The Magic Spear Descends Upon Us

A PowerShell function that returns detailed information regarding how User Account Control is configured on the current system in a human-readable format. Installation Instructions: Determine where your local scripts directory is with the following command: ([IO.DirectoryInfo](Join-Path $Profile.CurrentUserCurrentHost ".." "Scripts")).FullName Create a new file within that directory and name it Get-UserAccountControlPolicy.ps1 . Copy and paste the contents below into that file and save it. function Get-UserAccountControlPolicy { [CmdletBinding( ConfirmImpact = 'Low', DefaultParameterSetName = 'HideStatusParameterSet', PositionalBinding = $false, SupportsPaging = $false, SupportsShouldProcess = $false )] [OutputType([Object[]])] [Alias('Get-UACPolicy')] param ( [Parameter(ParameterSetName = 'HideStatusParameterSet')] [Alias('AccountScope',...

Microsoft's successor to the Natural Ergonomic Desktop 4000 , the Microsoft Ergonomic Keyboard (model/part designation LXM-00013 ) has a variety of special keys, many of which are difficult to reassign (and even merely assign under non-Windows operating systems). One in particular is the “Office 365” key that is positioned where either a Win or Menu key would typically be found. Assigning a Different Action to the Key One option is to override the default command triggered by pressing the key. The alternative command of your choosing can be something as simple as a built-in Windows utility or tool application such as the Character Map ( charmap ) or On-Screen Keyboard ( osk ), or something more complex like a PowerShell or AutoHotKey script. Substituting foo with the executable or command you've decided that you fancy the most, run the following command in a PowerShell prompt with administrative privileges: New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\ms-office...

Here's the scenario you're likely in: After having backed up any relevant content inside their home directory, you delete a user's local account in Windows via the control panel. You then navigate to C:\Users and attempt to delete their home directory only to find that their NTUSER.DAT file is still in use by the system, and rebooting - even in safe mode - has no effect. The job is left half-finished, and leaving jobs half-finished is simply unbecoming of a fine professional assassin such as yourself. Unacceptable! Removing the Profile Entry This guide assumes that you have, at the very least, already backed up the contents of HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList within the registry to a file. Press Win + R , copy and paste ms-settings:recovery , and press Enter to open the Recovery page within the Windows control panel. Under Advanced startup , select Restart now . Navigate to Troubleshoot → Advanced options → Startup Settings ...

While ASLR exploit mitigation has been present in Windows since Vista, it wasn't implemented as ubiquitously as it now is. Given the inherent nature of what Cheat Engine is , it's not exactly surprising that the two conflict with each other. Shut Up and Tell Me How to Fix It Open the start menu with Win , copy and paste explorer windowsdefender://ExploitProtection , and press Enter to open the Exploit Protection settings page within the Windows Security control panel. Navigate to the Program Settings tab and create the following entries via Choose exact file path in the dropdown that appears when making additions: Cheat Engine.exe cheatengine-i386.exe cheatengine-x86_64.exe cheatengine-x86_64-SSE4-AVX2.exe Kernelmoduleunloader.exe Upon adding an entry, you will be prompted with a list of possible settings to override: Disable mandatory ASLR and bottom-up ASLR for each one. I've provided a screenshot of my own control panel for refe...