If you want to generate a 22-character random alphanumeric password run the following in a terminal window:

LC_CTYPE=C LC_ALL=C tr -dc "a-zA-Z0-9-_\$\?" < /dev/urandom | head -c 22; echo

Managing backups for virtual machines (VMs) in the cloud is crucial for ensuring data security and continuity. Manually configuring backups for each VM can be time-consuming and error-prone. Thankfully, Azure Policy provides a powerful way to automate and enforce backup configurations. In this guide, I’ll walk through how to automatically configure Azure VM backups using Azure Policy targeting VMs with a specific tag and backing them up to an existing Recovery Services vault. I’ll also show you how to create and assign the Azure Policy using Terraform, a popular Infrastructure as Code (IaC) tool.

Note: Code given in this blog is only tested in LAB Environment so thoroughly test this before you use in your environment.

What We Will Achieve:

1. Tag-Based Targeting: Only VMs with a specific tag will be backed up.
2. Automatic Backup Configuration: VMs will be automatically configured for backup in an existing Recovery Services vault.
3. Enforcement via Azure Policy: We’ll use Azure Policy to enforce this configuration.
4. Terraform Automation: We’ll create and assign the Azure Policy using Terraform.

Step 1: Preparing Your Environment

Before diving into the setup, ensure you have the following:

• Azure Subscription: With the necessary permissions to create and assign policies.
• Recovery Services Vault: Already created in the same region as the VMs you want to back up.
• Tagged VMs: The VMs you want to back up should have a specific tag (e.g., BackupPolicy: Yes).
• Terraform Installed: Make sure you have Terraform installed and configured to work with Azure.

Step 2: Understanding Azure Policy

Azure Policy allows you to enforce organizational standards and assess compliance across your resources. By creating a policy definition, you can ensure that certain configurations, like VM backups, are automatically applied based on specific criteria, such as resource tags.

Step 3: Creating a Custom Policy Definition

Azure Policy definitions are JSON files that describe the policy. For our task, we’ll create a custom policy that:

• Identifies VMs with a Specific Tag: The policy will target VMs that have a particular tag.
• Assigns Them to a Backup Policy: It will configure these VMs to be backed up to a specified Recovery Services vault.

Here’s a sample JSON for the policy definition:

{
  "properties": {
    "displayName": "Configure backup on VMs with a specific tag to a Recovery Services vault",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {
      "tagName": {
        "type": "String",
        "metadata": {
          "description": "The name of the tag that the policy will look for.",
          "displayName": "Tag Name",
          "defaultValue": "BackupPolicy"
        }
      },
      "tagValue": {
        "type": "String",
        "metadata": {
          "description": "The value of the tag that the policy will look for.",
          "displayName": "Tag Value",
          "defaultValue": "Yes"
        }
      },
      "vaultName": {
        "type": "String",
        "metadata": {
          "description": "The name of the Recovery Services vault to back up the VMs to.",
          "displayName": "Recovery Services Vault Name"
        }
      },
      "backupPolicyName": {
        "type": "String",
        "metadata": {
          "description": "The name of the backup policy to apply.",
          "displayName": "Backup Policy Name"
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "equals": "[parameters('tagValue')]"
          }
        ]
      },
      "then": {
        "effect": "DeployIfNotExists",
        "details": {
          "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/properties.friendlyName",
                "equals": "[field('name')]"
              },
              {
                "field": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/properties.policyName",
                "equals": "[parameters('backupPolicyName')]"
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/aaf6465c-3d9a-4d1a-bb4a-2b3d7e18b503"
          ],
          "deployment": {
            "properties": {
              "mode": "Incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                  {
                    "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                    "apiVersion": "2019-06-15",
                    "name": "[concat(parameters('vaultName'), '/Azure/protectionContainers/vmworkload/iaasvmcontainerv2/', field('name'))]",
                    "properties": {
                      "protectedItemType": "Microsoft.Compute/virtualMachines",
                      "policyId": "[parameters('backupPolicyName')]"
                    }
                  }
                ]
              }
            }
          }
        }
      }
    }
  }
}

Step 4: Implementing Azure Policy with Terraform

Now, let’s automate the creation and assignment of this Azure Policy using Terraform.

