Uninstalling Adobe Flash Player using Group Policy - Part 1

"Flash is a spaghetti-ball piece of technology  

that has lousy performance and really bad security problems."

Part 1 is about disabling Flash Player in Microsoft Edge using Group Policy.

What version of Flash player are your users running?

As I am writing this blog post, administrators once again find themselves in a situation that has existed since the introduction of Windows 8.

1. Microsofts insists on integrating Adobe Flash Player in the Windows operating system.
2. At the same time, security patches for Flash player that Adobe has already released, are occasionally withheld from Windows users.

The current situation is that Microsoft seems to have called off the February 2017 patch day altogether and Windows Users are stuck with an unpatched Flash Player.

In Microsoft Edge 38.14393.0.0 (Windows 10 14393.693) the Windows 10 Flash version number is 24,0,0,194 when it should be 24.0.0.221.

Check your Flash Player version here: http://www.adobe.com/software/flash/about/

Disabling Flash Player in Microsoft Edge using Group Policy

Create a new GPO and attach it to the OU that contains your Windows 10 users

Navigate to User Configuration \ Preferences \ Windows Settings \ Registry \

Right click on Registry. Choose New \ Registry Items

Configure the Properties:

Action: Update

Hive: HKEY_CURRENT_USER

Key Path:

SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Addons

The full path is

"HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Addons"

The key Addons may not exists and will be created later, when the GPO is applied.

Value Name: FlashPlayerEnabled

Value Type: Reg DWORD

Value Data: 00000000

Review the Group Policy:

Log on to the computer and check the Edge Settings:

Be aware that the user can always re-enable flash in their Edge settings, but the GPO will disable Flash at every login of the user.

This solution is therefore not yet perfect, but only part one of a bigger solution.

In the second part, I will show how to disable Flash in Internet Explorer.

Installation of DPM 2012 R2 on Windows Server 2012 R2 in Hyper-V

This will walk you through the installation of System Center Data Protection Manager 2012 R2 (DPM 2012 R2) on Windows Server 2012 R2 Standard in a Hyper-V virtual environment.

The environment:

Virtualization

• On-premises Hyper-V using Microsoft Hyper-V Server 2012 R2

Storage Pool
The DPM will use a Direct Attached Storage (DAS) configuration with two physical HDDs for the storage pool.

• 3 TB SATA HDD 
• 8 TB SATA Shingled magnetic recording (SMR) archive HDD. 

File Photo Seagate ST8000 Archive HDD (4)

The HDDs will be made available to the DPM server as virtual hard disks (VHDX).

Database
The DPM's databse will be hosted on the locally installed Microsoft's SQL 2012 Standard with SP1.

Setting up the virtual machine

Before I can start, I need a virtual machine with Windows Server 2012 R2 installed and fully patched. I create a generation 2 vm with a max memory of 8 GB dynamically assigned vRAM.

Note that the storage pool disks will be added later.

Installing SQL Server 2012 SP1 Std x64

You could also use SQL 2014 as DPM's database. Support for SQL 2014 was added in one of the U
update rollups but for this installation I will use SQL 2012 with SP1.

Prerequisite .NET Framework 3.5 (1)
I added a virtual SCSI DVD-ROM drive and inserted the Windows Server 2012 R2 Std DVD. This installed .net.(2)

 

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Limit
Access /Source:d:\sources\sxs

Deployment Image Servicing and Management tool
Version: 6.3.9600.17031

Image Version: 6.3.9600.17031

Enabling feature(s)
[==========================100.0%==========================]
The operation completed successfully.

C:\Windows\system32>

 

 Several Windows Updates will be unlocked:

 

 

After the update installation, I ejected the virtual DVD and attached the virtual SQL installation DVD. I chose to install a new standalone installation.

 

 

In this screen I chose to install the Standard edition the way it comes with DPM 2012 R2. The product key is entered automatically. Express or Evaluation edition do not suffice.

The installer installed two SQL updates during the installation.

In the next screen I selected "feature installation" and all that is needed accroding to the requirements of DPM is:

• Instance Features\Database Engine Services
• Instance Features\Reporting Service - Native

And I decided to install the Management Tools

• Shared Features\Management Tools - Basic
• Shared Features\Management Tools - Complete

  
"Default Instance".

Now it is time to create one Domain account that will be used to run the SQL services. (3)

• SQL Server Agent
• SQL Server Database Engine
• SQL Server Reporting Services

 

The database engine will use Latin1_General_CI_AS

Choose Windows authentication mode and choose one or more domain groups that will be the SQL administrators.

On the Reporting Services Native Mode prompt choose Install and configure.

The installation completed successfully.

Installing DPM 2012 R2

I inserted the DPM installation disc ISO into the virtual optical drive and started the DPM installation.

 In the prerequisites check, I entered the hostname of the virtual machine that was supposed to host both the SQL and the DPM and clicked Check and Install.

 

DPM setup proceeded to install basic missing Windows components and asked for a restart.

On second attempt, I was able to proceed.

It is time to enter the product key.

There are a few options some of them rather inconsequential (Customer Experience Improvement Program) like the installation path. The installation path is not where the backups will go,

Success.

Installing Updates

I wanted to install all the updates most above all SP2 for SQL 2012 and the Rollup 6 for DPM 2012 R2.

