Out of the box Thinking https://rnz.ro/ 这是一个由NotionNext生成的站点 Sun, 27 Aug 2023 21:50:07 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en-US All rights reserved 2023, RNZ <![CDATA[CyberSecurity Memo – Learning, Sharing, Creating]]> https://rnz.ro/article/7a47717e-0962-4c59-a5d6-f63dabcd3eca https://rnz.ro/article/7a47717e-0962-4c59-a5d6-f63dabcd3eca Sun, 06 Aug 2023 00:00:00 GMT
notion image
 
P I’ll pop Cloud
Free

Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet

Jul 7, 2023
netsec
Deepnote is a collaborative data notebook for Python, SQL, and no-code analysis. It runs in the cloud and connects securely…
Vulnerability Scan

Tenable Vulnerability Management – Tenable.IO Tips and Tricks with Best Practices

Jul 7, 2023 netsec
Tenable Vulnerability Management® (formerly known as Tenable.io) allows security and audit teams to share multiple Tenable Nessus, Tenable Nessus Agent, and Tenable Nessus Network…
Cloud Free

A Free Online One Hour VPS (No Registration Required, Root Access, 2G RAM, 3GHz CPU)

Jun 28, 2023 netsec
CloudSigma is 100% Swiss-owned and based cloud service provider, which offers 15 cloud locations (as of June 2023) in Europe,…
Vulnerability Scan

Qualys PCI Scan and Vulnerability Scanning Tips and Tricks

Jun 28, 2023 Jonny
The Qualys Cloud Platform and its integrated apps can simplify security operations and lower the cost of compliance by delivering…
Partner

PTT Turkey Tracking: Revolutionizing the World of Logistics

Jun 28, 2023 netsec
When it comes to online shopping, being able to see where our packages are is just as important as receiving…
CyberArk

CyberArk P-Cloud (CyberArk Privilege Cloud) Deployment

Jun 24, 2023 netsec
This post summarizs the steps to deploy your P-Cloud. Interface Once you subscribed P-Cloud, you will get an activation email…
Cloud

HetrixTools – A Free & Powerful with Full Function Website and Server Performance Cloud Monitor Site

HetrixTools (beta), launched in May 2015, was created with the purpose of giving webmasters a useful set of monitoring tools…
Cloud

Azure AD PowerShell Commands and Usages

May 28, 2023 netsec
The Azure PowerShell Az module is a rollup module. Installing the Az PowerShell module downloads the generally available modules and…
Architecture

Canadian Cybersecurity and Privacy Framework

In Canada, the cybersecurity legal landscape is governed by various laws including privacy, anti-spam, criminal liability, and intellectual property:
Docker

[5 Min Docker] Free Sshwifty Web SSH & Telnet Client Deploy to Koyeb

May 28, 2023 netsec
Sshwifty is a SSH and Telnet connector made for the Web. It can be deployed on your computer or server to…
Azure

PowerApp Studying Notes

May 28, 2023 netsec
Microsoft Power Apps makes it easy for everyone to build professional-grade, custom business apps. Power Apps empowers everyone, no matter their…
Linux

Learning Unix By Access This Public Free Unix Server (Running Since 1987)

May 28, 2023 netsec
Super Dimension Fortress (SDF, also known as freeshell.org) is a non-profit public access UNIX shell provider on the Internet. It…

Posts navigation

CategoriesAI (7) Architecture (23) Azure (13) Blog (24) Checkpoint (80) Cisco (72) Cloud (100) CyberArk (50) Docker (41) F5 (11) Fortigate (17) Free (2) Guardium (18) Juniper (60) Linux (41) Network (53) Others (12) Palo Alto (8) Partner (9) Python (3) Raspberry Pi (8) Security (71) SIEM (21) Software (45) Symantec (14) Threat Hunting (18) Thycotic (21) Vmware (21) VPN (40) Vulnerability Scan (8) Windows (18) Wireless (6) report this ad Recent Posts • Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet • Tenable Vulnerability Management – Tenable.IO Tips and Tricks with Best Practices • A Free Online One Hour VPS (No Registration Required, Root Access, 2G RAM, 3GHz CPU) • Qualys PCI Scan and Vulnerability Scanning Tips and Tricks • PTT Turkey Tracking: Revolutionizing the World of Logistics • CyberArk P-Cloud (CyberArk Privilege Cloud) Deployment report this ad Recent Comments • netsec on Methods to Renew Microsoft 365 Developer Subscription • developer on Methods to Renew Microsoft 365 Developer Subscription • philip on Install WSA (Windows Subsystem for Android) and Android Apps In Windows 11 W/O Amazon Appstore • Sudhanshu Shekhar on CyberArk 12.1 Lab – 5. PSM Installation • Ashok Kumar on Install PAS (Privileged Account Security) Vault High AvailabilityArchives Archives Select Month Select MonthSelect Month July 2023 (2) July 2023 (2) June 2023 (4) June 2023 (4) May 2023 (8) May 2023 (8) April 2023 (19) April 2023 (19) March 2023 (1) March 2023 (1) February 2023 (9) February 2023 (9) January 2023 (7) January 2023 (7) December 2022 (18) December 2022 (18) November 2022 (14) November 2022 (14) October 2022 (4) October 2022 (4) September 2022 (7) September 2022 (7) August 2022 (7) August 2022 (7) July 2022 (7) July 2022 (7) June 2022 (8) June 2022 (8) May 2022 (2) May 2022 (2) April 2022 (3) April 2022 (3) March 2022 (4) March 2022 (4) February 2022 (13) February 2022 (13) January 2022 (7) January 2022 (7) December 2021 (1) December 2021 (1) November 2021 (8) November 2021 (8) October 2021 (11) October 2021 (11) September 2021 (3) September 2021 (3) August 2021 (3) August 2021 (3) July 2021 (15) July 2021 (15) June 2021 (7) June 2021 (7) May 2021 (12) May 2021 (12) April 2021 (7) April 2021 (7) March 2021 (10) March 2021 (10) February 2021 (11) February 2021 (11) January 2021 (16) January 2021 (16) December 2020 (10) December 2020 (10) November 2020 (17) November 2020 (17) October 2020 (1) October 2020 (1) September 2020 (3) September 2020 (3) August 2020 (13) August 2020 (13) July 2020 (11) July 2020 (11) June 2020 (18) June 2020 (18) May 2020 (8) May 2020 (8) April 2020 (30) April 2020 (30) March 2020 (12) March 2020 (12) February 2020 (7) February 2020 (7) January 2020 (7) January 2020 (7) December 2019 (10) December 2019 (10) November 2019 (8) November 2019 (8) October 2019 (7) October 2019 (7) September 2019 (9) September 2019 (9) August 2019 (12) August 2019 (12) July 2019 (2) July 2019 (2) June 2019 (2) June 2019 (2) April 2019 (1) April 2019 (1) March 2019 (10) March 2019 (10) February 2019 (4) February 2019 (4) January 2019 (11) January 2019 (11) December 2018 (1) December 2018 (1) November 2018 (17) November 2018 (17) October 2018 (7) October 2018 (7) September 2018 (2) September 2018 (2) August 2018 (8) August 2018 (8) July 2018 (4) July 2018 (4) May 2018 (4) May 2018 (4) April 2018 (2) April 2018 (2) February 2018 (7) February 2018 (7) January 2018 (3) January 2018 (3) December 2017 (1) December 2017 (1) November 2017 (3) November 2017 (3) October 2017 (4) October 2017 (4) September 2017 (8) September 2017 (8) July 2017 (4) July 2017 (4) May 2017 (2) May 2017 (2) April 2017 (2) April 2017 (2) March 2017 (7) March 2017 (7) February 2017 (6) February 2017 (6) January 2017 (3) January 2017 (3) December 2016 (2) December 2016 (2) November 2016 (9) November 2016 (9) October 2016 (8) October 2016 (8) September 2016 (4) September 2016 (4) August 2016 (4) August 2016 (4) July 2016 (2) July 2016 (2) June 2016 (5) June 2016 (5) May 2016 (1) May 2016 (1) April 2016 (6) April 2016 (6) March 2016 (9) March 2016 (9) February 2016 (6) February 2016 (6) January 2016 (13) January 2016 (13) December 2015 (11) December 2015 (11) November 2015 (5) November 2015 (5) October 2015 (7) October 2015 (7) September 2015 (3) September 2015 (3) August 2015 (8) August 2015 (8) July 2015 (4) July 2015 (4) June 2015 (5) June 2015 (5) May 2015 (6) May 2015 (6) April 2015 (4) April 2015 (4) March 2015 (7) March 2015 (7) February 2015 (9) February 2015 (9) January 2015 (8) January 2015 (8) December 2014 (5) December 2014 (5) November 2014 (3) November 2014 (3) October 2014 (10) October 2014 (10) September 2014 (12) September 2014 (12) August 2014 (9) August 2014 (9) July 2014 (4) July 2014 (4) June 2014 (9) June 2014 (9) May 2014 (9) May 2014 (9) April 2014 (3) April 2014 (3) March 2014 (6) March 2014 (6) February 2014 (4) February 2014 (4) January 2014 (4) January 2014 (4) October 2013 (3) October 2013 (3) September 2013 (4) September 2013 (4) August 2013 (4) August 2013 (4) June 2013 (5) June 2013 (5) May 2013 (5) May 2013 (5) April 2013 (3) April 2013 (3) March 2013 (4) March 2013 (4) February 2013 (1) February 2013 (1) January 2013 (5) January 2013 (5) December 2012 (2) December 2012 (2) October 2012 (3) October 2012 (3) September 2012 (2) September 2012 (2) July 2012 (1) July 2012 (1) June 2012 (3) June 2012 (3) May 2012 (1) May 2012 (1) April 2012 (2) April 2012 (2) March 2012 (3) March 2012 (3) February 2012 (8) February 2012 (8) January 2012 (13) January 2012 (13) December 2011 (10) December 2011 (10) November 2011 (9) November 2011 (9) • RSS - Posts • RSS - Comments 51Sec Sites ; This is a modal window.No compatible source was found for this media.
Cloud Free Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet Jul 7, 2023 netsec
CyberArk Privilege Cloud is a SaaS solution that enables organizations to securely store, rotate and isolate credentials (for both human…

