# Bad month for Microsoft
**URL:** https://www.twit.community/t/bad-month-for-microsoft/10414
**Category:** Windows
**Created:** [July 21, 2021, 8:12am UTC](https://www.twit.community/t/bad-month-for-microsoft/10414 "2021-07-21T08:12:59Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@big\_D](https://www.twit.community/u/big_D)
#### Post date: [July 21, 2021, 8:13am UTC](https://www.twit.community/t/bad-month-for-microsoft/10414/1 "2021-07-21T08:13:00Z")
After Printnightmare came the Windows Hello zero-day, which allowed a hacker to access any account using PC using a Hello capable camera for authentication (they just needed an infrared image of the user, which could be obtained using any IR camera - E.g. walking past them with the camera, putting a camera in an elevator etc. where the user would pass by). While it would be highly targeted, it is a serious problem.
Now we have Hivenightmare. A bug in a recent(?) Windows update, first noticed in Windows 11 Beta, but also in all versions of Windows 10 in support, allows any user to read key system files, including the SAM password database - passwords are hashed, but there are known workarounds for finding passwords.
There is currently no patch, but you can manually re-apply the correct protection to the files and you will have to manually remove an VSS copies on your system (and generate a new one, if you want to have a recovery point).
**Restrict access to the contents of %windir%\system32\config**
1. Open Command Prompt or Windows PowerShell as an administrator.
2. Run this command: `icacls %windir%\system32\config\*.* /inheritance:e`
**Delete Volume Shadow Copy Service (VSS) shadow copies**
1. Delete any System Restore points and Shadow volumes that existed prior to restricting access to %windir%\system32\config.
2. Create a new System Restore point (if desired).
> **[Shocking New Windows 10 Security Alert As Unpatched Bug Exposes Admin Passwords](https://www.forbes.com/sites/daveywinder/2021/07/21/shocking-new-windows-10-security-alert-as-unpatched-bug-exposes-admin-passwords/)**
>
> Microsoft has confirmed a shocking new vulnerability that exposes admin passwords to any local Windows 10 user
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934)
I’ll also post this over at Thurrott…
Edit: Or not, I’ve tried 5 times to post it there, but it just disappears.
---
### Author:  [@carbonga](https://www.twit.community/u/carbonga)
#### Post date: [July 21, 2021, 4:45pm UTC](https://www.twit.community/t/bad-month-for-microsoft/10414/2 "2021-07-21T16:45:13Z")
I’ve started watching “Curb your enthusiasm” and cannot get the music out of my head. It’s what I hear every time there’s a bad month of security at Microsoft, just after Capossela’s strong statement last Christmas session.
> [@WW 703: A Capossela Christmas](https://www.twit.community/t/ww-703-a-capossela-christmas/8821/5):
>
> „The world is starting to wake up to the fact that Microsoft is a serious security provider.“ (1:14:15) There were times - and some of them just a few weeks or updates back - in which that thought would have felt ominous and sent shivers through your spine. Wondered what Leo thought in that instant.
(You were right in your comment back then, but still. 😉 )
---
### Author:  [@big\_D](https://www.twit.community/u/big_D)
#### Post date: [July 21, 2021, 4:53pm UTC](https://www.twit.community/t/bad-month-for-microsoft/10414/3 "2021-07-21T16:53:56Z")
Over at Thurrott, people were asking how they can delete the shadow copies.
> **[vssadmin](https://docs.microsoft.com/de-de/windows-server/administration/windows-commands/vssadmin)**
>
> Referenz Artikel für die vssadmin-Befehle, die aktuelle Volumeschattenkopie-Sicherungen und alle installierten schattenkopienwriter und-Anbieter anzeigen.
Vssadmin list shadows
Vssadmin delete shadows /all
The first show which copies exist, the second deletes them. The usual caveats apply, make sure you have system backup, preferably make a new one after deleting the shadow copies.