Archive for the ‘Security’ Category

A Solution for Private Cloud Security “Blueprint,Design Guide & Operations Guide”

"A Solution for Private Cloud Security" series of three papers on private cloud security. With increasing numbers of organizations looking to create cloud-based environments or to implement cloud technologies within their existing data centers, business and technology decision-makers are looking closely at the possibilities and practicalities that these changes involve.

There are three documents in the downloadable .zip file:

  • A Solution for Private Cloud Security – Service Blueprint
  • A Solution for Private Cloud Security – Service Design
  • A Solution for Private Cloud Security – Service Operations

This document set represents the v.95 beta of this document set.

Please write to Tom Shinder at if you have recommendations or would like to review these documents for the official v1 release.

Download Page

Note: Tom is doing great job in building Reference and Security Architecture for Private Cloud

Categories: Cloud, IaaS, Microsoft, Security Tags:

New KB Article: Configuring Certificates for Virtual Machine Connection

August 13, 2010 1 comment

Hyper-V team just published a new KB article called “Configuring Certificates for Virtual Machine Connection” that talks about the way Hyper-V uses certificates and how to set it up. They also explain why we need them, something that might help new users and customers. This article provides information to folks who need to set this up and to folks who wanted to know how to work around wildcard certs.

It was put together by a member of our Test team, Krishna, at the request of our product support folks and now it’s here for you.

Enjoy it 😀

VMM Tricks: Manage VMM in restrictive Active Directory environment

February 12, 2010 Leave a comment

So you want to manage your VMM infrastructure while keeping an eye on your Hyper-V hosts security. looks like everyone wants to do that. So have you through before about using restricted Group group policy to limit membership for your local admins group.

let’s have a look at when to use a domain account for the VMM Service. In a restrictive Active Directory environment in which restricted Group group policy is in effect, we must use a domain account instead of Local System for the VMM service account. The Restricted Groups policy does not allow machine accounts to be a member of the local Administrators group. Under a Restricted Groups group policy, the VMM machine account will be removed from the computer, leaving VMM unable to communicate with the host. In that situation, VMM places the host in a Needs Attention state and places the VMM agents on hosts and library servers in Not Responding status in VMM.

For our “Restricted Group group policy” issue, we have two methods to fix it.

Method one


Add the VMM Server machine account to the Administrators “restricted groups” group policy setting. But if a Restricted Groups policy is defined and Group Policy is refreshed, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators.

Note To add the VMM Server machine account to the restricted group setting, use the following syntax:


Method two


Create a new organizational unit in the domain, move the Virtual Server and Hyper-V Server computer objects to the new OU and then configure the new organizational unit to block policy inheritance.

There are some articles which indicate the restricted group:

Updates to Restricted Groups (“Member of”) behavior of user-defined local groups

Restricted Groups

Restricted Groups Policy Settings

Thanks Alex to help in that.

Vulnerability in Windows Server 2008 Hyper-V Could Allow Denial of Service

February 10, 2010 1 comment

This security update resolves a privately reported vulnerability in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. The vulnerability could allow denial of service if a malformed sequence of machine instructions is run by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. An attacker must have valid logon credentials and be able to log on locally into a guest virtual machine to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Change Kaspersky Administration Kit AIK IP Address

Some times you may have to change your  Kaspersky Administration Kit IP address for restructuring purpose in your network.

You may face problem that all your agents appears offline in the Administration Kit console..all the clients appears with thier old IP.

The reason that the Kaspersky network agent is not able to contact the Administration Kit so it will not able to update its inforamations or get updates or policies from Administration Kit.

T keep the workstations connected to the Administration Kit you may to install another copy of Network Agent to each computer so that the admin kit can communicate again with the workstations.

In my case that solution does not help me a lot..I still facing the same problem so I used that batch to the agents and it works.

cd \
cd Program Files\Kaspersky Lab\NetworkAgent
klmover -address (New IP of AIK)

Categories: Security Tags: ,

Microsoft sounds bug alarm, confirms Windows-Word attacks

Promises patch to plug hole that’s been exploited for weeks

Microsoft Corp. yesterday warned of a critical vulnerability that affects users of Word running on Windows 2000, XP and Server 2003 SP1 — several weeks after one security company first reported an exploit and a day after a second vendor confirmed ongoing attacks.

