Loopback Check configuration Tool released – free download

Win2012  logo  SharePoint2013Logo70x338

Hi All.

It is here! Free for all! DOWNLOAD

I am happy to announce that the Loopback Check Tool has finally been made available at Codeplex – https://loopbackchecktool.codeplex.com
No more last minute t-shooting the loopback check and ending up disabling it, trying to find the KB or a decent blog post on how to do it.

This Tool takes care of it all for you. Download the exe, put it on your servers, run it to configure the Loopback Check feature simple and easy.

Its simple.
Its small (21kb zipped)
Only click and make it happen
No installation, one single exe that works on most Windows Servers (and clients)
Disable the Loopback check completely (Not recommended)
Enable or Disable the Loopback Check function
Enable it and add excluded URLs (Recommended, now easy to do)

This is a preview image of what the tool looks like


The tool works fine on:

Windows Server 2012
Windows Server 2012 R2
Windows Server 2008 R2
Windows Server 2008
Windows 7
Windows 8
Windows 8.1
And probably a few more…


You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

A quick guide to configuring the Loopback check

DisableLoopbackCheck & SharePoint: What every admin and developer should know.

Thanks to:

Herakles and Gutke!

Win2012  logo  SharePoint2013Logo70x338




Twitter | Technet Profile | LinkedIn

A quick-guide to setting up OWA with SharePoint 2013 – start to finish

Future and existing Office Web Apps – OWA Lovers!
This time, I just found that a quick guide like this was something that I needed myself, and since I could not find anything that was short and compact enough, I made my own guide…
This Little guide is completely based on the TechNet articles mentioned in the references section, but this is nontheless a lot shorter and easier to follow.


The old Clock at Oakwood station

Click your OWA task of choice:
Step 1
Prepare a 2008 R2 Server to run OWA
Prepare a 2012 Server to run OWA
Step 2
Install Office Web Apps Server
Step 3
Deploy a single-server Office Web Apps Server farm that uses HTTPS
Step 4
Configure SharePoint to use OWA over https (recommended)
Configure SharePoint to use OWA over http
Disconnect SharePoint from OWA farm
Configure the Default open behavior for documents
Credits and References

Prepare a 2008 R2 server to run Office Web Apps Server

1. Install the following software (Minimum required):

2. Import the server module
(In a PowerShell prompt running as administrator and with the SharePoint snapin loaded)
Import-Module ServerManager

3. Add the required Features and Roles by running this command:
Add-WindowsFeature Web-Server,Web-WebServer,Web-Common-Http,Web-Static-Content,Web-App-Dev,Web-Asp-Net,Web-Net-Ext,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Includes,Web-Security,Web-Windows-Auth,Web-Filtering,Web-Stat-Compression,Web-Dyn-Compression,Web-Mgmt-Console,Ink-Handwriting,IH-Ink-Support

4. Restart the server if prompted when the command finishes.

5. Done

TechNet Reference
Back to menu

Prepare a 2012 server to run Office Web Apps Server

1. In a PowerShell prompt running as administrator, add the required Features and Roles by running this command:
Add-WindowsFeature Web-Server,Web-Mgmt-Tools,Web-Mgmt-Console,Web-WebServer,Web-Common-Http,Web-Default-Doc,Web-Static-Content,Web-Performance,Web-Stat-Compression,Web-Dyn-Compression,Web-Security,Web-Filtering,Web-Windows-Auth,Web-App-Dev,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Includes,InkandHandwritingServices

2. Done

TechNet Reference
Back to menu

Install Office Web Apps Server
1. Download Office Web Apps Server from the Microsoft Download Center (Link).

2. Run Setup and walk through the steps in the wizard.
Windows Server 2012, open the .img file directly and run Setup.exe
Windows Server 2008 R2 SP1, use any program that can mount or extract .img files. Then run Setup.exe

3. Download and install the Office Web Apps Server update KB2810007.

TechNet Reference
Back to menu

Deploy a single-server Office Web Apps Server farm that uses HTTPS

If components of the .NET Framework 3.5 were installed and then removed, you might see “500 Web Service Exceptions” or “500.21 – Internal Server Error” messages when you run OfficeWebApps cmdlets. To fix this, run the following sample commands from an elevated command prompt to clean up settings that could prevent Office Web Apps Server from functioning correctly:
In Windows Server 2008 R2:
%systemroot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -iru
iisreset /restart /noforce
In Windows Server 2012:
dism /online /enable-feature /featurename:IIS-ASPNET45

1. Create the Office Web Apps Server farm

New-OfficeWebAppsFarm -InternalUrl <InternalURL> -ExternalUrl <ExternalURL> -CertificateName <CertificateName> -EditingEnabled

<InternalURL> FQDN name of the server that runs Office Web Apps Server
<ExternalURL> FQDN name that can be accessed on the Internet
<CertificateName> Is the friendly name of the https/SSL certificate used
-EditingEnabled, optional and is added to enable editing in Office Web Apps

2. Verify that the Office Web Apps Server farm was created successfully

Go to the https://internal.url.com/hosting/discovery
If you see a (WOPI)-discovery XML file in your web browser then all is good.

Depending on the security settings of your web browser, you might see a message that prompts you to select Show all content before the contents of the discovery XML file are displayed.

3. Done

TechNet Reference
Back to menu

Configure SharePoint to use OWA over https (recommended)
(In a PowerShell prompt running as administrator and with the SharePoint snapin loaded)

The Web Application to be used must be configured to use Claims as authentication method, else OWA will not work.

1. Create new binding:
New-SPWOPIBinding -ServerName <WacServerName>
(<WacServerName> must be the FQDN internal URL)

2. Verify current zone:

3. Change to internal-https if it is set to http:
Set-SPWOPIZone –zone “internal-https

4. Verify https:

5. Verify functionality in a document library (Not using the system account, appearing as sharepoint\system)
Click on the ‘Three dots’ after a documents name and see if you get a preview, if you do, its all good!

6. Done

TechNet Reference
Back to menu

Configure SharePoint to use OWA over http
(In a PowerShell prompt running as administrator and with the SharePoint snapin loaded)

The Web Application to be used must be configured to use Claims as authentication method, else OWA will not work.

1. Create new binding:
New-SPWOPIBinding -ServerName -AllowHTTP
( must be the FQDN internal URL)

2. Verify current zone:

3. Change to internal-http:
Set-SPWOPIZone –zone “internal-http”

4. Verify http:

5. Check AllowoverHttp setting:

6. Set AllowOAuthOverHttp to True.
$config = (Get-SPSecurityTokenServiceConfig)
$config.AllowOAuthOverHttp = $true

7. Verify change:

8. Verify functionality in a document library (Not using the system account, appearing as sharepoint\system)
Click on the ‘Three dots’ after a documents name and see if you get a preview, if you do, its all good!

9. Done

TechNet Reference
Back to menu

Disconnect SharePoint from OWA farm
(In a PowerShell prompt running as administrator and with the SharePoint snapin loaded)

1. Remove the binding
Remove-SPWOPIBinding –All:$true

2. Done

TechNet Reference
Back to menu

Configure the Default open behavior for documents

1. On a per farm level: Adjust the default open behavior on a per-file-type basis by using the New-SPWOPIBinding and Set-SPWOPIBinding Windows PowerShell cmdlets.

2. On a per Site Collection level by activating the ‘Open Documents in Client Applications by Default’ site Collection feature.

3. On a per Document library level using the Library setting – Advanced setting – ‘Default open behavior for browser-enabled documents’

4. Done

TechNet Reference
Back to menu


Deploy Office Web Apps Server

Configure SharePoint 2013 to use Office Web Apps

Configure the default open behavior for browser-enabled documents (Office Web Apps when used with SharePoint 2013)


Plan Office Web Apps (Used with SharePoint 2013)

SharePoint authentication requirements for Office Web Apps

Configuring Office Web Apps in SharePoint 2013 (Steve Peschka – Microsoft)

Enabling Licensing and Editing for Office Web Apps in SharePoint 2013 (Steve Peschka – Microsoft)

Thanks to:

Mattias Gutke! All the time dude!
Ankie D – a great customer who has forced me to learn more on OWA
Stefan K – Another customer who made me refresh my knowledge
Steve Peschka, he wrote the original guide…see ref section




Twitter | Technet Profile | LinkedIn

Move your SharePoint IIS sites from the systemdrive(C:)

Move your SharePoint IIS sites from the systemdrive(C:)
or avoid putting them there in the first Place.


Do you see the lion that is totally in the wrong Place…or is it the Jeeps that are…?

Deal fellow SharePointlovers!

This time, I’ll try to show you how to avoid the messed up situation most SharePoint installations are in, with everything on the systemdrive, or C:
Now, us people have over time been better and better at one thing, we understand that the logfiles should not be located on the systemdrive, so we have learned over time to move the ULS log and the Usage and Health log from C:, some have even been clever enough to move even the IIS log from C:

But, what do we still always, always, always, find installed on C:?… … …yes, C:\inetpub!

It not very strange though, the developers of Windows Server have made a point out of not giving us an option to install inetpub on a different path, not unless you do an unattended installation or otherwise script or Control your installation. The ‘Add/Remove roles’ wizards in Server 2008, 2008R2 and 2012 all lack this option (for a reason).

BUT! This is intentially, the default inetpub location should and must be in the systemdrive, IIS is considered an operating system Component and has to be there for a number of reasons. At the end you will find a link to a KB article that explains this in more detail. Leave inetpub and its subfolders where it is!

