分类目录归档:Windows

Windows

iCACLS使用说明

iCACLS.exe (2003 sp2, Vista+)

Change file and folder permissions – display or modify Access Control Lists (ACLs) for files and folders.
iCACLS resolves various issues that occur when using the older CACLS & XCACLS

Syntax
   Add or remove permissions:
      ICACLS Name
         [/grant[:r] User:Permission[...]]
            [/deny User:Permission[...]]
               [/remove[:g|:d]] User[...]]
                  [/inheritance:e|d|r ]
                     [/setintegritylevel Level[...]]
                        [/T] [/C] [/L] [/Q]

   Store ACLs for one or more directories matching name into aclfile for later use with /restore:
      ICACLS name /save aclfile [/T] [/C] [/L] [/Q]
    
   Restore ACLs to all files in directory:
      ICACLS directory [/substitute SidOld SidNew [...]]
          /restore aclfile [/C] [/L] [/Q]

   Change Owner:
      ICACLS name /setowner user [/T] [/C] [/L] [/Q]

   Find items with an ACL that mentions a specific SID:
      ICACLS name /findsid Sid [/T] [/C] [/L] [/Q]

   Find files whose ACL is not in canonical form or with a length inconsistent with the ACE count:
      ICACLS name /verify [/T] [/C] [/L] [/Q]
 
   Replace ACL with default inherited acls for all matching files:
      ICACLS name /reset [/T] [/C] [/L] [/Q]
   This is equivalent to “Replace all child permission entries with inheritable permission from this object” in the GUI.

Key
   name  The File(s) or folder(s) the permissions will apply to.

   /T  Traverse all subfolders to match files/directories. This will apply permission changes to
       all subfolders whether or not they are set to inherit permissions from the parent. On very large
       directory structures this may take some time as the command has to traverse the entire tree.
   
   /C  Continue on file errors (access denied) Error messages are still displayed.
  
   /L  Perform the operation on a symbolic link itself, not its target.

   /Q  Quiet - supress success messages.

   /grant :r user:permission
       Grant access rights, with :r, the permissions
       will replace any previouly granted explicit permissions (for the given user).
       Otherwise the permissions are added.

   /deny user:permission
       Explicitly deny the specified user access rights.
       This will also remove any explicit grant of the 
       same permissions to the same user.

   /remove[:[g|d]] User 
       Remove all occurrences of User from the acl. 
       :g remove all granted rights to that User/Sid.
       :d remove all denied rights to that User/Sid.

   /inheritance:e|d|r
          e - Enable inheritance
          d - Disable inheritance and copy the ACEs 
          r - Remove all inherited ACEs

   /setintegritylevel [(CI)(OI)]Level 
       Add an integrity ACE to all matching files. 
       level is one of L,M,H (Low Medium or High)

             Mandatory Label\Low Mandatory Level    = Low.
             Mandatory Label\Medium Mandatory Level = Medium/Standard.
             Mandatory Label\High Mandatory Level   = Elevated.

             If No mandatory label is displayed in the output, it is Medium by default. 

       A Directory Inheritance option for the integrity ACE can precede the level
       and is applied only to directories:

   user   A user account, Group or a SID

   /restore  Apply the acls stored in ACLfile to the files in directory

   permission is a permission mask and can be specified in one of two forms:
        a sequence of simple rights:
                D - Delete access
                F - Full access (Edit_Permissions+Create+Delete+Read+Write)
                N - No access
                M - Modify access (Create+Delete+Read+Write)
                RX - Read and eXecute access
                R - Read-only access
                W - Write-only access
        a comma-separated list in parentheses of specific rights:
                DE - Delete
                RC - read control
                WDAC - write DAC
                WO - write owner
                S - synchronize
                AS - access system security
                MA - maximum allowed
                GR - generic read
                GW - generic write
                GE - generic execute
                GA - generic all
                RD - read data/list directory
                WD - write data/add file
                AD - append data/add subdirectory
                REA - read extended attributes
                WEA - write extended attributes
                X - execute/traverse
                DC - delete child
                RA - read attributes
                WA - write attributes
        inheritance rights can precede either form and are applied
        only to directories:
                (OI) - object inherit
                (CI) - container inherit
                (IO) - inherit only
                (NP) - don’t propagate inherit
                (I)  - Permission inherited from parent container

Unlike earlier command-line tools, iCACLS correctly preserves the canonical ordering of ACE entries:

  1. Explicit Deny
  2. Explicit Grant
  3. Inherited Deny
  4. Inherited Grant

Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACL’s from the folder where it was created.

