Best posts made by x23piracy

Hi,

if someone else has to deal with ESET ERA and so on with it’s Remote Administrator that is using unique UUID’s.
The process ESET ERA is using to reset cloned agent uuid’s is very worse. A guy called (Ryan) from the eset forum and me decided to create our own agent reset utility.

If someone is interested i can share anything needed including source code.

Needed steps:

• Disable ESET Remote Administrator Service Startup to manual or disabled (you maybe need Safe-Mode to disable it)
• Call ResetERAgentUUID.exe within Setupcomplete.cmd or RunOnce

What it will do:

• Create new unique UUID
• Add UUID to ESET Remote Administrator’s Database file
• Add UUID to ESET Remote Administrator’s Registry Entry
• Set Service back to auto
• Start Service

What is it good for:

• Without unique id you will not see the client in ERA’s Webif

Download:

• Compiled: http://www25.zippyshare.com/v/yktkCCfN/file.html MD5 cd603b3ade720307185cf100120a7fce (zip)
• Source: 0_1470596155272_ResetERAgentUUID_src.zip

Requirements:

• Dot. 3.5 SP1
• Do not Install Endpoint Antivirus! The HIPS Module will pretend you from changing stuff we need to change. Install Endpoint via ERA Task but do not include it in your Image!

Regards X23

Hi,

please delete the following and try again:

rd /S /Q "C:\Users\Default\AppData\LocalLow"
rd /S /Q "C:\users\Default\AppData\Local\Microsoft\Windows\WebCache"
rd /S /Q "C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache"
del /F "C:\Users\Default\AppData\Local\Microsoft\Windows\WebCacheLock.dat"

This is only for newly created user accounts, if the account (profile) already exists you have to delete this in the specific profile, log off and on after that and try again.

I don’t know if that helps you, sources:

https://forums.fogproject.org/topic/10210/windows-10-1703-image-with-strange-issue
https://forums.fogproject.org/topic/10766/windows-10-1703-delete-this-if-you-use-copyprofile-in-unattend-xml

_Do you use “Copyprofile” within your unattend.xml? Which Win 10 Version is it? 1703, 1709, 1803, 1809 or 1903?

Regards X23

Hi,

what should i say? ok lol, they removed the extra option for powershell module in current proset setups, but if i choose to use more time reading everything i can find this:

Ok more googling until here:

ftp://ftp.supermicro.com/CDR-X9_1.23_for_Intel_X9_platform/Intel/LAN/v18.8/PRO1000/DOCS/SERVER/prosetdm.htm

PS c:\> Import-Module -Name "C:\Program Files\Intel\IntelNetCmdlets\IntelNetCmdlets"

Ok lets try:

Wooo that sh** works

The corresponding registry values seems to be this @Sebastian-Roth :

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001]
"*WakeOnPattern"="0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001\Ndi\Params\*WakeOnPattern]
"ParamDesc"="Akt. bei Musterübereinstimmung"
"type"="enum"
"default"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001\Ndi\Params\*WakeOnPattern\Enum]
"0"="Deaktiviert"
"1"="Aktiviert"

@Tom-Elliott said in Which table to check in db to see if there are pending wakeup entrys:

@Quazz Sure, I suppose, but not quite easily. You have to know exactly where the file is. I’m not 100% sure the file actually exposes the firmware configuration in that manner though.

i think you are absolutely right here because changing the pattern option via rdp interrupts the connection for ~5-6 seconds, seems to be a sign that the card reinitalizes (driver reload).

Regards X23

@LogicEthos said in Official Docker Container:

@Wayne-Workman working now thanks. I didn’t have a disk drive on my client. I didn’t think is was necessary to register with the host.

I was hoping to run a diskless Linux ISO.

Hi, is your fog docker project available for the public? I’ve just started today with docker and i am acutally on reading howto use docker
Idea, can we may work together on a fog docker container?