So, why would we want to do this anyway
why move the inetpub and all of its content, or at least the separate site catalogs to a different drive?
– Separation (Performance and Security)
– Compartmentalization (Performance and Security)
Having averything on the same drive is bad for a few reasons, primarily performance and security. Perfomance since the OS is on the C drive and security because if an attacker by some means gets access to a different less secure applications sitecatalog, they also get access to the systemdrive and possible also all other webapplication sitecatalogs. Moving them to other drives, same or different, helps mitigate both possible issues.
I therefore recommend doing this:

Do your regular installation, add the Web Server role and let the inetpub folder end up on C:, like I said, no worries. Whats important for us will not be located there anyway.
Next, edit the registry to make the default location of inetpub be for example D: (unless this is were you will be putting all of your logfiles, then select a third or fourth drive)
Install the SharePoint as you would normally do, Central administration will now end up were you pointed the default location.
Create your Web Applications using the GUI or PowerShell and leave out the path, the IIS sites will be were you wanted them.

So, how do we do this in more detail? A Guide…

Configure the Web Server(s)

1. Configure the default location

On all of your web servers in the farm, and on your Central Administration server(s), edit the registry key that Controls the default location:

Start regedit by, Right clicking in the very lower left corner and you will get a list of actions, click on Run.


Type Regedit and click Ok.


Click Yes in the UAC dialog.


In Registry Editor, we locate the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InetStp



Under ‘InetStp’ we have a number of keys.


Locate and Edit the key PathWWWRoot from the default: (%systemdrive%)


to: (D: or where you prefer to locate it, E: F: G: H:…)


There you go! All set, no IIS reset or restarts of any kind required.
Like said before, go on and do this on all servers that will host a webserver (WFE or CA). If you don’t, then you will have an inconsistent setup making Everything very hard to setup and t-shoot.

2. Add SharePoint
After this has been changed on all of you r web servers, you can go ahead and install the SharePoint binaries and configure your farm, The Central Administration site will now be located on the drive you have specified, it will be in the exact same path as it normally would but on a different drive. For example: ‘D:\inetpub\wwwroot\wss\VirtualDirectories\20000\’

Note that the Central Administration UI will now be default suggest a different path:


If you create a new site using PowerShell, it will also by default put it in D: even if you don’t specify any path:

New-SPWebApplication -Name TheVeryFirst -ApplicationPool SharePoint -HostHeader theveryfirst.corp.balkestahl.se -Port 80 -Url theveryfirst.corp.balkestahl.se -DatabaseServer blksthl-sql -DatabaseName SP11_Content_TheVeryFirst

As you can see, were done! 🙂


For the logfiles, I’ll make a separate post, they should also be moved, more so even than the sitefolders. Logfiles will fill up the disks, they will slow performance and maybe most importantly, they contain delicate information that you want to keep separated from the OS and IIS.


Guidance for relocation of IIS 7.0 and IIS 7.5 content directories

Configure ULS log and Usage and Health log location

Thanks to:

Mikael Nyström (The Deployment Bunny) – Truesec
Mattias Gutke – CAG


Good Luckl!!


Twitter | Technet Profile | LinkedIn

A quick guide to configuring the Loopback check

Update: A free tool is available that does all this for you in a GUI: Loopback Check configuration Tool released – free download

Hi dear friends!

401.1 Access denied…
If you try to access your newly created web application with a real nice FQDN or NetBIOS name and you end up getting a 401.1 Access denied…

Even after adding the site to the local intranet zone in IE…
Even after beeing prompted 3 times and filling in the correct credentials…
After setting up your Search to crawl you sites in a small farm whith crawl and web services on the same server…

You check and doublecheck your credentials, you add yourself as the farm admin, you try logging on with the farm account, but nothing…still 401.1…

I know this has been written about many times Before, but some things seem to still be missing…
Now everyone seems comfortable with the sparse description on how to ‘add hosts to the list’ which is pretty much what you do when configuring the loopback check the ‘secure way’. You can also disable the loopbackcheck completely, but why if there is no real reason. Read Spencer Harbars excellent post on the topic if you need explaining why this is so. It is a few years but it is still the truth!

The KB article 896861 for this is an old one and the title does not really tell you that this is the one you are looking for, ‘type the host name or the host names for the sites that are on the local  computer, and then click OK.’ is not crystal…

Jump to:
Configure Loopback check using the GUI
Configure Loopback check using Powershell
Credits and References

What you need to do is this step by step:

In ‘Metro’ mode, type regedit


Regedit will most likely be the only result, hit enter


In regedit, find the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0





Now, create a Multi-String Value under the MSV1_0 key.


Type in the name of the new Multi-String value: ‘BackConnectionHostNames’, Hit Enter.


Right click on the value BackConnectionHostNames and coose Modify.


Add the URL you want to be able to access from a local browser on the server.


Don’t know why, but I seem to Always get this. Click Ok.




Adding multiple URL’s to the list of ‘trusted’ URL’s, simply make a new line between them.


That will look like this.


To be extra sure that nothing else will sabotage functionality, check so that the URL’s are added to DNS.
(Or local hosts file)


Check so that the URL’s are added as bindings in IIS.


Verify that the URL’s are correct and are added to AAM.


Make sure that the URL is added to the Local Intranet Zone in Internet Explorer (if you need to browse the site from the server, NOT RECOMMENDED!).


Try to access the URL in a browser.


And the other URL.



Doing the same using PowerShell

Using PowerShell to configure the Loopback check, requires two steps:

1. Add the multistring value to the registry
Get-Item -path “HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”) -PropertyType “MultiString”

2. Restart the IISADMIN service
Restart-Service IISADMIN

1. Add the multistring value to the registry

Given that you have Everything setup correctly, your AAM’s, your DNS entrys, (URL added to local intranetsites zone in IE), and so forth…you can use this single PowerShell command to exclude the URL’s for your sites from the loopbackcheck, this way, you don’t have to disable the loopbackcheck at all (Way better security).

The following command will add my two URL’s to the exclusion list, edit the values to add your own URL’s.

Run this in a PowerShell prompt running in elevaled mode/as Administrator

Get-Item -path “HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”) -PropertyType “MultiString”

Running this will if Everything is done right, show this


This is how it will look if it succeeds!


If you get ‘The property already exists.’, then you already have the ‘BackConnectionHostNames’ value added to the registry, check using registry editor to see if you can delete it or if it has other values that need to be there.

After a successful execution, check the registry to verify


2. Restart the IISADMIN service

Now you have to restart the IISADMIN service in order for it to ‘reread’ the registry values and implement our Changes.
This is easy, in a PowerShell prompt running in elevaled mode/as Administrator

Restart-Service IISADMIN


Note the typo/bug in the text, it says stopping twice but what it does it stopping and starting


The command line in step 1 will add two (2) entries to the list, coolsite.corp.balkestahl.se and alias.corp.balkestahl.se. If you need to add more URL’s, add them to the Values, like: -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”, “mycoolnetbiosname”, “extraname.corp.balkestahl.se”).

Make sure that the doublequotes are formated in the proper way if you copy from this post!

That would make the command

Get-Item -path “HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”, “mycoolnetbiosname”, “extraname.corp.balkestahl.se”) -PropertyType “MultiString”


Restart-Service IISADMIN -force


You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

DisableLoopbackCheck & SharePoint: What every admin and developer should know. (Spencer Harbar folks)

Can’t crawl web apps you KNOW you should be able to crawl (Todd Klindt’s oldie but goodie)

Thanks to:

As Always, Mattias Gutke! Now at CAG. Always a great help and second opinion!




Twitter | Technet Profile | LinkedIn

The complete list of tools in Windows Server 2012

Tools Tools Tools Tools Tools….I wonder how much smaller in diskspace Windows would be without the tools? There are Tools for almost every task, just browse this list and you understand what I’m talking about.
Have you ever wondered about a commandline tool and did not find the proper explanation or the TechNet page for it?
Have you like me, had to learn what a lot of these does simply to be able to pass a certification?

IMG_0818(Oh, the Picture shows two bowls of chocolate, nothing else…)

Look no further, bookmark this page and you will find it all in one convenient place. No PowerShell here though, a lot of the stuff that can be made using these tools may or may not be performed using PowerShell CMDlets as well, but these are not listed here, this list is strictly for hardcore tools!

Do you miss any certain Windows Server 2012 tool that you feel should be here? Please let me know which it is and I’ll be sure to add it if you can convince me that it should be part of the list.



