Beep boop
We were trying to diagnose a problem with Windows Updates today using Get-WindowsUpdateLog on Windows Server 2019. We kept getting blocked by ASR rule C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB (Block use of copied or impersonated system tools) which kept tripping on the script’s use of tracerpt.exe which is supposed to be located in C:\Windows\System32. We kept getting this: Looking … Read more
Update 2026-06-28 Thanks to reader Panos, the 2022-2025 script should now be fixed. There was an error with the regex in the script which has been corrected in the repo. Update 2026-05-19 I have one confirmation the 2022-2025 script works. The author said they had to tweak the regex in the script but didn’t provide … Read more
Update 2021-12-18 – This looks like a much more competent script for detecting this vulnerability and there is a python version for Linux: https://github.com/CERTCC/CVE-2021-44228_scanner Updated 2021-12-17 – Script is v1.4 and looks for .war files now too Original post below Inspired by the one-liner here: https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#find-vulnerable-software-windows I wrote a script to expand on the command, … Read more
Update – 2021-12-15 – I can confirm that the December Windows Updates have fixed this issue for us. After installing OS updates on all of our servers in November 2021 we ended up with three servers, all running 2019 Core and all Domain Controllers, where the Windows Defender Advanced Threat Protection Service would not … Read more
Over the summer we build a Remote Desktop Gateway Cluster to provide remote access to workstations for some of our clients. Initial testing worked great for Mac OS, Windows and Linux users. For Mac OS we had clients download the official Microsoft RDP App from the App Store. Right before go-live day we updated our … Read more