mandag, 11-12-2023, Fokke Nauta skrev:
> On 11/12/2023 19:16, Paul wrote:
>> On 12/11/2023 6:48 AM, Fokke Nauta wrote:
>>> On 07/12/2023 15:28, Fokke Nauta wrote:
>>>> Hi all,
>>>>
>>>> We have 4 W10 Pro pc's in our local network. They all have access to
>>>> eachothers shares. We have also 2 laptops with W11 pro. They have access
>>>> to the shares of the W10 pc's, but from the W10 pc's we can't access the
>>>> W11 laptops. Trying so we get an error message: Just for one of the
>>>> laptops: Windows cannot access \\HPFOKKE. Error code 0x80070035. The
>>>> network path was not found. The other laptop gave the same message
>>>> (different hostname) and the same error code. I searched on the internet
>>>> and found https://www.partitionwizard.com/partitionmanager/0x80070035.html
>>>> I tried all the tricks, but nothing helped. One of you may have an idea?
>>>>
>>>> Many thanks beforehand.
>>>> With regards,
>>>> Fokke Nauta
>>>
>>> Hi all,
>>>
>>> Well, guess what? I got it working.
>>> My account on the W11 laptop was a Microsoft account, with a username and a
>>> 4 digit code. No password. Though I shared a folder on the laptop, it was
>>> not accessible. I deleted my account and created a new one. Same name, a
>>> local admin account with a password. Not a Microsoft account. And now the
>>> shares are accessible. Never expected this would do the trick.
>>>
>>> Thank you all very much for your help and suggestions.
>>>
>>> With kind regards,
>>> Fokke Nauta
>>
>> While the PIN allows logging into the screen of the computer,
>> I would think logging into "your account at Microsoft" would
>> require the password.
>
> No, it did not. It required a 4 digit login code.
>
>> The password must have been part of
>> the ceremony at some point.
>
> No, it wasn't
>
>> Otherwise, the MSA (which is plastered
>> all over the screen and could appear in screen shots), could be
>> brute-forced if the only main account protection was a PIN on
>> the Microsoft site.
>>
>> janis@gmail.com GMAIL password (strong)
>> janis@gmail.com Different password (strong), used during Windows MSA
>> account setup. (Don't use your GMAIL password when
>> authenticating at Microsoft site.) janis@gmail.com PIN - can be set up,
>> and used, for screen access. A PIN does not have to be
>> four digits, it can be longer A PIN does not have to be
>> digits, it could include letters
>>
>> The PIN is intended for local usage, as far as I know.
>
> That's correct.
>
>> It's not a "roaming on the Internet" level of protection.
>> When you log into the screen, the field should indicate whether
>> it is expecting a PIN or a password.
>
> No, it doesn't. It's just an empty field where you have to type in your
> code.
>
>> It would be expecting a
>> password, if you had avoided all the Microsoft attempts to have
>> you use a PIN.
>>
>> Paul
>
> I updated the W11 Home version to Pro, and I needed to create an
> account. It was a Microsoft account. I couldn't change it, so I created
> the MS account. No choice.
>
look at Rufus
rufus.ie

and apply
how to use rufus to install windows 11 without microsoft account

--
Mvh. Jørgen
[e-mail address is valid]

On 12/11/2023 3:21 PM, Fokke Nauta wrote:
> On 11/12/2023 20:14, ...w¡ñ§±¤ñ wrote:
>> Fokke Nauta wrote on 12/11/23 4:12 AM:
>>> On 11/12/2023 09:52, Graham J wrote:
>>>> Fokke Nauta wrote:
>>>>> On 10/12/2023 20:44, Graham J wrote:
>>>>>> Fokke Nauta wrote:
>>>>>>
>>>>>> [snip]
>>>>>>>
>>>>>>> I filled in when connecting to the W11 laptop, the user name and the password, but this did not work. Wrong username or password. Perhaps because it's a MS account, not a password but a 4 digit code.
>>>>>>
>>>>>> When you created the MS account you also created BOTH a password AND a 4-digit code.
>>>
>>> No, only a 4 digit code.
>>>
>>>> You should have kept notes of what you did.
>>>>>
>>>>> Of course I know what these are.
>>>>
>>>> If you know what the password is, why not try it?
>>>>
>>>>
>>>
>>> I only have the 4 digit code and it was not accepted.
>>>
>>> Fokke
>>
>> You have both if you created a PIN in Windows 11.
>>   - i.e. can't create a PIN for an MSA without having created the MSA Windows logon account with a username and password.
>
> No. The only option was to create a Microsoft account. With an user name and a 4 digit pin code. There was no option to create a normal user local admin account.
>
>> You should be past this point.
>>   The username/pw or PIN only works for accessing another device and its shares when that username/pw/PIN exists on the device being accessed.
>>   - i.e. the accessed device needs authorization from an admin account on the device.
>>
>>
> Fokke