Jump to References

A Back to the menu
Adprep Extends the Active Directory® schema and updates permissions as necessary to prepare a forest and domain for a domain controller that runs a later version of the Windows Server operating system than the current domain controllers in the forest or domain.
Append Allows programs to open data files in specified directories as if they were in the current directory. If used without parameters, append displays the appended directory list.
Arp Displays and modifies entries in the Address Resolution Protocol (ARP) cache, which contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. There is a separate table for each Ethernet or Token Ring network adapter installed on your computer. Used without parameters, arp displays help.
Assoc Displays or modifies file name extension associations. If used without parameters, assoc displays a list of all the current file name extension associations.
At Schedules commands and programs to run on a computer at a specified time and date. You can use at only when the Schedule service is running. Used without parameters, at lists scheduled commands.
Atmadm Monitors connections and addresses that are registered by the ATM Call Manager on an asynchronous transfer mode (ATM) network. You can use atmadm to display statistics for incoming and outgoing calls on ATM adapters. Used without parameters, atmadm displays statistics for monitoring the status of active ATM connections
Attrib Displays, sets, or removes attributes assigned to files or directories. If used without parameters, attrib displays attributes of all files in the current directory.
Auditpol Displays information about and performs functions to manipulate audit policies.
Autochk Runs when the computer is started and prior to Windows Server® 2008 R2 starting to verify the logical integrity of a file system.
Autoconv Converts file allocation table (FAT) and FAT32 volumes to the NTFS file system, leaving existing files and directories intact at startup after Autochk runs. Volumes converted to the NTFS file system cannot be converted back to FAT or FAT32.
Autofmt Formats a drive or partition when called from the Windows Recovery Console.
B Back to the menu
Bcdboot Enables you to quickly set up a system partition, or to repair the boot environment located on the system partition. The system partition is set up by copying a simple set of Boot Configuration Data (BCD) files to an existing empty partition.
Bcdedit BCDEdit is a command-line tool for managing BCD stores. It can be used for a variety of purposes, including creating new stores, modifying existing stores, adding boot menu parameters, and so on. BCDEdit serves essentially the same purpose as Bootcfg.exe on earlier versions of Windows, but with two major improvements: Exposes a wider range of boot parameters than Bootcfg.exe and has improved scripting support.
Bdehdcfg Prepares a hard drive with the partitions necessary for BitLocker Drive Encryption. Most installations of Windows 7 will not need to use this tool because BitLocker setup includes the ability to prepare and repartition drives as required.
Bitsadmin BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress.
Bootcfg Configures, queries, or changes Boot.ini file settings.
Break (Deprecated) Sets or clears extended CTRL+C checking on MS-DOS systems. If used without parameters, break displays the current setting.
C  Back to the menu
Cacls Displays or modifies discretionary access control lists (DACL) on specified files.
Call Calls one batch program from another without stopping the parent batch program. The call command accepts labels as the target of the call.
Cd Displays the name of or changes the current directory. If used with only a drive letter (for example, cd C:), cd displays the names of the current directory in the specified drive. If used without parameters, cd displays the current drive and directory. (This command is the same as the chdir command.)
Certreq Certreq can be used to request certificates from a certification authority (CA), to retrieve a response to a previous request from a CA, to create a new request from an .inf file, to accept and install a response to a request, to construct a cross-certification or qualified subordination request from an existing CA certificate or request, and to sign a cross-certification or qualified subordination request.
Certutil Certutil.exe is a command-line program that is installed as part of Certificate Services. You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, backup and restore CA components, and verify certificates, key pairs, and certificate chains.
Change Changes Remote Desktop Session Host (RD Session Host) server settings for logons, COM port mappings, and install mode.
Chcp Changes the active console code page. If used without parameters, chcp displays the number of the active console code page.
Chdir This command is the same as the cd command.
Chglogon Enables or disables logons from client sessions on an RD Session Host server, or displays current logon status.
Chgport Lists or changes the COM port mappings to be compatible with MS-DOS applications.
Chgusr Changes the install mode for the Remote Desktop Session Host (RD Session Host) server.
Chkdsk Checks the file system and file system metadata of a volume for logical and physical errors. If used without parameters, chkdsk displays only the status of the volume and does not fix any errors. If used with the /f, /r, /x, or /b parameters, it fixes errors on the volume.
Chkntfs Displays or modifies automatic disk checking when the computer is started. If used without options, chkntfs displays the file system of the specified volume. If automatic file checking is scheduled to run, chkntfs displays whether the specified volume is dirty or is scheduled to be checked the next time the computer is started.
Choice Prompts the user to select one item from a list of single-character choices in a batch program, and then returns the index of the selected choice. If used without parameters, choice displays the default choices Y and N.
Cipher Displays or alters the encryption of directories and files on NTFS volumes. If used without parameters, cipher displays the encryption state of the current directory and any files it contains.
Clip Redirects command output from the command line to the Windows clipboard. You can then paste this text output into other programs.
Cls Clears the Command Prompt window.
Cluadmin Enables you to connect to a failover cluster (formerly known as server cluster). Used without parameters, cluadmin starts Cluster Administrator, the tool used to configure and manage failover clusters.
Cluster Creates a new cluster or configures an existing cluster.
Cmd Starts a new instance of the command interpreter, Cmd.exe. If used without parameters, cmd displays the version and copyright information of the operating system.
Cmdkey Creates, lists, and deletes stored user names and passwords or credentials.
Cmstp Installs or removes a Connection Manager service profile. Used without optional parameters, cmstp installs a service profile with default settings appropriate to the operating system and to the user’s permissions.
Color Changes the foreground and background colors in the Command Prompt window for the current session. If used without parameters, color restores the default Command Prompt window foreground and background colors.
Comp Compares the contents of two files or sets of files byte-by-byte. If used without parameters, comp prompts you to enter the files to compare.
Compact Displays or alters the compression of files or directories on NTFS partitions. If used without parameters, compact displays the compression state of the current directory and the files it contains.
Convert Converts file allocation table (FAT) and FAT32 volumes to the NTFS file system, leaving existing files and directories intact. Volumes converted to the NTFS file system cannot be converted back to FAT or FAT32.
Copy Copies one or more files from one location to another.
Cprofile Cprofile – Cprofile is deprecated, and is not guaranteed to be supported in future releases of Windows.
Cscript Starts a script so that it runs in a command-line environment.
Csvde Imports and exports data from Active Directory Domain Services (AD DS) using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on the CSV file format standard.
D  Back to the menu
Date Displays or sets the system date. If used without parameters, date displays the current system date setting and prompts you to enter a new date.
Dcdiag Analyzes the state of domain controllers in a forest or enterprise and reports any problems to help in troubleshooting.
Dcgpofix Recreates the default Group Policy Objects (GPOs) for a domain.
Dcpromo Installs and removes Active Directory Domain Services (AD DS). (Preferred method is Server Manager, but dcpromo should be used for RODC’s and Server core)
Defrag Locates and consolidates fragmented files on local volumes to improve system performance.
Del Deletes one or more files. This command is the same as the erase command.
Dfscmd Configures DFS folders and folder targets in a DFS namespace.
Dfsrmig The dfsrmig command migrates SYSVOL replication from File Replication Service (FRS) to Distributed File System (DFS) Replication, provides information about the progress of the migration, and modifies Active Directory Domain Services (AD DS) objects to support the migration.
Diantz This command is the same as the makecab command.
Dir Displays a list of a directory’s files and subdirectories. If used without parameters, dir displays the disk’s volume label and serial number, followed by a list of directories and files on the disk (including their names and the date and time each was last modified). For files, dir displays the name extension and the size in bytes. Dir also displays the total number of files and directories listed, their cumulative size, and the free space (in bytes) remaining on the disk.
Dirquota The dirquota command-line tool is installed with File Server Resource Manager and includes subcommands for creating and managing quotas, auto apply quotas, and quota templates, as well as configuring general administrative options for working with quotas.
Diskcomp Compares the contents of two floppy disks. If used without parameters, diskcomp uses the current drive to compare both disks.
Diskcopy Copies the contents of the floppy disk in the source drive to a formatted or unformatted floppy disk in the destination drive. If used without parameters, diskcopy uses the current drive for the source disk and the destination disk.
Diskedit diskedit has been deprecated since Windows Server 2003 – not available in Windows Server 2012
DiskPart diskpart is a text-mode command interpreter that enables you to manage objects (disks, partitions, volumes, or virtual hard disks) by using scripts or direct input from a command prompt.
Diskperf diskperf is used to enable or disable physical and logical disk performance counters in Windows 2000 systems.
DiskRAID DiskRAID is a command-line tool that enables you to configure and manage redundant array of independent (or inexpensive) disks (RAID) storage subsystems.
Diskshadow DiskShadow is a tool that exposes the functionality offered by the Volume Shadow Copy Service (VSS). By default, DiskShadow uses an interactive command interpreter similar to that of DiskRAID or DiskPart. DiskShadow also includes a scriptable mode.
Dispdiag Logs display information to a file.
Djoin Provisions a computer account in a domain and requests an offline domain join when a computer restarts.
Dnscmd A command-line interface for managing DNS servers. This utility is useful in scripting batch files to help automate routine DNS management tasks, or to perform simple unattended setup and configuration of new DNS servers on your network.
Doskey Calls Doskey.exe (which recalls previously entered command-line commands), edits command lines, and creates macros.
Driverquery Enables an administrator to display a list of installed device drivers and their properties. If used without parameters, driverquery runs on the local computer.
Dsacls Displays and changes permissions (access control entries) in the access control list (ACL) of objects in Active Directory Domain Services (AD DS).
Dsadd Adds specific types of objects to the directory.
Dsamain Exposes Active Directory data that is stored in a snapshot or backup as a Lightweight Directory Access Protocol (LDAP) server.