Step 4.1: Creating the Terraform Configuration

Create a Terraform file (main.tf) with the following configuration:

provider "azurerm" {
  features {}
}

resource "azurerm_policy_definition" "vm_backup_policy" {
  name         = "vm-backup-policy"
  policy_type  = "Custom"
  mode         = "All"
  display_name = "Configure backup on VMs with a specific tag to a Recovery Services vault"
  description  = "This policy configures VMs with a specific tag to be backed up to a specified Recovery Services vault."

  policy_rule = <<POLICY_RULE
{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Compute/virtualMachines"
      },
      {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "equals": "[parameters('tagValue')]"
      }
    ]
  },
  "then": {
    "effect": "DeployIfNotExists",
    "details": {
      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
      "existenceCondition": {
        "allOf": [
          {
            "field": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/properties.friendlyName",
            "equals": "[field('name')]"
          },
          {
            "field": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/properties.policyName",
            "equals": "[parameters('backupPolicyName')]"
          }
        ]
      },
      "roleDefinitionIds": [
        "/providers/microsoft.authorization/roleDefinitions/aaf6465c-3d9a-4d1a-bb4a-2b3d7e18b503"
      ],
      "deployment": {
        "properties": {
          "mode": "Incremental",
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "resources": [
              {
                "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                "apiVersion": "2019-06-15",
                "name": "[concat(parameters('vaultName'), '/Azure/protectionContainers/vmworkload/iaasvmcontainerv2/', field('name'))]",
                "properties": {
                  "protectedItemType": "Microsoft.Compute/virtualMachines",
                  "policyId": "[parameters('backupPolicyName')]"
                }
              }
            ]
          }
        }
      }
    }
  }
}
POLICY_RULE

  parameters = <<PARAMETERS
{
  "tagName": {
    "type": "String",
    "metadata": {
      "description": "The name of the tag that the policy will look for.",
      "displayName": "Tag Name",
      "defaultValue": "BackupPolicy"
    }
  },
  "tagValue": {
    "type": "String",
    "metadata": {
      "description": "The value of the tag that the policy will look for.",
      "displayName": "Tag Value",
      "defaultValue": "Yes"
    }
  },
  "vaultName": {
    "type": "String",
    "metadata": {
      "description": "The name of the Recovery Services vault to back up the VMs to.",
      "displayName": "Recovery Services Vault Name"
    }
  },
  "backupPolicyName": {
    "type": "String",
    "metadata": {
      "description": "The name of the backup policy to apply.",
      "displayName":

 "Backup Policy Name"
    }
  }
}
PARAMETERS
}

resource "azurerm_policy_assignment" "vm_backup_assignment" {
  name         = "assign-vm-backup-policy"
  policy_definition_id = azurerm_policy_definition.vm_backup_policy.id
  scope        = data.azurerm_subscription.primary.id

  parameters = {
    tagName          = "BackupPolicy"
    tagValue         = "Yes"
    vaultName        = "YourRecoveryServicesVaultName"
    backupPolicyName = "YourBackupPolicyName"
  }
}

Step 4.2: Deploying the Terraform Configuration

1. Initialize Terraform: In the directory where you created the main.tf file, run the following command to initialize Terraform:

   terraform init

2. Apply the Configuration: Run the following command to deploy the policy and assignment:

   terraform apply

Terraform will prompt you to confirm the changes. Type yes to proceed.

This will create the custom Azure Policy and assign it to your Azure subscription, automatically configuring backups for any VMs with the specified tag.

Step 5: Monitoring and Compliance

After assigning the policy, Azure will automatically enforce the backup configuration on any existing or newly tagged VMs. You can monitor compliance by navigating to the Compliance section within Azure Policy. This section will show you which VMs are compliant (backed up) and which are not.

With Azure Policy and Terraform, you can automate and enforce backup configurations across your VMs effortlessly. By targeting VMs with specific tags, you ensure that only the necessary resources are backed up, saving costs and improving efficiency. This approach not only simplifies backup management but also ensures that your organizational policies are consistently applied.

By following the steps outlined in this guide, you’ll have a robust, automated backup solution that scales with your Azure environment and is easy to manage with Terraform.

Debloat Windows From Unnecessary Apps and Services

While the script is tried and tested, I would suggest you proceed with caution as it may break things. I have added caveats where to tread carefully in the steps below, so follow the process without fail. If you have an older computer and want to speed up Windows 11, this may help you a lot. But again, do it at your own risk.

