Hide installed application in Windows

By | May 17, 2024

There may be a time when you need to hide an installed application so that it will not be uninstalled. An easy way to keep an application from being uninstalled is to just hide it from appearing in Windows add/remove programs. This is easily achieved by adding the SystemComponent value DWORD in the uninstall section of the registry for that specific application.

Let’s say I want to hide the Zoom application from appearing in Windows. Currently, you can see it listed in the control panel

I can run the following powershell command to add the SystemComponent entry to the registry and set the value to 1 to hide the application:

New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57D6B477-1B0C-4C4B-8479-A89ACFDFD875}' -Name SystemComponent -Value 1

Now the application will no longer appear in the installed Applications section of Control panel.

To make the item visible again, just delete the SystemComponent from the registry.

Powershell .ToString()

By | April 22, 2024

I’m posting this as I spent too much time on figuring out how to convert the current IP of a machine and turn the IP address into an array. I needed this so I can change the last octet to a couple of other values that I would set later in the script. Powershell has an odd way of outputting data into different types such as objects. Objects can be frustrating when you just want a string output, but objects do give you all types of other possible information from the data you are querying.

The output of my variable $ipv4 is an object.

I mean there is quite a bit of data to choose from, but I just wanted the IP address. So, after digging around, I realized I needed to pass a PSObject .ToString() to my variable which will return the string representation for this object.

Finally! My variable only outputting the string value.

Now that I can get the actual string value I need, I can then use split(‘.’) to split the string at each period character to an array. For some reason, getting just the string value on this one stumped me longer than it should have. So, here it is for anyone that ever needs this (Or myself for future reference). Splitting your IP address into an array.

$ipV4 = (Test-Connection -ComputerName (hostname) -Count 1).IPV4Address
$ipArray =  ($ipV4.ToString()).Split(".")

Write-Host("IPV4 Output :" + $ipV4)
Write-Host("Octect1 [0] :" + $ipArray[0])
Write-Host("Octect2 [1] :" + $ipArray[1])
Write-Host("Octect3 [2] :" + $ipArray[2])
Write-Host("Octect4 [3] :" + $ipArray[3])

Replacing apt with Nala

By | April 19, 2024

Nala is an improved front-end for the apt package manager in Ubuntu/Debian Linux. It adds many features and a better visual representation to the activity of the command. A really good article about Nala can be found here at ItsFoss. There are many more features and arguments to nala than the normal apt command offers.

Nala upgrade in use.

I’ve decided to create an alias to stop me from using the apt command to using nala. To make sure the alias is persistent after every session or login, I needed to add the following alias commands to the bottom of my .bashrc file.

# Added alias for nala to be used instead of apt.
alias apt='\nala'
alias dapt='\apt'
# For aliases to work with sudo:
alias sudo='sudo '

Now save and exit the shell. Enter back into your terminal and when I run sudo apt update, I get nala running instead.

Running sudo apt upgrade runs through nala now.

Monthly patching schedule

By | October 6, 2023

I am often asked how I perform security and third-party patching for an entire company. Below, I have outlined the basic strategy I use, and this has not varied much in the past 15 years from every company where I have been responsible for maintaining the patching in regard to Windows servers and workstations. First off, I always test patching before roll-out. Period! I never assume every update installs without issue. Patching processes these days are much more reliable than they used to be, but sometimes a patch or an updated application can cause issues. Testing first doesn’t hurt anything and ensures the patching doesn’t have any conflicts with applications and operations, which could save you a major headaches in the long run.

To explain my reason for testing is to ensure no disruption to business. For example, if many of the endpoints that you are patching are located in restaurants, such as the the point-of-sale system or other critical machines required for business to operate, you will want to make sure those endpoints are always available, and that a patch or update does not cause problems for those devices to operate. If those endpoints are not running, that can cause an immediate loss of business to a location(s) financially. You don’t want to find out a patch or an updated application doesn’t play nice until too late.

I’ve been using Action1 as my patching platform for the past couple of years and have been impressed with the flexibility and ease of keeping the entire company up to date. The below details will be shown from the Action1 configuration I use, but the scheduling will match to my normal overall strategy.

Workstations – Automated patching. Daily. 6am. No reboot. Low risk to workstation users.

  • 1Password
  • Adobe Acrobat Reader*
  • Microsoft Edge*
  • Microsoft Teams*
  • Teams Machine-Wide Installer*
  • VLC*
  • *Webex*
  • XNView*
  • Zoom*

Workstations and Servers – Automated patching. Daily. 6:15am. No reboot.

