syswow64 blog

This article outlines the protection against the publicly disclosed Secure Boot security feature bypass involving the BlackLotus UEFI bootkit (CVE-2023-24932). It includes steps to enable the necessary mitigations and provides guidance on creating bootable media. I will provide: - An overview of the CVE issue. - Pre-requisite actions within ADK. - Detection and remediation scripts for CVE-2023-24932. - Instructions for creating a WinPE Boot.wim file to support systems that have undergone remediation. - A breakdown of the files changed and how to boot WinPE to support systems before remediation. 1. Secure Boot Security Feature Bypass Vulnerability CVE-2023-24932 see MSRC CVE-2023-24932 is a security vulnerability involving the BlackLotus UEFI bootkit, which allows attackers to bypass Secure Boot protections. This vulnerability enables the execution of malicious code at the UEFI level, potentially leading to persistent and evasive threats. Mitigations for this issue include updates to th...

  Issue: Trying to login to the Microsoft 365 app on iOS. It prompts for username, then briefly opens Authenticator app then return with the error "Another account from your organisation is already signed in on this device. Try again with a different account" Solution: Settings > Apps > Microsoft 365 > Reset Microsoft 365 (Office) (Slide over Clear all content and Delete Sign-in Credentials) Restart App Just logs in

  Introduction: In Azure Active Directory (Azure AD), you can create dynamic membership rules to automatically update groups. To quote Microsoft "Dynamic group membership reduces the administrative overhead of adding and removing users".. Or devices. This blog is to detail the properties and syntax needed to create dynamic membership rules for AutoPilot devices and assign deployment and ESP profiles.  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership   I wanted to create a group of all AutoPilot registered devices that has a specific Group tag 'PAW'. The intention being to assign a specific AutoPilot deployment profile/ESP and a set of configuration but only to defined computers and not all AutoPilot registered devices.  Group tags will be created for different departments so they receive specific policy, apps, config per department i.e. Finance, HR, IT services etc. Within my list of AutoPilot devices (see how to popu...

Windows Management User Group Special thanks to the WMUG team for allowing me to speak on the Topic " Keeping up -to-date with Windows 10 Servicing"; Key words 'Keeping Up' For those of you who asked for my slide deck please see the OneDrive link here . Hope see you at the next Meetup. https://www.meetup.com/en-AU/WMUGUK/events/calendar/

Removing the Application Catalog Role within ConfigMgr was not as straight forward as i was hoping ! Like many SCCM admins historically the Application Catalog Web service Point and Website point were installed in order to deploy applications to Users.   However, this feature is now depreciated and User deployments can be deployed without this role as the client will query a management point instead for all deployments (user and device). ( https://docs.microsoft.com/en-us/sccm/core/plan-design/changes/deprecated/removed-and-deprecated-cmfeatures ) I decided that this role should be removed as we were on 1810 Hotfix2 and colleagues had stated the transition was near seamless (see below regarding a reported BUG and quick fix to modify any Client setting). The procedure to remove the App Catalog role is straight forward: 1. Remove references to App Catalog website within Client Settings. 2. Remove the Roles within the SCCM console. See Adam Gross blog   In our case the remov...

Software Updates - Feature Upgrade - Windows 10 Software updates within an Enterprise organisation has been fairly straight forward until you attempt to use it for Feature Upgrades of Windows 10.  SCCM is very reliable at delivering the updates (Rollups, Updates, Upgrades) and as i have previously proved is UWF aware in Windows 10. However, the Feature Upgrade does require a bit of prep work if you do not want the new Appx Applications installed as part of the Upgrade. Moving between the 1507-1703 branches each Feature upgrade would reinstall the Appx Applications that you previously removed. Microsoft has addressed this in the 1703 - 1709 feature upgrade and if you removed an application it will not come back.  However, if the new branch has a new application this will get installed. Uninstalled in-box apps no longer automatically reinstall Starting with Windows 10, version 1703, in-box apps that were uninstalled by the user won't automatically reinstall as part of the featur...