Dsdbutil Performs database maintenance of the Active Directory Domain Services (AD DS) store, facilitates configuration of Active Directory Lightweight Directory Services (AD LDS) communication ports, and views AD LDS instances that are installed on a computer.
Dsget Displays the selected properties of a specific object in the directory.
Dsmgmt Facilitates managing Active Directory Lightweight Directory Services (AD LDS) application partitions, managing and controlling flexible single master operations (FSMO), and cleaning up metadata that is left behind by abandoned Active Directory domain controllers and AD LDS instances. (Abandoned domain controllers and AD LDS instances are those that are removed from the network without being uninstalled.)
Dsmod Modifies an existing object of a specific type in the directory.
Dsmove Moves a single object, within a domain, from its current location in the directory to a new location, or renames a single object without moving it in the directory tree.
Dsquery Queries the directory by using search criteria that you specify. Each of the dsquery commands finds objects of a specific object type, with the exception of dsquery *, which can query for any type of object.
Dsrm Deletes an object of a specific type or any general object from the directory.
E  Back to the menu
Echo Displays messages or turns on or off the command echoing feature. If used without parameters, echo displays the current echo setting.
Edit Starts MS-DOS Editor, which creates and changes ASCII text files.
Endlocal Ends localization of environment changes in a batch file, and restores environment variables to their values before the corresponding setlocal command was run.
Erase This command is the same as the del command. See Del for syntax and parameters.
Eventcreate Enables an administrator to create a custom event in a specified event log.
Eventquery.vbs Eventquery.vbs is deprecated, and is not guaranteed to be supported in future releases of Windows.
Eventtriggers Eventtriggers is deprecated, and is not guaranteed to be supported in future releases of Windows.
Evntcmd Configures the translation of events to traps, trap destinations, or both based on information in a configuration file.
Exit Exits the Cmd.exe program (the command interpreter) or the current batch script.
Expand Expands one or more compressed files. You can use this command to retrieve compressed files from distribution disks.
Extract Extract is deprecated and is no longer part of Windows Server
F  Back to the menu
Fc Compares two files or sets of files and displays the differences between them.
Filescrn The filescrn command is installed with File Server Resource Manager and includes subcommands for creating and managing file groups, file screens, file screen exceptions, and file screen templates, and for configuring general administrative options for screening files.
Find Searches for a string of text in a file or files, and displays lines of text that contain the specified string.
Findstr Searches for patterns of text in files.
Finger Displays information about a user or users on a specified remote computer (typically a computer running UNIX) that is running the Finger service or daemon. The remote computer specifies the format and output of the user information display. Used without parameters, finger displays help.
Flattemp Enables or disables flat temporary folders.
Fondue Enables Windows optional features by downloading required files from Windows Update or another source specified by Group Policy. The manifest file for the feature must already be installed in your Windows image.
For Runs a specified command for each file in a set of files.
Forfiles Selects and executes a command on a file or set of files. This command is useful for batch processing.
Format Formats a disk to accept Windows files.
Freedisk Checks to see if the specified amount of disk space is available before continuing with an installation process.
Fsutil Performs tasks that are related to file allocation table (FAT) and NTFS file systems, such as managing reparse points, managing sparse files, or dismounting a volume. If it is used without parameters, fsutil displays a list of supported subcommands.
Ftp Transfers files to and from a computer running a File Transfer Protocol (FTP) server service. Ftp can be used interactively or in batch mode by processing ASCII text files.
Ftype Displays or modifies file types that are used in file name extension associations. If used without an assignment operator (=), ftype displays the current open command string for the specified file type. If used without parameters, ftype displays the file types that have open command strings defined.
Fveupdate Fveupdate is deprecated, and is not guaranteed to be supported in future releases of Windows.
G  Back to the menu
Getmac Returns the media access control (MAC) address and list of network protocols associated with each address for all network cards in each computer, either locally or across a network.
Gettype Gettype is deprecated, and is not guaranteed to be supported in future releases of Windows.
Goto Directs cmd.exe to a labeled line in a batch program. Within a batch program, goto directs command processing to a line that is identified by a label. When the label is found, processing continues starting with the commands that begin on the next line.
Gpfixup Fix domain name dependencies in Group Policy Objects and Group Policy links after a domain rename operation.
Gpresult Displays the Resultant Set of Policy (RSoP) information for a remote user and computer.
Gpupdate Updates Group Policy settings.
Graftabl Enables Windows operating systems to display an extended character set in graphics mode. If used without parameters, graftabl displays the previous and the current code page.
H  Back to the menu
Hashgen Creates or deletes BranchCache content information, also called hashes, for the content in the specified directory on a BranchCache-capable file server.
Help Provides online information about system commands (that is, non-network commands). If used without parameters, help lists and briefly describes every system command.
Helpctr Helpctr is deprecated, and is not guaranteed to be supported in future releases of Windows.
Hostname Displays the host name portion of the full computer name of the computer.
I  Back to the menu
Icacls Displays or modifies discretionary access control lists (DACLs) on specified files, and applies stored DACLs to files in specified directories.
If Performs conditional processing in batch programs.
Inuse Inuse is deprecated, and is not guaranteed to be supported in future releases of Windows.
Ipconfig Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Used without parameters, ipconfig displays Internet Protocol version 4 (IPv4) and IPv6 addresses, subnet mask, and default gateway for all adapters.
Ipxroute Displays and modifies information about the routing tables used by the IPX protocol. Used without parameters,  ipxroute displays the default settings for packets that are sent to unknown, broadcast, and multicast addresses.
Irftp Sends files over an infrared link.
Ismserv This service enables messages to be exchanged between computers running Windows Server sites. This service is used for mail-based replication between sites. Active Directory includes support for replication between sites by using SMTP over IP transport. SMTP support is provided by the SMTP service, which is a component of IIS. The set of transports used for communication between sites must be extensible; therefore, each transport is defined in a separate add-in dynamic link library (DLL). These add-in DLLs are loaded into the ISM service, which runs on all domain controllers that are candidates for performing communication between sites. The ISM service directs send requests and receive requests to the appropriate transport add-in DLLs, which then route the messages to the ISM service on the destination computer.
J  Back to the menu
Jetpack Compacts a Windows Internet Name Service (WINS) or Dynamic Host Configuration Protocol (DHCP) database. Microsoft recommends that you compact the WINS database whenever it approaches 30 MB.
K  Back to the menu
Klist Displays a list of currently cached Kerberos tickets. This information applies to Windows Server 2012.
Ksetup Performs tasks that are related to setting up and maintaining Kerberos protocol and the Key Distribution Center (KDC) to support Kerberos realms, which are not also Windows domains. For examples of how this command can be used, see the Examples section in each of the related subtopics.
Ktmutil Starts the Kernel Transaction Manager utility. If used without parameters, ktmutil displays available subcommands.
Ktpass Configures the server principal name for the host or service in Active Directory Domain Services (AD DS) and generates a .keytab file that contains the shared secret key of the service. The .keytab file is based on the Massachusetts Institute of Technology (MIT) implementation of the Kerberos authentication protocol. The Ktpass command-line tool allows non-Windows services that support Kerberos authentication to use the interoperability features provided by the Kerberos Key Distribution Center (KDC) service in Windows Server 2008 R2.
L  Back to the menu
Label Creates, changes, or deletes the volume label (that is, the name) of a disk. If used without parameters, the label command changes the current volume label or deletes the existing label.
Ldifde Creates, modifies, and deletes directory objects. You can also use ldifde to extend the schema, export Active Directory user and group information to other applications or services, and populate Active Directory Domain Services (AD DS) with data from other directory services.
Ldp Performs operations such as connect, bind, search, modify, add, delete against any Lightweight Directory Access Protocol (LDAP)-compatible directory, such as Active Directory Domain Services (AD DS). Ldp is an LDAP client that you use to view objects that are stored in AD DS along with their metadata, such as security descriptors and replication metadata.
Lodctr Allows you to register or save performance counter name and registry settings in a file and designate trusted services.
Logman Logman creates and manages Event Trace Session and Performance logs and supports many functions of Performance Monitor from the command line.
Logoff Logs off a user from a session on a Remote Desktop Session Host (RD Session Host) server and deletes the session from the server.
Lpq Displays the status of a print queue on a computer running Line Printer Daemon (LPD).
Lpr Sends a file to a computer or printer sharing device running the Line Printer Daemon (LPD) service in preparation for printing.
M  Back to the menu
Macfile Manages File Server for Macintosh servers, volumes, directories, and files. You can automate administrative tasks by including a series of commands in batch files and starting them manually or at predetermined times.
Makecab Package existing files into a cabinet (.cab) file.
Manage-bde Used to turn on or turn off BitLocker, specify unlock mechanisms, update recovery methods, and unlock BitLocker-protected data drives. This command-line tool can be used in place of the BitLocker Drive Encryption Control Panel item.
mapadmin You can use Mapadmin to manage User Name Mapping for Microsoft Services for Network File System.
Md Creates a directory or subdirectory. This command is the same as the mkdir command.
Mkdir This command is the same as the md command. See Md for syntax and parameters.
Mklink Creates a symbolic link.
Mmc Using MMC command-line options, you can open a specific MMC console, open MMC in author mode, or specify that the 32-bit or 64-bit version of MMC is opened.
Mode Displays system status, changes system settings, or reconfigures ports or devices. If used without parameters, mode displays all the controllable attributes of the console and the available COM devices.
More Displays one screen of output at a time.
Mount You can use mount to mount Network File System (NFS) network shares.
Mountvol Creates, deletes, or lists a volume mount point.
Move Moves one or more files from one directory to another directory.
Mqbkup Backs up MSMQ message files and registry settings to a storage device and restores previously-stored messages and settings.
Mqsvc Message Queuing technology enables applications running at different times to communicate across heterogeneous networks and systems that may be temporarily offline. Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging. It can be used to implement solutions for both asynchronous and synchronous messaging scenarios.
