A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
2answers
1k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...
0
votes
0answers
24 views

IIS server get flood [on hold]

I've build one application for a company. It's a client side windows application. In that application, I am sending data to a server using a TCP port. That process is working fine. But, suddenly! that ...
0
votes
1answer
65 views

How do I view a list of known unpatched windows xp arbitrary code execution vulnerabilities? [duplicate]

I know there is secunia and cve.mitre and ms kb database but I could not find a way to filter results only for operating system "windows xp" (or 2003 server, they share about the same code) with ...
1
vote
2answers
66 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
0
votes
1answer
26 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
0
votes
0answers
4 views

Where can I get name of the person who registered Windows and his organization? [migrated]

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
2
votes
1answer
67 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
0
votes
1answer
34 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
1
vote
0answers
29 views

Mcafee endpoint encryption doesn't see previously encrypted partition after Windows 7 reinstallation

My partitions C and D were encrypted and Windows 7 was installed on C. I copied all important files to D and then changed harddrive controller from IDE to AHCI, removed C and created it again and then ...
2
votes
2answers
1k views

Is this a valid Windows update page

In my chrome browser if I google for Windows Update the first hit is windowsupdate.microsoft.com/‎ When I click on it I am redirected to ...
1
vote
0answers
73 views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
0
votes
2answers
77 views

Trust relationship between domains

I am working in a organisation where it has a structure of parent company and Subsidiary. Both are individual domains without Trust. I work for Subsidiary Requirement is Subsidiary company should ...
4
votes
4answers
372 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
2
votes
2answers
141 views

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
6
votes
0answers
84 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
1
vote
3answers
176 views

USGCB on a non-networked computer

We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem ...
0
votes
1answer
28 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
1
vote
1answer
58 views

Safe to disable UAC?

I have programmed my own Windows kiosk application (.NET) which requires admin rights from the OS to ensure certain services are running (amongst other things). However, this causes the UAC prompt ...
1
vote
1answer
30 views

Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat? [closed]

I'm looking for a RSS feed or a mailing list that would allow me to be alerted of new CVEs impacting Windows or Red Hat that have a very high score, such as the recent ones for Shellshock and Winshock ...
16
votes
4answers
4k views

Can the Windows Schannel vulnerability be exploited by visiting a website?

Microsoft has just patched a vulnerability in Schannel that could allow remote code execution (MS14-066). What I can't find are any reliable details on how this can be exploited. I've seen some people ...
0
votes
1answer
145 views

Does MS14-066 affect CE versions of Windows?

I'm aware of the impact of MS14-066 to Windows servers/workstations, and have managed the patching our of desktop networks. However, I am concerned that our Windows CE systems may also be affected, ...
2
votes
1answer
219 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
1
vote
1answer
223 views

How does Bitlocker only-PIN method work?

Microsoft explained USB-key and TPM based BitLocker decryption process on this article. USB-Key process: The steps in the illustrated sequence are as follows: 1- The operating system starts ...
12
votes
6answers
13k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
2
votes
1answer
107 views

How Windows Server 2008 Stores Local Users Passwords?

It is not clear to me how Windows Srver 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored. The following article describes all the methods used by ...
3
votes
1answer
64 views

How to store client secret securely on application base in Windows?

I would like to store valuable client data (ex. passwords, OAuth tokens) in a way that they will be accessible only from one application (separation on application base). The mechanism must be ...
0
votes
0answers
9 views

DiskCryptor error. Can it be fixed? or what equivalent disc encryption software should be installed? Thanks [migrated]

DiskCryptor is giving me the error: "Not enough space after partitions to install bootloader. Install bootloader to first HDD track?". Then after clicking YES, I get "Error code: 20" then upon ...
1
vote
3answers
316 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
1
vote
1answer
34 views

Machine Certificate Key File Artifacts

When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys". When using the certificate mmc snapin or removing a ...
1
vote
1answer
95 views

Trojan/Worm Cridex Issue

Currently we are receiving a surge in machines that are being attacked with Cridex. We received several spam/infected emails that have used macros to we think deploy a backdoor trojan that is ...
-1
votes
0answers
19 views

How to locate a Windows application's hard-coded GUID from a hex dump [migrated]

I have a Windows bootstrapper application that I compile myself, but the framework it uses doesn't let me change a particular GUID that it stores in the Windows registry when it installs MSI packages, ...
1
vote
1answer
66 views

Recovering From Suspected MPEG Malware Attack

Against my better judgement I foolishly opened an MPEG video emailed to me from a friend's email address because the topic in the email was something we had recently discussed. I am fairly certain ...
1
vote
0answers
41 views

About Windows Interactive services Security

I know most services run under non interactive windows station or desktop also called session 0 while as some services (interactive) running under local system account create a window on interactive ...
1
vote
0answers
59 views

How to prevent users from booting at safe mode [migrated]

I need to prevent users from booting at safe mode because they are using it to cheat on Kaspersky endpoint security.
0
votes
0answers
41 views

How can the .rsrc section of a PE used for evil?

I was doing some work with a bootable iso and ClamXav notified me that if found a potential security threat in one of the drivers, nvstor32.sys, located in the iso. I was really curious, so I googled ...
1
vote
2answers
248 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
2
votes
2answers
80 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
0
votes
0answers
25 views

Disable Win FW - via WinRS? [migrated]

Security practitioner working on MCSA, trying to see what I could do with WinRS from remote, namely disabling the firewall. winrs -r:1.1.1.6 netsh firewall offline sh mode Returns that the firewall ...
1
vote
0answers
17 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
3
votes
1answer
32 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
-1
votes
1answer
89 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
0
votes
1answer
76 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
-3
votes
3answers
130 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
0
votes
0answers
110 views

How can I use Windows 10 unattended, without getting keylogged and sending everything to Microsoft? [migrated]

I would really like to test the technical preview of Windows 10. I don't want to just install a few programs on it and see if they work, I also don't just want to quickly check out the new ...
1
vote
1answer
125 views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
0answers
321 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
2
votes
1answer
139 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
3
votes
1answer
108 views

Dos Attack and other malwares!

I have been experiencing DoS attacks: ack scan and rst scan. Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that ...
158
votes
7answers
27k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
0
votes
1answer
55 views

Floppy disk partition showed up when USB Flash drive inserted

For one of my course's midterm lab portion, the professor provided us flash drives to put our project in. Everyone had their named labeled on one, so she gave me the last one left out, which had a ...