Oracle Cloud Cleaning Up Idle Compute Instances & How to Keep it

May 16, 2023 netsec
Recently some Oracle Cloud Free Tier users received a email regarding their compute instances identified as idle. And the those…

Integrate ShareX with Free Forever S3 Compatble Storage Solution – Tebi.io (25G Storage, 250GB Outbound Traffic)

Apr 27, 2023 netsec
Tebi.io is a s3 compatible geographically distributed object storage solution. It is available with a free trial, or on a…
Architecture

CyberSecurity Review Resources for SaaS / PaasS & Other IT Solution

Apr 27, 2023 netsec
This post collects some useful resources to have a proper CyberSecurity review to any SaaS, PaaS, and other IT solutions.
AI

Two Things You Can Do If ChatGPT Has Been Blocked

Lately, what ChatGPT can do has brought up lots of concerns of data security and privacy, which cause ChatGPT got…

Risk Management Knowledges

Apr 27, 2023 netsec
Governance is at the centre of effective technology risk management. Those charged with governance should work with the management team…
Security

Gartner Magic Quadrant for Access Management (2015 – 2022)

Apr 27, 2023 Jon
Today’s businesses require secure 24/7 access to their cloud applications and data, and require more than Web Single Sign-On to…

SOC2 Summary

Apr 27, 2023 netsec
SOC 2 is a compliance framework designed and maintained by the American Institute of CPAs (AICPA). SOC 2’s security guidelines are…
AI

Free Online AI Drawing Playgrounds

Apr 27, 2023 netsec
There are many image generating models such as, Stable Diffusion, DALL-E2 and Midjourney. The main difference between Stable Diffusion and…
AI

Online Free AI Text to Video Generator Sites

Apr 27, 2023 netsec
Today, artificial technology is everywhere. We’ve talked a lot about AI creating tools and even AI builders, but what about…
AI

How to Use Google Colab to Run Stable Diffusion Web GUI to Draw AI Images

Apr 27, 2023 netsec
If you have a browser, you will be able to use Google Colab to run Stable Diffusion Web UI created…
Docker

Next Terminal – Another Interactive Auditing Bastion System (Simple to Install and Easy to Use)

Apr 27, 2023 netsec
My previous post introduced two bastion host. In this post, I am going to introduce another one, Next Terminal, which…
Cloud Free Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet Jul 7, 2023 netsec
Third party firewall or networking OS can be easily installed Barracuda CloudGen firewall since it is using a standard compatible…
AI

Online Free AI Text to Video Generator Sites

Apr 11, 2023 Jon
Today, artificial technology is everywhere. We’ve talked a lot about AI creating tools and even AI builders, but what about…
AI

How to Use Google Colab to Run Stable Diffusion Web GUI to Draw AI Images

Apr 9, 2023 netsec
If you have a browser, you will be able to use Google Colab to run Stable Diffusion Web UI created…
AI

Using AI to Draw Realistic Images – Github Project

Apr 9, 2023 netsec
ChatGPT has been out for a while, which raises lots of discussion and interesting on using those artificial intelligence technologies…
Blog

Free Internet Online Database Hosting Websites

Apr 9, 2023 netsec
Here is the definition of a database according to the dictionary: Structured set of files regrouping information having certain characters…

[5 Mins Docker] Deploy A Self-Hosted Speedtest App with Test History Results – Speedtest-x

Apr 9, 2023 netsec
This Github Speedtest-x project is an extension of LibreSpeed, which is a pretty lightweight speedtest tool. Speedtest-x project uses file datebase to…
Azure

Run Pipelines in Azure DevOps For Free

Azure Pipelines provides a quick, easy, and safe way to automate building your projects with consistent and quality code that’s…

Microsoft Azure DevSecOps: Application Security Principles and Practices Resources

Apr 9, 2023 netsec
Azure DevOps provides developer services for allowing teams to plan work, collaborate on code development, and build and deploy applications.…
Security

NPM (Nginx Proxy Manager) – Configure Basic HTTP Authentication and Use Universal SSL Certificate from Cloudflare

Apr 9, 2023 netsec
This post is to show you some useful features from NPM. You can restrict access to your website or some…
Docker

