Download – Windows Security Audit Events Spreadsheet

Title: Windows Security Audit Events Spreadsheet
Published: 12/02/2015
Publisher: Microsoft Corporation 
Version: November 2015
File name: WindowsSecurityAuditEvents.xlsx
Size: 70 KB
Download URL: Click here for download

Pop Quiz:

1) What’s the Event ID for an Account Lockout?

2) What about the Event ID denoting that permissions were changed on an object?

3) Or the Event ID for locking or unlocking a workstation?

Don’t worry, I can’t remember those off the top of my head either. And that usually means sifting through bookmarked links, PDFs or hitting Google to look it up.

Fortunately, Microsoft has an Excel spreadsheet detailing 412 different Event IDs related to Windows Security Audit Events. Those 400+ Event IDs are broken up into the following nine categories:

  • Account Logon
  • Account Management
  • Detailed Tracking
  • DS Access
  • Logon/Logoff
  • Object Access
  • Policy Change
  • Privilege Use
  • System

The spreadsheet also contains a tab with a complete description of the event message. This is a great tool for creating event monitors. Download and enjoy!

VN:F [1.9.20_1166]
Rating: 10.0/10 (1 vote cast)

Windows Server 2012 and R2 Locks and Limits

The question came up today about using Windows Server Essentials as a RADIUS server. Part of the consideration involves the arbitrary restrictions placed on the OS. Microsoft differentiates the server products with what are affectionately know as “Locks and Limits”.

Most folks in IT are aware of OS limits like the number of users in Windows Server or not being able to RDP into Windows 7 Home Edition. But there are other less-obvious limits like RAM or IAS, RRAS & SMB connection limits.

Fortunately there are two handy spreadsheets that detail the Limits, Roles & Features that are (or are not) available in Windows Server 2012 & R2 Editions.

Windows Server 2012 R2 Locks and Limits

Windows Server 2012 R2 Locks & Limits
File: Windows Server 2012 R2 Products and Editions Comparison.pdf (222 KB)

  • Windows Server 2012 R2 Datacenter
  • Windows Server 2012 R2 Standard
  • Windows Server 2012 R2 Essentials
  • Windows Server 2012 R2 Foundation
  • Microsoft Hyper-V Server 2012 R2
  • Windows Storage Server 2012 R2 Standard
  • Windows Storage Server 2012 R2 Workgroup

Windows Server 2012 Locks & Limits
File: Windows Server 2012 Products and Editions Comparison.pdf (226 KB)

  • Windows Server 2012 Datacenter
  • Windows Server 2012 Standard
  • Windows Server 2012 Essentials
  • Windows Server 2012 Foundation
  • Microsoft Hyper-V Server 2012
  • Windows Storage Server 2012 Standard
  • Windows Storage Server 2012 Workgroup
  • Windows MultiPoint Server 2012 Premium
  • Windows MultiPoint Server 2012 Standard

Currently, there is no word yet on Windows Server 2016 since it’s still in Technical Preview at this time. However, once the licensing folks figure out how to squeeze every penny out of Server 2016 (I’m very interested to see what they do with Nano Edition) there should be an updated spreadsheet released.

VN:F [1.9.20_1166]
Rating: 10.0/10 (1 vote cast)

Remote Desktop Connection Tips

OK, so I’m probably the last person on the planet to learn of this feature, but on the left side of Remote Desktop Connection (MSTSC.exe) there’s a drop-down that exposes features for Windows 8, 8.1, Server 2012 and Server 2012 R2.

Drop-down for Windows 8 in latest RDP client

This is helpful when you’re on a Win8.x or 2012/R2 machine, RDPed into another machine and you’re not sure if (when you mouse up to the top-right or bottom-right) if you’re popping up the charms menu for your machine or the remote machine.

Also, speaking of Remote Desktop, there are 2 pieces to the puzzle:

  • Remote Desktop Protocol (RDP) – server
  • Remote Desktop Connection (RDC) – client

Below are the current versions and key features.

RDP 8.0 update (10/23/2012)
Windows 7 and Server 2008 R2 

  • RemoteFX for WAN
  • RemoteFX Network Auto Detect
  • RemoteFX Adaptive Graphics
  • RemoteFX Media Streaming
  • RemoteFX USB Redirection for non-RemoteFX vGPU virtual desktops
  • Support for nested sessions
  • Performance counters for monitoring user experience

RDC 8.1 update (2/10/2014)
Windows 7 and Server 2008 R2

  • Full support of transparent windows
  • Moves and resizes of RemoteApp windows
  • Thumbnails, aero peek, and live taskbar
  • Dynamic monitor and resolution changes
  • Support for session shadowing
VN:F [1.9.20_1166]
Rating: 9.5/10 (2 votes cast)

Windows Storage Spaces 2012 R2 Resources

Tonight (Wed 12/18/2013) I had the privilege of giving my talk on
Performance Benchmarking in Storage Spaces 2012 R2” for the
Cincinnati Networking Professionals Association (CiNPA).