If you look at User Accounts, and you look at "Manage Other Accounts',
you can see a summary of the accounts, and... whether they
belong to the Administrators Group or not.

[Picture]

https://i.postimg.cc/t4d93Srb/account-summary.gif

Belonging to the Administrators Group, is like being the Administrator.

whoami /user /priv # Do this in ordinary Terminal window
# Do this in Administrator Terminal window
# Compare the results

The Impersonate Privilege, is one of the main levers of the
Administrator Group privileges. That's how you can elevate
to SYSTEM or TrustedInstaller (with some effort).

Paul

On 12/11/2023 2:59 PM, Fokke Nauta wrote:

> I updated the W11 Home version to Pro, and I needed to create an account. It was a Microsoft account. I couldn't change it, so I created the MS account. No choice.
>
> Fokke
>

I've only run into one case, where there was no "bypass"
available for this.

For example, if it asks for an account, enter

a@a.a

and the Microsoft server will tell you there is
something wrong with your choice, and would you
kindly make a local account now.

Paul

On Mon, 11 Dec 2023 12:48:54 +0100, Fokke Nauta <usenet@solfon.nl>
wrote:

>I deleted my account and created a new one. Same name, a local admin
>account with a password. Not a Microsoft account. And now the shares are
>accessible. Never expected this would do the trick.

For security reasons, you can use the same normal user who does not
have administrator rights on all computers, but this depends on your
risks.

Microsoft is adding one complexity after another. It's only going to
get worse.
My solution: I now only have one powerful Windows machine and use it
remotely (Chrome Remote Desktop or Remmina-RDP via Wireguard).

My other computers (for remote access) are all Chrome OS Flex. This is
much easier. They support SMB on LAN or via Wireguard, but I try to
avoid that. Google Drive runs fine on Windows and of course Chrome OS.

Regards

M.

Michael Logies wrote:
> On Mon, 11 Dec 2023 12:48:54 +0100, Fokke Nauta <usenet@solfon.nl>
> wrote:
>
>> I deleted my account and created a new one. Same name, a local admin
>> account with a password. Not a Microsoft account. And now the shares are
>> accessible. Never expected this would do the trick.
>
> For security reasons, you can use the same normal user who does not
> have administrator rights on all computers, but this depends on your
> risks.
>
> Microsoft is adding one complexity after another. It's only going to
> get worse.

[snip]

It is (just) possible to set up a Windows PC from scratch without using
a Microsoft Account - but you may have to research quite deeply.

Compare that with Apple. Since the arrival of OSX (I think) it hasn't
been possible to set up any sort of Apple Mac without using an "Apple
ID". Awkward if you want to use it where there is no internet
connection. (Which is as true now in some parts of rural England as it
used to be in third-world countries.)

--
Graham J

On 11/12/2023 20:59, Char Jackson wrote:
> On Sun, 10 Dec 2023 12:20:34 +0100, Fokke Nauta <usenet@solfon.nl> wrote:
>
>> And the router is configured in such way, that all pc's and the laptops
>> will get a fixed IP address, depending from their host name.
>> That's also for my mobile phone, but somehow it gets a different IP
>> address from the address that was configured.
>
> Mobile phones can be configured to offer a randomized MAC address to the DHCP
> server (your fritz box router). The IP address that gets handed out to the phone
> is based on that MAC address. If you want the phone to get the same address
> every time, you'll need to disable the randomized MAC feature.
>
> On Android phones, the randomized MAC feature is configured separately for each
> WiFi network. I can't tell you how or if iPhones act the same way.
>
> On Android, you'd go to Settings, Connections, <select your WiFi connection>,
> tap the gear icon, tap 'View more', then look for 'MAC address type'. It
> probably says 'Randomized MAC'. Tap it to change it, if you like.
>

Thanks.
I found it on my Android phone and changed it to a fixed MAC address.
But on the router they get a fixed IP address, based on the host name. I
can not fiil in the MAC addresses, unfortunately.

