Consulente ICT ICT Consultant

The Problem: The Overhead of Remote Desktop (RDP)

Image generated with Gemini AI

Managing dozens of Windows Servers by constantly opening Remote Desktop (RDP) sessions is slow, bandwidth-heavy, and often leaves orphaned GUI sessions hanging on the system. Furthermore, exposing the RDP protocol (port 3389) across inter-office networks unnecessarily increases the corporate attack surface.

The Solution: PowerShell Remoting via WinRM

The modern, scalable solution for IT Management is PowerShell Remoting. By utilizing the native WinRM (Windows Remote Management) protocol, you can open interactive sessions or execute batch scripts on remote machines directly from your terminal, exactly like you do with SSH on Linux.

1. Enabling WinRM on the Target Server

Log in to the target server (or deploy via Group Policy, GPO, if you are in an Active Directory environment) and open a PowerShell console with Administrator privileges. Execute the quick configuration cmdlet:

Enable-PSRemoting -Force

This command starts the WinRM service, sets it to start automatically, and creates the default firewall rules (TCP port 5985 HTTP). However, in zero-trust environments, HTTP is not enough.

2. Hardening: Forcing HTTPS (Port 5986)

To encrypt traffic at the transport layer and prevent Man-In-The-Middle attacks, you must bind WinRM to an SSL certificate. Assuming you have generated or requested a certificate for the server (via corporate PKI), you can create an HTTPS listener using PowerShell:

# Retrieve the certificate thumbprint
$Cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -match "YourServerName" }
$Thumbprint = $Cert.Thumbprint

# Configure the HTTPS listener
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Thumbprint -Force

Do not forget to open port 5986 on the Windows Server firewall.

3. Initiating the Connection from the Client

Now, from your Sysadmin workstation, you can connect to the server in total security by opening an interactive session:

Enter-PSSession -ComputerName YourServerName -UseSSL -Credential (Get-Credential)

Your terminal prompt will change, confirming that every command you type from that moment on is executing locally on the remote server.

Il Problema: La Pesantezza del Remote Desktop (RDP)

Immagine realizzata con Gemini AI

Gestire dozzine di server Windows Server aprendo sessioni in Desktop Remoto (RDP) è lento, consuma banda e lascia sessioni grafiche orfane appese nel sistema. Inoltre, esporre il protocollo RDP (porta 3389) sulle reti inter-ufficio aumenta inutilmente la superficie di attacco aziendale.

La Soluzione: PowerShell Remoting via WinRM

La soluzione moderna e scalabile per l'IT Management è PowerShell Remoting. Utilizzando il protocollo nativo WinRM (Windows Remote Management), puoi aprire sessioni interattive o eseguire script in batch su macchine remote direttamente dal tuo terminale, proprio come fai con SSH su Linux.

1. Abilitare WinRM sul Server Destinazione

Collegati al server target (o usa una Group Policy, GPO, se sei in un ambiente Active Directory) e apri una console PowerShell con privilegi di Amministratore. Esegui il comando di configurazione rapida:

Enable-PSRemoting -Force

Questo comando avvia il servizio WinRM, lo imposta su avvio automatico e crea le regole predefinite sul firewall (porte TCP 5985 HTTP). Tuttavia, in ambienti zero-trust, HTTP non basta.

2. Hardening: Forzare HTTPS (Porta 5986)

Per criptare il traffico a livello di trasporto e prevenire attacchi Man-In-The-Middle, devi vincolare WinRM a un certificato SSL. Supponendo di aver generato o richiesto un certificato per il server (via PKI aziendale), puoi creare un listener HTTPS tramite PowerShell:

# Recupera il thumbprint del certificato
$Cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -match "IlTuoServer" }
$Thumbprint = $Cert.Thumbprint

# Configura il listener HTTPS
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Thumbprint -Force

Non dimenticare di aprire la porta 5986 sul firewall di Windows Server.

3. Eseguire la Connessione dal Client

Ora, dalla tua postazione di lavoro Sysadmin, puoi connetterti al server in totale sicurezza aprendo una sessione interattiva:

Enter-PSSession -ComputerName IlTuoServer -UseSSL -Credential (Get-Credential)

Il terminale cambierà prompt, confermandoti che ogni comando che scriverai da quel momento in poi verrà eseguito localmente sul server remoto.

Image Generated with Gemini AI

The Problem: Default Exposure

A freshly installed Linux server exposed to the public cloud is a blank canvas, but also an easy target. Default SSH daemon configurations and open ports immediately attract automated scanners, botnets, and brute-force attacks.

The Solution: 5 Steps to Hardening

Before installing any enterprise application, the infrastructure must be locked down by enforcing the principle of least privilege.