Mqtgsvc Monitors a queue for incoming messages and performs an action, in the form of an executable file or COM component, when the rules of a trigger are evaluated as true.
Msdt Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input.
Msg Sends a message to a user on a Remote Desktop Session Host (RD Session Host) server.
Msiexec Provides the means to install, modify, and perform operations on Windows Installer from the command line.
Msinfo32 Opens the System Information tool to display a comprehensive view of the hardware, system components, and software environment on the local computer.
Mstsc Creates connections to Remote Desktop Session Host (RD Session Host) servers or other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration file, and migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files.
N  Back to the menu
Nbtstat Displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables for both the local computer and remote computers, and the NetBIOS name cache. Nbtstat allows a refresh of the NetBIOS name cache and the names registered with Windows Internet Name Service (WINS). Used without parameters, nbtstat displays help.
Net computer Adds or deletes a computer from a domain database.
Net group Adds, displays, or modifies global groups in domains.
Net localgroup Adds, displays, or modifies local groups. Used without parameters, net localgroup displays the name of the server and the names of local groups on the computer.
Net print Displays information about a specified printer queue or a specified print job, or controls a specified print job.
Net session Manages server computer connections. Used without parameters,  net session displays information about all sessions with the local computer.
Net share Manages shared resources. Used without parameters, net share displays information about all of the resources that are shared on the local computer. For each resource, the device name(s) or pathname(s) and a descriptive comment are displayed.
Net use Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections. The command also controls persistent net connections. Used without parameters, net use retrieves a list of network connections.
Net user Adds or modifies user accounts, or displays user account information.
Net view Displays a list of domains, computers, or resources that are being shared by the specified computer.  Used without parameters, net view displays a list of computers in your current domain.
Netcfg Installs the Windows Preinstallation Environment (WinPE), a lightweight version of Windows used to deploy workstations.
Netdiag The Netdiag command-line diagnostic tool helps to isolate networking and connectivity problems by performing a series of tests to determine the state of your network client. These tests and the key network status information that they expose give network administrators and support personnel a more direct means of identifying and isolating network problems. Moreover, because this tool does not require parameters or switches to be specified, support personnel and network administrators can focus on analyzing the output rather than on training users how to use the tool.
Netdom Enables administrators to manage Active Directory domains and trust relationships from the command prompt.
Netsh Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a currently running computer.
Netstat Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols). Used without parameters, netstat displays active TCP connections.
Nfsadmin You can use nfsadmin to manage Server for NFS and Client for NFS.
Nfsshare You can use nfsshare to control Network File System (NFS) shares.
Nfsstat You can use nfsstat to display or reset counts of calls made to Server for NFS.
Nlb After you have installed and configured Network Load Balancing (NLB), you can control its operations and modify parameter settings using the NLB control program, nlb.exe. To simplify and centralize system administration, you can run nlb.exe either on the cluster hosts or on any remote computer running Windows Server 2008 that can access the cluster over a local or wide area network. However, certain actions, such as modifying parameters, can be performed only on the cluster hosts.
Nlbmgr Using Network Load Balancing Manager, you can configure and manage your Network Load Balancing clusters and all cluster hosts from a single computer, and you can also replicate the cluster configuration to other hosts. You can start Network Load Balancing Manager from the command-line using the command nlbmgr.exe, which is installed in the systemroot\System32 folder.
Nltest Performs network administrative tasks.
Nslookup Displays information that you can use to diagnose Domain Name System (DNS) infrastructure. Before using this tool, you should be familiar with how DNS works. The Nslookup command-line tool is available only if you have installed the TCP/IP protocol.
Ntbackup The ntbackup command is not available in Windows Vista or Windows Server 2008. Instead, you should use the wbadmin command and subcommands to back up and restore your computer and files from a command prompt.
Ntcmdprompt Runs the command interpreter Cmd.exe, rather than Command.com, after running a Terminate and Stay Resident (TSR) or after starting the command prompt from within an MS-DOS application.
Ntdsutil Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). You can use the ntdsutil commands to perform database maintenance of AD DS, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled. This tool is intended for use by experienced administrators.
Ntfrsutl Dumps the internal tables, thread, and memory information for the NT File Replication Service (NTFRS). It runs against local and remote servers. The recovery setting for NTFRS in Service Control Manager (SCM) can be critical to locating and keeping important log events on the computer. This tool provides a convenient method of reviewing those settings.
O  Back to the menu
Openfiles Enables an administrator to query, display, or disconnect files and directories that have been opened on a system. Also enables or disables the system Maintain Objects List global flag.
P  Back to the menu
Pagefileconfig.vbs Pagefileconfig.vbs is deprecated, and is not guaranteed to be supported in future releases of Windows.
Path Sets the command path in the PATH environment variable (the set of directories used to search for executable files). If used without parameters, path displays the current command path.
Pathping Provides information about network latency and network loss at intermediate hops between a source and destination. Pathping sends multiple Echo Request messages to each router between a source and destination over a period of time and then computes results based on the packets returned from each router. Because pathping displays the degree of packet loss at any given router or link, you can determine which routers or subnets might be having network problems. Pathping performs the equivalent of the tracert command by identifying which routers are on the path. It then sends pings periodically to all of the routers over a specified time period and computes statistics based on the number returned from each. Used without parameters, pathping displays help.
Pause Suspends the processing of a batch program and displays the following prompt.
Pbadmin Pbadmin is deprecated, and is not guaranteed to be supported in future releases of Windows.
Pentnt Pentnt is deprecated, and is not guaranteed to be supported in future releases of Windows.
Perfmon Start Windows Reliability and Performance Monitor in a specific standalone mode.
Ping Verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message Protocol (ICMP) Echo Request messages. The receipt of corresponding Echo Reply messages are displayed, along with round-trip times. Ping is the primary TCP/IP command used to troubleshoot connectivity, reachability, and name resolution. Used without parameters, ping displays help.
Pnpunattend Audits a computer for device drivers, and perform unattended driver installations, or search for drivers without installing and, optionally, report the results to the command line. Use this command to specify the installation of specific drivers for specific hardware devices.
Pnputil Pnputil.exe is a command line utility that you can use to manage the driver store. You can use Pnputil to add driver packages, remove driver packages, and list driver packages that are in the store.
Popd Changes the current directory to the directory that was most recently stored by the pushd command.
Powercfg Control power settings and configure computers to default to Hibernate or Standby modes.
PowerShell Windows PowerShell™ is a task-based command-line shell and scripting language designed especially for system administration. Built on the .NET Framework, Windows PowerShell helps IT professionals and power users control and automate the administration of the Windows operating system and applications that run on Windows.The PowerShell.exe command-line tool starts a Windows PowerShell session in a Command Prompt window. When you use PowerShell.exe, you can use its optional parameters to customize the session. For example, you can start a session that uses a particular execution policy or one that excludes a Windows PowerShell profile. Otherwise, the session is the same as any session that is started in the Windows PowerShell console.
PowerShell_Ise Windows PowerShell Integrated Scripting Environment (ISE) is a graphical host application that enables you to read, write, run, debug, and test scripts and modules in a graphic-assisted environment. Key features such as IntelliSense, Show-Command, snippets, tab completion, syntax-coloring, visual debugging, and context-sensitive Help provide a rich scripting experience.
Print Sends a text file to a printer.
Prncnfg.vbs Configures or displays configuration information about a printer.
Prndrvr.vbs Adds, deletes, and lists printer drivers.
Prnjobs.vbs Pauses, resumes, cancels, and lists print jobs.
Prnmngr.vbs Adds, deletes, and lists printers or printer connections, in addition to setting and displaying the default printer.
Prnport.vbs Creates, deletes, and lists standard TCP/IP printer ports, in addition to displaying and changing port configuration.
Prnqctl.vbs Prints a test page, pauses or resumes a printer, and clears a printer queue.
Prompt Changes the Cmd.exe command prompt. If used without parameters, prompt resets the command prompt to the default setting, which is the current drive letter and directory followed by the greater than symbol (>).
Pubprn.vbs Publishes a printer to the Active Directory Domain Services.
Pushd Stores the current directory for use by the popd command, and then changes to the specified directory.
Pushprinterconnections Reads Deployed Printer Connection settings from Group Policy, and deploys/removes printer connections as needed.
Q  Back to the menu
Qappsrv Displays a list of all Remote Desktop Session Host (RD Session Host) servers on the network.
Qprocess Displays information about processes that are running on a Remote Desktop Session Host (RD Session Host) server.
Query Displays information about processes, sessions, and Remote Desktop Session Host (RD Session Host) servers.
Quser Displays information about user sessions on a Remote Desktop Session Host (RD Session Host) server.
Qwinsta Displays information about sessions on a Remote Desktop Session Host (RD Session Host) server.
R  Back to the menu
Rasdial Connects or disconnects a dial-up or virtual private network (VPN) connection. When you run the command without parameters, the status of current network connections is displayed.
Rcp Copies files between computers. This command has been deprecated.
Rd Deletes a directory. This command is the same as the rmdir command.
Rdpsign Enables you to digitally sign a Remote Desktop Protocol (.rdp) file.
Reagentc Configures the Windows Recovery Environment (Windows RE) and enables image recovery solutions.
Recover Recovers readable information from a bad or defective disk.
Redircmp Redirects the default container for newly created computers to a specified, target organizational unit (OU) so that newly created computer objects are created in the specific target OU instead of in CN=Computers.
Redirusr Redirects the default container for newly created users to a specified, target organizational unit (OU) so that newly created user objects are created in the specific target OU instead of in CN=Users.
Reg Performs operations on registry subkey information and values in registry entries.
