Windows Server on Network Haven

Fixing SCEP Certificate Enrollment over HTTPS on eLux Thin Clients

Wed, 13 May 2026 12:00:00 +0200

Currently we trying out eLux as an replacement of older thin clients with ThinOS or IgelOS. We tried to configure 802.1x authentication and the therefore needed certificate enrollment with our current SCEP/NDES server. We came across the issue that the scep client that eLux uses – sscep – an open source “Simple SCEP client for Unix” doesn’t support certificates requests over HTTPS.

When investigating the problem we found this GitHub issue which explains our problem. Our NDES server was only reachable over HTTPS – both on the administration page and most importantly also on the request web page (certsrv/mscep) where the client requests their certificates.

How to manually import WSUS updates in an air-gapped environment

Tue, 21 Apr 2026 23:10:03 +0200

Since 2023 you could not import updates manually to WSUS. Microsoft offers you a script to download the updates from the update catalog when you provide the UpdateID to the script. The script defaults to localhost if you dont provide the WSUS server. For example:

.\ImportUpdateToWSUS.ps1 -UpdateId 12345678-90ab-cdef-1234-567890abcdef

But this script has a big issue for air-gapped enviroments – it still relies on the microsoft update catalog to download and import it to the WSUS server. But in the background the script just uses the ImportUpdateFromCatalogSite() powershell function. If you look at the parameters, you can parse the UpdateID but also “an array of the local paths where any files required by the update can be found.”

Issue detecting domain network on domain controller when using NIC teaming

Fri, 10 Apr 2026 23:10:03 +0200

We had an issue where our domain controller lost its domain network profile after a reboot. When it came back up it was set to public instead of domain.

The problem occurred only when Windows NIC teaming (switch-independent) was used in combination with two network adapters in the team. As soon as one network adapter was disabled from the team (while the other remained active), the network profile (domain) was recognized correctly.