How to install Windows 11 on a PC that doesn't support it (No TPM)

 

How to install Windows 11 on a PC that doesn't support it (No TPM)

1. When you get to the Windows 11 setup screen, press Shift + F10 to open Command Prompt.
2. Type regedit and press Enter.
3. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\Setup
   

4. Right-click Setup, select New > Key, and name it LabConfig.
5. Inside LabConfig, right-click and create the following DWORDs:
   • BypassTPMCheck → Set value to 1
   • BypassSecureBootCheck → Set value to 1
   • BypassRAMCheck → Set value to 1 (if needed)
6. Close Registry Editor, then exit Command Prompt and continue installation.

FortiGate FortiNet FortiClient VPN stuck at Connecting with SAML Enabled.

 

Resolving FortiClient Stuck on 'Connecting' with SAML on Windows 11

I encountered an issue where FortiClient would hang on "connecting" when using SAML authentication on new Windows 11 machines. After some troubleshooting, I found the solution: install the latest version of the Microsoft Visual C++ Redistributable.

https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170

Windows Domain Controller (Server) boots up in "Private" network zone instead of "Domain"

Troubleshooting Windows Domain Controller Booting in "Private" Network Zone

Occasionally, your Windows Domain Controller (Server) may boot into the "Private" network zone instead of the expected "Domain" network zone. Here are steps to address this issue:

---

Primary Solution

The issue may stem from incorrect DNS configuration. If the server cannot resolve the domain name before the Network Location Awareness (NLA) service starts, the network zone may default to "Private."

To resolve this:

1. Set the server's primary DNS to 127.0.0.1 (its loopback address).
2. Set the secondary DNS to either:
   • Another Domain Controller's IP address, or
   • The server's other IP address (if it is the only Domain Controller).
3. Set the Network Location Awareness server to "Delayed Start" in Services.

---

Emergency "Break Glass" Solution

If the server continues to boot into the "Private" profile and the primary solution doesn't resolve the issue, you can disable the domain discovery negative cache by adding specific registry keys.

Registry Keys to Disable Domain Discovery Negative Cache

Add the following registry keys:

1. Disable the Domain Discovery Negative Cache
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

• Name: NegativeCachePeriod
• Type: REG_DWORD
• Value Data: 0
  (Default value: 45 seconds. Set to 0 to disable caching.)

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

• Name: MaxNegativeCacheTtl
• Type: REG_DWORD
• Value Data: 0
  (Default value: 5 seconds. Set to 0 to disable caching.)

Note: Disabling the negative cache ensures that failed domain detection results (e.g., ERROR_NO_SUCH_DOMAIN) are not cached. By default, Network Location Awareness (NLA) attempts domain detection multiple times during network setup (triggered by route or IP address changes). However, if the first detection fails and is cached negatively, subsequent attempts may also fail.

---

2. Alter NLA Domain Detection Behavior
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters

• Name: AlwaysExpectDomainController
• Type: REG_DWORD
• Value Data: 1

Note: This registry key modifies how NLA handles retries for domain detection, ensuring it always expects a Domain Controller.

---

By following these steps, you can mitigate issues with your Domain Controller booting into the wrong network profile. Always exercise caution when editing the registry and ensure you have backups before making changes.

Mysterious Orbs Identified as Advanced Drone Technology

 Mysterious Orbs Identified as Advanced Drone Technology

By Jim Addison | East Coast News Bureau

After weeks of speculation surrounding the mysterious glowing orbs spotted along the East Coast, experts now confirm that the phenomena are the result of advanced drone technology, likely part of ongoing military and commercial testing programs. Sources close to the investigation have revealed that both private-sector drone manufacturers and government agencies have been conducting trials involving autonomous drone swarms equipped with advanced lighting systems.

The orbs, described by witnesses as hovering, darting, and disappearing without sound, align closely with the behavior of next-generation drones designed for surveillance, reconnaissance, and synchronized operations. Defense analysts suggest the sightings are connected to classified military exercises, with testing zones coincidentally overlapping with civilian airspace.

“Cutting-edge drone technology is capable of extreme maneuverability and virtually silent operation,” said Dr. Lucas Bryant, an aerospace systems expert. “The lighting effects seen on these orbs are likely advanced LED arrays used for both signaling and stealth purposes during tests.”

