Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows-10]

An operating system developed by Microsoft released July 2015 and designed to run across devices with multiple form factors - PC, tablet, smartphone, Xbox and HoloLens.

0
votes
1answer
41 views

I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?

I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application. I did this at the same time as monitoring the application with ...
5
votes
2answers
80 views

How to prevent Windows Update from suspending BitLocker encrytion?

I was quite shocked today to see that a Windows 10 Pro machine that I recently set up with BitLocker (startup PIN + TPM with full disk encryption) suddenly didn't have BitLocker enabled anymore: And ...
0
votes
1answer
51 views

Does Windows 10 provide sufficient virus and threat protection? [closed]

I am configuring a new laptop with Windows 10 Home and trying to determine if it is necessary to buy one of the big antivirus packages such as Norton, McAfee, etc. Is the security software that comes ...
1
vote
1answer
93 views

WIN 10 hardening: Importance of “Allow system to be shut down without having to log on” policy

I am enforcing a hardening policy on my organization's work stations. One of the policies I removed, under Shutdown, is called "Allow system to be shut own without having to log on". Users started to ...
2
votes
1answer
71 views

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
2
votes
2answers
150 views

What can someone do with (non-admin) command prompt on a network?

Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator ...
1
vote
1answer
43 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
-1
votes
0answers
26 views

I messed up and opened a couple .docx files, and allowed them to run. What should I do? [duplicate]

I had a couple of emails from someone in my office saying to open the .doc attachment that was an invoice. I opened them but it was just blue and it said 'enable content to see the invoice'. I very ...
0
votes
0answers
10 views

Windows 10: Kerberos settings not found [migrated]

In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark. In this document, there is the ...
2
votes
1answer
58 views

prevent Ransomware on CIFS shares mounted on Windows 10

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
1
vote
2answers
136 views

How to copy files without copying Alternate Data Streams

I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
0
votes
1answer
55 views

SRUM (system resource usage monitor) forensics - Windows server?

Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
1
vote
2answers
86 views

What files can I keep to reinstall an infected system without getting infected again?

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have ...
1
vote
2answers
45 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
1answer
69 views

Can SMBv1 be secure if used for just SMB server discovery?

I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
0
votes
1answer
78 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
2
votes
1answer
100 views

Is RDRAND used in a safe way by Windows 10?

This question was already answered by Linus Torvalds for Linux, and is also cited in this Q/A on this stack: We use rdrand as _one_ of many inputs into the random pool, and we use it as a way to ...
0
votes
0answers
130 views

Something is visiting every URL after I do. What is it?

For each time I visit a unique URL on my web server, a mostly random Amazon owned IP address visits that URL fairly soon after. If I have a query string, and I use the same one that it's already ...
0
votes
0answers
19 views

Use local administrator and Domain Cached Credentials to obtain access to AD domain?

I have obtained local administrator privilege on a Windows machine connected to AD domain. Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins. I know that, it is possible to ...
0
votes
0answers
15 views

Methods for obtaining a Windows domain account, when having no domain account already?

I know of sniffing NTLM authentication, using a tool like Responder, and then brute-force these packets to obtain AD credentials. But what if the domain has disabled LLMNR and NetBIOS? Then Responder ...
0
votes
0answers
34 views

Which shims are used to patch memory?

Reading about Shims, I came across many suggestions that shims could be used to patch memory (for instance to inject a DLL). Unfortunately, I could not find the exact shims used to perform those ...
2
votes
1answer
110 views

Is there evidence to proof that Windows is spying us ? Are the anti-spy programs works and are they trustable?

Are there any evidences that Windows is spying the users ? Let's focus on Windows 10. I am almost sure it does. The things like telemetry and Cortana... However I never saw a proof like university ...
1
vote
1answer
93 views

Being connected to a trusted VPN, do I still need personal firewall, and if so, why?

Background Hardware: Dell Inspiron 15 Gaming 7577-92774 with recent BIOS (16-Aug-2018) Operating System: Windows 10 Pro, version 1803 (Build 17134.285) Antivirus / Firewall: ESET Smart Security ...
2
votes
1answer
94 views

Obtain NetNTLM/NTLM hash or login

In one CTF, I encountered a task that is solved by getting NetNTLM \ NTLM or just getting username. Tell me, please, is there any protocol that automatically sends NetNTLM / NTLM or username, when ...
3
votes
1answer
70 views

How does Windows knows a particular software is an AV?

