Windows Server 2025 16 core Stand

 DISM /online /Set-Edition:ServerStandard /ProductKey:HBNP2-Q32Q2-XQBPR-FK4XX-QV9YB /AcceptEula

Reusable Template Script for Any Windows Server-Ransomware-Protection

# ==============================================================================

# Script: Configure-TallyRansomware-Selvamani.ps1

# Target Data Path: E:\TallyPrimeSelvamani\data

# Target Executable: E:\TallyPrimeSelvamani\tally.exe

# ==============================================================================

# 1. Define Exact Paths

$TallyDataPath = "E:\TallyPrimeSelvamani\data"

$TallyExePath  = "E:\TallyPrimeSelvamani\tally.exe"

$ErrorActionPreference = "Stop"

Write-Host "====================================================" -ForegroundColor Cyan

Write-Host " Configuring Protection & Performance for Tally     " -ForegroundColor Cyan

Write-Host "====================================================" -ForegroundColor Cyan

# 2. Add Data Folder to Ransomware Shield (Protected Folders)

if (Test-Path -Path $TallyDataPath) {

    Write-Host "[+] Adding Protected Data Folder: $TallyDataPath" -ForegroundColor Yellow

    Add-MpPreference -ControlledFolderAccessProtectedFolders $TallyDataPath

    Write-Host "    Successfully added protected folder." -ForegroundColor Green

} else {

    Write-Host "[!] Warning: Folder '$TallyDataPath' not found. Please verify directory name." -ForegroundColor Red

}

# 3. Whitelist tally.exe (Allow Application through CFA)

if (Test-Path -Path $TallyExePath) {

    Write-Host "`n[+] Whitelisting Executable: $TallyExePath" -ForegroundColor Yellow

    Add-MpPreference -ControlledFolderAccessAllowedApplications $TallyExePath

    Write-Host "    Allowed executable successfully." -ForegroundColor Green

} else {

    Write-Host "[!] Warning: Executable '$TallyExePath' not found. If installed elsewhere, adjust path." -ForegroundColor Red

}

# 4. Add Defender Performance Exclusions (Prevents network scanning lag)

Write-Host "`n[+] Adding Performance Exclusions..." -ForegroundColor Yellow

Add-MpPreference -ExclusionProcess "tally.exe"

if (Test-Path -Path $TallyDataPath) {

    Add-MpPreference -ExclusionPath $TallyDataPath

}

Add-MpPreference -ExclusionExtension ".tsf"

Add-MpPreference -ExclusionExtension ".900"

Write-Host "    Performance exclusions configured successfully." -ForegroundColor Green

# 5. Enable Controlled Folder Access (Audit Mode First)

# Options: "AuditMode" (Safe testing) or "Enabled" (Immediate enforcement)

$DesiredMode = "AuditMode" 

Write-Host "`n[+] Setting Controlled Folder Access Mode to: $DesiredMode" -ForegroundColor Yellow

Set-MpPreference -EnableControlledFolderAccess $DesiredMode

Write-Host "    CFA mode updated." -ForegroundColor Green

# 6. Verify Settings

Write-Host "`n====================================================" -ForegroundColor Cyan

Write-Host " Current Controlled Folder Access Summary           " -ForegroundColor Cyan

Write-Host "====================================================" -ForegroundColor Cyan

$mpPrefs = Get-MpPreference

Write-Host "CFA Mode              : " -NoNewline

switch ($mpPrefs.EnableControlledFolderAccess) {

    0 { Write-Host "Disabled (0)" -ForegroundColor Red }

    1 { Write-Host "Enabled / Active Blocking (1)" -ForegroundColor Green }

    2 { Write-Host "Audit Mode Only (2)" -ForegroundColor Yellow }

}

Write-Host "`nProtected Folders:" -ForegroundColor Cyan

$mpPrefs.ControlledFolderAccessProtectedFolders | Where-Object { $_ -like "*Selvamani*" } | ForEach-Object { Write-Host " - $_" -ForegroundColor White }

Write-Host "`nAllowed Applications:" -ForegroundColor Cyan

$mpPrefs.ControlledFolderAccessAllowedApplications | Where-Object { $_ -like "*tally*" } | ForEach-Object { Write-Host " - $_" -ForegroundColor White }

Write-Host "`nConfiguration complete!" -ForegroundColor Green

Deleting a Protected Recovery Partition Using DiskPart

 1. Overview

This document outlines the step-by-step procedure for forcefully deleting a protected partition (such as a Recovery partition) on a Windows system using the DiskPart command-line utility.

