1) Je potřeba povolit “Insecure guest logons”

2) Je potřeba zakázat požadavek na šifrování spojení se Sambou

Metoda 1

Set-SmbClientConfiguration -EnableInsecureGuestLogons $true
Set-SmbClientConfiguration -RequireSecuritySignature $false

Metoda 2

1. gpedit.msc
2. Computer configuration > Administrative Templates > Network > Lanman workstation > Enable insecure guest logons > Enabled.
3. Computer Configuration > Windows Settings > Security Settings> Local Policies > Security Options > Microsoft network client: Digitally sign communications (always) > Disabled.

Názvy souborů v argumentech musí být full path.

start "" /B /LOW /WAIT "c:\program files\blabla" --param1 "arg1" --param2 "d:\data\file"

PowerShell:

Start-Process -FilePath 'c:\program files\blabla' -ArgumentList '--param1 "arg1" --param2 "d:\data\file"' -WindowStyle Hidden

reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{374DE290-123F-4565-9164-39C4925E467B}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A0953C92-50DC-43bf-BE83-3742FED03C9C}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}" /f

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
DWORD, 0 = schovan

Smazat vše pod těmito klíči (věci začínající na ##, věci v { } i CCD.

HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Explorer\MountPoints2
HKEY_USERS\{SID}\Software\Microsoft\windows\CurrentVersion\Explorer\MountPoints2

+ restartovat.

Jak zjistit SID:

wmic useraccount get name,sid

Zdroj: link

• Network Share Reconnecter

chcp 1250
start /b mojedavka.bat
exit 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\DisabledComponents (DWORD)
Disable all tunnel interfaces                                 0×1
Disable 6to4                                                  0×2
Disable ISATAP                                                0×4
Disable Teredo                                                0×8
Disable Teredo and 6to4                                       0xA
Disable all LAN and PPP interfaces                            0×10
Disable all LAN, PPP, and tunnel interfaces                   0×11
Prefer IPv4 over IPv6                                         0×20
Disable IPv6 over all interfaces and prefer IPv4 to IPv6      0xFF

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer\NoLowDiskSpaceChecks -> 1 (DWORD)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows
CSDVersion: zmenit z 200 na 300 (hexa, tj. z 512 na 768)  

Pro všechny uživatele - aktuálně nainstalované

Get-AppxPackage -AllUsers | Remove-AppxPackage

Provisioned apps - tj. ty, které se nainstalují každému novému uživateli

Get-AppXProvisionedPackage -online | Remove-AppxProvisionedPackage –online

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA: změnit z 1 na 0

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
přidat celou cestu k .exe spouštěné aplikace jako string value
  jako Data vložit "RUNASADMIN"

Local security policy editor (secpol.msc)
Local Policies -> Security Options -> User Account Control:
  Behavior of the elevation prompt for administrators in Admin Approval Mode
nastavit Elevate without prompting

• Zákaz spouštění .exe v AppData

CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\PlacesBar
"Place0"= // My Computer
"Place1"="C:\"  // c:

Windows pak rozbijou okna na ploše.

Stane se i při přepnutí vstupu na jiný.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration

Klíč, který začíná názvem SIMULATED

pod ním je klíč 00 a v něm další klíč 00
v obou nastavit následující položky na hodnoty odpovídající fyzickému rozlišení monitoru
 PrimSurfSize.cx
 PrimSurfSize.cy
HEX hodnotu lze opsat z klíče, který začíná názvem monitoru

1. Stisknout a držet Shift, restartovat PC.
2. V nabídce zvolit Další možnosti spuštění
3. Po restartu zvolit možnost 7 - spustit bez kontroly podepsaných ovladačů

• Nainstalovat Roli Vzdálené plochy, Licenčního serveru a Remote Desktop Session Host
• Přidat licenci
• PowerShell magic:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.ChangeMode(4)
# 2 = per device, 4 = per user
$obj.SetSpecifiedLicenseServerList("Jménoserveru")

• Zdroje: ServerFault, MS Knowledge Base

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook
(2016 = 16.0, 2013 = 15.0, 2010 = 14.0, 2007 = 12.0)

Přidat klíč typu String s názvem ForcePSTPath a jako hodnotu zadat cestu k adresáři,
kam se mají .pst/.ost soubory ukládat.

Funguje od Exchange 2010 SP1

Export možno provést pouze na síťový share.

V MS Exchange Management Shellu:

New-ManagementRoleAssignment –Role "Mailbox Import Export" –User Spravce
New-MailboxExportRequest -Mailbox uzivatel -FilePath \\sitovyshare\uzivatel.pst

cd /d "%Windir%\System32"
takeown /F MusNotification.exe
icacls MusNotification.exe /deny Everyone:(X)
takeown /F MusNotificationUx.exe
icacls MusNotificationUx.exe /deny Everyone:(X)
rem

Nutno spouštět jako administrátor (zápis do HKLM)

@echo off

set path_to_add=;X:\Bubak
set key="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

for /f "tokens=2*" %%a in ('REG QUERY %key% /v Path') do set "existingValuesPath=%%~b"
set newPath=%existingValuesPath%%path_to_add%
reg add %key% /v "Path" /d "%newPath%" /f /t REG_EXPAND_SZ