  • *Defender Antivirus*
  • Windows Malicious Software Removal Tool*

Monthly Patching – Servers and workstations.

All updates are manually approved. Reboots allowed. Patching is done manually, no automated schedules.

  • Updates deployed to lab/dev/qa system endpoints first. Verify no issues with functionality for 24 hours.
  • If no issues from lab endpoint patching. Update to pilot group of live sites for 24 hours. Pilot workstation group includes IT department workstations.
  • If no issues from pilot group. Deploy to all workstation endpoints.
  • If multiple endpoints at remote sites, do not deploy to all endpoints, break up patching into groups to ensure not all endpoints will be affected at same time during patching/reboots.

Server considerations

  • Do not deploy to a master domain controller first. Apply to a secondary domain controllers, then patch master domain controller on following day.
  • Server patching done outside business hours. Must have IT staff monitoring patching to ensure all servers operational after patching.
  • Snapshot all VM’s before patching or patch after backup routines to ensure quick rollback if needed.

I hope this provides some visibility into my patching strategy and helps you with coming up with your own patching cycle. Every patching cycle should be strict and consistent to minimize risk to any organization, but yet flexible to work around business needs.

Reformatting a flash drive formatted as ISO

By | October 4, 2023

Typically, when a flash drive is formatted from an ISO image, the flash drive will be formatted as an ISO9660 type and not want to be re-formatted or erased easily. Take a look at Gparted showing a flash drive below with the Linux Mint ISO on it.

When I attempt to delete the Partition in GParted, it is greyed out. If you try to format it, you will also get an error. The proper method is to use a command like:

sudo dd status=progress if=/dev/zero of=/dev/sde bs=4k && sync

The problem is this takes forever to run and zero out the entire flash drive. What I do is probably considered some hillbilly method but it works and works fairly quickly. I only seem to need to use this method when I want to reformat a flash drive shown as an ISO format. I run the shred -v command and let it run for about 10% to 15% (Which takes only a couple of minutes typically). I then hit CTRL C to cancel the operation.

Remove the flash drive and re-insert it. Now go into Gparted and create a partition table and format the flash drive any way you want.

Now I format the flash drive however I want. In this case, I formatted it as a Fat32.

Formatted to Fat32 and ready to be used.

Maybe I’ll post a more proper method later, but the above is down and really dirty but works quickly.

Using Powershell to read registry HKEY_USERS

By | August 30, 2023
Script execution. Shows the wallpaper path and file used for each user account in HKEY_USERS of the Windows registry.

Download files from website via Powershell

By | August 11, 2023

A simple method I like to use when I want to quickly run a powershell script to download a file from a webserver. I use this when endpoints are not on an internal network so a network share is not always available, but since I am usually remotely calling the powershell script, Internet access is established.

The commandlet I use is Invoke-RestMethod. I provide the source url for the file on a webserver to download and the destination, and I’m done. Extremely simple and extremely effective. There are so many ways to do this, but this is the method I personally use the most.

The below example is what I have used to download the CleanZoom utility from Zoom that will remove any installed versions of Zoom on an endpoint, save the file in a temporary directory and then execute the utility.

Scareware is not dead

By | June 19, 2023

An email was forwarded to me that came from a security MSP trying to stir up business with someone at the company I work at. Their quasi-scareware email was funny, but a horrible way for us to take seriously. Only thing missing was a sentence asking for bitcoin.

I remember several years ago, companies were scanning their web server logs and doing DNS look-ups to find out what companies visited their website. Then the Spam and cold call of sales would begin. That tactic finally died off……mostly. The below email was not sent to our company from a DNS look-up scrape (I know, as our external IP’s at work can barely can tell you what state we are in), it was pure spam. Probably someone going through Linkedin and such finding contacts.

If you send an email that begins like this, we cannot take you seriously.

Ah, remembering the good ole days, when the scareware looked like an actual alert:

Aloha!

By | April 14, 2023

Not a good week for NCR Aloha POS hosted solutions. They have been dealing with a BlackCat ransomware attack as reported by articles at:

BleepingComputer – NCR suffers Aloha POS outage after BlackCat ransomware attack.

DataBreaches.net – A short-lived BlackCat listing suggests NCR’s customers’ networks were accessed

Securityweek.com – Payments Giant NCR Hit by Ransomware

CPO Magazine – Financial Services Firm NCR Hit by Ransomware Attack, Disrupting Aloha and Back Office Products

CybersecurityDive – NCR restores more services following ransomware attack

The below screenshot was taken from https://status.aloha.ncr.com