2. Prerequisites & Safety Warning

[!CAUTION]
Data Loss Risk: The DiskPart tool permanently alters your drive structure. Selecting the wrong disk or partition can lead to irreversible data loss. Double-check all indexes before executing commands.

• Administrative privileges on the host system are required.
• Ensure backups of critical data are completed before proceeding.

3. Step-by-Step Execution Profile

diskpart

DISKPART> list disk

DISKPART> select disk 0

DISKPART> list partition

DISKPART> select partition 2

DISKPART> delete partition override

4. Verification & Expected Output

Upon successful execution, the console will output the following confirmation:
DiskPart successfully deleted the selected partition.

The space previously occupied by the deleted partition will now show as Unallocated Space, which can be merged into an adjacent volume or used to create a new partition.

AWS Client VPN Endpoint Setup

      Here's the high-level workflow :

➤ First, we generate certificates using EasyRSA.

➤ Then, we upload the server and client certificates AWS Certificate Manager.

➤ Next, we create a Client VPN Endpoint inside our VPC.

➤ After that, we associate it with our private subnet and set authorization rules.

➤ Finally, we connect from our laptop using the AWS VPN Client.

Step 1 - Create VPC & Subnet

➤ Open the VPC Console

➤ Create a VPC with CIDR 10.0.0.0/16

➤ Add a private subnet 10.0.1.0/24

➤ No Internet Gateway needed

Step 2 - Launch Private EC2 Instance

➤ Go to EC2 Console → Launch Instance ➤ Choose Amazon Linux 2 (or Ubuntu)

➤ Place the EC2 inside the private subnet

➤ Do not assign a public IP

➤ Attach a Security Group allowing SSH (port 22), but only from your VPN CIDR later

Step 3 - Generate Certificates

➤ Download EasyRSA from GitHub and extract it. https://github.com/OpenVPN/easy-rsa/releases/download/v3.2.2/EasyRSA-3.2.2-win64.zip

Refer the link - https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-auth-mutual-enable.html

➤ Open CMD run as Administrator and enter into the EasyRSA folder

➤ Generates:

- Certificate Authority (CA)

- Server certificate and key

- Client certificate and key

Please download the cert file I created and updated in my own Google Drive, and make use of it.

https://drive.google.com/drive/folders/1O9R4AEktbDU5Ae1HFczbPiPVQolQB1xO?usp=sharing

Step 4 - Upload Certificates to AWS

Go to AWS Management Console →→ Certificate Manager

➤ Upload server certificate (CA, public cert, and private key)

➤ Upload client certificate

➤ Copy the ARN values for later use

Step 5 – Create the Client VPN Endpoint

Go to VPC → Client VPN Endpoints → Create

➤ Select the server certificate ARN

➤ Set client CIDR range, e.g., 10.100.0.0/22

➤ Enable Split-tunnel if desired

After creation :

➤ Add authorization rule to allow VPC CIDR 10.0.0.0/16

➤ Associate VPN Endpoint with private subnet

Step 6 - Download Configuration and Connect

➤ Download the .ovpn configuration file ➤ Embed client certificates inside the file. ➤ Open SSH from EC2 to 10.100.0.0/22

Open AWS VPN Client on your laptop Import configuration and click Connect

DNS Filter IP

185.228.168.168
185.228.169.168

1.1.1.3
1.0.0.3

AWS

 We need to understand the following concept .

1. VPC

2. Subnets

3. Internet Gateway 

4. Route table 

5. Security group 

6. Ec2

7. Nat Gateway.

Steps to create and set up a VPC in AWS:

1. create a own vpc

2. create a public and private subnet for different Availability zone by assigning CIDR blocks.