Fokke

On 11/12/2023 22:26, Jørgen Nielsen wrote:
> mandag, 11-12-2023, Fokke Nauta skrev:
>> On 11/12/2023 19:16, Paul wrote:
>>> On 12/11/2023 6:48 AM, Fokke Nauta wrote:
>>>> On 07/12/2023 15:28, Fokke Nauta wrote:
>>>>> Hi all,
>>>>>
>>>>> We have 4 W10 Pro pc's in our local network. They all have access to
>>>>> eachothers shares. We have also 2 laptops with W11 pro. They have access
>>>>> to the shares of the W10 pc's, but from the W10 pc's we can't access the
>>>>> W11 laptops. Trying so we get an error message: Just for one of the
>>>>> laptops: Windows cannot access \\HPFOKKE. Error code 0x80070035. The
>>>>> network path was not found. The other laptop gave the same message
>>>>> (different hostname) and the same error code. I searched on the internet
>>>>> and found https://www.partitionwizard.com/partitionmanager/0x80070035.html
>>>>> I tried all the tricks, but nothing helped. One of you may have an idea?
>>>>>
>>>>> Many thanks beforehand.
>>>>> With regards,
>>>>> Fokke Nauta
>>>>
>>>> Hi all,
>>>>
>>>> Well, guess what? I got it working.
>>>> My account on the W11 laptop was a Microsoft account, with a username and a
>>>> 4 digit code. No password. Though I shared a folder on the laptop, it was
>>>> not accessible. I deleted my account and created a new one. Same name, a
>>>> local admin account with a password. Not a Microsoft account. And now the
>>>> shares are accessible. Never expected this would do the trick.
>>>>
>>>> Thank you all very much for your help and suggestions.
>>>>
>>>> With kind regards,
>>>> Fokke Nauta
>>>
>>> While the PIN allows logging into the screen of the computer,
>>> I would think logging into "your account at Microsoft" would
>>> require the password.
>>
>> No, it did not. It required a 4 digit login code.
>>
>>> The password must have been part of
>>> the ceremony at some point.
>>
>> No, it wasn't
>>
>>> Otherwise, the MSA (which is plastered
>>> all over the screen and could appear in screen shots), could be
>>> brute-forced if the only main account protection was a PIN on
>>> the Microsoft site.
>>>
>>> janis@gmail.com GMAIL password (strong)
>>> janis@gmail.com Different password (strong), used during Windows MSA
>>> account setup. (Don't use your GMAIL password when
>>> authenticating at Microsoft site.) janis@gmail.com PIN - can be set up,
>>> and used, for screen access. A PIN does not have to be
>>> four digits, it can be longer A PIN does not have to be
>>> digits, it could include letters
>>>
>>> The PIN is intended for local usage, as far as I know.
>>
>> That's correct.
>>
>>> It's not a "roaming on the Internet" level of protection.
>>> When you log into the screen, the field should indicate whether
>>> it is expecting a PIN or a password.
>>
>> No, it doesn't. It's just an empty field where you have to type in your
>> code.
>>
>>> It would be expecting a
>>> password, if you had avoided all the Microsoft attempts to have
>>> you use a PIN.
>>>
>>> Paul
>>
>> I updated the W11 Home version to Pro, and I needed to create an
>> account. It was a Microsoft account. I couldn't change it, so I created
>> the MS account. No choice.
>>
> look at Rufus
> rufus.ie
>
> and apply
> how to use rufus to install windows 11 without microsoft account
>

That's a good idea!

Fokke

Fokke Nauta wrote:

[snip]

>
> Thanks.
> I found it on my Android phone and changed it to a fixed MAC address.
> But on the router they get a fixed IP address, based on the host name. I
> can not fiil in the MAC addresses, unfortunately.

So get a proper router. Your Fritz!box is a horrible product.