An access control list (ACL) is a list of access control entries (ACE). When backing up or restoring an ACL with iCACLS, you must do so for an entire directory (using /save and /restore) even if you are only interested in the ACEs for a few individual files. In practice most permissions are set at the per-directory level.

Multiple /Grant /Deny /Remove clauses can be included in a single icacls command, on a large directory tree this has the advantage that the tree only has to be traversed once, rather than multiple times if you were to issue several consecutive icacls commands instead.

Modify vs Full control

  • To edit a file you must have the “Modify/Change” ACL (or be the file’s owner)
  • To use the iCACLS command to change the permissions of a file requires “FULL Control” (or be the file’s owner)
  • File “Ownership” will always override all ACL’s – you always have Full Control over files that you create.

Inheritance

Inherited folder permissions are given as:

 OI - Object inherit    - This folder and files. (no inheritance to subfolders)
 CI - Container inherit - This folder and subfolders.
 IO - Inherit only      - The ACE does not apply to the current file/directory

These can also be combined as follows:
 (OI)(CI)      This folder, subfolders, and files.
 (OI)(CI)(IO)  Subfolders and files only.
     (CI)(IO)  Subfolders only.
 (OI)    (IO)  Files only. 

So BUILTIN\Administrators:(OI)(CI)F means that both files and Subdirectories will inherit ‘F’ (Full control)
similarly (CI)R means Directories will inherit ‘R’ (Read folders only = List permission)

It is worth spending some time working out which permissions can be inherited and which need to be applied directly. On large/complex directory structures, minimising the number of ACLs can improve fileserver performance.

If inheritance is combined with /T (traverse subfolders) the change will apply to all folders, not just the top level.
for example:
icacls “C:\demo\example” /inheritance:e /T
Will traverse all subfolders below”C:\demo\example” and enable the inheritance for every one, this will replace any inheritance permissions that have been removed.

If no inheritance is specified, inheritance rules will not be changed but existing inherited permissions will be re-applied to existing objects in the specified location for the specified users/groups.
for example:
icacls “C:\demo\example” /grant administrators:(F) /T
This is similar to applying /reset to the child items of “C:\demo\example” but only resets the administrators group.

Built-In Groups

A command which addresses a built-in group by name like ICACLS foldername /GRANT Everyone:F /T
will only work when the system language is English.

To make this language independent, use an asterisk followed by the well-known SID for the group, see Q243330 for a list.

For example, to grant full control to Everyone on a folder: ICACLS foldername /GRANT *S-1-1-0:F /T

Running icacls under PowerShell

The options for icacls do not always run easily under PowerShell, but they can be made to work by setting a few variables and then executing with Invoke-Expression to expand all the variables:

#set PS variables for each of the icacls options
$Path = "c:\demo"   #The path must be the first thing passed to icacls
$Grant = "/grant:r"
$Remove = "/remove"
$replaceInherit = "/inheritance:r"
$permission = ":(OI)(CI)(F)"
$useraccount1 = "ss64dom\simon"
$useraccount2 = "administrators"
 
#run icacls using invoke Expression
Invoke-Expression -Command ('icacls $Path $replaceInherit $Grant "${useraccount1}${permission }"')

Examples:

Change the NTFS permissions on C:\demo\example\, remove all existing inherited permissions and replace with Full control for the Administrators group and Change/Modify permission for jsmith.
Apply the new permissions to the folder and inherit down to subfolders and files (OI)(CI):

icacls “C:\demo\example” /inheritance:r /grant:r Administrators:(OI)(CI)F
icacls “C:\demo\example” /grant:r Administrators:(OI)(CI)F /T
icacls “C:\demo\example” /grant:r ss64Dom\jsmith:(OI)(CI)M /T

or you can combine grants like:

icacls "C:\demo\example" /grant:r Administrators:(OI)(CI)F /T /grant:r ss64Dom\jsmith:(OI)(CI)M /T

View the permissions currently set on a folder:

icacls “C:\demo\example”

Grant the group FileAdmins ‘Delete’ and ‘Write DAC‘ permissions to C:\demo\example:

icacls “C:\demo\example” /grant:r FileAdmins:(D,WDAC)