3. Create Internet Gateway and attach it to the Vpc.

4. Create two Routing Table one as Public and one as private by associating the appropriate subnets to it.

5. Edit the Public route Table's Route alone and map the Internet Gateway, not the Private one and leave it as it is.

6. Create two security groups- one for public and one for private then edit the public security group's inbound rules with RDP, HTTP, HTTPS, SSH and map 0.0.0.0/0 in the source, And then for private security group edit the inbound rules and map the Security group of public in the source.

7. Create two Ec2's one in public and one in private subnets with proper security groups.

8. Login into the public Ec2 instance and check whether it is getting internet connection.

9. Create NAT gateway with new elastic IP for the internet connection in the privat subnet. then Map it to Private Routing table

10. Now login to the private ec2 and verify the connectivity and internet facility.

We need to understand the following concept:

1. Security Engineering (IAM) 

2. Storage Engineering (S3) 

3. Network Engineering (VPC) 

4. Database Engineering (RDS) 

5. Server Engineering (EC2) 

6. Application Engineering

Security Engineering: IAM

What is IAM?

Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM you can create and manage AWS users and groups, and use permissions to allow and deny their acces to AWS resources.

Types of users:

Root user:

Root url:

IAM users:

IAM url:

Practical: 

creating 4 components:

1. group

2. users

3. policies

4. roles

* 4 types of scenario:

1. user to service

2. service to service

3. user to service to service

4. creating MFA (Multi Factor Authentication)

                                     ELB & ASG --> AWS Service

Types of load balancer: 

1. Classic

2. Application 

3. Network

4. Gateway

Classic load balancer & Auto Scaling:

1. Ec2 Instance (2)

2. Classic Load balancer

3. Launch Template

4. Auto scaling group

#!/bin/bash

yum install httpd -y

service httpd start

echo "IBIKZ-Webserver 1"> var/www/html/index.html

#!/bin/bash

yum install httpd -y

service httpd start

echo "IBIKZ-Webserver 2"> /var/www/html/index.html

ALB 

ELB- Elastic Load Balancer
ASG- Auto Scaling Group

IRCTC website Tatkal

Types of load balancer: 

1. Classic

2. Application 

3. Network

4. Gateway

www.ibikz.com/product

www.ibikz.com/services

1. Ec2 Instance (2)

2. Target Group (2)

3. Application Load balancer

#!/bin/bash

yum install httpd -y

service httpd start

mkdir /var/www/html/prod

echo "prod home page"> /var/www/html/prod/index.html

#!/bin/bash

yum install httpd -y

service httpd start

mkdir /var/www/html/Dev

echo "dev home page"> /var/www/html/dev/index.html

-----------------------------------------------------------------------------------------------------------------------------

1. Elastic ip - static

     public, private

2. Add Drive

3. Add Data

4. Modify drive

5. Snap shot

6. attach the snap shot to another server

Storage Engineering - S3 (simple storage service)

This act like one Drive - Storage and retrieval

What is S3?

* Simple Storage Service, it is unstructured manner of storing, process and retraival of data.

* It is a storage on the Internet.

* It can be accessed anywhere and anytime from anywhere on the web.

* It also act as a Version Control System by having the feature called versioning.(Git)

Benefits:

Availability - 99.9%

Durability 99.9999999%

-

upto 5TB data can be stored under 1 object

upto 100 object can create in 1 bucket 

limitation we can't install any application or OS

volume is rural and s3 is global

Bucket --> max 100

object> It can be any format, max size of 5TB

It is a Global service.

Functions of S3:
It is a storage unit.

Collections of object.

It is a single level container, can cointain multiple folders, or objects can be placed directly.

Upload and Download can be easier

Name of the bucket should be globally unique.

Allows max 100 bucket per user

Data kept secured from unauthorized access through authentication machanism.

Docker and kubernetes

Docker Containerization

Containerization is a lightweight virtualization technology alternative to hypervisor virtualization.

any application can be bundled in a container that can run without any worries about dependencies, Libraries, and binaries.

containers are designed to run on any physical server, virtual machine, and cloud instance.