--
Graham J

Fokke Nauta wrote on 12/11/23 1:21 PM:
> On 11/12/2023 20:14, ...w¡ñ§±¤ñ wrote:
>> Fokke Nauta wrote on 12/11/23 4:12 AM:
>>> On 11/12/2023 09:52, Graham J wrote:
>>>> Fokke Nauta wrote:
>>>>> On 10/12/2023 20:44, Graham J wrote:
>>>>>> Fokke Nauta wrote:
>>>>>>
>>>>>> [snip]
>>>>>>>
>>>>>>> I filled in when connecting to the W11 laptop, the user name and
>>>>>>> the password, but this did not work. Wrong username or password.
>>>>>>> Perhaps because it's a MS account, not a password but a 4 digit code.
>>>>>>
>>>>>> When you created the MS account you also created BOTH a password
>>>>>> AND a 4-digit code.
>>>
>>> No, only a 4 digit code.
>>>
>>>> You should have kept notes of what you did.
>>>>>
>>>>> Of course I know what these are.
>>>>
>>>> If you know what the password is, why not try it?
>>>>
>>>>
>>>
>>> I only have the 4 digit code and it was not accepted.
>>>
>>> Fokke
>>
>> You have both if you created a PIN in Windows 11.
>>   - i.e. can't create a PIN for an MSA without having created the MSA
>> Windows logon account with a username and password.
>
> No. The only option was to create a Microsoft account. With an user name
> and a 4 digit pin code. There was no option to create a normal user local
> admin account.
>
>> You should be past this point.
>>   The username/pw or PIN only works for accessing another device and
>> its shares when that username/pw/PIN exists on the device being accessed.
>>   - i.e. the accessed device needs authorization from an admin account
>> on the device.
>>
>>
> Fokke

Windows 11 does not immediately provide the option to create a Local
account on first use.
Not asking about a Local Admin account, one can not create a MSA without
a password.

A new Windows 11 logon with an existing MSFT account email address(which
already would have a username/pw) can be used.

Optionally an email address(not a MSA) can be used as username or once
can create a new outlook.com address - once entered, the 'Finish' option
is available.
- 'Finish' initially sets up the account, not the entire profile. The
finale logon profile is setup/built after a successful logon.
... => On the first logon a password creation/entry is necessary and
the option to create a PIN(Windows Hello). Once done, the account's full
profile and folder/subfolder structure is built.

Not possible to create a **new** account with just a username and PIN

--
....w¡ñ§±¤ñ

On Tue, 12 Dec 2023 08:44:01 +0000, Graham J <nobody@nowhere.co.uk>
wrote:

>Fokke Nauta wrote:
>
>[snip]
>
>>
>> Thanks.
>> I found it on my Android phone and changed it to a fixed MAC address.
>> But on the router they get a fixed IP address, based on the host name. I
>> can not fiil in the MAC addresses, unfortunately.
>
>So get a proper router. Your Fritz!box is a horrible product.

I have a TP-link AX1800 router that I'm happy with, so I'm not
looking for anything new. But I never know what the future may bring
and what I might be looking for.

So let me ask why you say "Your Fritz!box is a horrible product." I've
never heard of Fritz!box before, so I have no opinions about it. Why
do you think it's horrible?

Ken Blake wrote:

[snip]

> I have a TP-link AX1800 router that I'm happy with, so I'm not
> looking for anything new. But I never know what the future may bring
> and what I might be looking for.
>
> So let me ask why you say "Your Fritz!box is a horrible product." I've
> never heard of Fritz!box before, so I have no opinions about it. Why
> do you think it's horrible?

One of your posts said that the computer name was FOKKE.fritz.box which
suggests that it is connected to a Fritz!box router.

The primary problem is that the Fritz!box cannot be configured to
respond to ping from the internet. In Britain many ADSL and VDSL
connections (in rural areas) are very unreliable, and I have found it
necessary to use a monitoring service such as
<https://f8lure.mouselike.org/auth.asp> to record graphs of the
connection failures. This gives ammunition to challenge the ISP to get
the service repaired and made more reliable.

Also, I prefer the Vigor routers that provide a LAN-to-LAN VPN
capability and several monitoring and management tools.

--
Graham J

On 12/12/2023 3:44 AM, Graham J wrote:
> Fokke Nauta wrote:
>
> [snip]
>
>>
>> Thanks.
>> I found it on my Android phone and changed it to a fixed MAC address.
>> But on the router they get a fixed IP address, based on the host name. I can not fiil in the MAC addresses, unfortunately.
>
> So get a proper router.  Your Fritz!box is a horrible product.

