Tuesday, September 27, 2016

ACAS \ Nessus Causes Systems to Crash, Reboot, or BSOD upon Credentialed Scans

Issue:
ACAS \ Nessus Causes Systems to Crash, Reboot, or BSOD upon Credentialed Scans
Environment:
Windows 7 workstations
Symptoms:
The moment an ACAS \ Nessus Credentialed scan begins, the target system crashes, reboots, or BSODs.
Solution:
Tracked this down to Microsoft Patch 3161531.
Appears to be happening when Tenable accesses C$ (almost immediately upon scan).
A related discussion on BSOD's when accessing C$ is here:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/4b1e0e7b-3b26-41f3-8979-0cd7a25d9209/kb3161561-crashing-server-when-remotly-accessed-with-smb?forum=winservergen
It appears that Microsoft has put out a related hotfix to this issue. Not because of Nessus specifically, but due to general problems when accessing C$, which I believe is ultimately why Nessus is failing.
For details, see both:
https://support.microsoft.com/en-us/kb/3161561
https://support.microsoft.com/en-us/kb/3179573

Thursday, September 1, 2016

Updates not working on new install of Windows 7

Issue:
Updates not working on new install of Windows 7
Environment:
Windows 7 x64 Fresh Install
Symptoms:
Going to Windows Updates results in a window which states 'Checking for updates', but that check never ends.
Solution:
I did see this solution after much looking on answers.microsoft.com , but wanted to put it here as it specifically worked for me:
Install Windows 7.
Don't connect to internet.
Install Windows6.1-KB3083710-x64.msu.
Reboot.
Install Windows6.1-KB3102810-x64.msu
Reboot.
Use the Windows Update tool as normal. The initial check for updates may still take some time, but should eventually work.

Wednesday, February 10, 2016

If you want to have a task deleted automatically after it runs, you must add at least one trigger that has an expiration date.

Issue:
When attempting to use Task Scheduler with the "/sc onstart" and "/z" switches, the task does not get deleted. The error "If you want to have a task deleted automatically after it runs, you must add at least one trigger that has an expiration date." may occur. This occurs when trying to run a scheduled task on startup (onstart) and have it deleted upon completion (/z). Although a deletion of the task could be performed via the GUI, the point is to have the task removed automatically.
Environment:
Windows. The goal is to kickoff a task when a computer is rebooted, have the task complete and then be deleted so that it doesn't run a second time.
Symptoms:
Task runs, however does not get deleted upon completion.
Solution:
It appears that to use the "/sc once" switch, a time MUST be entered. Without knowing the time that the system will be rebooted, this isn't easy or practical to do. Using the "/sc onstart" option with "/z" doesn't produce the desired results either (as mentioned above). The solution was to have the task delete itself.
The first task can be created such as:
SCHTASKS /create /sc onstart /tn "myTask" /tr "C:\temp\test.bat" /ru SYSTEM
The test.bat file would accomplish whichever tasks were desired, and then delete the task:
test.bat:
****
...Actions to take...
SCHTASKS /delete /tn "myTask" /f
****

Please note that this issue is different from the error "The task XML is missing a required element or attribute" which occurs if not using the /v1 switch, as described here:
https://support.microsoft.com/en-us/kb/2004151