Regards X23

@Wayne-Workman i am not really used with github but i can upload it somewhere and share it sure.
Give me some time, if you like you can share it via github.

EDIT:

Post 1 updated @Wayne-Workman

Regards X23

Hi,

what about a fog client log from a problematic machine?

Regards X23

Hi,

nice script and i am thinking of a place where we can collect useful snapins that are based on script and not binary.
@Wayne-Workman maybe somewhere in the wiki?

I would also appreciate an embedded solution for this, because when i dismantle a computer (employee leaves the company) i always bring the computer/notebook back to stock, remove it from ad (manually, goto ads an remove computer account) and i deactivate our av license.

@tom-elliott So it would be really cool if we would have that option in the advanced tasks.

Regards X23

create a index.html in /var/www with the following content:

<meta http-equiv="refresh" content="0; URL=/fog">

Hi,

are you sure this is wrong? if you image a client and then fog client becomes active it will report afaik all known macs from a system, this could be lan, wlan, bt, or a virtual nic maybe more. Correct me guys if i am wrong but this can be a bug or is just a feature

@tom-elliott @Wayne-Workman @george1421

Regards X23

@psycholiquid you are correct and on the same point like @george1421 but please show which law should be broken by reading that information out of the bios, there is no. Please send me links with the fact, we don’t need to talk about reimaging OEM i know the fact but in the end this is my problem ;).

Last week i purchased a VL of Windows 10 Enterprise, i will become legal but there is a bit of work to do.

I really hate the way MS is pushing all the middle class into the enterprise sector!

We had a SAM examination 2 years ago, and it was really easy to please them The only thing you need to do is beeing coorporative with em. In the end we purchased some SQL licenses (we had to less of them) and had to dig for some invoices for computers with oem os (about 5 of each kind)

All that bullshit storys about MS is coming into your company are fables, i don’t know a single person/admin where that happened. With which right (law) would they gain house right for deeper inspections?

Regards X23

@ablohowiak could you please update to latest rc?

@Schuede have you already changed the background in iPXE Boot Menu settings?

When it’s black this is normally depending on the resolution of your image.

Regards X23

@psycholiquid said in FOG Client / FOS report bios product key to database (Host) Activate through BIOS key (Deployment):

Thats the problem though your buying the rights to use the OS not the license. The key stays with the machine no matter what so if you throw the machine away you throw away the OS. That is why they set it up the way they do. I’m not trying to argue, although it looks like I am just letting everyone know ahead of time I would hate to see backlash. I don’t agree with M$ at all but it is their world and we are just living in it.

As long as i own the machine, and i do and therefore feeling free to read any information whereever it’s stored as long as i don’t break any encryption or kind of protection this cannot be anything against a law, what ever whoever is writing into their EULA’s it’s up to the OEM and MS to protect this information if they really need this.

This sorry shit is only a try to gain their own profit against oem reselling or key stealing by removing a sticker or simply make a copy of the productkey only.

Windows as subscription will come

If the computers life time ends in our company we remove it from active directory, the antivirus software licensing and of course as host in the fog management, if done the key is been deleted, no fear ms i don’t collect your funny product keys

Regards X23

https://blog.mozilla.org/security/2017/01/20/communicating-the-dangers-of-non-secure-http/

enter about:config into the firefox address bar (confirm the info message in case it shows up) & search for the preference named security.insecure_field_warning.contextual.enabled. double-click it and change its value to false.

What about SSL support?

@jackiegl3350n said in Client 11.9 Will not Install Fails at CA Certificates:

For future reference, our antivirus was blocking the application from communicating with the server.

More details please, which antivirus product caused it, have you added an exclusion or how did you solve it?