Reset permissions on all child items below C:\demo\example\, note the use of \*, without that, the permissions would be reset to those of C:\demo\

icacls “C:\demo\example\*” /c /t /reset

Propagate a new permission to all files and subfolders of C:\demo\example\, without using inheritance:
(so if any of the subfolders contain specific permissions, those won’t be overwritten)

icacls “C:\demo\example” /grant:r accountName:(NP)(RX) /T

Backup the ACLs of every file in the current directory:

icacls * /save Myacl_backup.txt

Restore ACLS using a previously saved acl file:

icacls /restore Myacl_backup.txt

Change the Integrity Level (IL) of a file to High:

icacls MyReport.doc /setintegritylevel H

Remove all inheritance on the ‘Demo’ folder and grant access to the domain user ‘Volta’, in this command the /t will traverse existing subfolders and files, and the (CI) will ensure that new folders/files added in future will inherit these permissions:

icacls C:\demo\example /inheritance:r /grant SS64dom\Volta:(CI)F /t

Grant the user jdoe rights to create, edit and delete files in the folder C:\demo\example\, but prevent deletion of the folder itself:

:: First remove inheritance and grant admins Full control to the top folder
icacls “C:\demo\example” /inheritance:r /grant:r administrators:(OI)(CI)(F)

:: Grant Modify + Delete Child to subfolders and files only
icacls “C:\demo\example” /grant:r ss64Dom\jdoe:(OI)(CI)(IO)(M,DC) /T

:: Grant Read/Execute, Write and Append to the top level folder
icacls “C:\demo\example” /grant:r ss64Dom\jdoe:(RX,WD,AD)

:: if any pre-existing subfolders Grant admins Full control
icacls “C:\demo\example” /grant:r administrators:(OI)(CI)(F) /T

The above does set the correct permissions, but an undesired bug/side effect is that within the top level folder the Windows Explorer right click option to create New files will be empty – only New Folder is shown:

Right Click - New is empty

How to Install Windows on RAID 5 with Drives Larger than 2TB

Setting Up the PERC with the DISKPART Tool for Windows Install

This type of RAID array requires a partition using a GUID (Globally Unique Identifier) Partition Table (GPT) to work properly for Windows in UEFI BIOS mode. Windows Setup, however, does not support making a GPT partition in the standard setup dialogue. Diskpart from the Command Prompt must be used to create a GPT partition to allow setup to see the RAID partition and continue setup.


Figure 1

  1. Start the install, and load the PERC H310 drivers via the OS “Load Diver” function. After the driver is loaded the RAID volume will appear in the install to device list (Figure 1).
  2. Press Shift+F10 to bring up a Command Prompt window.
  3. Type DISKPART and press Enter to enter the DISKPART tool. Enter the commands in the following steps as shown in bold and press enter.
  4. DETAIL DISK – This shows a list of volumes seen by the system. Make note of the Volume number for the RAID array.
  5. SELECT DISK=X – X will be the Volume number of the RAID shown in the detail disk report.
  6. CLEAN – Clears the partition information.
  7. CONVERT GPT – Sets the partition to GPT.
  8. EXIT – Exits DISKPART.
  9. Exit the Command Prompt window.
  10. The full RAID volume should show in the device list.
  11. Complete the remainder of the installation process normally. The RAID volume should show as “Windows Boot Manager” in UEFI.

If this was completed correctly, the system should boot normally in UEFI BIOS mode, and allow Windows to install.

Configure IIS to listen on specific IPs

By default IIS will listen for connections on port 80 for any IP bound to the server. This happens even if there are no host headers or bindings set for a specific IP. This can be a problem when trying to run multiple web servers on port 80.

To set IIS to listen on specific IPs follow the instructions below.

Windows Server 2003/IIS 6:

1. This requires the Server 2003 support tools. If this is not already installed it can be downloaded here.

2. Once installed open a command prompt and navigate to the support tools installation folder (default is C:\Program Files\Support Tools).
cd C:\Program Files\Support Tools

3. Stop http.
net stop http /y

4. Use this command to display the current list of IPs:
httpcfg query iplisten

5. By default it will listen on all IPs (0.0.0.0) so we can remove this.
httpcfg delete iplisten -i 0.0.0.0

6. Specify the IP(s) that IIS should listen on. Make sure to update 127.0.0.1 to the desired IP and run the command for each IP IIS should listen on.
httpcfg set iplisten -i 127.0.0.1

7. Start http and test out your sites.
net start http

Windows Server 2008/IIS 7:

1. Open a command prompt and type “netsh”.
netsh

2. Type “http”.
http

3. Enter the following command to display the current list of IPs to listen on. Note if no IPs are displayed like in the below image, IIS will listen on all IPs (default).
show iplisten

4. Use the command below to set IIS to listen on a specific IP. Make sure to replace 127.0.0.1 with the correct IP and run the command again for any additional addresses.
add iplisten ipaddress=127.0.0.1

5. In case you need to delete an IP from this list, use the following command.
delete iplisten ipaddress=127.0.0.1

6. Restart IIS to apply these changes.
iisreset

IIS listening 127.0.0.1 instead 0.0.0.0

I use command:

netsh http show iplisten

and saw 127.0.0.1 in listening list. (But I didn’t add it manually). So I delete it and add 0.0.0.0 instead.

netsh http delete iplisten ipaddress=127.0.0.1

netsh http add iplisten ipaddress=0.0.0.0

Then I restarted iis server.