Another reboot is due.

 Readying the Storage Pool

On the hyper-v host, vhdx file were created on each physical storage pool disk
disk

3 TB disk > F:\vhds\dpm data 1.vhdx (~3 TB; dynamically expanding)
8 TB disk > G:\vhds\dpm data 2.vhdx (~8 TB; dynamically expanding)

In the VM, i brought the disks online and initialized them as GPT. Disk type basic.


Using the DPM management console \ management tab, I added the disks to the storage pool:

The populated storage pool shows 10 TiB,

Q & A

Why did you not use pass through disks for the storage pool?
Firstly, because VHDX files are now a supported scenario and secondly because Microsoft has indicated that the pass through disk feature might be deprecated or and eventually removed in the future. Also, the virtual machine is supposed allow an easy live migration.

Sources
(1) Hardware and Software Requirements for Installing SQL Server 2012
(2) Deploy .NET Framework 3.5 by using Deployment Image Servicing and Management (DISM)
(3) Set up the SQL Server database for DPM
(4) http://www.seagate.com/files/www-content/product-content/hdd-fam/seagate-archive-hdd/_shared/images/archive-hdd-8tb-upper-hero-left-400x400.jpg

 Moving the WSUS 4 Database

"If it wasn’t for that last minute, nothing would ever get done."

Why might you want to do this in the first place? Having a database on the system drive is generally a bad idea. WSUS uses the Windows Internal Database which is located in the Windows folder. Having a database on a separate volume is generally a good idea, if only for performance reasons. 

Preparation

1) Designate a new location for the database. Perhaps SSD or NAS based storage.

2) Like any WSUS administrator sooner or later realises, I had been given a database but no means to administer it.  I downloaded and installed the SQL Express Management Studio (SQL Server 2012 SP2, SQLManagementStudio_x64_ENU.exe)

3) Stop the WSUS service (services.msc)



4) Locate your WSUS Windows Internal Database (WID)

 C:\>dir c:\windows\WID\Data
 Volume in drive C has no label.
 Volume Serial Number is ****-****

 Directory of c:\windows\WID\Data

02.03.2015  22:18    <DIR>          .
02.03.2015  22:18    <DIR>          ..
02.03.2015  00:40         4.194.304 master.mdf
02.03.2015  00:40         1.048.576 mastlog.ldf
02.03.2015  00:40         2.162.688 model.mdf
02.03.2015  00:40           524.288 modellog.ldf
02.03.2015  00:40        13.107.200 msdbdata.mdf
02.03.2015  00:40           524.288 msdblog.ldf
02.03.2015  22:19     3.816.882.176 SUSDB.mdf
02.03.2015  22:19        25.296.896 SUSDB_log.ldf
02.03.2015  21:51        40.960.000 tempdb.mdf
02.03.2015  21:05        22.675.456 templog.ldf
              10 File(s)  3.927.375.872 bytes
               2 Dir(s)  112.296.820.736 bytes free

C:\>

Making the move

In Management Studio, I connected to

\\.\pipe\Microsoft##WID\tsql\query





I expanded Databases and detached the SUSSB

In this case the destination is a folder on volume d:. d:\WSUS DB

Moving the DB (elevated command prompt):


C:\>move c:\windows\wid\data\susdb* "d:\WSUS DB"
c:\windows\wid\data\SUSDB.mdf
c:\windows\wid\data\SUSDB_log.ldf
        2 file(s) moved.

C:\>


It is too soon to re-attach the db. It would result in a read error or the database would be mounted as read-only. I needed to copy the NTFS permissions (ACL) first

PS C:\Windows\WID\data> Get-ACL | fl


Path   : Microsoft.PowerShell.Core\FileSystem::C:\Windows\WID\data
Owner  : BUILTIN\Administrators
Group  : BUILTIN\Administrators
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         NT SERVICE\MSSQL$MICROSOFT##WID Allow  Write, Delete, Read, Synchronize
         NT SERVICE\MSSQL$MICROSOFT##WID Allow  -1073676288
Audit  :
Sddl   : O:BAG:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;;0x13019f;;;S-1-5-80-1184457765-4068085190-3456807688-22009523
         27-3769537534)(A;OICIIO;SDGWGR;;;S-1-5-80-1184457765-4068085190-3456807688-2200952327-3769537534)



PS C:\Windows\WID\data>

This entry is most important: NT SERVICE\MSSQL$MICROSOFT##WID , but I copied the ACL as a whole.

PS C:\Windows\WID\data> Get-Acl C:\Windows\WID\Data | Set-Acl -Path 'D:\WSUS DB'
PS C:\Windows\WID\data>

In SQL Management Studio, I re-attached the database.

 



 Next I started the WSUS service.

Sources
(1) http://systemspecialist.net/2013/05/15/move-or-delete-a-wsus-4-windows-internal-database-wid-on-windows-server-2012/
(2) https://technet.microsoft.com/en-us/library/hh849810.aspx
(3) https://social.msdn.microsoft.com/Forums/sqlserver/en-US/345031e7-88c5-40e5-bfda-3880122045e0/error-17204-fcbopen-failed-how-to-set-persmission-correctly-on-a-datalog-file-for-sql-server?forum=sqldatabaseengine