Creating Global Conditions in System Center configuration Manager for Office 365 deployments Firstly I would recommend reading the Microsoft docs article below. https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-global-conditions Software Library  >  Application Management  >  Global Conditions . Scenario: I have an AD group " SD-LSG-Comp-Microsoft Project ClickToRun"  with computer objects that should install Office 365 -  ProjectProXVolume edition. I wanted to create one application with multiple deployment types depending on their AD membership. For example if the computer is only a members of the  " SD-LSG-Comp-Microsoft Project ClickToRun" AD group then the deployment should only run the deployment Type " Office 365 Default Deployment Type-Install_InstallProject.cmd ".   This deplyoment Type calls the Office 365 setup.exe with a configuration xml detailing the  <Product ID="ProjectProXVolume">. (For a det...

Scenario: I wanted to package the Office 365 Activation Troubleshooter ( Officeact.diagcab ) for Office 365 users with activation issues. I needed to find out the commands to use as well as the appropriate Detection Method. 1. Download: Officeact.diagcab https://aka.ms/diag_officeact 2. Create a PowerShell (Diagnostics.Office365.ps1) script to call the officeact.diagcab file. See example below 3. Create an SCCM Script application calling the Diagnostics.Office365.ps1 script powershell -ExecutionPolicy Bypass .\Diagnostics.Office365.ps1 Select the Detection Method tab and select radial next to "Use a custom script to detect the presence of the this deployment type". Select the Edit option on the right and set the script type to PowerShell and the script content as appropriate to the application. The script below will look at all running processes and filter out all processes that equal msdt; if a process matching this string is found the client will return an exit code of 0 ...

What Are Server Groups? Within SCCM Assets and Compliance you can create a collection containing Server Client membership. Once the 'Server Group' feature is enabled the properties of the collection will contain an additional option to declare that all members of the collection are part of a server group.   This means SCCM knows that the servers within this collection must be treated with specific logic and settings. In the example below the collection contains three nodes of a cluster and only one node may be Software Updated at a time. Once policy is received for the Software Update Group deployment an election is held in which one of the nodes will engage a lock state forcing the other nodes to wait until it has been released. The UpdatesDeployment.log details the 'Lock State'. Once the node has taken the lock (Lock State: 1) the server will then run the 'Node Drain Script' and continue if the script has an exit code of 0 zero or if the script times out (600 ...

Scenario: A two node cluster required new and old software updates to bring it up to compliance. The installation of KB3000850 was failing to install either manually or via SCCM deployment on one node  but not the other. WUAHandler.log Installation job encountered some failures. Error = 0x80240022. Commit Result = 0x00000001 CBS.log  Not able to add file to extract: update.ses [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND] CBS    Store corruption, manifest missing for package: Package_33_for_KB3081320~31bf3856ad364e35~amd64~~6.3.1.1 CBS    Mark store corruption flag because of package: Package_33_for_KB3081320~31bf3856ad364e35~amd64~~6.3.1.1. [HRESULT = 0x800f0831 - CBS_E_STORE_CORRUPTION]  Failed to resolve package [HRESULT = 0x800f0831 - CBS_E_STORE_CORRUPTION] WER: Generating failure report for package: Package_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8, status: 0x800f0831, failure source: Execute, start state: Staged, target state: Inst...

Scenario: The client has pretty standard ConfigMgr setup to manage there primary and dev systems. The clients communicate to Distribution and Management Points however, the PORT 8530 from the Software update Point ( SRVSUP01 ) can not be opened to clients in the dev vlan. Without getting into the technical architecture of the configured firewall rules a second Software update Point would be required to over come this architectural design. However, the Dev client would not switch over to the new SUP ( SRVSUP02) . Upon opening a Browser window from a Dev client it was possible to navigate to the addresses below thus confirming the availability of the new SUP. http:// SRVSUP02 .Contoso.local :8530/SimpleAuthWebService/SimpleAuth.asmx   http:// SRVSUP02 .Contoso.local :8530/ClientWebService/wusserverversion.xml   http:// SRVSUP02 .Contoso.local :8530/Selfupdate/wuident.cab The WUAHandler.log was reporting a scan failure error code: 0x8024401c. Implying the Scan agent was not ...