Virtualization Vs Containerization

Virtualization technology allows us to have multiple operating systems to share a single hardware processor.

Containerization is application-specific virtualization, because it provides applications with dedicated environments in the form of containers to run on, which can be deployed and run anywhere without a dedicated virtual machine with the operating system for each application.

also, the container was designed to solve modern problems and application management issues. so it is not a replacement for virtualization, but it is complementary to it.

Advantages of Containerization

Containers are isolated, don't require an operating system, and share a host kernel. so containers run on the same server and use the same resource. they do not interact with each other because its isolated, if one application crashes, other containers with the same application will keep running without any issues.

It's a portable and lightweight operating system and it contains only the required binaries, dependencies, and libraries to run the application. so it can be moved anywhere easily and run without worrying about compatibility, or dependencies kind of issue.

faster and resource efficient it's very fast to boot because containers are lightweight and start in less than a second since they do not require an operating system boot.

improving scalability and lower costs by allowing more containers in the environment without the need for more servers, containerization increases scalability anywhere from 10 to 100 times that of traditional VM environments.

Introduction to Docker - What is Docker on Containers

Docker is an open-source platform tool designed to manage containers, which allows us to build the application in a container with required libraries, binaries, and dependencies to run the application, ship the contained, and run it anywhere.

                      Docker Architecture and Components

 

     Docker Installation

A few quick notes about Docker:docker-installation-on-ubuntu-article

Multiple containers run on the same hardware

Maintains isolated applications

Enables high productivity

Quick and easy to configure

Before learning about this technology, the first step is to install it. In this article, you’ll learn how to install Docker on Ubuntu. 

Ubuntu:

#sudo apt-get update

#sudo apt-get install docker.io

Verify the docker version 

#docker -v

#lsb_release -a

CentOS/RHEL:

#sudo yum -y install docker

#sudo systemctl start docker;sudo systemctl enable docker

verify the docker version

#docker -v

 

       Open the terminal on Ubuntu.

 

                       sudo apt-get install docker.io

docker -v

sudo systemctl status docker

1, Install all the dependency packages using the following command:

    $ sudo snap install docker

2, Before testing Docker, check the version installed using the following command:

   $ docker --version

3, Pull an image from the Docker hub using the following command:

   $ sudo docker run httpd

      Here, httpd is the docker image present on the Docker hub.

4, Check if the docker image has been pulled and is present in your system using the following  cmd              

    $sudo docker images

5, To display all the containers pulled, use the following command:

   $ sudo docker ps -a

6, To check for containers in a running state, use the following command:

   $ sudo docker ps

    You’ve just successfully installed Docker on Ubuntu!

Necessary comment to operate docker.

sudo docker search httpd

sudo docker pull httpd

sudo docker pull docker.io/exasol/nagios-monitoring

sudo docker images

sudo docker rmi "image id" ( to remove images)

sudo docker system df

sudo docker ps

sudo docker run -d -it --name web httpd

sudo docker exec -it web /bin/bash

sudo docker run -d -it --name web  -p 80:80 httpd

sudo docker stop web

sudo docker stats web

sudo docker events

sudo docker rm web

sudo docker rm -f web

sudo docker top web

sudo docker save imange id > https-backup.tar  (to take image as backup)

scp https-backup.tar ranjith@192.168.2.133:/home/ranjith/ (for SCP)

sudo docker load -i https-backup.tar ( it will load the image from local not in internet)

sudo docker commit "container Id" ( it will commit the image)

sudo docker commit d16a51d08814 customimage:2.1 (to add tag for commited images)

sudo docker run -d -it --name test1 customimage:2.1 /bin/sh ( to login custome image)

sudo docker exec -it  0b4a4fca58d6 /bin/bash ( to exec the custome image and verify)

sudo docker network inspect ff8866d57f1d

sudo docker network ls

ip a

sudo docker port web5

Docker run -i -t centos (to mount os)

docker cp aaca4f3bedb6:/opt/nagios/etc/ /root/Desktop

docker cp /root/Desktop/etc/nagios.cfg aaca4f3bedb6:/opt/nagios/etc/