Regini Modifies the registry from the command line or a script, and applies changes that were preset in one or more text files. You can create, modify, or delete registry keys, in addition to modifying the permissions on the registry keys.
Regsvr32 Registers .dll files as command components in the registry.
Relog Extracts performance counters from performance counter logs into other formats, such as text-TSV (for tab-delimited text), text-CSV (for comma-delimited text), binary-BIN, or SQL.
Rem Records comments (remarks) in a batch file or CONFIG.SYS. If no comment is specified, rem adds vertical spacing.
Ren Renames files or directories. This command is the same as the rename command.
Rename This is the same as the ren command.
Rendom Rendom.exe is a command-line tool that is used to rename Active Directory domains. A domain rename is a complex operation that also requires other tools and processes in addition to using Rendom.exe.
Repadmin Repadmin.exe helps administrators diagnose Active Directory replication problems between domain controllers running Microsoft Windows operating systems.
Repair-bde Accesses encrypted data on a severely damaged hard disk if the drive was encrypted by using BitLocker. Repair-bde can reconstruct critical parts of the drive and salvage recoverable data as long as a valid recovery password or recovery key is used to decrypt the data.
Replace Replaces files. If used with the /a option, replace adds new files to a directory instead of replacing existing files.
Reset session Enables you to reset (delete) a session on a Remote Desktop Session Host (RD Session Host) server.
Rexec Rexec is deprecated, and is not guaranteed to be supported in future releases of Windows.
Risetup The risetup command is deprecated in Windows Server® 2008 and Windows Server 2008 R2.
Rmdir This command is the same as the rd command. See Rd for syntax and parameters.
Robocopy Advanced filecopy
Route Displays and modifies the entries in the local IP routing table.
Rpcinfo Lists programs on remote computers. The rpcinfo command-line utility makes a remote procedure call (RPC) to an RPC server and reports what it finds.
Rpcping Confirms the RPC connectivity between the computer running Microsoft Exchange Server and any of the supported Microsoft Exchange Client workstations on the network. This utility can be used to check if the Microsoft Exchange Server services are responding to RPC requests from the client workstations via the network.
Rsh This command has been deprecated. Runs commands on remote computers running the RSH service or daemon.
Rsm Manages media resources using Removable Storage. Using the rsm command, you can run batch scripts for applications that do not currently support the Removable Storage API.
Rss Manages Remote Storage from the command line. Using the rss command, you can run batch scripts for applications that will allow them to access Remote Storage directly.
Runas Allows a user to run specific tools and programs with different permissions than the user’s current logon provides.
Rundll32 Loads and runs 32-bit dynamic-link libraries (DLLs). There are no configurable settings for Rundll32.
Rwinsta Enables you to reset (delete) a session on a Remote Desktop Session Host (RD Session Host) server.
S  Back to the menu
Sc Communicates with the Service Controller and installed services. The SC.exe program provides capabilities similar to those provided in Services in the Control Panel.
Schtasks Schedules commands and programs to run periodically or at a specific time. Adds and removes tasks from the schedule, starts and stops tasks on demand, and displays and changes scheduled tasks.
Scwcmd Command line-tool used to perform Security Configuration Wizard tasks.
Secedit Configures and analyzes system security by comparing your current configuration to specified security templates.
Serverceipoptin Allows you to participate in the Customer Experience Improvement Program (CEIP).
Servermanagercmd Servermanagercmd.exe has been deprecated, and is not available in Windows Server 2012.
Serverweroptin Allows you to enable error reporting.
Set Displays, sets, or removes CMD.EXE environment variables. If used without parameters, set displays the current environment variable settings.
Setlocal Starts localization of environment variables in a batch file. Localization continues until a matching endlocal command is encountered or the end of the batch file is reached.
Setspn Reads, modifies, and deletes the Service Principal Names (SPN) directory property for an Active Directory service account. You use SPNs to locate a target principal name for running a service. You can use setspn to view the current SPNs, reset the account’s default SPNs, and add or delete supplemental SPNs.
Setx Creates or modifies environment variables in the user or system environment, without requiring programming or scripting. The Setx command also retrieves the values of registry keys and writes them to text files.
Sfc Scans and verifies the integrity of all protected system files and replaces incorrect versions with correct versions.
Shadow Enables you to remotely control an active session of another user on a Remote Desktop Session Host (RD Session Host) server.
Shift Changes the position of batch parameters in a batch file.
Showmount You can use showmount to display mounted directories.
Shutdown Enables you to shut down or restart local or remote computers one at a time.
Sort Reads input, sorts data, and writes the results to the screen, to a file, or to another device.
Start Starts a separate Command Prompt window to run a specified program or command.
Storrept The storrept command is installed with File Server Resource Manager and includes subcommands for creating and managing storage reports and storage report tasks, as well as for configuring general administrative options for File Server Resource Manager.
Subst Associates a path with a drive letter. If used without parameters, subst displays the names of the virtual drives in effect.
Sxstrace Diagnoses side-by-side problems.
Sysocmgr Sysocmgr is deprecated, and is not guaranteed to be supported in future releases of Windows.
Systeminfo Displays detailed configuration information about a computer and its operating system, including operating system configuration, security information, product ID, and hardware properties (such as RAM, disk space, and network cards).
T  Back to the menu
Takeown Enables an administrator to recover access to a file that previously was denied, by making the administrator the owner of the file.
Tapicfg Creates, removes, or displays a TAPI application directory partition, or sets a default TAPI application directory partition. TAPI 3.1 clients can use the information in this application directory partition with the directory service locator service to find and communicate with TAPI directories.You can also use Tapicfg to create or remove service connection points, which enable TAPI clients to efficiently locate TAPI application directory partitions in a domain.
Taskkill Ends one or more tasks or processes. Processes can be ended by process ID or image name. Taskkill replaces the kill tool.
Tasklist Displays a list of currently running processes on the local computer or on a remote computer. Tasklist replaces the tlist tool.
Tcmsetup Sets up or disables the TAPI client.
Telnet Communicates with a computer running the Telnet Server service.
Tftp Transfers files to and from a remote computer, typically a computer running UNIX, that is running the Trivial File Transfer Protocol (TFTP) service or daemon.
Time Displays or sets the system time. If used without parameters, time displays the current system time and prompts you to enter a new time.
Timeout Pauses the command processor for the specified number of seconds.
Title Creates a title for the Command Prompt window.
Tlntadmn Administers a local or remote computer that is running the Telnet Server Service.
Tracerpt The tracerpt command can be used to parse Event Trace Logs, log files generated by Performance Monitor, and real-time Event Trace providers. It generates dump files, report files, and report schemas.
Tracert Determines the path taken to a destination by sending Internet Control Message Protocol (ICMP) Echo Request or ICMPv6 messages to the destination with incrementally increasing Time to Live (TTL) field values. The path displayed is the list of near/side router interfaces of the routers in the path between a source host and a destination. The near/side interface is the interface of the router that is closest to the sending host in the path.
Tree Displays the directory structure of a path or of the disk in a drive graphically.
Tscon Connects to another session on a Remote Desktop Session Host (RD Session Host) server.
Tsdiscon Disconnects a session from a Remote Desktop Session Host (RD Session Host) server.
Tsecimp Imports assignment information from an Extensible Markup Language (XML) file into the TAPI server security file (Tsec.ini). You can also use this command to display the list of TAPI providers and the lines devices associated with each of them, validate the structure of the XML file without importing the contents, and check domain membership.
Tskill Ends a process running in a session on a Remote Desktop Session Host (RD Session Host) server.
Tsprof Copies the Remote Desktop Services user configuration information from one user to another.
Type Displays the contents of a text file. Use the type command to view a text file without modifying it.
Typeperf The typeperf command writes performance data to the command window or to a log file. To stop typeperf, press CTRL+C.
Tzutil Displays the Windows Time Zone Utility.
U  Back to the menu
Uddiconfig Saves Universal Description, Discovery, and Integration (UDDI) configuration settings to an XML file.
Umount You can use Umount to remove Network File System (NFS)–mounted drives.
Unlodctr Removes Performance counter names and Explain text for a service or device driver from the system registry.
V W  Back to the menu
W32tm You can use the W32tm.exe tool to configure Windows Time service (W32time) settings. You can also use W32tm.exe to diagnose problems with the time service. W32tm.exe is the preferred command-line tool for configuring, monitoring, or troubleshooting the Windows Time service.
Waitfor Sends or waits for a signal on a system. Waitfor is used to synchronize computers across a network.
Wbadmin Enables you to back up and restore your operating system, volumes, files, folders, and applications from a command prompt.
Wdsutil WDSUTIL is a command-line utility used for managing your Windows Deployment Services server.
Wecutil Enables you to create and manage subscriptions to events that are forwarded from remote computers, which support WS-Management protocol.
Ver Displays the operating system version number.
Verifier Driver verifier manager.
Verify Tells cmd whether to verify that your files are written correctly to a disk. If used without parameters, verify displays the current setting.
Wevtutil Enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs.
Where Displays the location of files that match the given search pattern.
Whoami Displays user, group and privileges information for the user who is currently logged on to the local system. If used without parameters, whoami displays the current domain and user name.
Winnt Winnt is deprecated, and is not guaranteed to be supported in future releases of Windows.
Winnt32 Winnt32 is deprecated, and is not guaranteed to be supported in future releases of Windows.
Winpop Winpop is deprecated, and is not guaranteed to be supported in future releases of Windows.
Winrs Windows Remote Management allows you to manage and execute programs remotely.
Winsat winsat assesses various features, capabilities, and attributes of a computer running Windows Vista®.
Wlbs The Wlbs command has been replaced by Nlb.exe. For more information, see Nlb
Wmic Displays WMI information inside an interactive command shell.
Vol Displays the disk volume label and serial number, if they exist.  If used without parameters, vol displays information for the current drive.
Wscript Windows Script Host provides an environment in which users can execute scripts in a variety of languages, languages that use a variety of object models to perform tasks.
Vssadmin Displays current volume shadow copy backups and all installed shadow copy writers and providers.
X  Back to the menu
Xcopy Copies files and directories, including subdirectories
Y  Back to the menu
Z  Back to the menu

Thats it, and thats that!


Windows Server 2012 Command-Line Reference

Windows PowerShell Support for Windows Server 2012




Twitter | Technet Profile | LinkedIn

A guide to https and Secure Sockets Layer in SharePoint 2013

Hi dear friends!


It has become something of a habit of mine, to jump over the tougher more difficult topics, the ones that I have spent a lot of energy avoiding before. Kerberos must be the worst of them all, and since I feel that I have Kerberos pretty much covered, I know everything and I can do anything…
This topic is something that I always avoided doing myself as well, if in production or in the lab, since certificates are difficult to understand and hard to come by for tests, I never got to try it much and thus it stayed a bit of a grey area for long.
But no more, by publishing this guide, I hope that I and you can all get over the fear of https/SSL together.
This guide is also available as a whitepaper to download Here
(Skip all the bullshit yada yada and jump straight to the steps.)

This guide was created far from the ultrafast fibreoptic gigabit internet Connections

One important thing to remember though, this guide is only meant to be used in test or lab, it is not recommended to use exactly this setup in production. If you are looking to setup https in production, then you should have a certificate issued by your own Certificate Authority or have one bought from a trusted certificate issuer such as Verisign for example. I don’t know all the downsides, but for one, you cannot revoke a self-signed cert.

My requirements for https in testing are these:
– They should look and behave the same as it would in production
– It should be a real DNS URL or a real URL added to the host file
– It should not cause any red warnings in the browser
– IIS and SharePoint must be configured the same way as if it were a real life scenario

How do we do this? Let me show you how I would do it…

First we need a proper environment, in my setup I have:
– A single SharePoint 2013 server on Windows Server 2012 running all roles but the DB.
– A SQL server 2008 R2 on Windows Server 2008 R2 (OS here is irrelevant)
– A Windows Server 2012 DNS server
– A Windows Server 2012 Domain Controller (Any DC will do…)
– A Windows 7 client with Internet Explorer 9. (Most common customer setup, works from the server as well with loopback check disabled)

I am also using a utility from the IIS 6.0 Resource kit, download that before we start from this link: Download IIS 6.0 Resource Kit

In order for https / SSL and SharePoint to work we need a few things, lets add it all up in a checklist:

– A Web Application with a root site already created
– A URL (FQDN preferred)
– A DNS entry to go with the URL
– A Self-signed Certificate (or from a trusted issuer)
– IIS Binding
– Certificate added to trusted authority on the client/server
– URL added to the local intranet zone in Internet Explorer for auto-logon

In my example, I will use the following:

Requirement In my test environment
– A URL (FQDN preferred) sharepoint2013.corp.balkestahl.se
– A DNS entry to go with the URL sharepoint2013.corp.balkestahl.se ->
– A Certificate (Self signed or from a trusted issuer) Certificate created using the IIS 6.0 RK utility SelfSSL.
– AAM Internal http and https, Public https only
– IIS Binding Bind my site to https and all IP using the created certificate

These are the steps we need to take (click on any link):

1. Create a new Web Application or use an existing one (use port 80 initially and not https/443 for this guide.)
2. DNS, create an A-Record
3. Create the certificate (or request, buy, get any way you choose the real deal)
4. Add IIS Binding with Host-Header (this has to be done manually)
5. AAM, Add the necessary Alternate Access Mappings
6. Add the certificate to the Trusted Certificate store on the client
7. Test functionality
8. T-Shooting
9. References and recognitions

Note: If there is something that I have missed in this guide, or that should be done differently, please let me know.
I will reply to any comment and feedback that you submit.

1. Web Application
This step can be skipped completely if you already have a working Web Application with http on port 80 with an existing Site Collection.
If you do not have that or don’t feel Confident that it will be adequate, follow these simple steps.

1.1 In Central Admin, go to Application Management, then Manage Web Applications, in the ribbon, click on new, fill in the form using your own values.

Note: The Name value is what the Web Application will be shown as in CA and in IIS.


1.2 Note that I have not chosen to use SSL here, this will be added at a later time. Leave these choices as default.


1.3 The http url for this web application. As we set this up initially on port 80 and using http only, this could be anything, I have chosen to use the same FQDN as my https address will use.


Leave all other settings as is, the default values will do just fine for this test. The default is in 2013 using claims as authentication provider and this will serve our goal well.
I will not show you step by step how to create a Site Collection in the Web Application, something that you must do in order for the browser to later access the URL. But the steps are something like this:

1.4 Create a new Site Collection: In Central Admin select Application Management

1.5 Under Site Collections section, click on Create Site Collection.

1.6 In the dropdown, select the proper Web Application.

1.7 Enter a Name, Address and Description.

1.8 If only for test, use the Team site template under the Collaboration tab.

1.9 Add yourself as a site Collection administrator, or the account that will test access from a client, or add both in the primary and secondary fields.

1.10 Click OK. Wait until it has been created. Done!

Back to main menu

2. DNS

2.1 On your Windows Server 2012 running the DNS service, start server manager, then click on Tools and select DNS:


2.2 Locate the forward lookup zone for your domain:


2.3 Right click the zone and select New Host (A or AAAA)…


2.4 Enter the name of your site, this together with the full domain path will form the FQDN, Fully Qualified Domain Name. In the IP address field you enter the IP address of the SharePoint web server:


2.5 Click on Add Host and then Done, when you see this and verify that the FQDN shown is correct, you are done with the DNS part.


Back to main menu

3. Create a certificate

In my test setup, I will create my own certificate but use a properly named one, this makes it feel more like the real thing. If you have not already done so, download and install the IIS 6.0 Resource kit that comes with the nifty little util called SelfSLL. This allows you to create a self-signed certificate that has a proper URL, a requirement if you want to avoid the red warning in the browser that a regular self-signed cert would give you. The RK can be downloaded here: Download IIS 6.0 Resource Kit

Content of the IIS 6.0 Resource Kit – the following tools are available in this package:

  • IIS 6.0 Migration Tool Version 1.0 Version 1.1 Now Available!
  • Apache to IIS 6.0 Migration Tool Version 1.0
  • CustomAuth Version 1.0
  • IISCertDeploy.vbs Version 1.0
  • IIS Host Helper Service Version 1.0
  • IISState Version 3.0
  • Log Parser Version 2.1 Version 2.2 Now Available!
  • Metabase Explorer Version 1.6
  • Permissions Verifier Version 1.0
  • RemapUrl Version 1.0
  • SelfSSL Version 1.0
  • TinyGet Version 5.2
  • Web Capacity Analysis Tool Version 5.2
  • WFetch Version 1.3

What we really want out of all this this time, is the small util called SelfSSL in bold. This little util allows you like I said before, to create a self-signed cert using an FQDN of choice. In my example, I want to use the URL: sharepoint2013.corp.balkestahl.se and have the cert created with the same URL. I’ll show you how step by step.
It’s really quite simple.

Note: You might consider even in a lab Environment, to install your own Certificate Authority and issue your own private Certificates, the following links will be of help when doing that:
Install the Certification Authority (Windows Server 2012)
Install a Root Certification Authority (Windows Server 2008 R2)
Active Directory Certificate Services Overview (Windows Server 2012) 

3.1 Run the tool from the start menu:


3.2 The command-line tool does not look much to the world:


Note: You need to be logged on with an account that is a member of the local administrators Group in order to use this tool.

It gives you some options and I’m not going to go into what can be done with this tool, I’ll just go with the default and create a certificate using the suggested settings with one exception, we need to use the proper site ID.
Every site in IIS gets an ID, this is in this case used to put the certificate in the correct place on the correct site.

3.3 Get the correct ID from IIS, open up the IIS Manager, in server manager, click on Tools and then on Internet Information Services Manager:


3.4 In Internet Information Services Manager, select your site:


3.5 On the right pane, near the bottom, click on Advanced Settings…:


3.6 In the next dialog, you will see a row called simply ID:


3.7 Select the number in the field and right click and copy:


3.8 Paste the ID after the /S: switch. You should also change the value for the /V: setting, this represents how many days the certificate will be valid, the default 7 is ok for me in a very temporary setup, but for longer test runs, make it 90 Days or so. If the certificate expires, you will get ugly warnings that the certificate has expired and that it is untrusted. Https wil still work but on probation…
Now you have all you need to proceed. Run the SelfSSL util and use the site ID but leave everything else default.
Answer yes to the question – Do you want to replace the SSL settings for site 724410038.

selfssl.exe /N:CN=SharePoint2013.corp.balkestahl.se /K:1024 /V:7 /S:724410038 /P:443


Note: One option that could be useful, if you add the /T to the command the certificate will be added to the local Machines trusted authority certificates list. This makes it trusted in the servers browser.

The certificate is now created and put into the personal store for this computer.
If you get an error here stating that the certificate could not be assigned to the site, then you most likely already have an instance of the same certificate name, locate any existence of the certificate and delete it. (See how later in the post under chapter 8. T-shooting)

Move on to Chapter 4 or go Back to main menu

4. IIS Binding

In order for the web server, IIS, to recognize any incoming traffic and locate the proper site to direct it to, IIS uses Host header bindings. This is done so that you can have more than one site on port 80 in the same web server. The default site has a blank Host header binding which will in affect make it claim all incoming requests as its own.
SharePoint stops the Default Web Site so that does not affect us now, but we need to take care of our own IIS Web Site that in reality is our SharePoint Web Application.

What we have to do, is make our IIS Web Site answer to all incoming traffic with a host header of https and the FQDN created in Chapter 2. DNS – sharepoint2013.corp.balkestahl.se

4.1 Start by opening up your IIS manager, in Server Manager, click on tools and the on Internet Information Services (IIS) Manager:


4.2 Locate your Web Site:


4.3 In the right hand pane, locate Bindings:


4.4 What you see here is a list of the existing Bindings for this site, Type, Host Name, Port and IP address. If you have created the certificate using the SelfSSL util and added the ID of the Web Site, then you will most likely see at least two rows here (see 4.5).

4.5 This is what you will have if the SelfSSL successfully added the cert to the site using its ID:
If this is what you have, select the second row with the https/443 and click on Edit, then scroll down to step 4.11 in this guide.


4.6 Assuming that it was not added, we have to add the cert to the site. Click on Add.


4.7 In this dialog, we must first select the proper protocol, https. Use the dropdown:


4.8 Once you have selected https as the protocol, you will find that a new field appears. This is where you select the certificate to use.


4.9 Select the certificate created in Chapter 3. Create a Certificate, in my environment, that is the sharepoint2013.corp.balkestahl.se certificate listed.

4.10 Once selected, you can click on View to verify that it really is the correct certificate and that everything looks to be in order, click on OK.


4.11 Next we add the Host Name that this Binding will be matched on, same as the certificate name, sharepoint2013.corp.balkestahl.se, click OK.


4.12 Now you should see two rows in the bindings list for this Web Site. One for the initial http/80 and one for https/443. This is goOoOod!


4.13 Now click on Close and Close the IIS manager.

Move on to Chapter 5 or go Back to main menu

5. Alternate Access Mappings – AAM

In order for SharePoint to know how to handle the incoming requests for this new URL, we need to add/configure Alternate Access Mappings, this basically tells SharePoint how to handle all URLs. AAMs Control if SharePoint should do a redirect or a translation of the incoming address. AAMs can be configured from Central Administration and using PowerShell, I will in this guide use only CA.

5.1 Open up your Central Administration site and click on Configure Alternate Access Mappings located under the System Settings category.
This will show you all Alternate Access Mappings for all of your Web Applications in the farm. In the top right dropdown, click on Change Alternate Access Mapping Collection and select the correct Web Application.
Now, it will look like this:


5.2 Next thing we want to do, is to alter the existing Public URL so that it uses https instead of http. Since all else is ok, add the s…


5.3 Ok on that will give you this view, note that both the Internal URL and the Public URL has changed. This site is now only accessible by the https protocol. (Not entirely true, but true enough)


5.4 I always like to be able to type in the default http URL in my browser, and if the site uses https, be redirected automatically. This is rather easy to do in SharePoint, simply add an Internal URL using http and add it to the Default zone which will direct us to the Public URL using https. It may sound difficult but trust me, it just works.

If you are interested in Learning more about Alternate Access Mappings and the inner workings, I have a free whitePaper published on the subject for 2010 Here and a basic post for 2013 Here.

Anyways, click on the Add Internal URLs link and simply add the same URL using http, make sure that the default zone is selected.

Note: The zones used in AAM has NO RELATION with the zones in Internet Explorer, they are named similar, but they have no connection whatsoever.


5.5 Now the list should look like this, note that you have http and https on the left (incoming traffic) and only https on the right (target):


You are now done configuring your Alternate Access Mappings! Let’s move on to testing, start with Chapter 6.
Back to main menu

6. Add the Certificate to the Trusted Authorities store.

If we do nothing else from here, we will be able to access the site using https, but it will not be pretty…in order to mimic https using a ‘real’ certificate we need to also add the certificate to the trusted store. This will make the browser trust the cert as authentic and it will stop throwing us the errors.

Note: If you are doing these tests on the server itself, you will need to disable the loopback check Before accessing the site, else it will fail. See Chapter 8. T-shooting for information on how to do this.

6.1 Try it first, open a browser, type in the address of the https URL and hit enter. You will first see this warning. Click on Continue to this website.


6.2 This will lead to a login prompt. This is to be expected at this Point, login using your credentials that you have made site Collection admin or that have access to the site Collection.


6.3 Access! Yeay! or…no…hang on?! that’s not the way I pictured it…we don’t have access and we have a red certificate error. This is not what we want our users to see…
Two things cause this:

6.3.1. The White ribbon telling us that this is a secured browser comes from that the server in this case, has IE ESC – Internet Explorer Enhanced Security Configuration enabled.
If you are using a client like Windows 7 or 8, you will not see this but should actually see the site content.
To fix this, follow the steps in this blog post: How to disable IE Enhanced Security in Windows Server 2012 (Opens up in a new window)

6.3.2. The red Certificate error is there because the certificate comes from an untrusted source. This is as it should be, and can be fixed.
To fix this, keep reading…


6.4 There are several ways to add the certificate to the trusted store, I will show you the easiest of them all. Click on the Certificate Error to the right of the red shield symbol. This will show this:


6.5 It is all true what it says, except that nobody is trying to fool us…Click on View Certificates to show this dialog:


6.6 You can probably guess what the next step is going to be? Click on Install Certificate…


6.7 We want the certificate to be in the Computers store, select Local Machine and click Next.


6.8 Select Place all Certificates in the following store and hit the Browse button.


6.9 Now, locate the ‘Trusted Root Certification Authorities’ and make sure it is selected, click OK.


6.10 Verify that this is what you see as well. Click on OK.


6.11 Success! Try again to browse to the site, you should probably close the browser and start a new browser window.


6.12 Now we’re talking! that’s more like it, no red errors, no banner preventing us from loading the content…all is good, Life is GOOD!

Note: On my own server, it simply took a while for the error to go away, the IE cache has a renewal cycle of 50 minutes, to force a renewal, press Ctrl F5. That should do it.

Back to main menu

7. Test functionality

Testing has really already been taken care of in Chapter 6, but if you did what I did and used the servers browser (not recommended in production) to test access, then you really should test from a client to get the proper feel for it.
Use the steps described in Chapter 6 on the client computer as well. The dialog may look a bit of, but it’s the same steps basically. Sample dialog:


You will get the Picture if you use the steps in Chapter 6. Once you see the image below in your browser, you are OK!

Back to main menu

8. T-shooting

T-shooting scenarios covered so far:
– 8.1 Delete redundant certificates
– 8.2 Configure Loopback check

8.1 Delete redundant certificates
If adding the cert fail and you want to delete every copy, do this:

8.1.1 Press the start button, type Certificates…


8.1.2 Select Manage computer certificates.


8.1.3 This will open up the ‘Certificates Manager’//MMC Certificates Snap in. Locate the Personal, Certificates folder. In the content, either delete them both, or, find out which is the newer and delete the old one.


8.1.4 In the Certificate Details, you will see the Valid from timestamp, this is from when the certificate was created.


8.1.5 When you know which one to keep, delete the other, right click delete.
Back to main menu

8.2 Configure Loopback check.

Note: Remember that the loopback check is a security feature that has been put there for a reason, it protects the server from a certain form of attacks. Disabling it will open up the server for such attacks. Read Spencer Harbars post at the link below for a deeper understanding of this concept.

Are you planning to do one of two things on your SharePoint server, then you need to configure this, configure, not necessarily disable it.
– If you have search on the server and the Content source Points to the server itself using an FQDN.
– If you want to use the servers browser to test functionality or to access CA using an FQDN. (This is us in this guide…)

Note: I strongly recommend against using any browser on any server! It is a security risk since use of the browser opens up new ways for unwanted code to enter the server. Always access the server from a client browser!
I use the servers browser in my lab to make it easier, but it is a contained lab environment and the accounts used do not have access to anything outside this particular lab environment. furthermore, the lab environment cannot be reached from outside nor can it access the Internet.
(Thanks Anders Janson, UAG/TMG/Security expert at Enfo Zipper for great feedback!)

Two links will tell you all you need to know:

8.2.1 DisableLoopbackCheck & SharePoint: What every admin and developer should know. (Spencer Harbar explains it all)

8.2.2 http://support.microsoft.com/kb/896861 (the best KB out there, it is old but still relevant)

Back to main menu

9. Resources and Recognitions

Don’t know who the author is, but this article gave me the last piece in the https puzzle.

How to Create a Self Signed Certificate in IIS 7

My thanks to the following individuals who have in different ways helped me in my ambitions to create these guides on difficult subjects for SharePoint:

Anders Janson (Enfo Zipper) Thanks Anders for very good and constructive feedback!
Hasain Alshakarti (TrueSec) Blog
Mattias Gutke (Enfo Zipper)
Anders Grönlund (Enfo Sweden)
Andrija Marcic (Microsoft)
Mattias Karlsson (Microsoft)
Herakles (Unknown)

Back to main menu




Twitter | Technet Profile | LinkedIn

Anonymous Authentication always on in SharePoint 2013

Hi friends.

Anonymous access is default on in SharePoint 2013, even if you select No?

First, remember, this is all just a reflection made by me and most likely, there is some obvious reason as to why this is, that simply just eludes me at this point. I know that SharePoint does not in itself allow Anonymous access, that has to be configured, but IIS allows it which seems to me like a bad idea.

I noticed this disturbing thing this morning when I created a Quick Web Application in a SharePoint 2013 test farm of mine running on Windows Server 2012. Thing was, I created a web application from the Central Administration GUI and selected all the quickest options, Default Everything but to use an existing Application Pool. This means that we select Windows Authentication, NTLM only and NO Anonymous access.

Let me explain…
On a SharePoint 2013 farm running on Windows Server 2012:
I created a normal Web Application using only the Central Administration GUI. I used port 2013 just to show where it is, then default on all security settings.

Like this:

I seelcted to use an existing Application pool to save time and Resources, but that is not relevant. Ok to create:

Next I checked what was actually done in IIS, from the preview I remebered having some questions on how this was performed…
In IIS 8.0 on Windows Server 2012 it looks like this:

Notice how 4 providers are enabled by SharePoint as default.
Anonymous Authentication
ASP.NET Impersonation
Forms Authentication
Windows Authentication

These are all enabled by default, Windows Authentication has only NTLM configured like we selected in CA. We also get a warning from having Forms Based authentication(redirect) and Windows Based(Challenge) enabled at the same time. IIS does not like this but I have managed to find out that this is ok, given certain circumstanses you need it to be this way.

If we do the same thing on a SHarePoint 2010 farm running on Windows Server 2008R2 and IIS 7.5:

We select to use NTLM and to not allow Anonymous, same as in 2013.

The settings in IIS:

And the list of providers look like this:

Like you can see, SharePoint 2010 only enables ASP.NET Impersonation and Windows Authentication.

If we put the two up side by side, it looks like this:


The question is, does this affect security in any way?
Is it still as secure?
Why not simply disable Anonymous Authentication?

If anyone has any good suggestions or explanations, please submit them as a comment and I will update this post to reflect the facts.


A really good link that explains the inner workings of claims based authentication in SharePoint, valid for 2010 and 2013 alike.
(Thnaks nojanaj for the tip)

Multiple Authentication Methods in SharePoint 2010




Twitter | Technet Profile | LinkedIn

Whitepaper: The final guide to Alternate Access Mappings

This 45 page Guide is now available as a Free PDF download from Microsoft Technet Gallery.
Download : The final guide to Alternate Access Mappings

A preview of the whitepaper:




Twitter | Technet Profile | LinkedIn