<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Praetorian Prefect &#187; Windows</title>
	<atom:link href="http://praetorianprefect.com/archives/tag/windows/feed/" rel="self" type="application/rss+xml" />
	<link>http://praetorianprefect.com</link>
	<description>Information security, a little slower...a little deeper</description>
	<lastBuildDate>Thu, 19 Jan 2012 03:59:33 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>WinPE 3.0 &amp; Forensics</title>
		<link>http://praetorianprefect.com/archives/2010/04/winpe-3-0-forensics/</link>
		<comments>http://praetorianprefect.com/archives/2010/04/winpe-3-0-forensics/#comments</comments>
		<pubDate>Mon, 12 Apr 2010 22:46:49 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[post-wide]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3608</guid>
		<description><![CDATA[It is a common task for an investigator to boot a machine using bootable media in the form of DVD or USB and there are countless options available. This tutorial is not intended to replace your favorite Helix CD or preferred method, but you may find this analysis interesting if you are a Windows expert performing a forensics analysis.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/04/winpe-3-0-forensics/feed/</wfw:commentRss>
		<slash:comments>19</slash:comments>
		</item>
		<item>
		<title>March&#8217;s Patch Tuesday</title>
		<link>http://praetorianprefect.com/archives/2010/03/3473/</link>
		<comments>http://praetorianprefect.com/archives/2010/03/3473/#comments</comments>
		<pubDate>Tue, 09 Mar 2010 20:38:40 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Patch Management]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[excel]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[office]]></category>
		<category><![CDATA[office for mac]]></category>
		<category><![CDATA[patch]]></category>
		<category><![CDATA[patch tuesday]]></category>
		<category><![CDATA[updates]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3473</guid>
		<description><![CDATA[<a href="http://praetorianprefect.com/wp-content/uploads/2010/03/msft_logo.jpg"><img src="http://praetorianprefect.com/wp-content/uploads/2010/03/msft_logo.jpg" alt="msft_logo" title="msft_logo" width="150" height="150" class="alignleft size-full wp-image-3484" /></a>

Today is patch Tuesday for March 2010, and Microsoft has released two security bulletins for this round of updates, neither of which are deemed critical. The second bulletin addresses seven different vulnerabilities across various versions of Microsoft Office Excel.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/03/3473/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Press F1 for Help, pwned.</title>
		<link>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/</link>
		<comments>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/#comments</comments>
		<pubDate>Tue, 02 Mar 2010 17:39:54 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Remote Exploit]]></category>
		<category><![CDATA[help system]]></category>
		<category><![CDATA[ie]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[winhlp32]]></category>
		<category><![CDATA[zero-day]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3444</guid>
		<description><![CDATA[

Microsoft published security advisory 981169 yesterday in response to the zero day vulnerability reported a few days prior. The vulnerability is in the help system and can be triggered by luring an Internet Explorer user into pressing the F1 key. Windows 2000, Windows XP SP2 &#38; SP3, and Windows 2003 SP2 with Internet Explorer 7 [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Windows 7 SMB Kernel Crash Video</title>
		<link>http://praetorianprefect.com/archives/2010/01/windows-smb-crash-video/</link>
		<comments>http://praetorianprefect.com/archives/2010/01/windows-smb-crash-video/#comments</comments>
		<pubDate>Thu, 14 Jan 2010 05:27:07 +0000</pubDate>
		<dc:creator>Prefect</dc:creator>
				<category><![CDATA[Remote Exploit]]></category>
		<category><![CDATA[crash]]></category>
		<category><![CDATA[kernel]]></category>
		<category><![CDATA[SMB]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=2997</guid>
		<description><![CDATA[Back <a href="http://praetorianprefect.com/archives/2009/11/how-to-crash-windows-7-and-server-2008/">on November 11th, 2009</a> we confirmed <a href="http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html">Laurent Gaffié's remote exploit</a> for Windows that causes a kernel crash. The operating system actually freezes creating a denial of service when for example a user is tricked into clicking on a link to a malicious SMB share on a web page. The SMB client goes into an infinite loop when processing this malformed request according to Microsoft. The video below demonstrates this effect, having a user click a web site link and showing the crash.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/01/windows-smb-crash-video/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Regular or Decaf? Tool launched to combat COFEE</title>
		<link>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/</link>
		<comments>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/#comments</comments>
		<pubDate>Tue, 15 Dec 2009 01:21:34 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Incident Response]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[anti-forensics]]></category>
		<category><![CDATA[cofee]]></category>
		<category><![CDATA[decaf]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=2250</guid>
		<description><![CDATA[

About a month ago, there was much news about the release of COFEE into the torrent wild. I even gave my two cents about the much hyped forensics toolkit which is provided to law enforcement for the purposes of easily capturing volatile data from personal computers during evidence collection. A tool to counter COFEE, aptly [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Six Bulletins in Last Patch Tuesday of 2009</title>
		<link>http://praetorianprefect.com/archives/2009/12/six-bulletins-in-last-patch-tuesday-of-2009/</link>
		<comments>http://praetorianprefect.com/archives/2009/12/six-bulletins-in-last-patch-tuesday-of-2009/#comments</comments>
		<pubDate>Tue, 08 Dec 2009 19:39:55 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[flash]]></category>
		<category><![CDATA[ie]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[patch]]></category>
		<category><![CDATA[patch tuesday]]></category>
		<category><![CDATA[updates]]></category>
		<category><![CDATA[vulnerabilities]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=2088</guid>
		<description><![CDATA[Today marks the last Microsoft patch Tuesday of 2009, and Microsoft has released patches to six bulletins:




MS09-071 &#8211; Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution (974318)
MS09-074 &#8211; Vulnerability in Microsoft Office Project Could Allow Remote Code Execution (967183) 
MS09-072 &#8211; Cumulative Security Update for Internet Explorer (976325) 
MS09-069 &#8211; Vulnerability in Local [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/12/six-bulletins-in-last-patch-tuesday-of-2009/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>From Promiscuous to Port Scanning with Powershell</title>
		<link>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/</link>
		<comments>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/#comments</comments>
		<pubDate>Mon, 23 Nov 2009 19:04:15 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Administration]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[network]]></category>
		<category><![CDATA[portscan]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[scripting]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=1924</guid>
		<description><![CDATA[

It&#8217;s been a while since my last post regarding Powershell which showed how to scan hosts for network interfaces in promiscuous mode. This time around, we’ll scan for some well known ports in our Active Directory to see who has a local IIS or SQL Express running on their machine. I know what you’re thinking. [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Where is your BES Policy?</title>
		<link>http://praetorianprefect.com/archives/2009/10/where-is-your-bes-policy/</link>
		<comments>http://praetorianprefect.com/archives/2009/10/where-is-your-bes-policy/#comments</comments>
		<pubDate>Mon, 26 Oct 2009 16:23:52 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Data Leak Prevention]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[BES]]></category>
		<category><![CDATA[blackberry]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[iphone]]></category>
		<category><![CDATA[IT]]></category>
		<category><![CDATA[mobile]]></category>
		<category><![CDATA[passwords]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=1139</guid>
		<description><![CDATA[Several months ago, users of a wireless carrier in the United Arab Emirates (UAE) were sent an SMS message to their Blackberry devices instructing them to install a software patch that would resolve recent network trouble they’ve been experiencing. The patch turned out to be spyware (Etisalat.A[MA]) and would intercept the user’s email, sending the [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/10/where-is-your-bes-policy/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Server 2008 R2: Active Directory Functional Levels</title>
		<link>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/</link>
		<comments>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/#comments</comments>
		<pubDate>Tue, 06 Oct 2009 09:12:14 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[federation services]]></category>
		<category><![CDATA[kerberos]]></category>
		<category><![CDATA[ldap]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[server]]></category>
		<category><![CDATA[windows 2008]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=758</guid>
		<description><![CDATA[Windows Server 2008 R2 was released in August, and it introduced new functional levels for Active Directory. This article takes a look back at the different functional levels of the past and what is new in the latest release of the server operating system for Active Directory (yes, a recycle bin for AD objects!).

Functional levels [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>2008 Server to the Core</title>
		<link>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/</link>
		<comments>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 21:47:06 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[featured]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[cli]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[scripting]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[windows 2008]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=398</guid>
		<description><![CDATA[One of my favorite websites in the days of Windows 2000 Server was a project from a group of system managers from the Department of Electrical Engineering at the Swiss Federal Institute of Technology; it was titled “Real Men Don&#8217;t Click”, and it was dedicated to accomplishing tasks solely using the command line interface (CLI). [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Who’s Being Promiscuous in Your Active Directory?</title>
		<link>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/</link>
		<comments>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/#comments</comments>
		<pubDate>Tue, 15 Sep 2009 00:18:50 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[WMI]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=719</guid>
		<description><![CDATA[I’m always a fan of more queries and peaks at what is going on in my AD domain, especially at what is happening on the workstations. I was working on some WMI queries to get information about network interfaces using the Win32_NetworkAdapterConfiguration class, and thought about promqry.exe. Promqry is a tool provided by Microsoft to [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Windows Task Scheduler: Backwards Incompatibility</title>
		<link>http://praetorianprefect.com/archives/2009/09/windows-task-scheduler-backwards-incompatibility/</link>
		<comments>http://praetorianprefect.com/archives/2009/09/windows-task-scheduler-backwards-incompatibility/#comments</comments>
		<pubDate>Mon, 07 Sep 2009 01:49:35 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[vista]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[windows 7]]></category>
		<category><![CDATA[WMI]]></category>
		<category><![CDATA[xp]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=741</guid>
		<description><![CDATA[Scheduled tasks are plentiful in most environments. Managing them is typically a nightmare. You have some running to truncate and copy off logs someplace, or others to run a proprietary backup utility to dump a copy of your Quickbooks data; whatever the reason, over time there are more and they are everywhere. Typically, you want [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/09/windows-task-scheduler-backwards-incompatibility/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

