In order for a Linux (client) box to communicate with (and perform NTLM auth) a Windows domain controller through a restrictive firewall you would need the following ports opened at a minimum:

udp 53
tcp/udp 88
tcp/udp 135
tcp 139
tcp 389
tcp 445
tcp/udp 464

Once upon a time Splunk had an “EventType” named “Key_Events_On_Hosts” then one day it disappeared. It used to power some reports that I use. So I had to go find it from a backup. Here is the EventType is all it’s naked glory.

( sourcetype="WinEventLog*" OR sourcetype="XmlWinEventLog*" (Type="*Error*" OR Type="*Fail*" OR EventCode=1074 OR EventCode=19 OR EventCode=20 OR EventCode=21 OR Eventcode=1001) ) OR ( 
sourcetype="WindowsUpdateLog" (status="installed" OR status="failure" OR status="restart required") ) 

If you do a lot of scripting then this snippet maybe useful. I use this snippet to change the default password for Splunk Universal Forwarder installations, from the default to random. You don’t actually need to record the password for the forwarder - and it’s easy enough to reset if you do.

@echo off
set pass=
set s=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
set m=0
:loop
set /a n=%random% %% 62
call set pass=%pass%%%s:~%n%,1%%
set /a m=m+1
if not %m%==32 goto loop:
echo %pass%

1. Open Admin command prompt or powershell
2. Remove the unused KMS key: slmgr -upk
3. Install your MAK key: slmgr -ipk XXXX-XXXX-XXXX-XXXX
4. Activate Windows

If you are downloading and opening a lot of documents directly from Firefox. Firefox, by default will write them to disk with read only permission, causing OpenOffice to open them read only. This is annoying if you want to make minor modifications before copying and pasting into a report. The solutions is within Firefox. Go to “about:config” and set “browser.helperApps.deleteTempFileOnExit” to false.