Windows 10 – GPOs – Disable OneDrive

Need to disable Microsoft OneDrive in your enterprise?

Here’s how:

1. Open GPMC
2. Edit your GPO
3. Navigate to Computer Configuration | Administrative Templates | Windows Components | OneDrive
4. Double-click “Prevent the usage of OneDrive for file storage"
5. Select “Enabled”

All done!

Windows 10 – GPOs – Disable Mobile Hotspot

Need to avoid users from sharing their connection through a mobile hotspot?

Here’s how:

1. Open GPMC
2. Edit your GPO
3. Navigate to Computer Configuration | Administrative Templates | Network | Network Connections
4. Double-click “Prohibit use of Internet Connection Sharing on your DNS domain network"
5. Select “Enabled”

All done!

Windows 10 – GPOs – Disable Password Reveal

Don’t want anyone to see the typed password on your Windows logon screen or anywhere on system?

Here’s how:

1. Open GPMC
2. Edit your GPO
3. Navigate to Computer Configuration | Administrative Templates | Windows Components | Credential User Interface
4. Double-click “Do not display the password reveal button”
5. Select “Enabled”

If you want to apply this to Internet Explorer only:

1. Navigate to Computer Configuration | Administrative Templates | Windows Components | Internet Explorer | Security Features
2. Double-click “Do not display the password reveal button”
3. Select “Enabled”

Win10 Deploy – Changing Traffic Priority Wired vs. Wireless

If you’re doing an OS Deployment and you have both wired and wireless connections active, you may notice some strange behaviors during your deployment. This normally happens if for example for security reasons your wireless lan don’t have access to some resources.

To make sure your traffic always travels on your wired connection, simple run the following command that changes the priority of your ipv4 traffic:

netsh int ipv4 set interface “Ethernet” metric=2

Note that this command is for Windows 8 and above. For Windows 7 change “Ethernet” to “Local Area Connection”.

And you’re done!

Petya Ransomware – Protect Yourself!

And again…another large scale ransomware comes to the web…
This time, it’s called Pety and much like last month Wannacry, it overwrites the Master Boot Record (MBR) with Ramson:DOS/Petya.A and encrypts system drive sectors.
After a forced reboot, the user is locked out of the the system and coerced into purchasing a key to free up the system.
A recovery information similar to the screenshot above is displayed.
What should you do?

1 – If you haven’t done this before, during Wannacry threat, and  you’re lucky enough not to get infected, than you should install Microsoft MS17-010 Update Rollout

Here’s the direct links:

Product	Security Update Rollup	Standalone Update
Windows 10 / Server 2016 v1703	Already patched	N/A
Windows 10 / Server 2016 v1607	KB4022715	N/A
Windows 10 / Server 2016 v1511	KB4022714	N/A
Windows 10 / Server 2016 “v1”	KB4022727	N/A
Windows 8.1 / Server 2012 R2	KB4022717	KB4012213
Windows 8 / Server 2012	N/A	KB4012598
Windows 7 / Server 2008 R2	KB4022722	KB4012212
Windows Vista / Server 2008	N/A	KB4012598
Windows XP / Server 2003	N/A	KB4012598

2 – Now for Petya, you should patch your Microsoft Office with one of the following hotfixes from CVE-2017-0199:

Product	Update
Office 2007	KB3141529
Office 2010	KB3141538
Office 2013	KB3178710
Office 2016	KB3178703