SSL certificates on Sites with Host Headers

Source:https://blogs.iis.net/thomad/ssl-certificates-on-sites-with-host-headers

Today I got the following question:

“I have two sites (siteV1.mysite.com and sitev2.mysite.com). They listen on the same IP address and port. We generated a certificate for siteV1.mysite.com and SSL is working properly. The problem is that some of our customers use siteV2.mysite.com and they are getting certificate errors. What’s the problem?”

Here is the issue:

There are three pieces of data to uniquely identify an IIS site:

  • The IP address
  • The Port
  • The Host name which HTTP 1.1 clients send as an HTTP request header. 

This IP:Port:Hostname triplet is called a binding. The binding “192.168.1.192:80:myserver” for example represents a site that listens on IP address 192.168.1.192, port 80, host-header myserver

The very first things IIS (HTTP.SYS to be more precise) does when a request comes in is to read the site’s configuration. Connection limits and timeouts are examples of site configuration. The site binding is used to find the right site configuration. The SSL certificate seems to be another great example of site configuration – the SSL certificate is needed to decrypt the encrypted SSL data coming from the client.

And the IIS User Interface certainly makes it appear as if the SSL certificate would be site configuration, too – doesn’t it? In reality however you can’t bind a SSL certificate to a site. The IIS UI is fooling you. But why? 

It’s a chicken and egg problem: The host name is encrypted in the SSL blob that the client sends. Because the host name is part of the binding IIS needs the host name to lookup the right certificate. Without the host name IIS can’t lookup the right site because the binding is incomplete. Without the certificate IIS can’t decrypt the SSL blob that contains the host name. Game over – we are turning in circles. 

What IIS does under the covers is to ignore the host name. IIS binds the certificate to IP:Port and warns you when you try to bind a certificate to the same IP:Port combo with different host names. 

But there is a way if you need two different sites on the same IP:Port. You can accomplish this by getting a certificate that contains both common names, i.e. sitev1.mysite.com and sitev2.mysitem.com. Cert Authorities usually allow more than one so called “common names” in a certificate. By binding the certificate to one of the two sites you won’t not get certificate errors anymore. The client is happy if one of the names in the certificate matches. 

But there is another caveat: you can’t use the IIS7 User Interface to add a host header to an SSL site binding. You have to use command-line tools, do it programmatically or edit applicationhost.config directly. Here is an example and a link how you can it via command-line:

appcmd set site /site.name:”MySite V2″ /+bindings.[protocol=’https’,bindingInformation=’*:443:sitev2.mysite.com’]

And last but not least: with IIS7 you can use the following command to figure out what certificate is bound to a particular IP:Port combination:  
netsh http show sslcert

This command will show the IP:Port binding but also some other SSL settings.

Windows Process Activation Service error 5 – Access Denied

解决办法:C:\INETPUB\HISTORY. Under here you will see several folders with a prefix of CFGHISTORY. The folder with the highest revision number will be your latest backup. Copy this file and overwrite the existing file at C:\WINDOWS\SYSTEM32\INETSRV\CONFIG.

I ran into a strange error recently on an Exchange 2013 server. The WWW Publishing Service was stopped. When I tried to start the service it failed on a dependency. A quick check revealed the Windows Process Activation Service (WAS) was stopped. When I tried to start WAS, I received the following error.

Windows could not start the Windows Process Activation Service service on Local Computer Error 13 The data is invalid

Windows could not start the Windows Process Activation Service service on Local Computer. Error 13: The data is invalid.

The Event Viewer was littered with equally cryptic Event IDs, such as WAS 5005 and WAS 5036. 继续阅读

Remove IIS Server version HTTP Response Header

How to remove HTTP response headers in IIS 7, 7.5, 8.0, 8.5, and ASP.NET. Windows Server IIS loves to tell the world that a website runs on IIS, it does so with the Server header in the HTTP response, as shown below. In this post I’ll show you how to remove response server headers in IIS. You don’t want to give hackers too much information about your servers, heh? ;-).

Normal HTTP Response headers

Even though I’m not a big fan of security by obscurity (are you?), removing common server response headers is often advised by security experts. Attackers might gain a lot of information about your server and network, just by looking at the response headers a web server returns.

