Disable Automatic Maintenance using PSEXEC

I had this exact same problem as the post describes. VM’s were laggy and cpu was at 100%, the culprit was “TiWorker.exe” , which is auto maintenance, not some nasty malware bug… But a ‘feature’ in Server 2012 and R2.

I went one stop further and added a command to use a text document which contained a list of server names, so I could disable on all the necessary servers – I’ll add that to the post if i find it:

Disable automatic maintenance with PSEXEC

DNS Bulk records creation

So I’m starting to work my way through all my favourites and anything that I found useful historically and came across this.

When you’ve got multiple linux appliances/VMs that you need to manually create host records for and especially on a green field site, or when installing a bunch of new kit – or even when you create a lot of infrastructure from bare bones, it’s always faster to have a good script to take away some of the pain of going through the manual process!

For me, this came in handy because I had 13 ESXi hosts with various linux virtual appliances that needed manually adding. The following link shows how you can either make use of DNSCmd, or powershell:

DNS Bulk records creation

WannaCry Attack and Petya

Yes, yes, we’re all sick of hearing about it this, but for those of you who didn’t get exposed to it, or did and needed that little bit more information, I’m posting it anyway.

As you may know, it wasn’t just Windows XP machines that got hit (contrary to popular media belief), there was a huge effect on Windows 7 machines that hadn’t been updated in a while.

I worked on this for the NHS and although it was mitigated by being a Horizon View environment, for another Trust, it was absolutely devastating to their physical environment.

So, aside from the patching you’ve all done and the MS KB:

KB4012212 for Win7 and KB4012213 for Server 2012

https://technet.microsoft.com/library/security/MS17-010

There is also the option to completely disable SMB v1. You can…Honest… It won’t break anything!

Good article from MS on why you NEED to stop using it and one on how to disable it:

https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/

https://blogs.technet.microsoft.com/staysafe/2017/05/17/disable-smb-v1-in-managed-environments-with-ad-group-policy/

Also, for those of you who would like to use a script, I found the following (somewhere!) Credit to the author!

=========================================================================

DISABLE SERVER SIDE SMB V1 PROTOCOL

=========================================================================

 

# Disable SMB V1 – Windows Server 2012 R2, Windows 10 and Windows 8.1

$ComputersList = Get-Content -Path “D:\temp\testservers.txt”

Invoke-Command -ComputerName $ComputersList {Remove-WindowsFeature FS-SMB1 -NoRestart}

 

# Disable SMB V1 – Windows 8 and Windows Server 2012

$ComputersList = Get-Content -Path “D:\temp\testservers.txt”

Invoke-Command -ComputerName $ComputersList {Set-SmbServerConfiguration -EnableSMB1Protocol $false}

 

# Disable SMB V1 – Windows Server 2008, Windows Server R2, Windows 7 and Windows Vista

$ComputersList = Get-Content -Path “D:\temp\testservers.txt”

Invoke-Command -ComputerName $ComputersList {Set-ItemProperty -Path”HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force}

 

 

=========================================================================

DISABLE CLIENT SIDE SMB V1 PROTOCOL

=========================================================================

 

# Disable SMB V1 – Windows Server 2012 R2, Windows 10 and Windows 8.1

$ComputersList = Get-Content -Path “D:\temp\testservers.txt”

Invoke-Command -ComputerName $ComputersList {Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart}

 

# Disable SMB V1 – Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012

$ComputersList = Get-Content -Path “D:\temp\testservers.txt”

Invoke-Command -ComputerName $ComputersList {sc.exe configlanmanworkstation depend= bowser/mrxsmb20/nsi}

Invoke-Command -ComputerName $ComputersList {sc.exe config mrxsmb10start= disabled}

 

Just goes to show that the reluctance for various institutions to perform updates needs to be overcome, as the consequences for older OS are becoming more and more serious!