How-to Investigate Active Directory Logon Mischief

The Windows domain feature for locking accounts can be a helpful feature against malicious attempts to guess a password via brute force.

The version of netlogon.dll that has tracing included is installed by default on all currently supported versions of Windows. To enable debug logging, set the debug flag that you want by using nltest.exe, the registry, or Group Policy.

Group Policy

You will have to adjust a few policy settings to get the DCs to audit logon events. This are usually set correctly, but it can be worth a check of the environment to make sure the DCs are get the proper audit settings.

Audit account logon events for domain accounts and Audit logon events for logons to the computer.

Events

The Event IDs we are most concerned with are under the Windows Logs > Security section of Event Viewer.

  • 4624
  • 4776

If the auditing of Events on Domain Controllers doesn’t reveal the whole story, you can enable debug tracing in the NETLOGON service.

Enable Trace Logging in NETLOGON

If you try audit account logon but the workstation field keeps turning up empty you can enable trace logging on the DC trace debug logs output to C:\Windows\debug\netlogon.log

The log file netlogon.log can grow to 20MB and will be rotated out for a new log file.

To enable and disable trace logging in netlogon service, use the following nltest.exe commands respectively.

nltest.exe /dbflag:2080ffff
nltest.exe /dbflag:0

The following will be written to netlogon.log when you set the flags.

[MISC] [5584] DbFlag is set to 2080ffff

You will find entries these in the netlogon.log file.

[LOGON] [884] X: SamLogon: Transitive Network logon of (null)\ADMIN from (via X) Entered
[LOGON] [884] X: SamLogon: Transitive Network logon of (null)\ADMIN from (via X) Returns 0xC0000064

More information

https://support.microsoft.com/en-us/help/109626/enabling-debug-logging-for-the-netlogon-service

Increase Service Logging

At times it can be help to increase the logging for a given component, like LDAP Interface Events. You have to do this using regedit, under the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Conclusion

It can be hard to find logon activity in a Windows environment. But, if you have the right policies enabled and know which debug settings to turn when you need to troubleshoot activity, you will be that much further ahead.

Jun 2nd, 2020 • Filed under Active Directory, Microsoft, Windows Server

Extending iOS 13 UIColor

iOS 13 comes with a new color scheme, and to access the old system colors, you will need to reach for UIColor and maybe create a Color object, like so:

let ourColor = Color(UIColor.systemGray5)

Extending the UIColor class is made easy by switch extension.

extension UIColor {
    var asColor: Color {
        return Color(self)
    }
}

Use it like so:

let ourColor = UIColor.systemGray5.asColor
Jun 2nd, 2020 • Filed under Apple, iOS, Swift, SwiftUI

Different Uses for Those Extra Mouse Buttons

Input devices now come with a plethora of buttons, especially the devices for gamers. I don’t do much gaming on computers, but I use them for everything else.

The moment you can figure out a way to reduce tasks, your computing experience will be much better.

Logitech Options – MX Anywhere

In the world of Windows, I set the tilt buttons on the scroll wheel to move an active Window to another screen. The keyboard shortcut for these actions respectfully Win + Shift + Left/Right.

This ables me to quickly move a window from one monitor to the other, saving the need to drag windows from monitor to monitor.

In the land of macOS, yes I have Macs. I have two (2) monitors, I use applications mostly full screen and switch between the different full screens, two (2) applications per screen, you get the idea. They can be moved and adjusted through Mission Control, make applications full screen, unbind applications from each other, move to another screen, etc.

Logitech Options – MX Ergo Trackball

I use the tilt buttons to set the Desktop (Left or Right). I also make use of an extra button near the trackball to active Mission Control, this enables quick action on screens and full-screen applications

I use Logitech Options software to set the buttons accordingly. You will have to use the software that the vendor provides for your devices. Microsoft, Logitech, Kensington, etc.

Stay safe everyone.

Apr 11th, 2020 • Filed under Apple, Hardware, macOS, Microsoft, Windows

Prevent Bluetooth Power Saving from Disconnecting Peripherals

I was having issues with my Logitech MX Anywhere mouse on a Windows 10 notebook. The mouse would lose connection momentarily and there would be a noticeable lag before the computer and mouse would reconnect, annoying.

I struggled to find the root cause of this issue for some time. But, eventually nailed it to the aggressive power savings of Windows 10. There are options to turn this feature off.

If you have updated drivers, the next step is to check the power settings for the Bluetooth Chipset in your computer, in my case Intel Wireless Bluetooth.

Right-click and select Properties.

Machine generated alternative text:
Intel(R) Wireless Bluetooth(R) Properties 
General Advanced Diver Details Events 
Intel(R) Wireless Bluetooth(R) 
Device type 
Manufacturer 
Device status 
Intel Corporation 
Port #0007Hub #0001 
This device is working properly 
Change settings

If you aren’t an admin, click Change settings and enter administrator credentials.

Click the Power Management tab.

Machine generated alternative text:
Intel(R) Wireless Bluetooth(R) Properties 
General Advanced Diver Details Events 
Intel(R) Wireless Bluetooth(R) 
Power Management 
Allow the computer to tum off this device to save power 
Alo*' this device to wake the computer

Deselect the Allow the computer to turn off this device to save power check box. This feature can be overly aggressive in how Operating System (OS) and the Device Drivers management the power of the device.

Click OK to apply the changes.

Your Bluetooth mouse should not disconnect from the computer due to power aggressive power management any more.

Happy computing.

Mar 31st, 2020 • Filed under Microsoft, Windows