For those who attended, and those interested in Storage Spaces, here are the resource links mentioned during the presentation:

Video – Storage Spaces: What’s New in Windows Server 2012 R2
Video - Storage Spaces: What’s New in Windows Server 2012 R2

Blog – Step-By-Step: Deploy Hyper-V on SMB 3.0
Blog - Step-By-Step: Deploy Hyper-V on SMB 3.0

Download – Iometer

eBay – Dell PowerEdge C1100 (2 proc, quad core, 24 GB, 1U) for $335
Dell PowerEdge C1100

Blog – Step-by-step for Storage Spaces Tiering in Server 2012 R2
Blog – Step-by-step for Storage Spaces Tiering in Server 2012 R2

Training – Free MVA Networking Fundamentals course
Training – Free MVA Networking Fundamentals course

Training – Free MVA Windows Server 2012: Storage
Training – Free MVA Windows Server 2012: Storage

Training – Free MVA Windows Server 2012 R2 Storage Jump Start: New Choices
Training – Free MVA Windows Server 2012 R2 Storage Jump Start: New Choices

Video – Using Microsoft Visio 2013 for Network Documentation (Parts 1-3)


Misc – My Pinterest #Bacon Collection

VN:F [1.9.20_1166]
Rating: 0.0/10 (0 votes cast)

Seagate Dips Their Toe in the Storage Spaces Water

Western Digital has been around for a while with their WD Sentinel SMB storage appliances, and now Seagate has joined the fray.

Enter the Seagate Business Storage Windows Server 4-Bay NAS.

Windows Storage Server 2012 Available with Seagate's New 4-Bay Business Storage NAS

OK, so right about now you’re saying, “Hey, a NAS and Storage Spaces aren’t the same thing.” But, if you look closer at the specs you’ll notice that this little box includes Windows Storage Server 2012 Workgroup, which means (drumroll please) it includes Storage Spaces.

Plus, it comes in four flavors:

  • 4TB ($1,005 ERP) #STDM4000100
  • 8 TB ($1,334 ERP) #STDM8000100
  • 12 TB ($,1539 ERP) #STDM12000100
  • 16 TB ($1,744 ERP) #STDM16000100

With a posted speed of up to 200 MB/sec you’re not exactly in SSD territory speed-wise, but you do get a lot of storage for your money.

Rather than listen to me re-hash all the specs, check out the blog post by Scott Johnson or cruise over to the official Seagate website for the NAS.

Props: @supersquatchy

VN:F [1.9.20_1166]
Rating: 10.0/10 (1 vote cast)

Stupid PowerShell Tricks – Getting Your PC to Talk

WarGamesRemember the 80’s? (Too young?)

One of my 80’s favorites was the movie WarGames.

(Hint: You should really watch it on Netflix – it’s a classic.
Here’s the WarGames movie trailer for you kids.)

Anyway, for those of you who DO remember War Games, that speech synthesizer was pretty creepy back in the day.
But it was equally cool because speech was pretty rare in those days unless you had a Texas Instruments TI-99/4A (which I did – woot!)

It’s hard to believe that movie came out 30 years ago, and technology has changed a lot. Windows has had speech built in for quite some time, but did you know you can access the speech API with PowerShell?

Who cares, right? WRONG! It’s pretty fun! And it’s a good bit of code to use to prank your IT co-workers. (Think login script or batch file that runs as a scheduled task…)

Here is a video demo of Windows Server 2012 reading classic computer lines from the movie WarGames:

“Joshua” from WarGames (1983) as played by Windows Server 2012 & PowerShell


Not too shabby for a Windows Server, eh?

So, shall we play a game?

Below is the PowerShell code for you to play with and tweak.
Have fun annoying people!


Copy-and-paste code for WarGames.ps1

    This script employs the Speech API for speaking
    and quotes lines from the movie "WarGames" (1983)
    At the beginning load the Speech API, create a SpeechSynthesizer object.
    It uses this object’s Speak method to speak
    File Name : WarGames.ps1
    Code From : DimiG |
    Requires  : PowerShell Version 2.0
    Just for tutorial

# Add text for speaking here
$text = @(`
"Hello, my name is Joshua.",`
"Greetings Professor Falken.",`
"Shall we play a game?",`
"Of course. I should reach DEF CON 1",`
"and launch my missiles in 28 hours.",`
"Would you like to see some projected kill ratios?",`
"What’s the difference?",`
"You are a hard man to reach.",`
"Could not find you in Seattle",`
"and no terminal is in operation at your classified address.",`
"D O D pension files indicate current mailing as:",`
"Dr Robert Hume,",`
"AKA Stephen W Falken,",`
"5 Tall Cedar Road.",`
"Strange game.",`
"The only winning move is not to play.",`
"How about a nice game of chess?"`

# Load the dll
[System.Reflection.Assembly]::LoadWithPartialName("System.Speech") | out-null

# Create new object
$spk = New-Object System.Speech.Synthesis.SpeechSynthesizer

# Step Up Volume
$spk.Volume = 100

# Check out voices installed on this computer…
$spk.GetInstalledVoices() | %{$_.voiceinfo}

# Now say…

Props: DimiG for the PoSh code

VN:F [1.9.20_1166]
Rating: 7.7/10 (3 votes cast)

Video – Windows Server 2012 Essentials

Rick Claus and Cristian Molina from Microsoft talk about Windows Server 2012.

