing only. So you get one more year quality updates if you want.

Just to clarify what servicing and support means:

• With servicing you receive public available quality updates. This does not include private hotfixes if needed.
• Support means you can also call in and get potentially a private fix if its a bug. And it includes the quality updates from servicing as well.

But this additional servicing is limited to Enterprise and Education only!Another reason not to use Pro Version ;-)

 

 

Details: 

https://blogs.technet.microsoft.com/windowsitpro/2018/02/01/changes-to-office-and-windows-servicing-and-support/

Current Timetable (Version 1511, 1607, 1703, 1709):

Release	Release date	End of support	End of additional servicing for Enterprise, Education
Windows 10, version 1511	November 10, 2015	October 10, 2017	April 10, 2018
Windows 10, version 1607	August 2, 2016	April 10, 2018	October 9, 2018
Windows 10, version 1703	April 5, 2017	October 9, 2018	April 9, 2019
Windows 10, version 1709	October 17, 2017	April 9, 2019	October 8, 2019

WMI Explorer 2.0 - including Powershell Code generation

While working with PowerShell you come sometimes to situations you need to control something on the machine not reachable right out of the box. So WMI is the answer to your question. Lots of things you can only trigger by WMI through PowerShell when it comes to automation also in combination with SCCM.

The main pain point is how to find the right thing at the right place. And then how to bring it into a PowerShell query. For both questions an easy answer is WMI Explorer.



 

As there is a specific script tab to create the needed PowerShell code.
Here as example to figure out the used Processor.

Requirements

•  Microsoft .NET Framework 4.0 Full or .NET Framework 4.5.1
•  Minimum display resolution: 1024x768
•  Administrator rights to view some WMI objects
•  (Optional) Internet access for automatic update check

Features

•  Browse and view WMI objects in a single pane of view.
•  Connect as alternate credentials to remote computers.
•  Asynchronous and Synchronous mode for enumeration.
• Method execution.
• SMS (Configuration Manager) mode providing additional functionality for Configuration Manager.
• Filter classes and instances matching specified criteria.
• View classes/instances in Managed Object Format (MOF).
• Search classes, methods and properties for names matching specified criteria.
• Run WQL queries.
• Automatic generation of WQL query for the selected Class/Instance.
• Automatic script creation (PowerShell and VBS).
• Highlighting enumerated objects.
• Display property descriptions and possible enumeration values (if available).
• Display methods descriptions and parameters.
• Display embedded property values.
• Caching enumerated classes/instances.
• View WMI Provider Process Information.
• Automatic check for new version.
• Added option to specify COMPUTERNAME as a parameter and automatically connect.
  Example: WmiExplorer.exe COMPUTERNAME

 DOWNLOAD IT HERE

GPO debug logging

Sometimes you need to search deeper to check why GPOs don't get applied.

Therefore you can enable the debug logging of the GPO client (service).
Please DO NOT FORGET TO DISABLE IT AFTERWARDS!!!

To enable logging in the Gpsvc.log file, follow these step by step guide:

  1. Click Start , click Run , type regedit , and then click OK .
  2. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows  NT\CurrentVersion

  3. On the Edit menu, point to New , and then click Key .

  4. Type Diagnostics , and then press ENTER.

  5. Right-click the Diagnostics subkey, point to New , and then click DWORD Value .

  6. Type GPSvcDebugLevel , and then press ENTER.

  7. Right-click GPSvcDebugLevel , and then click Modify .

  8. In the Value data box, type 0x30002 , and then click OK .

  9. Exit Registry Editor.

  10. At a command prompt, type the following command, and then press ENTER:
  gpupdate /force

  11. View the Gpsvc.log file in the following folder:
  %windir%\debug\usermode

Note - if the usermode folder does not exist under %WINDIR%\debug\ the gpsvc.log file will not be created. If the usermode folder does not exist, create it under %windir%\debug.


Thanks to CSS for the hint ;-)


Also check this out: https://technet.microsoft.com/en-us/library/cc749336


If you want to go REALLY DEEP then you find here more guidance.
https://mva.microsoft.com/en-US/training-courses/windows-performance-jump-start-8830
 Then you need the Windows Performance Recorder which is tracking EVERYTHING on your system. Be aware this is searching a needle in the haystack as it produces GB's of binary logs!!!

Serious vulnerability: RSA-Keys generated by Infineon TPMs are Insecure

Normally I do not talk about single security vulnerabilities except there are really serious ones they are a little bit odd and out of the normal security scope (like patching vulnerable windows services which is done automatically during patch days). Here manual interaction is necessary!

Today we talk about a serious one in Infineon TPMs. Its a bug in the firmware implementation which unfortunatelly affects many different models from many different vendors. It is CVE-2017-15361, also referred to as "Return of Coppersmith's Attack" (ROCA).

ATTENTION!  Application of firmware update is not enough! You will need additional steps depending on Microsoft services and functions you used with TPM before!  e.g. Bitlocker, Active Directory etc!!!

Affected are INFINEON TPM chips which are used widely.

Here the MS Security Advisory (on first access you need to accept the EULA. Afterwards you may need to click this link again!!!)
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012

Here is the Infineon Statement
https://www.infineon.com/TPM-update


List of affected models by vendor
(list not complete just major vendors included, but may include already the right firmware update packages by model!)

ACER
https://us.answers.acer.com/app/answers/detail/a_id/51137

Dell (nearly not affected)
http://www.dell.com/support/article/SLN307820

HP (Consumer)
https://support.hp.com/us-en/document/c05792935

HP (Enterprise Support)
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03789en_us

Lenovo
https://support.lenovo.com/us/en/product_security/LEN-15552

Fujitsu
http://www.fujitsu.com/global/support/products/software/security/products-f/ifsa-201701e.html

Toshiba
http://go.toshiba.com/tpmsecuritynotice


Known affected vendors (by 10/24/2017)
(for newer informations check the CVE above again!)

• Atos SE
• Dell
• Fujitsu
• Gemalto AV
• Google
• Hewlett Packard Enterprise
• Infineon Technologies AG
• Lenovo
• Microsoft Corporation
• Rubrik
• WinMagic
• Yubico

Microsoft Devices affected:

If your hardware is a Surface device, firmware updates are yet not available as of October 10, 2017. Microsoft is working to make firmware updates available for following affected devices and will provide links to the updates when they become available.

• Surface Book
• Surface Pro 3
• Surface Pro 4
• Surface Studio
• Surface Hub

Note that the Surface 3, Surface Laptop, and the Surface Pro released in June 2017 are NOT affected by this vulnerability.

To check your own machine:

1. Apply the latest MS October 2017 kummulative patch!
2. Open "TPM.msc" 
3. Check for the Status entry

Additional steps are needed!
Checkout therefore the Microsoft Advisory in section "Recommended Actions!"
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012


special thanks to Andreas Erber which brought me to attention of this!