• 1. Public Key Authentication: Ditch passwords entirely. Generate a certificate using ssh-keygen, copy it to the server, and edit /etc/ssh/sshd_config by setting PasswordAuthentication no.
• 2. Disable Root Login: In the same SSH configuration file, ensure you set PermitRootLogin no to force access only via standard users and subsequent privilege elevation via sudo.
• 3. Firewall Segmentation (UFW): Drop all incoming traffic except what is strictly necessary.

  sudo ufw default deny incoming
  sudo ufw allow ssh
  sudo ufw enable

• 4. Brute-Force Mitigation (Fail2Ban): Automatically ban malicious IPs at the network level that repeatedly fail login attempts.

  sudo apt install fail2ban -y

• 5. Silent Updates: Keep the system protected from zero-day vulnerabilities by installing unattended-upgrades for the automatic application of critical security patches without service interruptions.

Immagine generata con Gemini AI

Il Problema: L'Esposizione Predefinita

Un server Linux appena installato ed esposto su cloud pubblico è una tela bianca, ma anche un bersaglio facile. Le configurazioni predefinite del demone SSH e le porte aperte attirano immediatamente scansioni automatizzate, botnet e attacchi brute-force.

La Soluzione: 5 Passaggi di Hardening

Prima di installare qualsiasi applicativo aziendale, l'infrastruttura deve essere blindata applicando il principio del minimo privilegio.

• 1. Autenticazione a Chiave Pubblica: Abbandona le password. Genera un certificato con ssh-keygen, copialo sul server e modifica /etc/ssh/sshd_config impostando PasswordAuthentication no.
• 2. Disabilitare l'accesso Root: Nello stesso file di configurazione SSH, assicurati di inserire PermitRootLogin no per forzare l'accesso solo tramite utenza standard e successiva elevazione tramite sudo.
• 3. Segmentazione con Firewall (UFW): Chiudi tutto il traffico in ingresso tranne lo stretto necessario.

  sudo ufw default deny incoming
  sudo ufw allow ssh
  sudo ufw enable

• 4. Mitigazione Brute-Force (Fail2Ban): Banna automaticamente a livello di rete gli IP malevoli che falliscono ripetutamente i login.

  sudo apt install fail2ban -y

• 5. Aggiornamenti Silenti: Mantieni il sistema protetto dalle vulnerabilità zero-day installando unattended-upgrades per l'applicazione automatica delle sole patch di sicurezza critiche, senza interruzioni di servizio.

You are trying to install an old (perhaps management) software that is perfectly legitimate, but a large red Windows screen yells at you: "This app has been blocked for your protection". There is no "Run anyway" button.

1. The Certificate Block

The UAC (User Account Control) intercepts software whose digital signature certificate has expired or been revoked. Right-click the downloaded .exe file, go to Properties. If you see a security warning at the bottom, check the "Unblock" box and hit Apply.

2. Forced Launch via Terminal

Image generated with Gemini AI

If Windows continues to block it, use Admin authority. Open the Command Prompt by running it as Administrator. Navigate using the cd command to the folder where the file is located (e.g., cd C:\Downloads) and type the name of the executable (e.g., setup.exe). Being launched from an already verified environment with maximum privileges, the installation will bypass the graphical block.

Warning: this maneuver is exactly why we sysadmins always insist on encrypting drives with BitLocker. If the account is local (not linked to a Microsoft email) and unencrypted, here is the classic "skeleton key" trick.

Image generated with Gemini AI

1. The Utilman Trick

Boot the PC with a Windows installation USB drive. Use Shift+F10 to open the command prompt. The game involves navigating to the System32 folder and renaming the Accessibility executable (utilman.exe), replacing it with the command prompt (cmd.exe).

2. The Brutal Reset

Rebooting the PC normally, when you reach the lock screen, clicking on the Accessibility icon in the bottom right will open a command prompt with maximum privileges (SYSTEM). Just type net user username newpassword to force the change and get back into the system. No formatting required.

Your computer is struggling; you open Task Manager and see a process at the top of the list called Antimalware Service Executable devouring RAM and CPU. It's the Windows Defender background engine.

1. The Scanning Paradox

The reason it gets stuck is often surreal: the antivirus is incessantly checking its own folder and files in an infinite loop.

Image generated with Gemini AI

2. The Exclusions Trick

Open Windows Security > Virus & threat protection. Under settings, click on "Manage settings" and scroll down to Exclusions. Click "Add or remove exclusions". Choose "Process" and type exactly MsMpEng.exe. Also add a Folder exclusion pointing to C:\ProgramData\Microsoft\Windows Defender. Now the antivirus will breathe.

You transferred a hard drive from an old PC or tried to modify a specific folder, but Windows denies you access even if you are an Administrator. The blame lies with the ACLs (Access Control Lists).

Image generated with Gemini AI

1. Taking Ownership

Right-click the inaccessible folder > Properties > Security tab > click on Advanced. At the top, you will see "Owner: TrustedInstaller" or an unknown alphanumeric code. Click on Change.

2. Apply Permissions

Type your username or simply "Administrators", press "Check Names", and hit OK. Pay close attention: check the box "Replace owner on subcontainers and objects" before hitting Apply. Now that you are the legal owner of the files, you can delete or modify them at will.