Regards X23

@george1421 webif should be a known short for web interface

@captjoekpr http://stackoverflow.com/questions/19322345/how-do-i-change-the-default-index-page-in-apache

@Quazz http://www.thewindowsclub.com/offline-scan-using-windows-defender
https://www.deskmodder.de/wiki/index.php?title=Offline_Scan_beim_Booten_mit_dem_Windows_Defender

@netbootdisk apache access log?
https://stackoverflow.com/questions/9234699/understanding-apaches-access-log

Ok, this doesnt tell you what have been done, maybe this is something:

https://serverfault.com/questions/283513/apache-customlog-to-log-full-url

Anyway this will produce a big log you may need log rotation,

Regards X23

Hi,

that’s what i got so far:

service apache2 start
service php7.1-fpm start
service mysql start
service vsftpd start
service tftpd-hpa start
service FOGMulticastManager start
service FOGImageReplicator start
service FOGSnapinReplicator start
service FOGPingHosts start
service FOGSnapinHash start
service FOGImageSize start
/usr/bin/php -q /opt/fog/service/FOGTaskScheduler/FOGTaskScheduler &

Why is the FOGTaskScheduler no registered Service?

Is there a way to start all the services marked as startup service?

service --status-all

Using this command i can see the services are enabled to start but simply opening bash will bring my into an already booted system where just all the startup services has been forced to close. Is there a way to retrigger the service init?

root@x23i7:/mnt/c/Users/x23# service --status-all
 [ + ]  FOGImageReplicator
 [ + ]  FOGImageSize
 [ + ]  FOGMulticastManager
 [ + ]  FOGPingHosts
 [ + ]  FOGScheduler
 [ + ]  FOGSnapinHash
 [ + ]  FOGSnapinReplicator
 [ - ]  acpid
 [ + ]  apache-htcacheclean
 [ + ]  apache2
 [ - ]  apparmor
 [ ? ]  apport
 [ - ]  atd
 [ - ]  bootmisc.sh
 [ - ]  checkfs.sh
 [ - ]  checkroot-bootclean.sh
 [ - ]  checkroot.sh
 [ - ]  console-setup
 [ - ]  cron
 [ ? ]  cryptdisks
 [ ? ]  cryptdisks-early
 [ - ]  dbus
 [ - ]  hostname.sh
 [ ? ]  hwclock.sh
 [ + ]  irqbalance
 [ + ]  iscsid
 [ - ]  keyboard-setup.dpkg-bak
 [ - ]  killprocs
 [ - ]  kmod
 [ - ]  lvm2
 [ + ]  lvm2-lvmetad
 [ + ]  lvm2-lvmpolld
 [ - ]  lxcfs
 [ - ]  lxd
 [ - ]  mdadm
 [ - ]  mdadm-waitidle
 [ - ]  mountall-bootclean.sh
 [ - ]  mountall.sh
 [ - ]  mountdevsubfs.sh
 [ - ]  mountkernfs.sh
 [ - ]  mountnfs-bootclean.sh
 [ - ]  mountnfs.sh
 [ + ]  mysql
 [ ? ]  networking
 [ - ]  nfs-kernel-server
 [ ? ]  ondemand
 [ + ]  open-iscsi
 [ - ]  open-vm-tools
 [ + ]  php7.1-fpm
 [ ? ]  plymouth
 [ ? ]  plymouth-log
 [ - ]  procps
 [ - ]  rc.local
 [ + ]  resolvconf
 [ - ]  rpcbind
 [ - ]  rsync
 [ - ]  rsyslog
 [ - ]  screen-cleanup
 [ - ]  sendsigs
 [ - ]  ssh
 [ + ]  tftpd-hpa
 [ - ]  udev
 [ - ]  ufw
 [ - ]  umountfs
 [ - ]  umountnfs.sh
 [ - ]  umountroot
 [ - ]  unattended-upgrades
 [ - ]  urandom
 [ - ]  uuidd
 [ + ]  vsftpd
 [ - ]  xinetd

As you can see FOGTaskScheduler is no registered Service.

Is the PXE Services started with TFTP?
What about RPC Bind and NFS Server, howto start em?

Regards X23