[5 Mins Docker] Deploy A Light Weight, Super Fast and Nice Personal Navigation Site – Flame (Docker Run & Fly.io)

Mar 9, 2023 netsec
Based on Github project page, Flame is self-hosted startpage for your server. Its design is inspired (heavily) by SUI. Flame…
Security

List Your Folder / Files NTFS Permission into CSV File For Audit Check

Feb 24, 2023 netsec
Managers and compliance auditors often ask IT admins or security admins to present a report listing file share permissions granted…
Cloud

Create Your Own Domain Free Web App & Running 7x24x365 with Replit – Free Online IDE SaaS Website

Feb 16, 2023 netsec
Replit, formerly Repl.it, is a San Francisco-based start-up and an online integrated development environment. Replit being Software as a service…

Posts navigation

1 2 3 4 … 73
CategoriesAI (7) Architecture (23) Azure (13) Blog (24) Checkpoint (80) Cisco (72) Cloud (100) CyberArk (50) Docker (41) F5 (11) Fortigate (17) Free (2) Guardium (18) Juniper (60) Linux (41) Network (53) Others (12) Palo Alto (8) Partner (9) Python (3) Raspberry Pi (8) Security (71) SIEM (21) Software (45) Symantec (14) Threat Hunting (18) Thycotic (21) Vmware (21) VPN (40) Vulnerability Scan (8) Windows (18) Wireless (6) report this ad Recent Posts • Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet • Tenable Vulnerability Management – Tenable.IO Tips and Tricks with Best Practices • A Free Online One Hour VPS (No Registration Required, Root Access, 2G RAM, 3GHz CPU) • PTT Turkey Tracking: Revolutionizing the World of Logistics • CyberArk P-Cloud (CyberArk Privilege Cloud) Deployment report this ad Recent Comments • netsec on Methods to Renew Microsoft 365 Developer Subscription • developer on Methods to Renew Microsoft 365 Developer Subscription • philip on Install WSA (Windows Subsystem for Android) and Android Apps In Windows 11 W/O Amazon Appstore • Sudhanshu Shekhar on CyberArk 12.1 Lab – 5. PSM Installation • Ashok Kumar on Install PAS (Privileged Account Security) Vault High AvailabilityArchives Archives Select Month Select MonthSelect Month July 2023 (2) July 2023 (2) June 2023 (4) June 2023 (4) May 2023 (8) May 2023 (8) April 2023 (19) April 2023 (19) March 2023 (1) March 2023 (1) February 2023 (9) February 2023 (9) January 2023 (7) January 2023 (7) December 2022 (18) December 2022 (18) November 2022 (14) November 2022 (14) October 2022 (4) October 2022 (4) September 2022 (7) September 2022 (7) August 2022 (7) August 2022 (7) July 2022 (7) July 2022 (7) June 2022 (8) June 2022 (8) May 2022 (2) May 2022 (2) April 2022 (3) April 2022 (3) March 2022 (4) March 2022 (4) February 2022 (13) February 2022 (13) January 2022 (7) January 2022 (7) December 2021 (1) December 2021 (1) November 2021 (8) November 2021 (8) October 2021 (11) October 2021 (11) September 2021 (3) September 2021 (3) August 2021 (3) August 2021 (3) July 2021 (15) July 2021 (15) June 2021 (7) June 2021 (7) May 2021 (12) May 2021 (12) April 2021 (7) April 2021 (7) March 2021 (10) March 2021 (10) February 2021 (11) February 2021 (11) January 2021 (16) January 2021 (16) December 2020 (10) December 2020 (10) November 2020 (17) November 2020 (17) October 2020 (1) October 2020 (1) September 2020 (3) September 2020 (3) August 2020 (13) August 2020 (13) July 2020 (11) July 2020 (11) June 2020 (18) June 2020 (18) May 2020 (8) May 2020 (8) April 2020 (30) April 2020 (30) March 2020 (12) March 2020 (12) February 2020 (7) February 2020 (7) January 2020 (7) January 2020 (7) December 2019 (10) December 2019 (10) November 2019 (8) November 2019 (8) October 2019 (7) October 2019 (7) September 2019 (9) September 2019 (9) August 2019 (12) August 2019 (12) July 2019 (2) July 2019 (2) June 2019 (2) June 2019 (2) April 2019 (1) April 2019 (1) March 2019 (10) March 2019 (10) February 2019 (4) February 2019 (4) January 2019 (11) January 2019 (11) December 2018 (1) December 2018 (1) November 2018 (17) November 2018 (17) October 2018 (7) October 2018 (7) September 2018 (2) September 2018 (2) August 2018 (8) August 2018 (8) July 2018 (4) July 2018 (4) May 2018 (4) May 2018 (4) April 2018 (2) April 2018 (2) February 2018 (7) February 2018 (7) January 2018 (3) January 2018 (3) December 2017 (1) December 2017 (1) November 2017 (3) November 2017 (3) October 2017 (4) October 2017 (4) September 2017 (8) September 2017 (8) July 2017 (4) July 2017 (4) May 2017 (2) May 2017 (2) April 2017 (2) April 2017 (2) March 2017 (7) March 2017 (7) February 2017 (6) February 2017 (6) January 2017 (3) January 2017 (3) December 2016 (2) December 2016 (2) November 2016 (9) November 2016 (9) October 2016 (8) October 2016 (8) September 2016 (4) September 2016 (4) August 2016 (4) August 2016 (4) July 2016 (2) July 2016 (2) June 2016 (5) June 2016 (5) May 2016 (1) May 2016 (1) April 2016 (6) April 2016 (6) March 2016 (9) March 2016 (9) February 2016 (6) February 2016 (6) January 2016 (13) January 2016 (13) December 2015 (11) December 2015 (11) November 2015 (5) November 2015 (5) October 2015 (7) October 2015 (7) September 2015 (3) September 2015 (3) August 2015 (8) August 2015 (8) July 2015 (4) July 2015 (4) June 2015 (5) June 2015 (5) May 2015 (6) May 2015 (6) April 2015 (4) April 2015 (4) March 2015 (7) March 2015 (7) February 2015 (9) February 2015 (9) January 2015 (8) January 2015 (8) December 2014 (5) December 2014 (5) November 2014 (3) November 2014 (3) October 2014 (10) October 2014 (10) September 2014 (12) September 2014 (12) August 2014 (9) August 2014 (9) July 2014 (4) July 2014 (4) June 2014 (9) June 2014 (9) May 2014 (9) May 2014 (9) April 2014 (3) April 2014 (3) March 2014 (6) March 2014 (6) February 2014 (4) February 2014 (4) January 2014 (4) January 2014 (4) October 2013 (3) October 2013 (3) September 2013 (4) September 2013 (4) August 2013 (4) August 2013 (4) June 2013 (5) June 2013 (5) May 2013 (5) May 2013 (5) April 2013 (3) April 2013 (3) March 2013 (4) March 2013 (4) February 2013 (1) February 2013 (1) January 2013 (5) January 2013 (5) December 2012 (2) December 2012 (2) October 2012 (3) October 2012 (3) September 2012 (2) September 2012 (2) July 2012 (1) July 2012 (1) June 2012 (3) June 2012 (3) May 2012 (1) May 2012 (1) April 2012 (2) April 2012 (2) March 2012 (3) March 2012 (3) February 2012 (8) February 2012 (8) January 2012 (13) January 2012 (13) December 2011 (10) December 2011 (10) November 2011 (9) November 2011 (9) ; No compatible source was found for this media.
Cloud Free Deepnote – Free Plan with 5G RAM and 2vCPU VPS – Expose Ports to Internet Jul 7, 2023 netsec
FreshRSS is a free, self-hostable RSS feeds aggregator. Fly.io is a super amazing platform that runs application servers close to…

