Skip to content

Fortigate IP List

Most of them have read that Belsen group release a configuration file of 15k device affected by CVE-2022-40684 Here there’s the ip addres listed in that collection. If your ip is in the list, check carefully on your device and assume it compromised.

Exchange removal script

Prepare Exchange for Uninstall You will need to run several PowerShell commands to help prepare your server for uninstall. Uninstall Exchange Now you are ready to run the uninstaller. From an elevated command prompt, navigate to the directory “C:\Program Files\Microsoft\Exchange Server\Bin” or “C:\Program Files\Microsoft\Exchange Server\v14\Bin” and run:

Granting folder permissions to IIS application pools

Whenever a new application pool is created, IIS creates a security identifier (SID) that represents the name of the application pool itself. For example, if you create an application pool with the name “Smartcrypt,” a security identifier with the name “Smartcrypt” is created in Windows. Resources can be secured by using this identity. However, the …

Exchange: Replacing certificate for Microsoft 365 hybrid connector’s

When certificates needs to be renewed or changed on (on-premise) Exchange server’s, and you have Microsoft 365 hybrid setup though Hybrid Configuration Wizard, a Office 365 connecter is setup as send and receive: Receive: Send: If you try to delete the old certificate, without setting the new cert for the connectors, you will get this …

Remove DFS link

This link was in fact an NTFS reparse point. Using the “fsutil” command solved the problem. For example, in the case of an reparse point located at “C:\$Recycle.bin\S-1521\x\y\z\Documents”, you must: 1- Open the command prompt in administrator mode 2- go to the folder containing the link (for example “C:\$Recycle.bin\S-1521\x\y\z\”) 3- fsutil reparsepoint query (eg: “fsutil …

FortiGate not logging denied/violation traffic

I’ve checked the “log violation traffic” on the implicit deny policy in both the GUI and CLI and it is on (which I believe should be the default anyway). As a test I also created a policy singling out some specific traffic and set the action to deny, with logging enabled. The traffic is blocked …

Fortigate Multiple DDNS

When Dynamic DNS (DDNS) is enabled on FortiGates, VPN Manager supports DDNS. First VPN Manager searches for the interface IP for IPsec Phase2. If no IP is found, then VPN Manager searches for DDNS. You can use FortiManager and the CLI-only objects menu to enable DDNS on each FortiGate device. The CLI-only objects menu is available in the Device …

TLS and NPS

Looks like NPS only supports TLS1.0 by default. So if you go restricting your ciphers too much you’ll find none of your NPS clients able to connect using EAP. That’s a bit of a problem when you have an 802.1x secure network and every client is expected to authenticate. If a cipher is not available on …

What does Robocopy mean by tweaked, lonely, and extra?

“Tweaked”, “Lonely”, and “Extra” refer to RoboCopy “Classes” of files. For each directory processed RoboCopy constructs a list of files matching the Include Filespecs, in both the source and destination directories. The program then cross-references these lists, seeing which files exist where, comparing file times and sizes where possible, and places each selected file in …