Block USB drive using solidcore

Purpose: Disable usb flash drives from loading using solidcore.

Instructions
Step 1. Log into EPO

Step 2. Create a new rule group under Application Control

Step 3.

I like to name my rules starting with a . so user rules stay at the top

Step 4.

Edit the created rule

Step 5. 

Click the Binary tab and add 

Enter usbstor.sys as rule name and Name select Ban radio button and click ok

Click ok

Step 6. add this newly created rule to an existing policy that is being applied

Batch delete files older then X days using forfiles : updated!

Purpose:
This batch example will search for files with the extension .txt and deletes file less then 5 days old.

Required:
----------------------------------------------------
Forfiles.exe
/p  The path to search
/s Recurse into sub-folders
/M Mask
/C command The command to execute for each file

/D - dd      Select files with a last modified date less than or
                equal to the current date minus "dd" days. (in the past)
-----------------------------------------------------
Del.exe
-----------------------------------------------------

Code:

Echo on
Forfiles /P c:\temp\ /S /M *.txt /C "cmd /c del @path" /D -5

If you have a space in the path the only way i found forfiles.exe to work is the following example

if a file is older then 30 days in e:\example space then delete
forfiles -p "e:\example space" -m *.* -s -d -30 -c "cmd /C del @FILE"

Disable Solidcore

Running solidcore you may run into a problem where you have to disable it with out using epo or the local CLI

Here are the steps.

Step 1.

Boot computer into Safe Mode(Press F5 before windows boot screen)

Step 2.

Open Registry (Start->Run->regedit)

Step 3.

Navigate to:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swin\Parameters]

Step 4.

Double-click DWORD RTEMode and change value to 0

Double-click DWORD RTEModeOnReboot and change value to 0

Reboot the computer and the agent should now be disabled.
Note:
Doing this will send out alerts to the central server.

Excel document for pinging list of computers VBA

Here is an excel document I created that will ping a list of nodes in column A and give results in column B. There are much better tools that can be used such as angry ip scanner http://www.angryip.org/w/Home. I just wrote this as an example

Requirements:
Tested with Office 2010

Download:
Download

Howto: Two different subnets same physical LAN how to get them to talk without a gateway

Have you ever ran into a problem where you had two windows boxes that were on different sub nets on the same physical LAN and you needed to establish temporarily communication?

Say you have these two computers with the following ip addresses.

Computer 1

172.16.1.2 

Computer 2

192.168.100.1

So what we are going to do is tell each computer that in order to get to the other computer they have to go out their local interface.

Open a command prompt and run each of the following commands on the respective computer.

Computer 1

route add 192.168.100.1 MASK 255.255.255.255 172.16.1.2

Computer 2

route add  172.16.1.2  MASK 255.255.255.255 192.168.100.1

This now should allow for communication to occur.

I wrote a batch file to help with adding the route command


@echo off
echo -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Echo Created By Tony Unger
Echo **********************************************************************
echo Note:

echo Setup Routing Table
Echo Enter IP address you wish to connect to
REM IP address that was entered
set /p IPAddress=

REM Find Local IP Address - Works for Win7 if you have more then 1 adapter this may not work

REM Windows 7
FOR /F "TOKENS=2* DELIMS=:" %%A IN ('IPCONFIG ^| FIND "IPv4"') DO FOR %%B IN (%%A) DO SET LOCIPADDR=%%B


route add %IPAddress% MASK 255.255.255.255 %LOCIPADDR% /p

ATTR attributes for Solidcore 5

These are not listed in the documentation I had to get this information from development.


Attr command can be used to configured the required files to behave corresponding the solidifier.

-a  Always authorized attribute
     This attribute allows the user to configure a supported file as always authorized to execute.
      File configured under this attribute will be allowed to execute whether solidified or not.


-b  Bypassed from memory control attribute
      This attribute allows user to configure a process to run bypassed from MP-mangking and MP-decoying.
      This is one of the memory protection technique provided by solidifier but it is disabled by default.


-c  Bypassed from Critical Address Space Protection attribute
     Critical Address Space Protection is the latest and most effective memory protection technique provided by Solidifier. It is enabled by default.


     -c attribute configures a process to run bypassed from MP-CASP.


-d  Bypassed from process stack randomization attribute

    This comes under MP-VASR which is enabled only on special request from customer.


-e  Rebase dll attribute
    Changing the base address of the dll.


-r  Bypassed from dll relocation attribute
     -d, -e and -r attributes belong to VASR memory protection technique. This feature is disabled by default as CASP
     is enabled.


-f  Full crawl attribute
     -f attribute belongs the MP-mangling and MP-decoying memory protection. This feature is disable by default.
 
-i  Bypassed from installer detection attribute
    -i belongs to pkg-ctrl feature which tracks for the installation and uninstallation of MSI based packages...


-u  Always unauthorized attribute
    block the file from execution even if solidified.

-o  Process Context registry bypass:

Solidifier will not track any registry operations for the process configured under this attribute. All the registry operations in context of the configured process will be bypassed from solidifier.


-n Bypassed from DEP:
DEP is the Data Execution Prevention provided by Solidifier for 64-bit Machines. It is  a Memory protection technique provided by solidifier for 64 bit machines.Memory protection check will not apply  on the process configured as ‘Bypassed from DEP’.

-l Anti-Debugging Bypass:


Anti-debugging feature is there to prevent any process to access Memory space of the solidifier product. This is usually done by the debuggers to debug the application.

Any process bypassed from Anti-debugging  feature shall be able to access the solidifier address space in the kernel.

-p Process Context File Operations Bypass

Solidifier will not track any file operations for the process configured under this attribute. All the file operations in context of the configured process will be bypassed from solidifier.

Runas Touch Screen Application

Purpose:
One of the problems I had at work was the ability to run an application as a different user on a touch screen computer. So I wrote an application that dynamically creates buttons based on what it reads from a text file called paths.txt. This program does support arguments and should be able to figure out how to break up the path to find them.

To install just extract the application and paths.txt to a folder and runas away.

Requirements:
.net 4 framework
osk.exe in the usual place if you want to use the onscreen keyboard

TODO:
Add some more error checking with reading the text file
Clean code
Maybe allow this to work with domain user if someone wants.



Paths.txt 

name,path
------------------------------------------------------------------------------
Add\Remove Programs,rundll32.exe shell32.dll,Control_RunDLL Appwiz.cpl
Command Prompt,C:\Windows\System32\cmd.exe
Datetime,rundll32.exe shell32.dll,Control_RunDLL TimeDate.cpl
Display Properties,rundll32.exe shell32.dll,Control_RunDLL Desk.cpl
Notepad,C:\Windows\Notepad.exe
System Properties,rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl
Taskmgr,taskmgr
Control Panel,rundll32.exe shell32.dll,Control_RunDLL
------------------------------------------------------------------------------

Download Link: 
RunasUserTS.zip

Source code:

Leave a message and I will work on uploading the source