How to Upgrade Windows 10 Evaluation Version to Full Version

Feb 15, 2023 netsec
Micrsoft Evaluation Center offers evaluation version for you to have a free trial to exploring technical stuff easily. But if…
Partner

A Career in Cybersecurity: Everything You Need to Know

Feb 13, 2023 Partner
Are you looking for a career in cybersecurity? With the rapid growth of technology, cyber threats are becoming increasingly prevalent.…

Create New Client ID& Secret in OneDrive and Google Drive & Get Refresh_Token Using Rclone

Feb 1, 2023 netsec
I had a couple of posts in this blog to show you how to use Rclone to mount some different…
Architecture

[Cybersecurity Architecture] Risk Management

Feb 1, 2023 netsec
Governance is at the centre of effective technology risk management. Those charged with governance should work with the management team…
Docker

[5 Minutes Docker Series] Deploy A Free RSS Aggregator Website – Miniflux

Feb 1, 2023 netsec
I have been looking for a free online web service which can aggregate the updates from hundreds of websites I…
Linux

Change Windows to *NIX like OS on Microsoft Surface Pro:Support Wifi/Bluetooth/TouchScreen/Battery Status (No Camera)

This post is used to record the steps how I changed my Surface Pro from Windows to those ChromeOS like…

[Free Hosting] x10hosting : WordPress in 5 Minutes with Your Own Domain and SSL Auto-Renew

Jan 10, 2023 netsec
x10 Free hosting for the masses since 2006!
Azure

Enable Azure File Shares SMB Over QUIC

Jan 10, 2023 netsec
This post summarize a easy way with detailed steps to enable SMB over QUIC using a Windows 2022 Azure Edition…

Some Alist Advanced Usages

Jan 10, 2023 netsec
This post summarized some advanced usages of AList.
Docker

[5 Minutes Docker Series] Deploy A Free File List App for Multiple Cloud Storages – Alist

Jan 10, 2023 netsec
AList is a file list program that supports multiple storage, powered by Gin (back end) and Solidjs (front end). It…

Barracuda Basic Firewall Access-list Policy Lab

Jan 10, 2023 netsec
This post is a continuous post from previous one Barracuda CloudGen Firewall F12 Initial Configuration Lab. In this post, I am…
]]> <![CDATA[Cybersecurity Memo]]> https://rnz.ro/article/ddbb99d8-2079-4f63-be23-c2f6c8d7554d https://rnz.ro/article/ddbb99d8-2079-4f63-be23-c2f6c8d7554d Sun, 06 Aug 2023 00:00:00 GMT
AI Architecture Azure Blog Checkpoint Cisco Cloud CyberArk Docker F5 Fortigate Free Guardium Juniper Linux Network Others Palo Alto Python Raspberry Pi Security SIEM Software Symantec Threat Hunting Thycotic Vmware VPN Vulnerability Scan Windows Wireless
Cyber Security Blog Archive Jul 2023 (11)Jul 2023 (11) Jun 2023 (5)Jun 2023 (5) May 2023 (5)May 2023 (5) Apr 2023 (13)Apr 2023 (13) Mar 2023 (12)Mar 2023 (12) Feb 2023 (3)Feb 2023 (3) Jan 2023 (10)Jan 2023 (10) Dec 2022 (12)Dec 2022 (12) Nov 2022 (18)Nov 2022 (18) Oct 2022 (7)Oct 2022 (7) Sep 2022 (7)Sep 2022 (7) Aug 2022 (6)Aug 2022 (6) Jul 2022 (5)Jul 2022 (5) Jun 2022 (10)Jun 2022 (10) May 2022 (6)May 2022 (6) Apr 2022 (5)Apr 2022 (5) Mar 2022 (5)Mar 2022 (5) Feb 2022 (8)Feb 2022 (8) Jan 2022 (9)Jan 2022 (9) Dec 2021 (5)Dec 2021 (5) Nov 2021 (9)Nov 2021 (9) Oct 2021 (10)Oct 2021 (10) Sep 2021 (4)Sep 2021 (4) Aug 2021 (6)Aug 2021 (6) Jul 2021 (13)Jul 2021 (13) Jun 2021 (13)Jun 2021 (13) May 2021 (8)May 2021 (8) Apr 2021 (8)Apr 2021 (8) Mar 2021 (14)Mar 2021 (14) Feb 2021 (8)Feb 2021 (8) Jan 2021 (21)Jan 2021 (21) Dec 2020 (8)Dec 2020 (8) Nov 2020 (10)Nov 2020 (10) Oct 2020 (4)Oct 2020 (4) Sep 2020 (4)Sep 2020 (4) Aug 2020 (9)Aug 2020 (9) Jul 2020 (22)Jul 2020 (22) Jun 2020 (18)Jun 2020 (18) May 2020 (18)May 2020 (18) Apr 2020 (20)Apr 2020 (20) Mar 2020 (22)Mar 2020 (22) Feb 2020 (8)Feb 2020 (8) Jan 2020 (4)Jan 2020 (4) Dec 2019 (3)Dec 2019 (3) Nov 2019 (18)Nov 2019 (18) Oct 2019 (7)Oct 2019 (7) Sep 2019 (6)Sep 2019 (6) Aug 2019 (3)Aug 2019 (3) Jul 2019 (2)Jul 2019 (2) Jun 2019 (4)Jun 2019 (4) May 2019 (2)May 2019 (2) Apr 2019 (3)Apr 2019 (3) Mar 2019 (1)Mar 2019 (1) Feb 2019 (7)Feb 2019 (7) Jan 2019 (5)Jan 2019 (5) Dec 2018 (11)Dec 2018 (11) Nov 2018 (3)Nov 2018 (3) Oct 2018 (7)Oct 2018 (7) Sep 2018 (5)Sep 2018 (5) Aug 2018 (8)Aug 2018 (8) Jul 2018 (3)Jul 2018 (3) Jun 2018 (3)Jun 2018 (3) May 2018 (1)May 2018 (1) Apr 2018 (6)Apr 2018 (6) Feb 2018 (4)Feb 2018 (4) Jan 2018 (5)Jan 2018 (5) Dec 2017 (2)Dec 2017 (2) Nov 2017 (3)Nov 2017 (3) Oct 2017 (4)Oct 2017 (4) Sep 2017 (9)Sep 2017 (9) Aug 2017 (3)Aug 2017 (3) Jul 2017 (3)Jul 2017 (3) May 2017 (2)May 2017 (2) Apr 2017 (2)Apr 2017 (2) Mar 2017 (7)Mar 2017 (7) Feb 2017 (6)Feb 2017 (6) Jan 2017 (3)Jan 2017 (3) Dec 2016 (2)Dec 2016 (2) Nov 2016 (8)Nov 2016 (8) Oct 2016 (8)Oct 2016 (8) Sep 2016 (4)Sep 2016 (4) Aug 2016 (4)Aug 2016 (4) Jul 2016 (2)Jul 2016 (2) Jun 2016 (5)Jun 2016 (5) May 2016 (1)May 2016 (1) Apr 2016 (5)Apr 2016 (5) Mar 2016 (9)Mar 2016 (9) Feb 2016 (6)Feb 2016 (6) Jan 2016 (12)Jan 2016 (12) Dec 2015 (9)Dec 2015 (9) Nov 2015 (4)Nov 2015 (4) Oct 2015 (6)Oct 2015 (6) Sep 2015 (3)Sep 2015 (3) Aug 2015 (8)Aug 2015 (8) Jul 2015 (4)Jul 2015 (4) Jun 2015 (5)Jun 2015 (5) May 2015 (6)May 2015 (6) Apr 2015 (4)Apr 2015 (4) Mar 2015 (7)Mar 2015 (7) Feb 2015 (8)Feb 2015 (8) Jan 2015 (6)Jan 2015 (6) Dec 2014 (4)Dec 2014 (4) Nov 2014 (4)Nov 2014 (4) Oct 2014 (10)Oct 2014 (10) Sep 2014 (12)Sep 2014 (12) Aug 2014 (7)Aug 2014 (7) Jul 2014 (3)Jul 2014 (3) Jun 2014 (8)Jun 2014 (8) May 2014 (9)May 2014 (9) Apr 2014 (3)Apr 2014 (3) Mar 2014 (5)Mar 2014 (5) Feb 2014 (2)Feb 2014 (2) Jan 2014 (4)Jan 2014 (4) Oct 2013 (2)Oct 2013 (2) Sep 2013 (4)Sep 2013 (4) Aug 2013 (4)Aug 2013 (4) Jun 2013 (3)Jun 2013 (3) May 2013 (4)May 2013 (4) Apr 2013 (4)Apr 2013 (4) Mar 2013 (3)Mar 2013 (3) Feb 2013 (1)Feb 2013 (1) Jan 2013 (5)Jan 2013 (5) Dec 2012 (1)Dec 2012 (1) Oct 2012 (3)Oct 2012 (3) Sep 2012 (2)Sep 2012 (2) Jul 2012 (1)Jul 2012 (1) Jun 2012 (3)Jun 2012 (3) May 2012 (1)May 2012 (1) Apr 2012 (2)Apr 2012 (2) Mar 2012 (3)Mar 2012 (3) Feb 2012 (6)Feb 2012 (6) Jan 2012 (12)Jan 2012 (12) Dec 2011 (8)Dec 2011 (8) Nov 2011 (6)Nov 2011 (6)
]]> <![CDATA[IT Pro Security - Bandicam Screen Recorder [Win]]]> https://rnz.ro/article/3a826cf5-37ab-490d-845b-f2d36ada0fe6 https://rnz.ro/article/3a826cf5-37ab-490d-845b-f2d36ada0fe6 Sun, 06 Aug 2023 00:00:00 GMT
notion image
Bandicam is a lightweight screen recorder software for Windows that can capture anything on your PC screen as a high-quality video. This app
Get a Windows 11 Development Environment for Free
notion image

