Windows Server on justinverstijnen.nl

Fixing CVE-2026-41089 on Windows Server

Sun, 17 May 2026 00:00:00 +0000

How would an attacker be able to use this? An attacker would send specially crafted Netlogon requests to a vulnerable server. By manipulating the way the Netlogon service processes these requests, the attacker may be able to trigger remote code execution (RCE) without requiring prior authentication. Something we must prevent at all costs.

The potential impact of this CVE being unresolved is:

Remote code execution on the target server
Full system compromise if the attack succeeds
Privilege escalation to SYSTEM level access
Lateral movement within the network
Compromise of Active Directory infrastructure if a Domain Controller is affected

In this post I will quickly go through what systems are impacted and how you can install the required updates to remediate the vulnerability.

Active Directory FSMO roles

Tue, 04 Feb 2025 00:00:00 +0000

What are the FSMO roles of Active Directory?

FSMO stands for Flexible Single Master Operations. Active Directory is normally multi-master, meaning changes can be made on any domain controller. However, some operations must be handled by one specific domain controller at a time to avoid conflicts. These special responsibilities are called the FSMO roles.

There are five FSMO roles:

Two forest-wide roles
Three domain-wide roles

Let’s look at them all and explain what their function is:

Managing Hyper-V server without Active Directory

Tue, 17 Dec 2024 00:00:00 +0000

When you use Hyper-V server, you want to manage this with the management tools. However, by default Hyper-V only allows connections from domain-joined machines by design because of security and trust reasons.

We can bypass this requirement by building these trust ourselves and so managing the server from a machine that isnt even in a domain but Entra ID Joined or in a workgroup.

Installing Hyper-V management tools

When you use Windows 11 Pro/Education/Enterprise, you have the option to install Hyper-V on your machine. This can be done through the features on demand window:

Migrate Group Policies to a new server or domain like a pro

Wed, 07 Aug 2024 00:00:00 +0000

Once in a while, we as IT administrators need to export and import our Group Policies of Windows Server to another server. Sometimes to copy a great policy you’ve built, or to migrate a customer to a new server.

By default, the only option Microsoft has built in into Group Policy Management (gpmc.msc) is the backup option. This creates some administrative tasks.

The Export and Import scripts

I have created two scripts with Powershell that fully exports and imports all Group Policy Objects (GPOs). This with 2 seperate scripts. These can be found and downloaded from my Github page:

Windows Server Backup Retention

Tue, 30 Apr 2024 00:00:00 +0000

For more information about the wbadmin tool, see:

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin

The Script

With this small script based on wbadmin we can remove old backups while keeping the last 30 items for example. This retains the data for 30 days while also keeping your storage nice and clean.

The script itself consists of the following command:

POWERSHELL

wbadmin delete backup -keepVersions:30 -quiet

Explanation of the command

wbadmin: The command-line tool that makes this solution possible. It is part of Windows Server Backup.
delete: Indicates that a delete operation should be performed.
backup: Specifies what should be deleted: backups.
-keepVersions:30 Keeps the 30 most recent backups and deletes all older backups.
-quiet: Prevents confirmation prompts (Y/N) and avoids showing a command window to interactive users.

You can change the amount of backups to keep according to your needs and storage by changing the 30 to a lower or higher number.

Change Evaluation version to Standard/Datacenter version

Wed, 03 May 2023 00:00:00 +0000

When you install a fresh Windows Server installation from a .iso file, it will be installing the OS as a Evaluation version. When you want to activate the installation with a key you need to rebuild the OS and set the edition to Standard.

Microsoft considers Standard and Standard Evaluation as different editions of Windows, because of this we have to change the edition before you can activate the installation. When you want to use the edition Datacenter, you can change the command to Datacenter which also works.