Craig's IT Extras: 2017

SQL Server Reporting handouts

PowerShell code signing (course 10961B)

On LON-DC1

Install the full UI.
Install-WindowsFeature User-Interfaces-Infra –IncludeAllSubFeature

Restart.

Install AD Certificate Services.
Install-WindowsFeature AD-Certificate, ADCS-Cert-Authority –IncludeManagementTools

Server Manager, Post-deployment Configuration.
Create an Enterprise Root CA called “ADatum CA”.

Run Certification Authority management tool.

Right click Certificate Templates, choose Manage.

Right-click Code Signing, choose Duplicate Template.
General tab, Template display name “Code Signing II”.
Request Handling tab, select Allow private key to be exported.
Click OK.

Close Manage Templates.

Switch to Certification Authority management tool.

Right click Certificate Templates, choose New Certificate template to Issue.
Code Signing II.

On LON-CL1

Start, Run, certmgr.msc.

Right-click Personal, choose All Tasks, Request New Certificate.
Select Certificate Enrollment Policy page, click Next.
Request Certificates page, select Code Signing II, click Enroll.

Open Personal \ Certificates.

Right-click the certificate with a template of Code Signing II, choose Copy.
Right-click Trusted Publishers, choose Paste.

Note: In practice you should use Group Policy to distribute the Trusted Publisher certificate, probably to machines' certificate stores.

Run a PowerShell prompt.
cd CERT:\CurrentUser\my
$CSCert = (dir -CodeSigningCert)[0]
Set-AuthenticodeSignature -Certificate $CSCert -FilePath E:\Democode\Demo-Signing2.ps1

If the signing is successful then you will see something similiar to the following.

SignerCertificate Status Path

----------------- ------ ----

84623FD8D796C6E722DE330B4DDFD6FEB01AF412 Valid Demo-Signing2.ps1

Group Policy Processing

Active Directory replication

Remotely administering Hyper-V with WinRM

Hyper-V in Windows 10 and Server 2016 uses WinRM for remote management.

In order to remotely manage a machine that is not in the same domain as the client, the server's name or IP address must be added to TrustedHosts on the client and CredSSP authentication must be configured on both machines.

On the server:

Enable-PSRemoting # On by default in Windows Server.

Enable-WSManCredSSP -Role server

On the client:

$HVHost = "172.29.203.25"

$TH = Get-Item WSMan:\localhost\Client\TrustedHosts | select -ExpandProperty value

if ( $TH.Length -eq 0 )
{ $TH = $HVHost }
else
{ $TH += ",$HVHost" } # A comma-separated list.

Set-Item WSMan:\localhost\Client\TrustedHosts -Value $TH

Enable-WSManCredSSP -Role client -DelegateComputer $HVHost

From Hyper-V Manager, connect to server. Enter the server's name or IP address and click the Set User button to enter an administrative username and password.