In the router industry, there is sharing of commercial firmware
for them. One firmware company makes code for around a hundred
router models coming from different companies.

This means, when you see a thousand router models for sale,
there might be less variation in their runtime behavior, than
a thousand firmware developers all working on code.

One USENETter who was having problems, the box he was sold
had the "test firmware not for production" warning when
you were viewing the web setup. That means the hardware manufacturer
used the bringup kit the chipset maker produced, without
modifying it. And as a bonus, that firmware was "functional"
and had a LOT of security problems. I could log into it
from out here on the Internet :-)

The very worst routers, really can give the industry
a bad name. But anything which is name-brand, there are
staff tasked with plugging security holes when a CVE shows up.

If a router has sufficient RAM and NAND flash, it may be
possible to replace the firmware, with one of the free versions.
I'm not saying this is necessary in this case, and that would
only be for situations where the original firmware was
very very bad (like the one I could log into from the Internet
using the default password, and it was like the owner of the
box had purchased hardware but "got no firmware at all").

Paul

On Tue, 12 Dec 2023 08:44:01 +0000, Graham J <nobody@nowhere.co.uk>
wrote:

> Your Fritz!box is a horrible product.

Fritzboxes are excellent products and market leaders in Germany for
good reason. For me, a Fritzbox is not only an ADSL router (100 down
/40 Mbit up/s) incl. wireguard server, but also the telephone system
of my dental practice. The fact that the Fritzbox does not respond to
ping is a security feature. Failure to respond to pings cannot be
exploited in court. Anyone in Germany who wants to prove faults in
their Internet connection in order to get money back from the provider
uses the software of the Federal Network Agency, which creates the
corresponding logs:
https://www.bundesnetzagentur.de/DE/Vportal/TK/InternetTelefon/Stoerung/start.html

Regards

M.

On 12/12/2023 17:00, Graham J wrote:
> Ken Blake wrote:
>
> [snip]
>
>
>> I have  a TP-link AX1800 router that I'm happy with, so I'm not
>> looking for anything new. But I never know what the future may bring
>> and what I might be looking for.
>>
>> So let me ask why you say "Your Fritz!box is a horrible product." I've
>> never heard of Fritz!box before, so I have no opinions about it. Why
>> do you think it's horrible?
>
> One of your posts said that the computer name was FOKKE.fritz.box which
> suggests that it is connected to a Fritz!box router.

That's correct.

> The primary problem is that the Fritz!box cannot be configured to
> respond to ping from the internet.

Didn't know this.

> In Britain many ADSL and VDSL
> connections (in rural areas) are very unreliable, and I have found it
> necessary to use a monitoring service such as
> <https://f8lure.mouselike.org/auth.asp> to record graphs of the
> connection failures.  This gives ammunition to challenge the ISP to get
> the service repaired and made more reliable.
>
> Also, I prefer the Vigor routers that provide a LAN-to-LAN VPN
> capability and several monitoring and management tools.
>
>

I'm pretty happy with my fritz box router. It works well.