First, I did some GoogleFu and came up with nothing. My question is: How does Windows 10 know things like McAfee, Symantec, AVG, etc are antivirus solutions? My assumption is that they set a ...
7
votes
2answers
231 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
1
vote
1answer
63 views

How to determine if Windows 10 executable can connect to my network

I'm considering use of a scanner driver I see on a website. I don't know the site or the owner so I'll be paranoid and assume that this Windows 10 exe is malicious. I can run the code in a throwaway ...
0
votes
2answers
91 views

Should I change my built-in Administrator password?

I had never thought much about this until the only account on my home PC somehow lost admin privileges (changing to guest - I suspect this is a Microsoft bug but will probably never know). So, ...
-1
votes
1answer
95 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
0
votes
1answer
92 views

Does this evidence seem consistent with an intrusion via the VNC server?

I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long: On two occasions over the past ~3 weeks, a hacker gained remote ...
1
vote
2answers
441 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
2
votes
2answers
91 views

Is there a way to prove that a program was executed on my Windows PC?

Can I prove that someone used an executable that connected to the Internet (not necessary a harmful one) on my Windows 10 PC? Especially when the program was installed on a removable device such as a ...
0
votes
0answers
15 views

Hyper-V keep enhanced session while blocking redirected drives

I'm creating a nested vm user desktop inside Windows 10 Enterprise. I'm using the hyper-v console, not mstsc.exe. The user desktop vm needs to use a headset and microphone which requires Enhanced ...
0
votes
0answers
50 views

Why 6.7 version of image magick can be exploitable even it is Vulnerable version?

I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
0
votes
0answers
63 views

Wireshark showing all ports being probed from my tablet

The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
3
votes
1answer
103 views

VeraCrypt mounted container safety

If I mount encrypted container, it stays in encrypted state until file is opened. At this moment, file is fetched in memory and decrypted - VeraCrypt - Beginner's Guide. Can malicious program open a ...
1
vote
0answers
87 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
0
votes
2answers
221 views

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)? This might be my only option to try before contacting my ISP which could be quite annoying to do.
0
votes
1answer
248 views

Can Microsoft collect data from inside a virtual machine?

If I spin up an OS in a VM, can Microsoft still collect and track data from the guest OS? I'm just wondering if Windows 10 collects that much data or not. Just FYI: no, I'm not a nutter that's ...
1
vote
0answers
79 views

How to block all aplications from internet connection?

I would like to block all windows10 applications from internet access So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
1
vote
0answers
64 views

Why is there no SEH handler found in Windows 10?

I use immunity debugger and mona.py to find SEH pointer in Windows 10. Command is !mona seh. But it says no pointer is found. I want to know what has changed in Windows 10 to protect against this ...
1
vote
1answer
127 views

Would it be a security risk if I moved PsTools to the windows system32 folder?

Microsfot Sysinternals has a helper program called PsTools inside this PsTools suite are a bunch of .exe tools that I use regularly from a command line. I was thinking about moving all these files to ...
3
votes
0answers
31 views

Is it possible to prevent rogue/unauthorised computers booting from your PXE server?

In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image? What risks are we exposed to should a malicious 3rd party boot ...
1
vote
1answer
87 views

Can a Windows program compromise the desktop hardware without giving administrator rights?

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive, and can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?...
1
vote
0answers
114 views

Decrypt to memory for editing

I am looking for a secure way to edit sensitive text data, using Git and Vim in the process. An ideal solution would be: clone the encrypted git repository into memory; decrypt into memory; do the ...
4
votes
2answers
105 views

What do the Disabled and NotBefore properties do for root certificates on Windows 10?

On this Microsoft page, they mention that a new feature in Windows 10 is that it can stop trusting root certificates using the Disabled and NotBefore properties. What is the exact meaning of these ...
0
votes
0answers
24 views

OS - Security Issues - Text Appearing - Performance Downgrade [duplicate]

First, I noticed PC performance downgrade, then random text started appearing in the different text fields (e.g. in Word when I was typing my text, half of page of some random text could appear or in ...
7
votes
1answer
603 views

Replacing cached domain credentials in SECURITY hive

Windows stores the (NTLM) hashes of local users' passwords in the SAM hive. By booting from a live system (for example), one can not only extract those hashes for offline cracking, but also simply ...
4
votes
1answer
2k views

BitLocker on Windows 10 Home

If I encrypt a flash drive using BitLocker on a Windows 10 Pro (With BitLocker supported and installed) device and put it in compatible mode, can I enter the key and read/write to and to/from it from ...
0
votes
0answers
76 views

Install dualboot Windows to avoid viruses

I need to work with some suspicious files or rather files without verified source. It is known that anti viruses(I use kaspersky and malwarebytes combined) fail to notice some hidden trojans. So I ...