Get a Windows 11 Development Environment for Free

Windows 11 development environment version 2307 is based on Windows 11 build 22621.1992, the latest stable Windows 11 release that includes
Install the WIN system from the U disk
notion image
The PE system is a temporary emergency system made under Windows. When the computer cannot start normally, you can use
Popular Compression & Decompression Software
notion image
System

Popular Compression & Decompression Software (zip &rar) [Win]

Compression and decompression commonly used in system software (1) WinRAR WinRAR is a powerful compressed package manager that can be
Multimedia
1. FSViewer FSViewer76.rar: Download Link Code:1024 Website: https://www.faststone.org/FSIVDownload.htm FastStone Image Viewer 7.7 Freeware (Last Update: 2022-08-24) : An image browser, converter and
Enhance

Super Tool to Clean Up Your Duplication Files – Duplicate Cleaner Pro v5.19 [Win]

Compared with Duplicate Cleaner Pro 4, the performance of Duplicate Cleaner Pro 5 has been improved by nearly 100 times!
Enhance
Uninstall Tool is a small, safe, fast and powerful software uninstall removal tool. It supports to scan the remaining registration
Download
]]> <![CDATA[Cybersecurity Learning, Sharing, Creating]]> https://rnz.ro/article/9a540279-c50c-4c07-9b80-b5903a508607 https://rnz.ro/article/9a540279-c50c-4c07-9b80-b5903a508607 Sun, 06 Aug 2023 00:00:00 GMT
]]> <![CDATA[51Sec Web App Dashboard - 51Sec BookMark Website Portal On Cloudflare Works]]> https://rnz.ro/article/3490ce84-f293-4bb7-83ae-4a002d9f861c https://rnz.ro/article/3490ce84-f293-4bb7-83ae-4a002d9f861c Sat, 05 Aug 2023 00:00:00 GMT
https://sites.51sec.org/
You can tell your story: obstacles, hard work, results, accidents and turning points.
 
https://sites.51sec.org/
 

📝 Body

Opinion1

Quote

Opinion2

Quote

🤗 Summery

Sum up your contents

📎 References

  • Some Quotes
  • Some articles
 
💡
For questions about the installation or use of NotionNext, you are welcome to leave a message in the comment area at the bottom and discuss together
]]> <![CDATA[Removable Storage Automatic BitLocker Recovery Key Escrow to Azure AD | BitLocker-to-go Guide for Intune - SMBtotheCloud]]> https://rnz.ro/article/7c6f7894-32a9-4cd3-a9d1-958570c40091 https://rnz.ro/article/7c6f7894-32a9-4cd3-a9d1-958570c40091 Mon, 31 Jul 2023 00:00:00 GMT
BitLocker on removable drives is known as “BitLocker to go”, but I will just refer to it as BitLocker in this writing. Requiring BitLocker on removable drives is fairly easy with the built-in Intune Endpoint Security profile templates. Some of you may be thinking removable storage should be completely blocked for security reasons. I agree in most cases, but there are still use cases where removable storage may be necessary. For example, I worked with a law enforcement agency in the past where evidence needed to be stored on USB storage if it was sent off-site. To further enhance security on removable devices, we can do some additional things, such as disabling write access to removable storage drives if they were not BitLocker encrypted from a corporate Intune enrolled device.
After I started doing some testing, I wanted the BitLocker recovery keys to be uploaded to Azure AD, but there was no native way to enforce this with the provided BitLocker templates. The selection to “Require device to back up recovery information to Azure AD” is not available for removable drives. Also, there is no way to “auto encrypt” a removable storage device. We can enforce requiring BitLocker for removable storage, but this still requires user interaction to complete the encryption process. There is no way around requiring some user interaction for the encryption process, but I wanted to figure out a way to automatically escrow removable storage BitLocker recovery keys to AAD. If we are requiring BitLocker for removable drives, we need a way, as Admins, to unlock removable drives. I created a script that does this, but I needed a trigger to run the script when a removable drive is encrypted. I eventually found a pretty simple solution using a scheduled task to trigger the script on EventID 768, when a drive starts encrypting with BitLocker. This post is longer than usual, but walks through the following items:
  • How to enforce BitLocker on removable storage
  • How to enforce read-only permissions on removable storage devices not encrypted on a company-owned device
  • The PowerShell script used as the action in our scheduled task to upload the recovery key to AAD
  • Deploying the scheduled task to workstations as a Win32 app
  • Locating a Drive’s Key ID & Recovery Key so you can unlock a drive. (This is useful if a device was lost and returned or found and we do not know which PC encrypted it)
An animated GIF of the end result is below, followed by all the details and steps:
notion image