Several sightings occurred near military bases, including reports from residents of Grissom Joint Air Reserve Base in Indiana and along the Pamlico Sound in North Carolina, further strengthening the theory of coordinated defense-related experiments. Officials, while reluctant to comment directly, have neither confirmed nor denied the connection.

In the private sector, drone manufacturers are pushing the boundaries of autonomous flight. One unnamed industry insider disclosed that large-scale drone swarms are being developed for commercial light shows, emergency response, and infrastructure monitoring—capabilities that match the erratic but organized flight paths of the reported orbs.

While natural and optical phenomena were considered early in the investigation, such as ball lightning or atmospheric reflections, experts now agree that these factors fail to explain the structured and intentional movements observed.

For now, the public can rest assured: the glowing orbs illuminating the night sky are not extraterrestrial visitors but a glimpse into the future of drone technology—silent, swift, and undeniably advanced.

 

Configuring Secure LDAPs on Domain Controller

This opens another Management Console for Certificate Templates separately in another window. Find Kerberos Authentication from Template Display Name list and right click on it. Choose Duplicate Template from context menu. On the New Template Properties on General tab provide Template display name LDAPs and choose Publish certificate in Active Directory. Go to Request Handling tab and choose Allow private key to be exported. Next in the Subject Name, choose both User principal name (UPN) and Service principal name (SPN) and click OK.

This newly generated copy of Kerberos Authentication certificate template will show as LDAPs in the templates list. Close Certificate Template Console.

After closing certificate template console, It will return to certsrv (Certification Authority) mmc console. On the Certificate Template right click and choose New >> Certificate Template to Issue. In the Enable Certificate Templates choose LDAPs name. and click OK. IF IT DOES NOT SHOW UP- run "certutil -setCAtemplates +LDAPs

Newly enabled certificate template will show on the list.

Certificate templates is configured, its time to use it. Now new SSL certificate need to be generated on Active Directory Domain Controller. Search and open mmc.exe, Go to File >> Add/Remove Snap-in then click Certificates and click Add. The certificates snap-in allows you to browse the contents of the certificate stores for yourself, a service, or a computer.

First select Computer account on Certificates snap-in and in the Select Computer keep default Local computer (the computer this console is running on) and press Finish. Repeat same process again click Certificates and click Add, but this time choose Service account and in the Select Computer keep default Local computer (the computer this console is running on), on the next select Active Directory Domain Services. In the last click Finish. Now under selected snap-ins you will see two certificates snap-ins, Click OK to proceed.

This will help to install certificates, which are digital credentials used to connect to wireless networks, protect content, establish identity, and do other security-related tasks.

Next on the Domain Controller, go to Certificates (Local Computer) mmc console - it is a LocalMachine certificate stores (Computer Account). Under Personal >> right click Certificates and choose All Tasks, then Request New Certificate. On the Certificate Enrollment Wizard, click Next on Before you Begin and Select Certificate Enrollment Policy, Request LDAPs certificate from list, the earlier created one by clicking check box. Check if Certificate Installation status is succeeded and press Finish (If it is failing restart Certificate Authority services and try again).

New certificate will be listed with Certificate Intended Purposes is KDC Authentication, Samrt Card Logon, Server Authentication, Client Authentication. and Issued to is FQDN of domain controller computer where this certificate was installed. Note down Thumbprint. 

Create a new Folder with below command.

New-Item -Path C:\ -Name Certs -ItemType Directory

Next from the LocalMachine >> Personal certificates store list all the certificates specially with ThumbPrint. Match the thumbprint on the cert, and use it to export it as PFX certificate with password.

Get-ChildItem Cert:\LocalMachine\My\ | Select-Object ThumbPrint, Subject, NotAfter, EnhancedKeyUsageList

#Change Password and Certificate ThumbPrint accordingly.
$password = ConvertTo-SecureString -String "123456" -Force -AsPlainText
Get-ChildItem -Path Cert:\LocalMachine\My\0F388654F85C5E1A3934B18293C0FFAB6BD464DF | Export-PfxCertificate -FilePath C:\Certs\LDAPs.pfx -Password $password

My new certificate is generated unde path C:\Certs with name LDAPs.

 

Next copy the certificate from LocalMachine Personal store to the Active Directory Domain Services Service Account Certificate store under NTDS\Personal Certificates, using below command. 

