Analyze Energy Efficiency

Windows 7 and Server 2008 include a hidden power efficiency diagnostic report that can help make your computer more energy efficient.  The report is generated through the powercfg utility and monitors your computer for 60 seconds.  Power settings, hardware and what you computer is doing is all monitored to identify power waste.  Once completed, the report will show errors, warnings and general information about the power efficiency capabilities of your hardware and what is preventing it from operating efficiently.

Generating the report requires access to an administrative level Command Prompt. Click on the Start Button, type in cmd, hold down CTRL and SHIFT and then hit Enter.  That will start an administrative level command prompt.

Next, type in powercfg /energy and hit enter. 

After the report is generated the file is placed in c:\windows\system32\.  Before you can open the report with a browser, copy the file to your desktop first. Both Firefox and Internet Explorer seem to have issues opening files from the System32 folder. 

Read More

Where Did All My Free Space Go?

It happens to everyone eventually. Your hard drive is suddenly full and you are left wondering where did all my free space go? Now you must begin the task of deleting old files and folders to reclaim space but where do you start? In the past I would suggest manually checking the sizes of all of your folders so you know where to begin the hunt but now there is a great utility called WinDirStat that does the work for you.  After inspecting a drive you are shown exactly how much data is in each folder, what file types are taking up the most space and even a visual representation of the files on your disk.

Now you know exactly where to target your cleanup effort.


WinDirStat Web site.
Free Download.

Read More

How To Properly Disable IPv6

Starting in Windows Vista and Server 2008, Microsoft includes native support for IPv6 (Internet Protocol Version 6) and is enabled by default.  IPv6 is the new computer address protocol that will eventually replace IPv4 which is currently the most popular standard. Unless you network has a specific requirement for IPv6, very few do, you can safely disable IPv6. Unlike other protocols, you cannot disable IPv6 by disabling the protocol on each of your network interfaces. While that will disable the protocol for the interfaces the loopback and tunnel interfaces will still have it enabled that can cause problems with applications.  The proper way to disable IPv6 is to disable via the registry.

First, click on the Start Button and type in regedit and hit Enter.

Then, navigate through HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, services, TCPIP6 and Parameters. Right click on Parameters and select New and then DWORD (32-bit) Value. Name the new value DisabledComponents and hit Enter. Now right click on the new DisabledComponents value you just created and select Modify. Set the value of DisabledComponents to FFFFFFFF and click OK.

After a reboot IPv6 will be disabled on all interfaces.

Read More

Enable iOS AirPrint Support On Windows

In the latest version of iOS Apple included a new feature called AirPrint. Designed to bring native printing support to the iOS platform it can be found on version 4.2 or later devices such as the iPhone, iPod and iPad. At launch only a handful of HP wireless printers can be used but with the help of this article it is possible to AirPrint to any printer connected to a Windows computer, including Windows servers.

First, enable network printer sharing for the printer attached to your computer. In Windows 7, click on the Start button and select Devices and Printers. Locate your printer, right click on the icon and select  Printer properties.

Click on the Sharing tab, check the Share this printer box and then click OK.

If this machine does not have iTunes installed you will need to install the Bonjour Print Service. You can download the file from Apple directly.

After Bonjour is installed, make sure UDP port 5353 is open if you have a firewall.

Now it is time to install the AirPrint components.  There are a few installers available, but I recommend downloading the Elpamsoft AirPrint Installer. Airprint Installer Mirror.
After the file has been downloaded and extracted, run AirPrint Installer.exe with administrative rights (right click on the file and select Run as administrator). Click the Install AirPrint Service button.

Finally, make sure the Service Startup selection is set to Auto and click the Start button.

The setup is now complete. Test AirPrint by using Safari and the Bookmark button or in Mail with the Reply button. You will find a Print option in the pop-up menu. Select your Printer and touch Print. You may be asked to authenticate, use your windows account on the host computer.

Read More

Configure IP Address And DNS From Command Line

The IP address of your computer can be set from the command prompt by running the following commands at an administrative level prompt:

netsh interface ip set address name="Local Area Connection" static 123.123.123.123 255.255.255.0 123.123.123.1 1

Local Area Connection is the name of the adapter you want to modify. In single NIC systems it is normally called Local Area Connection.

123.123.123.123 is the IP address you want to set.

255.255.255.0 is the subnet mask.

123.123.123.1 is the gateway.

1 is the gateway metric. You can leave this as 1 for almost all cases.

If you want to enable DHCP you can run:

netsh interface ip set address name="Local Area Connection" dhcp

There are two commands for DNS since administrators typically configure a primary and secondary DNS server.

For the primary DNS run:

netsh interface ip set dns name="Local Area Connection" static 208.67.222.222

For the secondary run:

netsh interface ip add dns name="Local Area Connection" 208.67.220.220 index=2

If you want to configure the computer to use DNS from DHCP run:

netsh interface ip set dnsservers name="Local Area Connection" source=dhcp

When you are finished with all of your IP and DNS changes run ipconfig -all to review the new settings.