In an advisory posted Friday, Microsoft acknowledged “public reports of very limited, targeted attacks” that exploit a bug in the Microsoft Jet Database Engine, a Windows component that provides data access to applications including Microsoft Access and Visual Basic.

According to Symantec Corp., however, the attacks Microsoft described used malicious Word 2000, 2002, 2003 and 2007 documents, which in turn call up the vulnerable Jet .dll (Dynamic Link Library file).

“We believe that the issue being described [by Microsoft] is one described on March 20, 2008, by Elia Florio of Symantec Security Response,” the security firm told customers of its DeepSight threat-analysis network on Saturday. “He notes a recent discovery, by Panda Security, of a possible zero-day exploit observed in the wild.”

Panda researcher Ismael Briones had blogged about the vulnerability nearly three weeks ago, but said Microsoft had dismissed his report of an in-the-wild exploit. “Microsoft replied that they would not fix these mdb vulnerabilities, as it seems they will not acknowledge vulnerabilities which are from .mdb files,” Briones said in his March 3 post.

“You appear to be reporting an issue with a file type Microsoft considers to be unsafe. Many programs, such as Internet Explorer and Outlook, automatically block these files,” Briones reported Microsoft as telling him in its e-mailed response.

Last week, however, Symantec researchers analyzed an exploit that circumvented the .mdb file format blocking in Outlook by simply renaming the file to a format the e-mail client accepted. “In fact, it is possible to call msjet40.dll directly from Word, without using Access at all,” claimed Symantec’s Florio in a Thursday post. “In this attack, the .doc file uses mail-merge functionalities to import an external data source file, and so it effectively forces Jet to load the malicious Access sample.”

Florio also noted that there are at least two unpatched bugs in Jet that have been exploited by hackers. One of those bugs was reported three years ago.

Microsoft said that users running Word on machines powered by Windows Vista and Windows Server 2003 SP2 are not at risk because those operating systems include a different version of Jet.

Although Microsoft downplayed the threat, spokesman Bill Sisk confirmed that a patch was on the way. “We currently have teams working to develop an update of appropriate quality for release in our regularly scheduled bulletin process or as an out-of-band update, depending on customer impact,” he said in a post to the Microsoft Security Response Center’s blog.

Until a fix is available, Microsoft said users and IT administrators could disable Jet or block .mdb files at the gateway.

The next scheduled Microsoft patch day is Tuesday, April 8.

Source : Computerworld By Gregg Keizer

Categories: Security

ISA Firewall Best Practices Analyzer v6 RTMs

February 22, 2008 Leave a comment
Brief Description
The ISA Server Best Practices Analyzer Tool is designed for administrators who want to determine the overall health of their ISA Server computers and to diagnose current problems. The tool scans the configuration settings of the local ISA Server computer and reports issues that do not conform to the recommended best practices.

The ISA Server Best Practices Analyzer (BPA) is a diagnostic tool that automatically performs specific tests on configuration data collected on the local ISA Server computer from the ISA Server hierarchy of administration COM objects, Windows Management Instrumentation (WMI) classes, the system registry, files on disk, and the Domain Name System (DNS) settings.

The resulting report details critical configuration issues, potential problems, and information about the local computer. By following the recommendations of the tool, administrators can achieve greater performance, scalability, reliability, and uptime.

The ISA Server Best Practices Analyzer is supplied with two supplemental tools.

• The ISA Data Packager enables you to create a single .cab file containing ISA Server diagnostic information that can be easily sent to Microsoft Product Support Services for analysis.

• BPA2Visio generates a Microsoft Office Visio® 2003 or Visio 2007 diagram of your network topology as seen from an ISA Server computer or any Windows computer based on output from the ISA Server Best Practices Analyzer Tool.

Go there and be the one to use it

Categories: Security Tags: , ,
%d bloggers like this: