OS Guide: Slipstream Updates Using DISM and OSCDImg *Updated

We have found out that we need to have the May Servicing Stack Update (SSU) KB4132216 _and_ the latest SSU which is currently KB4465659 in the Updates_WinServ folder we drop the Cumulative Update into for the Windows Server 2016 slipstream run.

• Article: OS Guide: Slipstream Updates Using DISM and OSCDImg

Note that the current version of the script points to Server 2019. Please use that as a base to tweak and create a set of folders for Windows Server 2016 and Windows 10 updates.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
www.s2d.rocks !
Our Web Site
Our Cloud Service

Remote Desktop Client: An authentication error has occurred. *Workaround

Updates last night included one for CredSSP CVE-2018-0886.

For those of us that are hesitant to patch our servers the instant a patch is available we'll be seeing RD Clients unable to connect for the period prior to our regression testing and release cycle.

Remote Desktop Connection

An authentication error has occurred.
The function requested is not supported.

Remote Computer: SERVERNAME
This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660

For now, the workaround on the remotely connecting RD Clients is to set the following registry key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters]
"AllowEncryptionOracle"=dword:00000002

Copy and paste the above into Notepad and Save As "CredSSP.REG" in a quickly accessible location.

Double click on the created file and MERGE. An elevated Registry Editor session would also allow for import via the FILE menu.

Once the above registry setting is in-place reboot the client machine and the connection should work.

Happy Patching! :)

UPDATE 2018-05-09 @ 10:47 MST: A caveat:

It is better to update the server backend, if possible, before making the above registry change.

If that is _not_ possible, then after the updates have been applied on the server(s) make sure to _change_ the registry setting to its most secure setting.

UPDATE 2018-05-10 @ 17:38 MST:

Update sources:

• Windows Server 2012 R2 Updates List
• KB4103725 fixes the issue but may require a manual from the console/desktop reboot!
• Windows Server 2016 Updates List
• KB4103723 fixes the issue but requires a reboot

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Web Site
Our Cloud Service

Exchange 2013 OWA Comparison: RTM to CU1

We are happy to report that after walking through all of the troubleshooting steps we needed to that Exchange 2013 CU1 installed successfully on one of our Exchange 2013 RTM greenfield deploys.

Note that there were 18 steps to the whole process _after_ completing the AD prep steps and installing the required components on Server 2012.

This is a shot of Exchange 2013 RTM OWA:

This is a shot of Exchange 2013 CU1 OWA:

We now have the SPAMfighter folder listed.

One thing we noticed is that OWA loaded a _lot_ faster on the new platform than it used to on RTM.

As always, _test_ updates in a lab setting before wondering out and running them on production systems.

We had a System State and a full ShadowProtect backup of this particular setup before we jumped in as a just-in-case.

Given that some of the RTM bugs were critical at this site we jumped into CU1 right away on a production system.

So far, we can report that things are back to normal. So far . . .

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer