CISA BOD 26-04 and KEV catalog

Just posting some CISA links for my own reference.

BOD 26-04: Prioritizing Security Updates Based on Risk | CISA

Known Exploited Vulnerabilities Catalog | CISA

Pi-Hole lists

I have always touted the great benefits I see with Pi-Hole running on my local network. I recently added the Phishtank list to my block lists on my Pi-Hole cluster. Here are all of my lists:

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

https://easylist.to/easylist/easylist.txt

https://adaway.org/hosts.txt

https://v.firebog.net/hosts/AdguardDNS.txt

https://v.firebog.net/hosts/Admiral.txt

https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt

https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts

https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts

https://v.firebog.net/hosts/RPiList-Malware.txt

https://v.firebog.net/hosts/RPiList-Phishing.txt

https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt

https://github.com/Zaczero/pihole-phishtank/blob/main/hosts.txt

My household is pretty small, and we are not huge social media users. The block-rate on the main pi-hole runs about 10% most days.

PRTG jumping on the Grafana Bandwagon

Our friends over at Paessler are jumping on the Grafana bandwagon and providing an improved dashboarding solution. The OpsBoard product has proven to be kind of a mess.

https://blog.paessler.com/how-to-create-multi-core-dashboards-with-prtg-data-exporter-and-grafana

Laptop Fairy

I hope to do something similar someday.

https://www.npr.org/2025/10/09/nx-s1-5527861/tech-fairy-laptop-free

Windows 11 Local User Creation

Seems that creating a new local user in Windows 11 isn't quite as easy as you'd expect. But PowerShell makes it fairly simple. To create a new local "backup/emergency" user you can issue these commands from an Admin PowerShell. Of course, make sure to use a good solid password. The second command will add the user to the local Administrators group.

PS>New-LocalUser -Name BackupUser -AccountNeverExpires
cmdlet New-LocalUser at command pipeline position 1
Supply values for the following parameters:
Password: **********
Name Enabled Description
---- ------- -----------
BackupUser True
PS>Add-LocalGroupMember -Name Administrators -Member BackupUser

It should be noted that is you are looking to utilize Remote Desktop on this machine, it will need to be Windows 11 Pro. You can get that info with this command.

Get-WmiObject win32_operatingsystem | select Caption, Version
Caption Version
------- -------
Microsoft Windows 11 Home 10.0.26100

And, to grab your MAK, there's a command for that too:

(Get-WmiObject -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey 

Passkeys - an explanation

I have been struggling with passkeys lately for a couple of reasons. 

I have been working fully remotely for many years now and enjoy the flexibility of being about to do this work from just about anywhere I have access to a computer with high speed access to the internet. This means that I can almost sit down in any location with any computer and do the majority of my work without any additional software or hardware aside from my cell phone. 

As long as I have access to a web browser, I can do 75% of my daily workload. That means email, Teams, Outlook, and access to a support portal. As you can guess, this requires secure authentication to these services. Secure authentication has changed a LOT over the years and lately it has taken a turn towards "Passkeys". 

Now I don't mind depending on a hardware device such as a phone, FIDO key, or other Authenticator service (app) that exchanges anonymous (random) data to allow access to a system (two factor auth). I do have a problem with a service that holds that data along with other data about me and has control over how that data is shared and who has control over that data (myself or the vendor).

Here is a good explanation of the benfits and pitalls of using these Passkeys along with some alternatives.

https://lucumr.pocoo.org/2025/9/2/passkeys/

PRTG bringing the educational material

I've been supporting PRTG for a while now and I've always had great things to say about the support people behind the application. Their documentation and product support team has always been spot on and up to date. The application itself is also a great tool that has always performed just the way you would expect. There is obviously a great group of people behind the scenes doing something right. 

They also have been pumping out the blog posts recently and one of the latest was a great informative read that really highlights a lot of things that anyone supporting anything in IT should know.

Network Protocols are the backbone of the internet and how everything communicates with everything else. PRTG knows a thing or two about them being a leader in the monitoring field for some time now and they have written a great article explaining them in simple, easy to follow material.

https://blog.paessler.com/network-protocols-list-the-language-of-the-digital-world-explained

Feed Validator

Here's a great way to validate an RSS feed. It allows you to test and validate the feed as well as offering suggestions to make the feed more readable for a wide range of readers.

https://validator.w3.org/feed/ 

Proton Two Factor Auth

 Proton has released its Authenticator App. And there was much rejoicing.

RSS Lookup!

Here is a great tool for looking up RSS Feeds. I have a couple PowerShell scripts built into PowerNews (https://github.com/loatswil/PowerNews) that do this but it's nice to have a much more thorough online version.

https://www.rsslookup.com/

Microsoft Embracing RSS feeds?

Is it possible that Microsoft is once again embracing the RSS feed?

Over the years, RSS feeds have come and gone so often that many of them are no longer valid. They seem to change weekly. I have always been on the hunt for new feeds and even written PowerShell modules that pull them, parse them, and spit out a local page for viewing. It's very easy to tailor the feed to your needs including Blocklists and Allowlists.

For a long time now many people have used a popular social media site to display updates when we already had a simple and easy way to publish this stuff. Now it appears that Microsoft at least is moving away from this social media method and back to RSS. Here's the "new" Azure status link complete with "rssfeed" in the URL. 

https://rssfeed.azure.status.microsoft/en-us/status/feed/

Let's hope it's the start of a new trend.

M365 Forms Admin

How to get information on a Form in M365:

• Open the Form in a browser.
• Open Dev Tools.
• Go to the Network tab.
• Look at the properties for the "response" page and find the UID of the owner.
• The Tenant ID will also be listed first (after the api).