!!! POZOR !!! typ klíče na Windows 8.1 (a asi i starších) je jen REG_SZ

printui /s /t2

1. Instalace se provádí přes Office Deployment Tool a konfigurační soubor.
2. Klíč musí být typu “MAK”.

Konfigurák:

<Configuration>
  <Add OfficeClientEdition="64" Channel="PerpetualVL2019" AllowCdnFallback="TRUE" ForceUpgrade="TRUE">
    <Product ID="Standard2019Volume" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX">
      <Language ID="cs-cz" />
      <Language ID="en-us" />
      <ExcludeApp ID="Groove" />
      <ExcludeApp ID="OneNote" />
      <ExcludeApp ID="OneDrive" />
      <ExcludeApp ID="Publisher" />
    </Product>
  </Add>
  <Property Name="SharedComputerLicensing" Value="0" />
  <Property Name="PinIconsToTaskbar" Value="TRUE" />
  <Property Name="SCLCacheOverride" Value="0" />
  <Property Name="AUTOACTIVATE" Value="0" />
  <Updates Enabled="TRUE" />
  <RemoveMSI All="TRUE" />
  <AppSettings>
    <Setup Name="Company" Value="ZŠ Křesomyslova" />
  </AppSettings>
  <Display Level="Full" AcceptEULA="TRUE" />
</Configuration>

SET PathPortableApps=C:\WW\Apps\PAP\PortableApps
SET PathApps=C:\WW\Apps
SET PathApps64=C:\WW\Apps64

rem Documents
assoc .odt=LibreOffice.OpenDocument.Text
assoc .ods=LibreOffice.OpenDocument.Spreadsheet
assoc .odp=LibreOffice.OpenDocument.Presentation
assoc .ott=LibreOffice.Template.Text
 
ftype LibreOffice.OpenDocument.Text="%PathPortableApps%\LibreOfficePortable\LibreOfficeWriterPortable.exe" "%%1"
ftype LibreOffice.OpenDocument.Spreadsheet="%PathPortableApps%\LibreOfficePortable\LibreOfficeCalcPortable.exe" "%%1"
ftype LibreOffice.OpenDocument.Presentation="%PathPortableApps%\LibreOfficePortable\LibreOfficeImpressPortable.exe" "%%1"
ftype LibreOffice.Template.Text="%PathPortableApps%\LibreOfficePortable\LibreOfficeWriterPortable.exe" "%%1"
 
assoc .docx=OpenXML.Text
assoc .xlsx=OpenXML.Spreadsheet
assoc .pptx=OpenXML.Presentation
 
ftype OpenXML.Text="%PathPortableApps%\LibreOfficePortable\LibreOfficeWriterPortable.exe" "%%1"
ftype OpenXML.Spreadsheet="%PathPortableApps%\LibreOfficePortable\LibreOfficeCalcPortable.exe" "%%1"
ftype OpenXML.Presentation="%PathPortableApps%\LibreOfficePortable\LibreOfficeImpressPortable.exe" "%%1"

rem PDF
assoc .pdf=FoxitReader.PDF
 
ftype FoxitReader.PDF="%PathPortableApps%\FoxitReaderPortable\FoxitReaderPortable.exe" "%%1"

rem Pictures
assoc  .bmp=IrfanView.BMP
assoc  .jpg=IrfanView.JPG
assoc  .png=IrfanView.PNG
assoc .webp=IrfanView.WEBP
 
ftype  IrfanView.BMP="%PathApps64%\IrfanView\i_view64.exe" "%%1"
ftype  IrfanView.JPG="%PathApps64%\IrfanView\i_view64.exe" "%%1"
ftype  IrfanView.PNG="%PathApps64%\IrfanView\i_view64.exe" "%%1"
ftype  IrfanView.WEBP="%PathApps64%\IrfanView\i_view64.exe" "%%1"
 
# rem Audio
 
assoc .flac=foobar2000.FLAC
assoc  .m4a=foobar2000.M4A
assoc  .mka=foobar2000.MKA
assoc  .mp3=foobar2000.MP3
assoc  .ogg=foobar2000.VORBIS
assoc  .wma=foobar2000.WMA
assoc   .wv=foobar2000.WAVPACK
 
ftype foobar2000.FLAC="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.M4A="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.MKA="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.MP3="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.VORBIS="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.WMA="%PathApps%\foobar2000\foobar2000.exe" "%%1"
ftype foobar2000.WAVPACK="%PathApps%\foobar2000\foobar2000.exe" "%%1"

rem Video
assoc .3gp=MPCHC.3GP
assoc .asf=MPCHC.ASF
assoc .avi=MPCHC.AVI
assoc .flv=MPCHC.FLV
assoc .mkv=MPCHC.MKV
assoc .mp4=MPCHC.MP4
assoc .mpeg=MPCHC.MPEG
assoc .mpg=MPCHC.MPG
assoc .wmv=MPCHC.WMV
 
ftype MPCHC.MP4="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.3GP="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.ASF="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.AVI="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.FLV="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.MKV="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.MP4="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.MPEG="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.MPG="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"
ftype MPCHC.WMV="%PathApps64%\MPC-HC\mpc-hc64.exe" "%%1"

for %%f in ("wifi\*.xml") do ( netsh wlan add profile filename="wifi\%%~nf.xml" )

Registr:

HKEY_USERS\.Default\Control Panel\Keyboard\InitialKeyboardIndicators

Nastavit hodnotu na 2.

• Windows - uleželé