Fighting iOS paranoia

Newer iOS version do not trust custom issued certificates by default. To make a certificate trusted, do the following:

1. Send the CA certificate to some other email available from the device as an attachment.
2. Once received, tap on it and install it to a "profile"
3. Go to Settings->General->About->Certificate Trust Settings
4. You should see your CA certificate profile there. Make it trusted.

Bitlocker

A new Surface laptop came with the bitlocker is not activated, but the hard drive was yet encrypted. The owner asked to turn off the encryption completely.
The UI of Windows 10 does not provide such an ability, but that could be achieved using the command line utility:

 manage-bde -off C: 

Read more how bitlocker works here.

Cisco VPN client issue

Windows 8.1 with Bing, came with a netbook computer.
Need to make work the Cisco VPN client which gives the following error on a connect attempt:

Secure VPN Connection terminated locally by the Client, Reason: 440 Driver Failure

Tried this solution to install Citrix DNE. Did not help.

The event viewer shows that the driver signature can not be verified.
Desperatly did the following to make it work:

1. Turned off the BitLocker. Well, why I need a secured notebook which I can not use?
2. Disabled UEFI's Secured Boot. 
3. Executed the following commands:
   bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
   bcdedit -set TESTSIGNING ON
4. Reinstalled the Cisco VPN client.

Works now!

Cure for IE's paranoia

After the update KB3025390 was installed for IE11, it's stopped to allow access to its internal objects from outside. As it was described in this article, this behaviour could be cured by the following registry changes:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER]
"iexplore.exe"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER]
"iexplore.exe"=dword:00000001

Update: MS has released an update KB 3021952. To be installed to solve the issue instead of hacking the registry.


See also: http://www.inflectra.com/Support/KnowledgeBase/KB105.aspx

PC hunter

Sometimes when you try to modify a registry key you are getting "access denied" and even changing the ownership does not help. In this case try a free utility called "PC Hunter". It lets you to delete a problem registry node and then you could just created it back with default permissions.
The link to download: http://www.xuetr.com/download/PCHunter_free.zip
Original article the utility was mentioned:
https://www.raymond.cc/blog/full-control-permission-to-delete-or-edit-restricted-windows-registry/2/

runas.vbs

Very simple script to run a command line application with elevated privileges: 

if WScript.Arguments.Length > 0 Then
    Set objShell = CreateObject("Shell.Application")
    dim a : a = ""
    for i=1 to WScript.Arguments.Length-1
        a = a & WScript.Arguments(i) & " "
    next
    objShell.ShellExecute WScript.Arguments(0), a, "", "runas"
end if

A certification pit

Each time we need renew or issue a new certificate for test web servers it becomes a quest. The certification server is installed on a windows 2003 server and each time it behaves different. I wonder, if somebody noticed that too?
It works differently in different browsers, and does not let you in even with IE until the browser's advanced security property "Enable Integrated Windows Authentication" is off.

Security asshole

To remove elevated right requirement from a folder in a windows 6+
you just need to add the "Modify" rights to the group "Users".
That's it.

windows sudo ersatz

To see if a process is executed with elevated rights or not: open the Process Explorer (as Administrator), find the process you need to check, then open the property's Security tab.
If the "BUILTIN\Administrators" record says "Deny" - that means the process is standard,
if it says "Owner", then it's elevated.

IIS's pool process (w3wp.exe) is executed elevated, so no need to worry, but need make sure if the application pool is running as "LOCAL SERVICE", that "LOCAL SERVICE" have rights to the resources the web application need access to. Also to give it more rights, in the web application setting check "Same as the application pool".

separate explorer

IE7+ does not prevent to open the Window Explorer as a different user as I thoght. Actually, it does, but you can use the "/separate" option of explorer.exe to launch it as another user in a different process.

The only problem, you can't open a particular resource or folder that way.