Edge Show 63 - Windows Server 2012 Essentials

Title: Edge Show 63 – Windows Server 2012 Essentials
Run time: 23 minutes 23 seconds
Format: Silverlight

Can’t see the Silverlight video above?

Click the link below to choose another video format or to download offline.

  • MP3
  • MP4
  • WMV


VN:F [1.9.20_1166]
Rating: 0.0/10 (0 votes cast)

PowerShell – Move AD FSMO Roles in Server 2012

Over the long weekend we worked on two projects:

  1. Upgrade the Hyper-V hosts on the cluster at the data center
  2. Finish prepping a new Hyper-V host and Domain Controller for a new branch office with a new subnet

imageSince the cluster at the data center holds all of the Active Directory FSMO roles we needed to transfer the roles to an alternate location on the MPLS network so that project 1 didn’t slow down or stop project 2.

PowerShell to the rescue!


Open PowerShell as an Administrator and type:

netdom query fsmo

You’ll see each of the 5 FSMO roles and which domain controller holds them.

Using PowerShell to transfer FSMO roles

The 5 FSMO roles are numbered 0-4:

0 – PDCEmulator
1 – RIDMaster
2 – InfrastructureMaster
3 – SchemaMaster
4 – DomainNamingMaster

Why do we care what those numbers are? Because we can move the FSMO roles very quickly and save a lot of typing.

For example, which PowerShell command is easier to type?

Move-ADDirectoryServerOperationMasterRole -Identity “Target-DC” -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator

Or this one?

Move-ADDirectoryServerOperationMasterRole -Identity "Target-DC" -OperationMasterRole 0,1,2,3,4

Personally, if you’re moving all the roles at once to the same DC (like when doing some server maintenance) the 0,1,2,3,4 is easy.

Once you type in either of those commands you are prompted with several options for confirmation.

Y, A, N, L, S or ?

Moving FSMO roles with PowerShell


If you choose “Y” for Yes, PowerShell will prompt you to move each role,
then move to the next role, like this.

PowerShell FSMO role transfer - individual confirmation

If you choose “N” for No, PowerShell will skip transferring that role.

If you choose “A” for All, PowerShell will try to transfer all 5 roles to Target-DC.

If the transfer of a FSMO role fails PowerShell will let you know loud and clear.

PowerShell FSMO role transfer message


Unfortunately, if the transfer is successful you basically don’t get any confirmation of the role transfer.

You’ll need to run NETDOM QUERY FSMO to double-check who has the roles.
NETDOM QUERY FSMO to double-check FSMO role location

Side note – Once nice thing about using PowerShell to transfer the FSMO roles is that you can script the transfer to run at a scheduled time (so you don’t forget to put the roles back where they should be later).

Also, I didn’t have to load the Active Directory PowerShell module – Windows Server 2012 does that for me automatically.

VN:F [1.9.20_1166]
Rating: 9.4/10 (84 votes cast)

Download – Capacity Planner for Hyper-V Replica

Title: Hyper-V Replica Capacity Planner
Author: Microsoft Virtualization Team
Publisher: Microsoft Corporation
Published: 5/21/2013
File #1: Capacity Planner for Hyper-V Replica.docx
File size: 263 KB
Pages: 12
File #2: HVRCapacityPlanner.exe
File size: 437 KB
Price: FREE
Download URL: Click here to download

When considering deploying Hyper-V Replica numerous questions come up:

  • How much network bandwidth is required between the primary and replica site?
  • How much storage is required on the primary and replica site?
  • What is the storage impact by enabling multiple recovery points?

Microsoft released a new tool to help you answer those questions.

Tip: READ THE DOCUMENTATION (seriously – it’s only 12 pages).



VN:F [1.9.20_1166]
Rating: 0.0/10 (0 votes cast)

Everything You Wanted to Know About Hyper-V Replica

Hyper-VWe had a fun demo of how to configure and use Hyper-V Replica in Windows Server 2012 using two HP MicroServers at the KYSBSUG meeting on Thursday May 9, 2013. Hyper-V replica truly is one of the killer features of Windows Server 2012.

Below are the links we discussed at the KYSBSUG meeting along with some extra URLs from my Hyper-V Replica research.

Tip: If you’re completely green to Hyper-V Replica, check out out the VIR302 video below from TechEd 2012.

Bottom line – this list is pretty much anything you could ever want to know about Hyper-V Replica in Windows Server 2012:

Update 2013-05-10: Added 11 more Hyper-V Replica resources

VN:F [1.9.20_1166]
Rating: 10.0/10 (3 votes cast)