Read More

Change Remote Desktop RDP Port

Port 3389 is the home of the remote desktop protocol that powers Remote Desktop Services on all modern versions of Windows.  If your system has Remote Desktop enabled, it is listening for connections on port 3389.  Since this port is both well known and can be used to attack accounts, it is low hanging fruit for script kiddies and bots looking for an easy target.

Theoretically on a system that does not have an account lockout policy in place which by the way is not a system default, the RDP protocol can be used to get the administrator password with brute force.  Brute force is a fancy way of saying trying all possible passwords.  If the system never locks out the account then time is the only barrier to eventually getting you password and logging in.

The first defense is to implement a good account lockout policy but that does not solve the entire problem.  Any administrator of a public facing Windows web server will notice that their server is continiously attacked by bots looking for an easy target.  The bots will often lock out your accounts which can be very annoying.

To protect your system from the bots and script kiddies I always reccomend changing the default RDP port.  This will not fool an intelligent attacker but it will weed out the noise.

There are two methods you can use to change the default RDP port.  The first is a simple registry hack:

Open up Registry Editor by running regedit.  Then navigate to HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Control, Terminal Server, WinStations and RDP-Tcp.  Right click on the PortNumber dword and select Modify.  Change the base to Decimal and enter a new port between 1025 and 65535 that is not already in use. Finally click OK.



The second method uses a Microsoft Fix It wizard.  Click here to download the utility from Microsoft then click next to start the wizard.  On the PortNumber screen enter the new port you want to use, click next and that is it.



Make sure to reboot after either method to ensure the change is active.

Keep in mind that the next time you want to connect to your system with RDP you will need to provide the port number.  You can do that from the Remote Desktop client by appending a colon after the host name or ip address followed by the port number.  For example, if I have a computer with host name of tweak with RDP running on port 1234 I would use tweak:1234 in the remote desktop client hostname field.

Read More

Create An Account Lockout Policy

In my last article I showed you how you can protect your computer against anonymous user account attacks by turning on account logon auditing so you could see when someone attempts to remotely logon to your account.  Now I am going to help your increase your level of protection with the Account Lockout Policy.

Creating an Account Lockout Policy will protect your account by limiting the number of time a remote application or attacker can try to guess your password.  This works by automatically locking out your account after a designated number of incorrect passwords were entered.  Your account will remain locked out for a designated period of time before it is automatically unlocked and it can be logged into again.  This provides a valuable addition to your account security because it can render brute force password attacks useless.  If you have your lockout threshold set to 4 bad attempts and the lockout duration to 15 minutes, an attacker can try to guess your password a maximum of 16 times per hour.

Now that you know how valuable an Account Lockout Policy is, let’s get it setup on your computer:

    1. Click on the Start Button and key in Secpol.msc and hit Enter.
    2. Navigate through Account Policies and Account Lockout Policy.
    3. Right click on Account lockout threshold and select Properties.
    4. Enter in the value you want to use and hit OK to save. I like to use 4 here.
    5. Windows will set the default values for the lockout duration and Reset account lockout counter values.  If you want to change these values from the defaults (30 minutes), right click on them and select Properties. After making your changes hit OK to save and exit.

Read More

Turn On Auditing To Monitor Account Attacks

There is no doubt that all of the new security features in the modern versions of Windows will help keep your computer more secure.  However, these features become less valuable when they are not turned on by default.  One feature, known as user account auditing, is not turned on by default. With this feature is turned off, anyone with physical access or remote access to through a hole in your firewall (such an opening for Remote Desktop) can use a brute force attack against your user account for as long as they want without getting noticed at all.   How? The default audit security policy is configured to not log any account logon events, successful or failed.

This allows an attacker to try to hack your accounts for as long as it takes to break in.  There are a few ways to protect against this that I am going to go over in my next article about the Account Lockout policy.  But first, it is important to turn on this account auditing so that you can see who may be trying to break into your accounts.  After you have adjusted the auditing security policy, you will be able to see any account attacks including the account that they tried to logon with and where the request came from.

Let's get started and turn on audition for failed logon events:

    1. Click on the Start Button and key in secpol.msc in the box and hit Enter.
    2. Navigate through Local Policies and Audit Policy.
    3. Right click on Audit account logon events policy and select Properties.
    4. Check the Failure box and hit OK.
    5. Right click on Audit logon events policy and select Properties.
    6. Check the Failure box and hit OK. Your screen should now look like the figure below:



    7. Close Local Security Policy editor.

Your computer has now been configured to log all failed user account logon attempts.

Once you have turned on account auditing, you can view the logs in Event Viewer (run eventvwr.msc) under Windows Logs and Security.

Read More