#Change Certificate ThumbPrint accordingly.
Move-Item "HKLM:\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\0F388654F85C5E1A3934B18293C0FFAB6BD464DF" "HKLM:\SOFTWARE\Microsoft\Cryptography\Services\NTDS\SystemCertificates\MY\Certificates\"

Verify certificates in MMC console or on registry location HKLM:\SOFTWARE\Microsoft\Cryptography\Services\NTDS\SystemCertificates\MY\Certificates\ whether they are added successfully.

This is last step in the article, verify LDAPs is correctly setup/configured buy connecting it. For this we need ldp.exe tool, Make sure RSAT AD tools are installed before using it. (It is already installed on Active directory if AD tools are selected for installation)

Install-WindowsFeature RSAT-AD-Tools -IncludeAllSubFeature -IncludeManagementTools

Search for ldp and open it. On the Connection menu select connect choose server, make sure FQDN is selected, Port is 636 and SSL is checked, Click OK to proceed. Once succeeded It shows Established connection to selected domain controller.

Useful Articles

 

How to Disable OneDrive for Business in Office 365 – SharePoint Online?

How to Disable OneDrive for Business for All Users?

Here is how to disable OneDrive entirely in Office 365:

1. Go to SharePoint Admin Center >> Click “More Features” from the left navigation.
2. On the “User Profiles” page, Click on the “Manage User Permissions” link under the “People” group.
   
   
   
   
   
   
3. This opens the permissions popup for the user profiles service. By default, “Personal Site creation” permission is enabled for all users through the “Everyone except external users” group.
4. Uncheck the Create Personal Site permission check box (and check Disable OneDrive if available!) to disable OneDrive for all users.
   

From now on, users will be unable to create their OneDrive, which stops OneDrive sites from being created. To enable OneDrive for business back, tick those checkboxes again!

Disable OneDrive for Business for Some Users:

If you need to disable OneDrive for all users except a particular group of people, create a new security group in AD/Office 365 and add the group to the above user permissions, and then enable “Create Personal site” and disable “Disable OneDrive” checkboxes only for the particular group!

Disable Existing OneDrives in Office 365:

The above steps don’t harm existing OneDrive sites that were created. Users can access their existing OneDrive sites as usual. If you need to prevent them from accessing OneDrive sites, your options are:

• Remove Site Collection Admin permission of the user from OneDrive Sites
  • Go to: SharePoint Admin Center >> Click on “User profiles” from the left navigation
  • Click on Manage User Profiles >> Find the user >> Click on the user’s context menu
  • Manage personal site collection owners >> Change the site collection owner.
• Ask the user to download all their OneDrive data and Delete OneDrive Sites. If you want to delete existing OneDrive sites, use: How to Delete OneDrive Sites in Office 365?

Office 365 PowerShell to Disable OneDrive for Business

How to block the OneDrive site of a user in Office 365? Here is the PowerShell to disable OneDrive for Business site by setting the “No Access” lock:

1 2 3 4 5 6 7 8 9 10 11

Import-Module Microsoft.Online.SharePoint.Powershell -DisableNameChecking    #Parameters $AdminSiteURL="https://crescent-admin.sharepoint.com" #Tenant Admin Site $OneDriveSiteURL = "https://crescent-my.sharepoint.com/personal/salaudeen_crescent_com"   #Connect to SharePoint Online Admin Center Connect-SPOService -Url $AdminSiteURL -Credential (Get-Credential)   #powershell disable onedrive for business Get-SPOSite -Identity $OneDriveSiteURL | Set-SPOSite -LockState NoAccess

Remove the “OneDrive” Link from the App launcher in Office 365

We can also hide the OneDrive for Business app from the App launcher using the below option from

1. Go to SharePoint Admin Center >> Click on Settings from the left navigation >> Click on “Classic settings page” at the bottom. (URL: https://YourTenant-admin.sharepoint.com/_layouts/15/online/TenantSettings.aspx)
2. At the “Show or Hide Options” for OneDrive for Business, toggle to the “Hide” button

This disables the OneDrive link for all users in the App Launcher, but existing OneDrive users can still access their OneDrive if they browse the URL directly. Also, this doesn’t prevent users from saving files to OneDrive or using the OneDrive Sync client.