"@odata.context": "https://forms.office.com/formapi/api/xxxxxxxx-xxxxxxxxx-xxxx-xxxxxxxxxxxx/users/xxxxxxxx-xxxxxxxxx-xxxx-xxxxxxxxxxxx/

• Go to this page with the GUI/UID pasted at the end.
• You will need an admin role assigned to a user with a Forms license to access this page.

https://forms.office.com/Pages/delegatepage.aspx?originalowner=xxxxxxxx-xxxxxxxxx-xxxx-xxxxxxxxxxxx

• Here's the Microsoft learn page:

https://learn.microsoft.com/en-us/microsoft-forms/admin-information#form-ownership-transfer

How to clear cache in new Outlook

1. I borrowed part of this post since I didn't want to include classic Outlook.

2. https://www.ablebits.com/office-addins-blog/clear-outlook-cache/

3. *************************************************

4. Clearing cache in the new Outlook for Windows is not as straightforward as in the older versions, but it can still be done with a few steps.
   
   Follow these instructions to clear the cache in the new Outlook for Windows:Close the new Outlook app.
   
   Open the Run dialog by pressing the Windows + R keys together.
   Type or paste the following command in the Run box and click OK:
   
   olk.exe --devtools
   
   Be sure to include a space before the two dashes if typing the command manually.

5. You will need to close Outlook if it's currently open or the DevTools window will not show up.
   

6. 
   The new Outlook will open (you may be prompted to sign in), and the DevTools window will also appear.
   
   In the DevTools window, click the Application button on the toolbar.
   
   Clear local storage cache. In the left pane, under the Storage section, find the https://outlook.office.com link under Local Storage. Right-click on this link and select Clear.
7. Clear cookies. Still in the left pane, locate the https://outlook.office.com link under Cookies, right-click on it and select Clear.
   Close the DevTools window.
   
   Once these steps are completed, the cache for the new Outlook should be deleted, and you can reopen the app for a fresh start. Remember, this process will remove temporary files that may include saved login credentials, so you may need to sign in again after deleting the cache.

Job Description Nightmares

Here are a couple of actual bullet points on job descriptions I have found recently.

Work Experience :10 - 15 years

• Own the definition, design, and delivery of a functional design

So, to break down that sentence, I need to be able to "Own the design of a design".

Here's another great one:

Competencies (Knowledge, Skills, Abilities)

• Advanced accuracy skills

Makes me wonder what a regular accuracy skill might be.

The scheduling section is even better:

Schedule/Attendance

• Ability to work long hours 

I'm sure this would follow OSHA standards, though. Right?

Job hunting is hard enough as it is, but deciphering job descriptions to find a suitable work environment is an art unto itself.

Outlook Startup Options

More times than not, you can fix an Outlook issue by either clearing the cache or starting up with a special switch.

Microsoft allows for many switches that can be run from startup to solves a variety of issues. Here's the link to the page that covers many Microsoft apps.

https://support.microsoft.com/en-us/office/command-line-switches-for-microsoft-office-products-079164cd-4ef5-4178-b235-441737deb3a6#Category=Outlook

Pi IPO on the plate

Can't wait to own part of this valuable resource. I doubt it will be a money-maker, but it's still something worth investing in.

Teams client log prep

Another good article on collecting logs from Teams clients. It's always a good thing to gather logs and this is a great method for Teams.

I've been working with Teams for years and this is the first time I've seen this method. Perhaps it's a new feature.

Basically, just ctrl-alt-shift-1 will prepare a directory with all of the needed files. You can zip it up and send it off to support.

https://learn.microsoft.com/en-us/microsoftteams/log-files
 

Clearing Outlook cache

So, in keeping with the cache clearing theme, here are some instructions on clearing the cache for your local version of Outlook. This can be helpful for a large number of reasons.

• First of all, close Outlook.
• Press the Windows + R keys and enter this command.
• %localappdata%\Microsoft\Outlook
• This will open your Outlook folder containing your RoamCache.
• Open that folder
• Select all of these files and delete them or move them to the Recycle Bin in case you need them later.

Clearing Teams cache

This must be the #1 solution when dealing with a funky Teams client.

Of course, testing things out with a Private/Incognito mode browser is usually the first and easiest way to figure this out. But the next step is to clear the cache.

Clearing the Teams local cache:

https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/teams-administration/clear-teams-cache


 

Creating HAR files for troubleshooting

Here are some great instructions for creating a HAR file for troubleshooting.

https://help.okta.com/oag/en-us/content/topics/access-gateway/troubleshooting-with-har.htm

For Edge:

1. Open Edge.
2. Close all InPrivate windows.
3. Press Ctrl + Shift + N to open a new InPrivate window.
4. Click the Settings and more menu (...) to the right of the toolbar and select More toolsDeveloper tools.
5. Click Network.
6. Ensure that Edge is recording. A red button indicates that a recording is already in progress. Otherwise, click Record network log.
7. Visit the page and complete the steps that trigger the issue.
8. When you're finished, click Stop recording network log.
9. Click Export HAR (the down arrow icon) or press Ctrl + S to export the file as HAR.
10. Save the HAR file.

From Wikipedia:

The HTTP Archive format, or HAR, is a JSON-formatted archive file format for logging of a web browser's interaction with a site. The common extension for these files is .har.

The specification for the HTTP Archive (HAR) format defines an archival format for HTTP transactions that can be used by a web browser to export detailed performance data about web pages it loads. The specification for this format is produced by the Web Performance Working Group of the World Wide Web Consortium (W3C). This document was never published by the Web Performance Working Group and has been abandoned.