Way To Wisdom: June 2016

Thursday, June 30, 2016

Installing Dotnet Framework 3.5 offline on Windows 8/8.1

The .NET Framework is an integral part of many applications running on Windows and provides common functionality for those applications to run. The required .NET Framework version might be different for different software and the most required .NET Framework version is 3.5 which comes preinstalled in Windows 7. The .NET Framework 4.5 is included with Windows 8, the .NET Framework 4.5.1 is included with Windows 8.1 and the .NET Framework 4.6 is included with Windows 10.

BUT

Whenever you try to open a program requiring .NET Framework 3.5, you get following message:
An app on your PC needs the following Windows feature: .NET Framework 3.5 (includes .NET 2.0 and 3.0)

You can see .NET Framework 3.5 in "Add or remove Windows Features" in "Programs and Features" in Control Panel. But we end up with nothing.
Now, you dont have internet connectivity or you already have .NET Framework 3.5 with you or you dont want to waste your bandwidth to download.
The funniest thing is that if you try to install offline installer package you already have; we will get the same message.!

So what we have to do

1. First you'll need to copy Windows 8 setup files to your hard disk. If you have Windows 8 setup ISO copied in your system, you can mount it by right-click on it and select "Mount" option or you can extract its content using 7zip/WinRAR
If you have Windows 8 setup disc and don't want to copy its content, its ok. Just insert the disc in your CD/DVD drive so that Windows can access its content.

2. Now open Command Prompt as Administrator and then provide following command:
Dism /online /enable-feature /featurename:NetFx3 /All /Source:X:\sources\sxs /LimitAccess
Here "X:" represents the CD/DVD drive letter in your system which contains Windows 8 setup disc. Replace it with the correct drive letter according to your system.
If you extracted Windows 8 setup files in a directory, replace D:\sources\sxs with the correct path.

3. As soon as you execute the above mentioned command, Windows will start installing .NET Framework 3.5 in your system and it'll not require Internet connection.

It'll take a few minutes and you'll get a message that the operation completed successfully.
4. That's it. Now you have installed .NET Framework 3.5 in Windows 8 without using Internet connection.

Tuesday, June 28, 2016

Group Policy to disable USB Drives

simple effective and free way to block these as well as other forms of removable media on a windows computer.

1.	Create a GPO The first step is to open Group Policy Management and create a new GPO. I typically like to create 2 GPO's One for blocking read access and one for blocking write access. By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access. The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues. These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.
2.	Set the Desired Policy Items In your GPO browse to the following location. User Configuration > Policies > Administrative Templates > System > Removable Storage Access If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access. In my attached image i show an example of blocking all read access. Therefor to block read access to each of these media types simply enable the deny read access item for each. If you want to block write access enable the block write access options. If you want to block both the enable both options. Its really that simple. ---------------------------------------------------------------- Note: For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected. Within the Group Policy Editor, navigate to \Computer Configuration\Policies\Administrative Templates\System\Removable Storage Access. NOTE: If you prefer to set these restrictions on a per-user basis instead of computer-wide, then use the Group Policy path \User Configuration\Policies\Administrative Templates\System\Removable Storage Access. Group Policy – Removable Storage Access Note from the above screenshot that we can use Group Policy to limit access to the following device classes: Naturally, we want to apply GPO security filtering to ensure that only our desired users and computers are affected by our new policy. From the Group Policy Management Console we can make use of theSecurity Filtering and/or the WMI Filtering areas to properly scope our GPO. This is depicted in the following screen image: In order to put your new GPO into effect immediately, open an administrative command prompt and issue the following command: gpupdate/ force This command refreshes Group Policy throughout your Active Directory domain.
3.	Apply the GPO Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's. Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out. How the restriction works Once your GPO has been ingested by your domain, a user will see the following message box whenever they attempt to mount a restricted media device: In Local non domain computers Go to the client machine and go to start button and type in to search box `gpedit.msc` then your group policy window will open left side of window - search `application templates` and double click on it then click on `system` next you will see `removable storage access` just click on it then you will see lots of group policy name see the `all removable storage access: deny all access` double click on it and select the option `enable` and click on OK button you will success to block USB of client

Create a GPO

The first step is to open Group Policy Management and create a new GPO.

I typically like to create 2 GPO's One for blocking read access and one for blocking write access.

By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access.

The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues.

These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.

Set the Desired Policy Items

In your GPO browse to the following location.

User Configuration > Policies > Administrative Templates > System > Removable Storage Access

If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access.

In my attached image i show an example of blocking all read access.

Therefor to block read access to each of these media types simply enable the deny read access item for each.
If you want to block write access enable the block write access options.
If you want to block both the enable both options.

Its really that simple.

