EM+S Overview of documentation

This blog entries started as a "note to self". There is a lot of information out there and when needed you can of course Google it on Bing, but sometimes it nice just to browse a page looking for inspiration or have a place to go where you know the information are of high quality. So I created this list with links to EM+S product homepage and official documentation. I also included links to playbooks for ATA, CAS and AAD. I love the playbooks, they are a great source to test and learn. Microsoft Virtual Academy also have some nice classes for EM+S related learning

Are alle necessary updates in place

When you are setting up servers and installing Server software you will often discover that you are missing certain KB updates that are requirements for the software. Often will this be related to that server are patch from a strict security related point of view, so new "features", will not be pushed out by SCCM or other similar tools. Sadly with this strategy important optimization and stability upgrades as well as necessary updates for application installation are missing.

MVP Dagen nærmer seg (Norwegian post)

Da er det bare en uke til MVP dagen hvor 10 fantastiske Norske MVP'er og meg skal ha en dag fult av praktiskte foredrag på norsk med norske forhold som utgangspunktet. 

At dette er noe som er interessant er det ingen tvil om, selv om vi utvidet deltager antallet er det nå nesten fult igjen. Så har du ikke bestilt billett ennå bør du komme deg inn på registeringssiden og registrere deg før de siste billettene er borte.

When was Windows started?

How long have the Server of PC been running? Sometimes you need to figure when the OS was started. As always there are different was of getting this information. Some ways are quick and easy when you are sitting with the OS GUI in front of you, but other times you might want to use it in a script or get it from the command line. Here are a selection of methods I use.

GUI

You can checkout network adapter duration, but you will easier find the "Task Manager - Performance - Up Time"

When was Windows installed?

For different reason, you might want to know when Windows installed.

Luckily you can find this information other places then checking out the date on certain system files that was created/modified and stamped at the same time as when you installed Windows. The file date stamp method does not in calculate that files change this information during upgrades etc. during the lifecycle of the installation 

In registry, you have a Key to help you with this information.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

A Safer Way Of Running Unsigned Powershell Scripts

There is no doubt that as a company you should have setup a way of signing all the PowerShell script you are intending to run in your production environment.
But as we all known there will be situation where you want to run unsigned code, or maybe you are testing things out before you are ready to sign them.

Slide deck from Hackcon2017

The slide deck from my session "Protecting your critical systems from new and unknown malware, 0-days, and APT" can be downloaded here