Category: General

This year on the Microsoft Ignite conference Microsoft announced the modern replacement for MMC and ServerManager.
It is called Honolulu: https://docs.microsoft.com/en-us/windows-server/manage/honolulu/honolulu
Also Microsoft ranted about Admins using RDP for Administration. “It was never designed for it. Those admins should read the documentation. It states, it allows two channels only for emergency administration. But that problem will fix itself, as we discontinue the gui on servers. Also if you want to Administer GPOs for Windows 10 clients you have to do that form a Windows 10 client, as some settings are not available on a Server-Type OS.”
Also Microsoft once again urges Admins not to use Jump hosts, but instead Implement PAW (aka. SAW).
PAW (Privileged Admin Workstation) or SAW (Secure Admin Workstation) is an advanced security concept for admins.
It’s key features are:

• Isolated Environments, day-to-day stuff like e-mail or webbrowser don’t have access to privileged sessions or applications. In fact they don’t know that those exist at all.
• Does not need special hardware, it only needs a Computer with an TPM and uefi (and even those are not mandatory, but highly recommended)
• At minimum two OSes running in parallel, recommended is one per tier.
  Credential Guard enabled
• Windows Defender Application Guard enabled

Other things to consider:

• Tier 0 Admins should be blocked access to Tier 1 and Tier 2 *¹
• Tier 1 Admins should be blocked access to Tier 0 and Tier 2 *¹
• Tier 2 (Workstation) Admins should be blocked access to Tier 0 and Tier 1 *¹
• Only PAW/SAW allow local logon for Admins, but Applocker blocks Windows Logon for admins, so only UAC elevation works (windows hello with fingerprint for elevation, recommended).
• LAPS should be installed everywhere
• Recommended Applocker Rules Video 01:15:40 (only about 12 Rules)
• Use IPSec, every client and every server should communicate over IPSec, so having physical access to the network is non compromising (works for everything after Windows 2000).
  Use Exploit Guard (former EMET)
• IPSec with ESP and AH (IPv6) and IPSec with ESP for IPv4 if there is (or could be) a NAT
• Use Device Guard for single purpose machines like ATMs, except if admins are bored (as high administrative effort is required)
• Look at ESAE
• Look at Protected Accounts
• Disable RDP. Only use Remote Administration through WinRM (PowerShell), as that does not allow Credential Theft
• Disable NTLM authentication for Shared folders (access by IP-Address), as NTLM makes Credential Theft easy.
• Enable SMB Encryption (or IPSec), as requests can be intercepted otherwise.
• Maybe add PIN auth to bitlocker in addition to TPM
• Restrict outgoing Connections (also the destinations) using Windows Firewall (through GPO recommended)
• Use Kerberos
• Block Internet Access from Secure context, that requires:
  • Having an internal WSUS
  • Having an KMS for Windows (Re-)Aktivaton
  • Having an internal PowerShell Help-Server, to update PowerShell command help *²
  • Having an internal PowerShell Script and Modules repository *²
• Use TOTP (RFC6238) for your APS.NET Core stuff 2nd video at 17:31
• Don’t use SMS or E-Mail for Two Factor auth

Summary Talk about Security concerns

1. Mastering the lions PAW: How to build a privileged access workstation | BRK3286
2. Security and identity in ASP.NET Core | BRK3283

________________________
*¹: (Deny: “Access to computer from the network”, “logon as a batch job”, “log on as a service”, “log on locally”, “log on through terminal services”)
*²: Recommended for administrative support, by me.

Recently I’ve been playing around with the new Hyper-V Nested Virtualization feature within Windows 10 (build 10565 and greater) and Windows Server 2016. It is pretty cool to be able to creat…

Quelle: Install a VMWare ESXi 6.0 Hypervisor in a Hyper-V VM

Hyper-V Nested Virtualization

Part 1 – Prepare the ESXi ISO
Install VMWare PowerCLI: https://my.vmware.com/group/vmware/get-download?downloadGroup=PCLI630R1
Open PowerCLI
Download ESXi-Customizer PowerShell Skript: http://www.v-front.de/p/esxi-customizer-ps.html#download and place it in D:\ESXi-Hyper-V
Enter the following commands:

cd D:\ESXi-Hyper-V
.\ESXi-Customizer-PS-v2.5.ps1 -v60 -vft -load net-tulip

Part 2 – Create the Hyper-V VM
– Generation 1
– Startup Memory > 4096 MB
– Use Dynamic Memory for this Virtual Machine: $false
– Virtual Hard Disk: >10 GB
– Install an operating system from a bootable CD/DVD-ROM
– Image ile (.iso): select the in Part 1 generated iso
Now edit the Settings of the ESXi VM:
– Processor: 2
– Remove the “Network Adapter”
– Add a “Legagy Network Adapter”
– Select a Virtual Switch
– Save the settings

Part 3 – Enable Nested Virtualization
– Open PowerShell and write:

Import-Module Hyper-V;
Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true;
Get-VMNetworkAdapter -VMName <VMName> | Set-VMNetworkAdapter -MacAddressSpoofing On;

Part 4 – Boot ESXi Virtual Machine
– At the Bootscreen of the installation Media quickly press “Tab” and append “ignoreHeadless=TRUE” at the end of the Boot Options.
– Complete the setup process.
– Remove the installation disk and press “Enter” to reboot.

Part 5 – Configure the ESXi Boot Options:
– At the boot menue quickly press SHIFT+O and add the “ignoreHeadless=TRUE” Boot Option.
– After ESXi has started, press F2 and navigate to “Troubleshooting Options” => “Enable ESXi Shell”
– Press ALT+F1 to switch to the ESXi Shell
– Login to the shell
– Execute esxcfg-advcfg –set-kernel “TRUE” ignoreHeadless
– After that press STRG+D to logoff.
– Now press ALT+F2 to switch back to the GUI.
– Optionally turn off ESXi Shell.
– Esc out off the Options menu.

Now you have a fully funktional ESXi Host within a Hyper-V Virtual Machine. It should be noted, that this setup is not supported neither by VMWare nor by Microsoft.