----------------------------------------------------------------
Note:

For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected.

Within the Group Policy Editor, navigate to

\Computer Configuration\Policies\Administrative Templates\System\Removable Storage Access.

NOTE: If you prefer to set these restrictions on a per-user basis instead of computer-wide, then use the Group Policy path

\User Configuration\Policies\Administrative Templates\System\Removable Storage Access.

Group Policy – Removable Storage Access

Note from the above screenshot that we can use Group Policy to limit access to the following device classes:

Naturally, we want to apply GPO security filtering to ensure that only our desired users and computers are affected by our new policy. From the Group Policy Management Console we can make use of theSecurity Filtering and/or the WMI Filtering areas to properly scope our GPO. This is depicted in the following screen image:

In order to put your new GPO into effect immediately, open an administrative command prompt and issue the following command:

gpupdate/ force

This command refreshes Group Policy throughout your Active Directory domain.

Apply the GPO

Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's.

Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out.

How the restriction works

Once your GPO has been ingested by your domain, a user will see the following message box whenever they attempt to mount a restricted media device:

In Local non domain computers

Go to the client machine and

go to start button and type in to search box gpedit.msc

then your group policy window will open

left side of window - search application templates and double click on it

then click on system

next you will see removable storage access just click on it

then you will see lots of group policy name

see the all removable storage access: deny all access

double click on it and select the option enable and click on OK button

you will success to block USB of client

Cant open exe files on windows

When you try to open EXE files, you may get errors messages like: "Access Deny", "Runtime error" etc.

This might be because of corrupt registry settings or some third party product (or virus) can change the default configuration for running EXE files. This may lead to failed operation when you try to run EXE files.

If you are using Windows XP and you enable "System Restore" , you need to disable "System Restore" in "Safe Mode" before using the instructions

1. Click Start, and then click Run.
2. Type "command.com" or "cmd" , and then press Enter. (A DOS window opens.)
3. Type the following: Press Enter after typing each one.
    "cd \"
    "cd windows"
4. Type copy "regedit.exe regedit.com" and then press Enter.
5. Type "start regedit.com" and then press Enter.
6. Navigate to and select the key:
HKEY_CLASSES_ROOT\exefile\shell\open\command
7. In the right pane, double-click the (Default) value.
8. Delete the current value data, and then type:
"%1" %*
   *Tip: Type the characters: quote-percent-one-quote-space-percent-asterisk.
9. Close Regedit utility.

Cheers

Change IP Configuration through commands

View Your Network Information

Before you change your IP address and related information, you’ll need to find the full name of the network for the interface you want to change. To do this, type the following command:

netsh interface ipv4 show config

Scroll down until you see the interface. In our example, we’re going to modify the Wi-Fi interface, which on our machine is just named “Wi-Fi.” You’ll also see other default names that Windows assigns to interfaces, such as “Local Area Connection,” “Local Area Connection 2,” and “Ethernet.” Just find the one you’re looking for and make note of the exact name. You can also copy and paste the name to Notepad.

Change Your IP Address, Subnet Mask, and Default Gateway

Set static IP

netsh interface ip set address name=”Local Area Connection” static 192.168.0.1 255.255.255.0 192.168.0.254

netsh interface ipv4 set address name="Wi-Fi" static 192.168.1.10 255.255.255.0 192.168.1.1

Set dynamic IP (DHCP)

netsh interface ip set address name=”Local Area Connection” source=dhcp

Set static Prefered DNS server

netsh interface ip set dns name=”Local Area Connection” static 192.168.0.250

Set alternate DNS server

netsh interface ip add dns name=”Local Area Connection” 8.8.8.8 index=2

Set dynamic Prefered DNS server

netsh interface ip set dnsservers name=”Local Area Connection” source=dhcp

Note: Those given in blue italics must be changed with your network adapter name in network settings and ip addresses of your network/service providers.

Cant run third party exe files on Windows 8

Cant run third party exe files on Windows 8

Windows 8 is a bit more secure than other earlier versions of windows. But it is too much annoying for the end user. Downloaded exe files are not allowed to run on windows 8 by default.

To install EXE files downloaded from the internet on Windows 8 you’ll need to modify the registry settings.
(You have to turn off UAC)

1) Start by going to the Run command and type in “regedit” without the quotes. The Windows Registry Editor will appear.

2) Next, navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

3) Click on the EnableLUA key and set the value to 0. This really disables UAC.

4) An Action Center message will appear prompting you to restart the computer to disable UAC.

5) Restart the computer and run EXE files downloaded from the internet at your own risk.

NOTE: You will not be able to run any apps from the Windows store. So disabling UAC for real does have its drawbacks, but remember you can always set EnableLUA back to 1 to run them.