Get-WindowsUpdateLog triggers Microsoft Attack Surface Reduction (ASR) Rules

We were trying to diagnose a problem with Windows Updates today using Get-WindowsUpdateLog on Windows Server 2019. We kept getting blocked by ASR rule C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB (Block use of copied or impersonated system tools) which kept tripping on the script’s use of tracerpt.exe which is supposed to be located in C:\Windows\System32. We kept getting this: Looking … Read more

Windows Updates failing after upgrading to Windows Server 2025 Core

My Homelab consists of 4 Windows Servers. They were all initially running Windows Server 2019 (2 GUI, 2 Core) which were at some point upgraded to Windows Server 2022 and then again to Windows Server 2025. After the latest in-place upgrades to Server 2025 my two GUI based installs had no problem installing Windows Updates … Read more

Quick add/remove Veeam exceptions for Microsoft Defender

Just upgraded my Homelab’s Veeam Deployment to 12.3 and during the process there was a big warning about having Antivirus exceptions configured properly for Veeam. In my environment I’m also using PostgreSQL as my database back-end for Veeam. Based on the information provided I whipped up a quick script to add/remove exceptions to Microsoft Defender … Read more

Domain Controllers no longer automatically renew certificates after configuring “Certificate Services Client – Auto-Enrollment” via GPO

This requires a fairly specific configuration to occur but I didn’t see this documented anywhere so I figured I’d write about it. If you run your own Enterprise Certificate Authority using the Active Directory Certificate Authority and have used the default ‘Domain Controller’ template you may run into this problem. By default, it does not … Read more