Therefore it’s advised you remove at least some of them. 继续阅读

Windows远程管理

1、启用WinRM时,使用enable-psremoting -force命令时出现的一些错误处理:

PS C:\Users\Administrator> enable-psremoting -force
在此计算机上,WinRM 已设置为接收请求。
Set-WSManQuickConfig : 拒绝访问。
所在位置 行:50 字符: 33
+             Set-WSManQuickConfig <<<<  -force
    + CategoryInfo          : InvalidOperation: (:) [Set-WSManQuickConfig], InvalidOperationException
    + FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.SetWSManQuickConfigCommand

PS C:\Users\Administrator> Enable-PSRemoting -Force
在此计算机上设置了 WinRM 以接收请求。
Set-WSManQuickConfig : <f:WSManFault xmlns:f=”http://schemas.microsoft.com/wbem/wsman/1/wsmanfault” Code=”2″ Machine=”l
ocalhost”><f:Message><f:ProviderFault provider=”Config provider” path=”%systemroot%\system32\WsmSvc.dll”><f:WSManFault
xmlns:f=”http://schemas.microsoft.com/wbem/wsman/1/wsmanfault” Code=”2″ Machine=”web79-62.xm.vh.cnolnic.org”><f:Message
>无法检查防火墙的状态。 </f:Message></f:WSManFault></f:ProviderFault></f:Message></f:WSManFault>
所在位置 行:69 字符: 17
+                 Set-WSManQuickConfig -force
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Set-WSManQuickConfig],InvalidOperationException
    + FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.SetWSManQuickConfigCommand

处理方法:

gpedit.msc

计算机管理->管理模板->Windows组件->Windows远程管理(WinRM)->WinRM服务中

启用“允许通过WinRM进行远程服务器管理”

说明:

  1. 一般出现上述错误之后,虽然WinRM是启动的,但没有监控端口(5985);
  2. 启用策略之后要重启WinRM服务,正常情况下,监控端口5985有存在;
  3. 由于enable-psremoting -force没有正常运行,所以防火墙规则中要手工添加允许对5985的入站规则。如:netsh advfirewall firewall add rule name=”Windows Remote Management” dir=in action=allow profile=public,private,d
    omain protocol=tcp localport=5985 remoteip=<your ipaddress> description=”Windows Remote Management”

2、远程连接服务器进行管理(WinRM)时,出现如下错误:

[ipaddress] 连接到远程服务器 ipaddress失败,并显示以下错误消息: WS-Management 服务无法处理该请求。在 ipaddress计算机上的 WSMan: 驱动器中找不到 Microsoft.PowerShell 会话配置。有关详细信息,请参阅 about_Remote_Troubles
hooting 帮助主题。
    + CategoryInfo          : OpenError: (ipaddress:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : InvalidResourceUri,PSSessionStateBroken

解决办法:在要进行远程管理服务器上运行如下命令,然后重启WinRM服务

Get-PSSessionConfiguration | Enable-PSSessionConfiguration

PowerShell 远程执行任务

基础

MS 定义了一个叫做 WS-Management 的协议,这个协议为计算机设备远程交换管理数据提供了一个公开的标准。在 Windows 平台上,MS 通过 Windows 远程管理服务(Windows Remote Management service,简称 WinRM) 实现了 WS-Management 协议。这就是我们可以通过 PowerShell 执行远程操作的基础,因为 PowerShell 就是通过 WinRM 服务来进行远程操作的。 继续阅读

Nginx配置WebService、MySQL、SQL Server、ORACLE等代理

nginx配置webservice

#user  nobody;
worker_processes  4;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    upstream esbServer {   
        server 127.0.0.1:8083 weight=1 max_fails=2 fail_timeout=30s;   
    }

    #gzip  on;

    server {
        listen       8081;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /ladder_web {
            proxy_set_header X-real-ip $remote_addr;
            proxy_pass http://esbServer;
        }

       
    }

}

nginx 配置mysql代理 — 基于nginx1.9以上 stream module 继续阅读

Command Line-Version (SetACL.exe) – Syntax and Description

For a quick start, tell SetACL the following:

  • Object name (-on): This is the path to the object SetACL should operate on (file/directory/registry key/network share/service/printer).
  • Object type (-ot): What kind of object does the object name refer to: file or directory (file), registry key (reg), service (srv), printer (prn), network share (shr)?
  • Action (-actn): What should SetACL do with the object specified?

Example:

SetACL.exe -on c:\Windows -ot file -actn list

SetACL.exe -on c:\Windows -ot file -actn list

This lists the permissions set on the Windows directory in the default list format (CSV).

Have a look at the examples section to get an idea what more complex commands look like. 继续阅读