Fokke

On 11/12/2023 22:39, Paul wrote:
> On 12/11/2023 3:21 PM, Fokke Nauta wrote:
>> On 11/12/2023 20:14, ...w¡ñ§±¤ñ wrote:
>>> Fokke Nauta wrote on 12/11/23 4:12 AM:
>>>> On 11/12/2023 09:52, Graham J wrote:
>>>>> Fokke Nauta wrote:
>>>>>> On 10/12/2023 20:44, Graham J wrote:
>>>>>>> Fokke Nauta wrote:
>>>>>>>
>>>>>>> [snip]
>>>>>>>>
>>>>>>>> I filled in when connecting to the W11 laptop, the user name and the password, but this did not work. Wrong username or password. Perhaps because it's a MS account, not a password but a 4 digit code.
>>>>>>>
>>>>>>> When you created the MS account you also created BOTH a password AND a 4-digit code.
>>>>
>>>> No, only a 4 digit code.
>>>>
>>>>> You should have kept notes of what you did.
>>>>>>
>>>>>> Of course I know what these are.
>>>>>
>>>>> If you know what the password is, why not try it?
>>>>>
>>>>>
>>>>
>>>> I only have the 4 digit code and it was not accepted.
>>>>
>>>> Fokke
>>>
>>> You have both if you created a PIN in Windows 11.
>>>   - i.e. can't create a PIN for an MSA without having created the MSA Windows logon account with a username and password.
>>
>> No. The only option was to create a Microsoft account. With an user name and a 4 digit pin code. There was no option to create a normal user local admin account.
>>
>>> You should be past this point.
>>>   The username/pw or PIN only works for accessing another device and its shares when that username/pw/PIN exists on the device being accessed.
>>>   - i.e. the accessed device needs authorization from an admin account on the device.
>>>
>>>
>> Fokke
>
> If you look at User Accounts, and you look at "Manage Other Accounts',
> you can see a summary of the accounts, and... whether they
> belong to the Administrators Group or not.
>
> [Picture]
>
> https://i.postimg.cc/t4d93Srb/account-summary.gif
>
> Belonging to the Administrators Group, is like being the Administrator.
>
> whoami /user /priv # Do this in ordinary Terminal window
> # Do this in Administrator Terminal window
> # Compare the results
>
> The Impersonate Privilege, is one of the main levers of the
> Administrator Group privileges. That's how you can elevate
> to SYSTEM or TrustedInstaller (with some effort).
>
> Paul

Wasn't able to get the command prompt without admin rights.

Fokke

On Tue, 12 Dec 2023 16:00:40 +0000, Graham J <nobody@nowhere.co.uk>
wrote:

>The primary problem is that the Fritz!box cannot be configured to
>respond to ping from the internet.

Reading the documentation that`s wrong:
https://fritzhelp.avm.de/help/de/FRITZ-Box-Fon-WLAN-7490/1und1/021/hilfe_filter_stealth_mode

>Also, I prefer the Vigor routers that provide a LAN-to-LAN VPN
>capability and several monitoring and management tools.

Fritzboxes have included:
DynDNS
VPN (IPSec)
VPN (Wireguard, which I use with a Fritzbox 7490, works great, on
Windows, Android, iOS, ChromeOS)

A lot of monitoring is also included.

Biggest Plus for a Fritzbox is that they are supported for a minimum
of 5 years, often longer. My Fritzbox 7490 was introduced in April
2013 and got Wireguard with an update a few months ago. The 7490 was
the top model at the time and is still used by many small businesses
in germany.

Regards

M.

On 12/12/2023 3:29 PM, Fokke Nauta wrote:

>> Belonging to the Administrators Group, is like being the Administrator.
>>
>>     whoami /user /priv   # Do this in ordinary Terminal window
>>                          # Do this in Administrator Terminal window
>>                          # Compare the results
>>
>> The Impersonate Privilege, is one of the main levers of the
>> Administrator Group privileges. That's how you can elevate
>> to SYSTEM or TrustedInstaller (with some effort).
>>
>>      Paul
>
> Wasn't able to get the command prompt without admin rights.
>
> Fokke

[Picture]

https://i.postimg.cc/63z9DcSR/terminals-user-priv.gif

Paul

On Tue, 12 Dec 2023 16:00:40 +0000, Graham J <nobody@nowhere.co.uk>
wrote:

>Ken Blake wrote:
>
>[snip]
>
>
>> I have a TP-link AX1800 router that I'm happy with, so I'm not
>> looking for anything new. But I never know what the future may bring
>> and what I might be looking for.
>>
>> So let me ask why you say "Your Fritz!box is a horrible product." I've
>> never heard of Fritz!box before, so I have no opinions about it. Why
>> do you think it's horrible?
>
>One of your posts said that the computer name was FOKKE.fritz.box which
>suggests that it is connected to a Fritz!box router.

No, that wasn't one of my posts. You're apparently confusing me with
someone else.

>
>The primary problem is that the Fritz!box cannot be configured to
>respond to ping from the internet. In Britain many ADSL and VDSL
>connections (in rural areas) are very unreliable, and I have found it
>necessary to use a monitoring service such as
><https://f8lure.mouselike.org/auth.asp> to record graphs of the
>connection failures. This gives ammunition to challenge the ISP to get
>the service repaired and made more reliable.
>
>Also, I prefer the Vigor routers that provide a LAN-to-LAN VPN
>capability and several monitoring and management tools.

OK thanks.