주제: windows
-
PowerShell error handling for admin scripts: terminating errors, $ErrorActionPreference and $LASTEXITCODE
PowerShell has two error classes that behave differently in a script: terminating errors that try/catch can stop, and non-terminating errors that only $ErrorActionPreference or -ErrorAction can turn into a stop. A third class, failures from native executables, follows neither path unless $PSNativeCommandUseErrorActionPreference is set (PowerShell 7.4+, experimental in 7.3).
-
Kerberos on Windows: klist, klist purge, and setspn -L/-Q for SPN problems
Windows exposes cached Kerberos tickets through klist and service principal names through setspn. Duplicate SPNs and clock skew between a client and a domain controller are the two failures that most often turn into confusing 'cannot authenticate' errors rather than a clear Kerberos message.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Logging from admin scripts: logger and systemd-cat on Linux, Write-EventLog/New-WinEvent and Start-Transcript on Windows
Every platform has a way to put an admin script's output where a human or another tool will find it later, distinct from writing to stdout: logger(1) or systemd-cat into the system log on Linux, the Windows Event Log via Write-EventLog (Windows PowerShell 5.1 only) or New-WinEvent, and Start-Transcript for a raw session capture. None of them should ever receive a secret.
-
Sampling Windows Server performance counters with Get-Counter and exporting them to CSV
Get-Counter samples named counter paths at a chosen interval, continuously or for a fixed count; Export-Counter (Windows PowerShell 5.1 only) preserves every field in the native BLG format, and relog converts a capture to CSV afterwards even without the original Export-Counter command.
-
Windows answer files (unattend.xml): configuration passes and where Setup looks for them
An unattend.xml answer file supplies settings to specific configuration passes of Windows Setup — windowsPE, generalize, specialize and oobeSystem are the ones provisioning touches most. Setup finds the file through a fixed implicit search order and caches it in %WINDIR%\Panther, and Windows System Image Manager builds these files and can hide, but not encrypt, local-account passwords in them.
-
Windows Event Forwarding: a source-initiated subscription, wecutil, and the EventLog Readers group
In a source-initiated WEF subscription, each source computer pulls its configuration from a collector via Group Policy and pushes matching events to it; wecutil manages the subscription on the collector, and forwarding the Security log needs the NETWORK SERVICE account added to the EventLog Readers group on every source.
-
악용 근거와 영향받는 자산을 기준으로 2026년 10월 정기 보안 업데이트 우선순위 정하기
대규모 업데이트를 자산별 작업 대기열로 정리하는 패치 우선순위 분류 절차를 제안합니다. 확인된 악용, 노출 및 업무상 영향으로 긴급도를 판단하고, 악용 근거가 없는 경우에는 EPSS를 보조 수단으로 사용합니다.
-
Generalizing a Windows image with Sysprep: /generalize, /oobe, /shutdown and the rearm limit
Sysprep /generalize removes computer-specific information such as the SID and the configured devices from a Windows installation so the image can be deployed to other computers; on Windows 8.1/Server 2012 and later Sysprep can be run up to 1001 times per image (3 times on Windows 7/Server 2008 R2), and generalize failures leave their trace in the Panther logs under System32\Sysprep.
-
Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do
Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.
-
Log retention and disk budgeting on a host: journald, logrotate and Windows event log sizing
journald's SystemMaxUse caps the journal's own disk footprint, logrotate's maxage and rotate counts cap rotated files elsewhere, and wevtutil sl sets a Windows event log's maximum size. All three are disk-budgeting settings the operator or an agent chooses; how long records must be kept for legal or organisational reasons is a policy decision this article does not make.
-
Windows exit codes beyond pass/fail: robocopy's bitmask, msiexec's installer codes, and $LASTEXITCODE
robocopy encodes several independent facts (files copied, extra files, mismatches, failures) into one number below 8 that must be read as a bitmask, not compared to zero; msiexec returns specific Windows Installer codes where 3010 and 1641 mean success with a pending reboot, not failure; and PowerShell's $LASTEXITCODE is the only reliable way to see a native program's real code, with different rules depending on how the script was invoked.
-
Windows Shell CVE-2026-96951: Windows 11 수정 확인과 첨부파일 보호 유지
정확한 Windows 11 릴리스에 맞는 누적 업데이트를 확인하고 재시작을 완료하며, 첨부파일 출처 정보와 SmartScreen 보호 기능을 유지해야 합니다. 경고가 없다고 다운로드한 파일이 안전한 것은 아닙니다.
-
2026년 10월 이후의 Windows 10: 소비자 및 조직용 ESU 지원 범위
Microsoft의 소비자용 ESU 페이지는 현재 지원 기간을 2027년 10월 12일까지로 명시합니다. 조직에는 별도의 연간 ESU 조건이 적용되므로, 계속 사용하는 각 Windows 10 장치에 대해 자격 요건, 프로그램 연차, 활성화 상태, 설치된 업데이트를 각각 기록합니다.
-
Why NTP still runs inside virtual machines despite guest agents and paravirtual clocks
Virtual machines get time-related help from several layers — kvm-clock, guest agents, Hyper-V integration services — but none of them substitute for an NTP or chrony client running inside the guest. This article explains what each layer actually does and why time sync stays a guest-OS responsibility.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
-
windows_exporter: installing the MSI with enabled collectors, and verifying /metrics on Windows
windows_exporter ships as an MSI that installs itself as a Windows service and can take installer properties for which collectors to enable, the listen port, and a Windows Firewall exception, all set non-interactively through msiexec.
-
Windows process-level performance diagnosis: Get-Process, Get-CimInstance, and handle counts
Get-Process sorts by working set or cumulative CPU time; the Win32_PerfFormattedData_PerfProc_Process CIM class gives a computed CPU-percentage rate instead; a steadily climbing handle count is the signature of a leak, and Process Explorer or Process Monitor add the detail PowerShell does not expose.
-
cmd.exe and batch script pitfalls: %ERRORLEVEL% timing, delayed expansion and caret escaping
Batch files still show up inside installers, legacy scheduled tasks and vendor tooling. %ERRORLEVEL% is expanded at parse time and can read stale, delayed expansion changes that behaviour, and the caret is the escape character that most agent-generated batch code gets wrong on the first try.
-
Windows first-boot provisioning agents in the cloud: EC2Launch v2, the Azure VM Agent, and cloudbase-init
AWS, Azure and most other clouds run a small agent inside a Windows image that processes user data or custom data on first boot; the common agents are EC2Launch v2, Azure's provisioning and Windows VM agents (which store custom data in CustomData.bin but do not execute it) and the open-source cloudbase-init. Each logs to a different location worth checking when provisioning appears to have silently failed.
기계 판독 가능: JSON