How to Enforce BitLocker for removable storage devices:

  1. Within the Intune admin dashboard, select Endpoint security > Disk Encryption. Make a new Policy or edit an existing policy. A quick note about making a new policy 0
          2. notion image
  1. A quick note if you’re making a new Policy – the encryption type for each drive type is a required field. If you are making a new policy, you still must “configure” the other drive types and select an encryption method, or you will receive an error. If this is a new policy and you’re only interested in enforcing removable storage, you’ll need it set at least like the screenshot below, or you’ll get an error when trying to create the policy. If you already have a BitLocker Policy you are editing, you can disregard this.
          2. notion image
          At a minimum, set like this to avoid the above error:
        • notion image
  1. Under BitLocker – Removable Drive Settings, configure like the below screenshot. Depending on your environment, you may want to use CBC encryption instead of XTS. If we want to enforce that all removable storage is encrypted, we want to block write access to removable drives until they are BitLocker encrypted. We will get to the fourth option to block write access configured in another organization in the next section.
          2. notion image
          Save your configuration profile and apply to your target groups.
  1. Once the device receives the policy, this is what will happen if a user inserts a removable storage device:
      • They will be required to encrypt the device if they want to write files to it. Since its very likely corporate data will be written to the drive, this is a good practice.
      • When they select to Encrypt the drive, they’ll be prompted to set a password or use a smart card. In the vast majority of situations, they’ll be setting a password:
      • They’ll need to save the recovery key somewhere. Assuming you have BitLocker enforced on your system and data drives (which you should), they’ll need to use the print option since you can’t save a BitLocker recovery key to a BitLocker-protected volume. They can print to a PDF file and save that on the local computer. Later on, we will show you how this can be auto-escrowed to AAD.
      • In most situations, they can select Encrypt used space only. However, depending on the sensitivity of your data, and if you’re enforcing this in an environment where sensitive data has already been stored and deleted from removable drives, it may be better to encrypt the entire drive:
      • Click Start encrypting:
      • Wait for the drive to finish the encryption process:
      • When completed, you can see the drive showing it’s protected by BitLocker:
      • If the drive is removed and reinserted or inserted into another PC, the user will be required to unlock it to access the contents:
      • They have the option to remember the device if it will be used frequently on their device:

Disable write access to removable storage devices unless encrypted from a corporate device:

Enabling this setting will prevent write access to a removable storage device unless it is BitLocker encrypted from a corporate-owned device.
  • In your BitLocker policy, enable “Block write access to devices configured in another organization”
  • Once Enabled, if a user inserts a drive that was BitLocker encrypted on a device outside of your organization, they’ll still be promoted to unlock the device, and can read data on the device, but if they try writing to the device they will be blocked with an error stating the drive is write protected:
  • If needed, the drive can be decrypted and re-encrypted on the user’s device if they need to write to the storage device

Automatically Escrow removable storage device key to AAD – The Script

The script that escrows the recovery key for a removable storage device to AAD is only four lines, and it’s simpler than many might think. The biggest hurdle with this script was only identifying removable storage drives. The rest of the script uses the same commands we use to upload regular fixed or OS drive BitLocker recovery keys to AAD. The script is below with some details. Remember, this script will be triggered from our scheduled task based on the EventID generated when a drive begins encrypting.
The top line with the $USBDrives variable identifies any removable storage drive plugged into a device. It accomplishes this by only selecting disks with a drive type of “2”, which is a removable storage device. It then only selects the DeviceID field, which is the letter the drive mounts as. We need this to identify the mount point later in the script:
The rest is pretty simple. We have a Foreach statement to process the commands to upload recovery keys to AAD for each drive letter identified as a removable storage drive. This is necessary because if Drive D is inserted and was previously encrypted, but a second USB drive is inserted and encrypted (E:), we need to process the commands for each drive letter to ensure they’re escrowed to AAD. Duplicates are not created in AAD if the recovery key for a drive already exists. A successful upload of recovery keys to Azure AD will result in EventID 845 in the Microsoft-Windows-BitLocker-API/Management log.

Automatically Escrow Removable Storage Recovery key to AAD – The Scheduled Task

The reason I chose to use a scheduled task, is we want the recovery key escrowed to Azure AD as soon as possible. We also want the drive connected while this happens. Proactive remediations are preferable to scheduled tasks in most cases, but currently, proactive remediations can only be run at certain intervals. For this task, I want it to trigger based on an event ID, and a scheduled task can do that. The details of the scheduled task are:
  • It runs as system
  • The trigger is the event ID when a drive starts BitLocker encryption – EventID 768 from the Microsoft-Windows-BitLocker-API/Management log
  • The action is the script from the previous section. I have the script being copied to the %windir%\system32\tasks directory. This is where the scheduled tasks are stored, and access to that directory requires local admin rights. So, users can’t go into that directory and delete or edit the files.
I won’t get into the weeds on how to deploy a scheduled task with Intune. For that, see my other blog post here – https://smbtothecloud.com/deploy-scheduled-tasks-with-a-win32app/. To begin, we need our scheduled task XML file, our script to escrow recovery keys to AAD, a PowerShell script to create the scheduled task, and an uninstall script if we want to remove the scheduled task. All of this, including the .intunewin file if you want to deploy this exact solution, is available on my Github here. A quick review of the necessary files is here:
  • BL2GOEscrowtoAAD.xml – This is our Scheduled task XML we will be importing
  • BL2GoToAAD.ps1 – this is our action script that escrows the recovery keys to AAD
  • BL2Go-ScheduledTask.ps1 – this is our install script for the Win32 app to create the scheduled task and also copy our action script, BL2GoToAAD.ps1, to the %windir%\system32\tasks directory
  • Uninstall.ps1 – this will remove the scheduled task if we want to uninstall the Win32 app from Intune
As I previously mentioned, I won’t go into details on the Scheduled Task XML file in this post – see my other blog post linked above for more details on that. But here are the other scripts we use for this solution. The BL2GoToAAD.ps1 script was shown in the previous section, so no review is needed here. Below are the Install and uninstall scripts for the Win32 App:
Our Install script, which creates the scheduled task and copies the action script to %windir%\system32\tasks:
And our uninstall script, which removes the scheduled task if we ever want to delete it:
Now, some of you can skip this part, but for those of you who want the steps to create the Win32 App, here they are. I’m assuming you know how to wrap files as a .intunewin file already. Move all the above files into the same directory and wrap them into a .intunewin file like below:
Create a new Win32 app in Intune and upload your .intunewin file when prompted. Provide a name and description and click Next:
Under Program, we want our install and uninstall commands to be exactly like they are below. If you do not use %sysnative%, the task will be created properly, but our action script will be uploaded to C:\Windows\SysWOW64\tasks. If you aren’t familiar with using %sysnative%, see this blog post for more information – https://smbtothecloud.com/make-registry-changes-with-intune-win32-apps/. We also want to make sure the install behavior is System.
  • Install Command: %windir%\sysnative\WindowsPowerShell\v1.0\powershell.exe -Executionpolicy Bypass .\BL2Go-ScheduledTask.ps1
  • Uninstall Command: %windir%\sysnative\WindowsPowerShell\v1.0\powershell.exe -Executionpolicy Bypass .\uninstall.ps1
Add the requirements you want for your deployment and move on to detection rules. We will add two detection rules. The first is to make sure the scheduled task exists. The second is to make sure our action script exists. We will use file detection for both. Here are the scheduled task detection rules. Note that although this file is technically an XML file after the XML is imported and the scheduled task is created, the .XML extension is removed. This is why there is no file extension on the BL2GOEscrowtoAAD file.
And the detection for the action script:
Complete the remaining steps and deploy the app to your devices. You should start getting successful installs after devices check-in. If you don’t want to wait, you can restart the Microsoft Intune Management Extension service on devices to force them to check in:
Here is what the task looks like on the devices after it’s deployed. You may need to open task scheduler as an admin to see the task:
And the trigger:
And the Action:

Locating the Recovery Key for a removable storage device if you don’t know which device encrypted it:

This is important. After all, what’s the point of enforcing BitLocker on removable storage if it’s going to be a huge pain to locate the recovery key? If a device needs to be unlocked but we don’t know which PC encrypted it, we can use the Graph API to locate the device object in AAD where the recovery key is stored. We do this based on the device Key ID.
  1. Insert the protected volume into a PC, when prompted to unlock it, select enter recovery key:
  1. The first 8 digits of the Key ID will be shown on your screen, record this:
  1. Next, go to the graph Explorer and authenticate to your tenant – https://developer.microsoft.com/en-us/graph/graph-explorer
  1. Select the Information Protection resource, and drill down to Bitlocker > RecoveryKeys. Or, enter this string into the query input: https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys. Remove {bitlockerRecoveryKey-id} from the query search if its there so the query returns all keys in your tenant. Also, make sure you consent to the necessary permissions before running the query.
  1. After consenting, run the Query. All the Key ID’s with the device ID where they were encrypted should be returned, like the screenshot below:
  1. Press CTRL+F to search, and enter the value we recorded in step 2. In this example, we are searching for a key that starts with 82EACEE7. Our results show the full Key ID, along with the DeviceID for the device that encrypted the device:
  1. Go to Azure AD, and search for the device ID that encrypted the drive. The device ID in our example is cc30adb8-7d0a-4b87-81aa-652d0f1dd584. This will return the device Object in the Azure AD GUI:
  1. Select the device, and then click on BitLocker keys. Find the Key ID, and the corresponding recovery Key to unlock the device:
You’re probably familiar with toast notifications in Windows. They are the notifications that pop up in the bottom right-hand corner of your screen. They can be purely informational or have action buttons to click, such as opening a website. I wanted to figure out how to create custom notifications and use the action buttons to perform certain tasks for the signed-in user, such as running a PowerShell script. A similar example is a recent post by Damien Van Robaeys (https://www.systanddeploy.com/2022/02/a-toast-notification-to-display-warning.html) to show a toast notification warning a user if their device has not been rebooted in a certain amount of days. It took me several weeks of on-and-off research and testing to get a solid understanding of how toast notifications work. The biggest hurdle for me was having the action buttons run PowerShell scripts. I broke this post into two separate parts since there is so much to cover. If you aren’t interested in what’s happening on the backend, and you purely want to start making custom toast notifications, I suggest you install the BurntToast PowerShell module and start using that. It was something I stumbled across when I began researching custom toast notifications. It’s a great module and uses simple commands to build and deliver a Toast notification. However, I wanted to figure out how toast notifications work and how to build them from scratch, so that’s what this post will mostly focus on.
This post is a compilation of much research and testing, and there were a few resources in particular that were a huge help. If you ever want to use custom toast notifications, I hope this covers all basic steps and save you time from doing a lot of R&D. This is a deep topic, and toast notifications can be much more complex than what is covered here. My goal was to make custom notifications and have the action buttons do more than simply launch a website (which is what they do in most cases). I wanted to run custom PowerShell scripts with the action buttons. We will review the nuts and bolts of toast notifications and then walk through setting up a toast notification to check if any 30+ day-old 500+MB files exist in the user’s downloads folder. The user will have three action buttons – 1. Open the user’s downloads folder, 2. Open a PowerShell Gridview of the affected files, or 3. Auto deletes those files. All files used in these posts are available on my github. Also, I understand Storage Sense is a better solution for cleaning up the downloads folder, but this is an easy example that can be modified to do other things. Here is everything this post will cover:

Part 1:

  • Sources I used for my learning on this topic. There were a few community contributors who provided great learning content on toast notifications
  • Toast Notification XML files and how to customize them
  • Triggering a toast notification from PowerShell
  • Running custom scripts from the action buttons and how to create a custom protocol handler

Part 2:

  • Files needed for deploying toast notifications with Intune
  • Deploying the needed files to our target machines
  • Deploy custom toast notifications as a proactive remediation
  • Deploy custom toast notifications as a scheduled task
  • A Quick Review of the Burnt Toast PowerShell module
Let’s get into Part 1 of this post. I added a table of contents below since this is a longer-than-usual post:
Table of contents
  1. Sources and Credits
  1. Toast notification XML files and how to customize
  1. Initiating a Toast Notification from PowerShell
  1. Running Scripts from our Action Buttons & Creating a custom Protocol Handler

Sources and Credits

Before I begin, I need to give some other people credit for the content they have out there. These contributors have great content which helped me learn about toast notifications.
  • Adam Driscoll – his module review of the BurntToast module also has details on creating a custom protocol handler. This allows us to run PowerShell scripts from the action buttons on the toast notifications.

Toast notification XML files and how to customize

When I first dove into this, I had no backend knowledge of Toast notifications. I simply knew what they were. So, I had to start almost from scratch. The first step was determining how they are built. A Toast notification is simply an XML file that Windows reads to display the nice-looking notifications we receive. Remember, this is only the payload for the notification. We still need something to trigger or initiate the notification, which we get to in the next section. Additional info on the structure of the notifications and other features can be found here – https://learn.microsoft.com/en-us/windows/apps/design/shell/tiles-and-notifications/adaptive-interactive-toasts?tabs=xmlAt. The XML for a very basic Toast notification to show some text is displayed below:
This XML displays the toast notification below:
notion image
We can add many customizations to a Toast notification, but as previously mentioned, we won’t go too deep into this. What I wanted were some action buttons for scripts. I also wanted to make it look nice with some additional images. Something pertaining to your company or your IT department will make the notification appear more professional and real to the end users. The resulting XML I used to accomplish my goal is below along with a screenshot pointing to the various fields and how they’re displayed in the notification. A quick note on the hero image – the recommended size of the image is 364×180.
You can do more with your notifications if you’d like, but for me, this checked all the boxes for what I wanted and it’s easy to repurpose in the future.

