albert-widjaja’s gists

richardhicks / Optimize-DomainControllerTlsCipherSuites.ps1

Last active March 22, 2024 18:53

Disable Insecure TLS Cipher Suites for LDAPS on Domain Controllers

	# This Gist is a PowerShell script to set the SSL Cipher Suite Order Group Policy Object (GPO) for Windows Server 2016 and 2019/2022.
	# Reference: https://www.dsinternals.com/en/active-directory-domain-controller-tls-ldaps/

	# Security optmized cipher suite list for Windows Server 2019/2022
	$Ciphers2022 = 'TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'

	# Security optmized cipher suite list for Windows Server 2016
	$Ciphers2016 = 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'

	$GpoName = 'Domain Controller Security Baseline'

githubfoam / windows ADBA KMS cheat sheet

Last active August 8, 2024 06:17

windows ADBA KMS cheat sheet

	==========================================================================================================
	#Slmgr.vbs Options for Volume Activation
	Attempting to manage an older system from Windows 7 or Windows Server 2008 R2 will generate a specific version mismatch error

	==========================================================================================================
	#ChatGPT
	Explain Key Management Server in windows.

	A Key Management Server (KMS) is a feature in Microsoft Windows that allows organizations to activate volume licensed versions of Windows and Office products within their network environment without the need for individual activation keys for each computer.

joegasper / ConvertFrom-DN

Last active June 5, 2024 02:37

Convert between DistinguishedName and CanonicalName

	#Updated ConvertFrom-DN to support container objects

	function ConvertFrom-DN {
	[cmdletbinding()]
	param(
	[Parameter(Mandatory, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
	[ValidateNotNullOrEmpty()]
	[string[]]$DistinguishedName
	)
	process {

jbratu / setupiisforsslperfectforwardsecrecy_v17.ps1

Last active August 6, 2024 17:23

Great powershell script for tightening HTTPS security on IIS and disabling insecure protocols and ciphers. Very useful on core installations.

	# Copyright 2019, Alexander Hass
	# https://www.hass.de/content/setup-microsoft-windows-or-iis-ssl-perfect-forward-secrecy-and-tls-12
	#
	# After running this script the computer only supports:
	# - TLS 1.2
	#
	# Version 3.0.1, see CHANGELOG.txt for changes.

	Write-Host 'Configuring IIS with SSL/TLS Deployment Best Practices...'
	Write-Host '--------------------------------------------------------------------------------'

lukehutton / EnableSchUseStrongCrypto.ps1

Last active May 7, 2024 07:15

http://msdn.microsoft.com/en-us/library/windows/desktop/aa379810(v=vs.85).aspx HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto Instructs Schannel to disable known weak cryptographic algorithms, cipher suites, and SSL/TLS protocol versions that may be otherwise enabled for better interoperability.

New-ItemProperty -path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -name 'SchUseStrongCrypto' -value 1 -PropertyType 'DWord' -Force | Out-Null

Albert Widjaja albert-widjaja