SCCM Software Updates - Failed to Add Update Source for WUAgent  Today I have been looking at a range of servers (Server 2008 /R2 2012 /R2) that were failing to communicate with the Software Update Point (SUP) in SCCM and retrieve deployment policy. The UpdateDeployment.log was reporting the Job error 0x80004005 Job error (0x80004005) received for assignment ({af7a48e6-d550-4070-dd9b-ecc234567584}) action UpdatesDeploymentAgent 12/6/2017 10:32:27 AM 2096 (0x0830) The WUAHandler.log  was reporting "Unable to read existing WUA Group Policy object" and "Failed to Add Update Source for WUAgent " Unable to read existing WUA Group Policy object. Error = 0x80004005. WUAHandler 12/6/2017 3:41:00 AM 2828 (0x0B0C) Failed to Add Update Source for WUAgent of type (2) and id ({3AAB6A76-CE2D-4E8A-9F11-123AE69612A1}). Error = 0x80004005. WUAHandler 12/6/2017 11:03:31 AM 2276 (0x08E4) Until the agent can report back to the SUP, SCCM will not be able to summarize Software Update sta...

All New posts are placed on: http://www.SystemCenterBlog.co.uk

Windows 10 - UE-V Deployment Guide UE-V in Windows 10 is setup pretty quickly but the documentation for Group Policy and expected outcomes is all over the place.  In order to help other IT Pro's navigate their UE-V implementation I have documented my configuration with observations. Folder and Executable Reference Table Templates folder                    = C:\ProgramData\Microsoft\UEV\Templates InboxTemplates folder           = C:\ProgramData\Microsoft\UEV\InboxTemplates Scripts Folder                         = C:\ProgramData\Microsoft\UEV\Scripts SettingsStoragePath                = Central UNC Share i.e \\ServerName\UEVData\%UserName% SettingsTemplateCatalogPath = Central UNC Share i.e \\ServerName\UEVCatalogPath UEVAppMonitor.exe                  ...

Software Updates - Feature Upgrade - Windows 10 Software updates within an Enterprise organisation has been fairly straight forward until you attempt to use it for Feature Upgrades of Windows 10.  SCCM is very reliable at delivering the updates (Rollups, Updates, Upgrades) and as i have previously proved is UWF aware in Windows 10. However, the Feature Upgrade does require a bit of prep work if you do not want the new Appx Applications installed as part of the Upgrade. Moving between the 1507-1703 branches each Feature upgrade would reinstall the Appx Applications that you previously removed. Microsoft has addressed this in the 1703 - 1709 feature upgrade and if you removed an application it will not come back.  However, if the new branch has a new application this will get installed. Uninstalled in-box apps no longer automatically reinstall Starting with Windows 10, version 1703, in-box apps that were uninstalled by the user won't automatically reinstall as part of the featur...

Windows 10 Overlay for Unified Write Filter (UWF) This entry is to document my experience with the Windows 10 feature Unified Write Filter (UWF); with the intention to replace DeepFreeze on shared computers. "Unified Write Filter (UWF) protects the contents of a volume by redirecting all write operations on that volume to the overlay, which is a virtual representation of the changes to the volume. Conceptually, an overlay is similar to a transparency overlay on an overhead projector. Any change that is made to the transparency overlay affects the projected picture as it is seen by the viewer. However, if the transparency overlay is removed, the underlying picture remains unchanged. In a UWF protected system, UWF creates a single overlay, which contains information about writes to all protected volumes on a system. The overlay supports up to 16 terabytes of protected volumes." (extract from  https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/uwfoverlay )  H...