Initiating a Toast Notification from PowerShell

Now that we have our XML file, we need a way to trigger a toast notification. This is where Ben Whitmore’s blog post was a big help to me. We accomplish this with PowerShell by importing the ToastNotificationManager and XmlDocument Windows Runtime classes. This allows PowerShell to read the XML file and trigger a toast notification. This allows us to manually test our XML notification files – just make sure to change the $XMLString variable to the location of your XML file. The resulting PowerShell script to trigger a notification from our XML file is below.
Note that we have an AppID variable. This is a required field and displays on the Toast Notification as the app where the notification came from. We can get a list of these by using the PowerShell command Get-StartApps. You can use the AppID value for the App you want to use as displaying the notification. I use Windows PowerShell as the app, but this quick example shows how we can change it to something else.
In our real-world example, we don’t want a notification triggering unless there is at least one file older than 30 days and larger than 500MB in the user’s downloads folder. Since my downloads folders in my lab have barely any items, I modified the script to be 1 day instead of 30 and 1 MB instead of 500 so I could properly test. You can adjust these values as needed. I also use PowerShell as the AppID in my script.

Running Scripts from our Action Buttons & Creating a custom Protocol Handler

This part was a headscratcher at first, and for a little while, I didn’t think I’d be able to figure this out (or if it was even possible). I first attempted to simply point my XML action to open a program based on the file path. I then tried pointing it at a script to launch a program or run an action, but it continued to fail. As I continued to research, I discovered that toast notification actions rely on URL schemes, which rely on Protocol Handlers. Anything that does not have a protocol handler built into Windows needs a custom protocol registered. For example, Windows already knows what to do for URL schemes such as HTTP:// HTTPS:// FTP:// or FILE://. This basically tells the OS how to handle a URL with a defined protocol handler. So, we need to create one for powershell:// that can launch PowerShell scripts. This was not as easy as it sounds. After a while of testing and searching for help online, I found a YouTube video from Adam Driscoll that clarified everything for me. It is linked above, but the portion of the video from 4:30 – 7:45 clarifies using a PowerShell protocol handler. Another good explanation for using a protocol handler for PowerShell is here – Custom Protocol Handler and PowerShell (Part 2) – IT Constructors.
To create a custom protocol handler, we need to add some registry Keys. They will be placed in the HKEY_CLASSES_ROOT hive. The Reg File is below along with screenshots of the registry keys and values. The value under the command key is the script called (or program launched) when using the parent key in URL format. For example, PowerShell: or PowerShell://. We will use a CMD script to launch PowerShell. More clarification on all this is below. I did my best to simplify it since this was the most difficult part of this project (for me). Here are the reg keys needed when creating a custom protocol handler. I also have this available as a PowerShell script to add the keys and values on my github. Keep in mind you’ll need the command key default value pointing at your location of the ToastScript.cmd file.
Before we move on, let’s take a step back and look at another example. A much simpler example is if we wanted to create a protocol handler that launched an application. For example, perhaps you want to send a weekly toast notification with a reminder to complete a timesheet or submit regular data to an application, and you wanted that application to open with a toast notification button. If we use Microsoft word as an example, we can make a protocol handler for word:// to launch Microsoft word:
After creating the above registry entries, if we use the word URL protocol (word: or word://) it will launch Microsoft Word. We can do this from a browser, PowerShell, or a Run prompt:
OK, so now that we have a basic understanding of protocol handlers (and there is much more to them, but this was as far as I needed to go for what I needed to accomplish), let’s get back to how PowerShell it’s being launched for our custom protocol handler. Since we want to run actual scripts, we need a way to pass those scripts to the custom protocol handler. Here is our ToastScript.cmd file, which is what runs when the PowerShell:// URL protocol is called.
The script launches PowerShell with some additional parameters to keep it hidden. The key to how this works is the -Command “& ‘%1’.Replace(‘powershell://’, ”).Trim(‘/’)” portion of the script. The %1 variable in the registry value (see below) passes our PowerShell:// URL and additional test after the // into the script where the ‘%1’ variable is.
We can see how the script interprets this if we remove the .Replace(‘powershell://’, ”).Trim(‘/’)” part of the script, add a pause at the end, and then try passing some characters. An example is below. I’ve shortened the toastscript.cmd so it no longer contains “.Replace” and everything after, and added a pause so the window stays open and we can see what happens. You can see below the URL “powershell://testingcommand” was successfully passed into our toastscript.cmd in place of the %1 variable.
Now that we have tested the script and passed the variable so we can see it’s working correctly, We need to strip some of the characters out so it represents real PowerShell syntax. If we consider the example above, we need to get rid of these highlighted characters – ‘powershell://TestingCommand/’ which will then leave us with only what we add after the URL handler – powershell://TestingCommand. To accomplish this, we add the .Replace(‘powershell://’, ”).Trim(‘/’)” back to our script, which will remove our unneeded characters. To demonstrate, we will use the get-service cmdlet. Our complete toastscript.cmd is shown below along with the example. I am leaving the pause in the script so we can see the output, but remember to remove the pause once you’ve tested successfully.
We can see that our test cmdlet was successful. The above picture really ends up from the Windows command line like this in the background:
This is what will be happening in the background for our toast notifications if the action buttons are clicked. The only difference is instead of our action buttons calling specific cmdlets, we will be pointing to a .ps1 file to run a script. Hopefully, now you have a basic understanding of this. It took me a lot of testing to fully understand how this all works together. Now that we understand how the scripts work with the protocol handler, let’s call the scripts we want to run for our toast notification action buttons. I have three that I am going to use:
  1. Open the user’s downloads folder
  1. Open a PowerShell gridview of the affected files
  1. Automatically delete the affected files
I should note that although the file protocol handler (file:) can open file paths in file explorer, it was failing to open when I was using variables like %username% or %userprofile% in the XML file. For that reason, I am using a PowerShell script to open the user’s downloads folder. Here are our scripts:
Open the logged-in user’s downloads folder:
Open a PowerShell Gridview of the affected files – The size and age of files here should match our script from above. I have it set to 1 day and 1 MB for testing purposes
Auto-delete affected files – Same as above. Make sure your age/size here is the same as our script to detect if a notification should be triggered:
The script files will need to be placed on the local machine somewhere (or on a network share if the device will always have a line of sight). In this example, I have them in the c:\programdata\toast directory. Next, we edit our XML file. The Content field contains the names of the action buttons, and arguments contain the action to take if the button is clicked. Notice how we are using the URL protocol handler we created earlier. Clicking the buttons injects our .ps1 action script paths into our ToastScript.cmd file, which executes the action script. Test your notification out by triggering it with PowerShell to make sure the buttons are displaying properly and the scripts trigger when clicking the buttons.
Here it is an action:
That was a long section, but now we have working buttons that run specific scripts on our Notifications. Now we need to deliver this to our target machines via Intune. That will all be covered in Part 2. Thanks for reading.
]]>