1. First, press the Windows key once and type “powershell” in the Windows search bar. From the search results, click on the “Run as Administrator” option on the right pane.

2. Next, copy the below command and paste it into the PowerShell window. After that, hit Enter.
It will automatically clone the Windows debloater script and launch the program within a few seconds.

iwr -useb https://christitus.com/win | iex

3. After executing the command, WindowsDebloater will open up, choose to your liking.

Set up L2TP/IPSec VPN on Windows Server 2019

Introduction

A VPN or Virtual Private Network is used to securely tunnel the data from a local computer to a remote server. You can visualize VPN as a private network distributed across the internet or public network. Using VPN, different devices can securely talk to each other as if they are connected over a private network.

There are various VPN tunneling protocols are available. In this tutorial, we will configure a fresh VPS running Windows Server 2019 as an L2TP over IPSec VPN. L2TP or Layer 2 Tunneling Protocol is a tunneling protocol but it does not provide strong encryption. IPSec comes into picture here, which provides very strong encryption to data exchanged between the remote server and client machine.

We will leverage on Remote and Remote Access Services (RRAS) which provides easy to use interface to configure networking features such as VPN, NAT, Dial-Up Access server, Lan Routing, etc.

Prerequisites

• Cloud VPS or Dedicated Server with Windows Server 2019 installed.
• You must be logged in via Remote Desktop Protocol as an administrative user.

Step 1: Update System

Search for Windows Powershell and open it in Administrative mode by right-clicking and selecting Open as Administrator.

Install Windows update module for Powershell by running the command.

Install-Module PSWindowsUpdate

You may be prompted for confirmation, press Y and enter all the time.
Now get the list of latest updates by running.

Get-WindowsUpdate

Finally, install the updates by running the command.

Install-WindowsUpdate

Once updates are installed, restart the computer by running the command.

Restart-Computer

Step 2: Install Remote Access Role

Open Powershell again in administrative mode and run the following command to install the Remote Access feature with Direct Access and VPN (RAS) and Routing along with management tools.

Install-WindowsFeature RemoteAccess
Install-WindowsFeature DirectAccess-VPN -IncludeManagementTools
Install-WindowsFeature Routing -IncludeManagementTools

Step 3: Configure Routing and Remote Access

Open Server Manager and navigate to Tools >> Remote Access Management.

On the left pane, right-click on your local server and click Configure and Enable Routing and Remote Access.

In Configure and Enable Routing and Remote Access Wizard, select Custom Configuration radio button as we will manually configure the routing and access. Click Next button.

Next, select VPN access and click next to see a summary of the selection.
*NAT is needed if you have 1 NIC connected with Public wan ip

Finally, on clicking Finish button, you will see a prompt to start the Routing and Remote Access Services. Click on the Start Service button.

Step 4: Configure VPN Properties

Now that we have our VPN running, let’s go ahead and configure it. Under the Routing and Remote Access window, on the left pane, right-click on your local server and click Properties.

Navigate to the security tab and click on Allow custom IPSec policy for L2TP/IKEv2 connection and put a very long PSK(Pre-shared key). You can use any tool to generate a random key.

Make sure to note down the PSK as we will need to share the PSK with every user who wants to connect to the VPN server.

Now, go to IPv4 tab and under IPv4 address assignment select static address pool. Click Add button and you will get a pop up to put IP address ranges. Put the starting address and ending address of the IP address range you want the users to assign to.

Click the OK button to save the address range and finally click OK to save the changes. You may get a warning saying you need to restart the Routing and Remote Access for changes to apply, you can safely click OK and ignore it for now as we will restart the service after completing next step.

Step 5: Restart Routing and Remote Access

On the left pane of Routing and Remote Access window, right-click on your local server and click on Restart under All Tasks.

This will restart the Routing and Remote Access services and all the changes we have made will be applied.

Step 6: Configure Windows Firewall

On the start menu, search for Windows defender firewall and open it. Click on Advanced settings on windows defender firewall.

Under Advanced setting, click on Inbound Rules on the left pane and then click on New Rule on right side pane.

Windows Server 2019 has predefined rules which we need to enable for VPN to work. In New Inbound Rule Wizard click on Predefined radio button and select the Routing and Remote Access from the drop-down.

Under Predefined Rules select Routing and Remote Access(L2TP-In) checkbox and click Next.

Under Action select, the option Allow the connection and click Finish.

The firewall is now configured to allow inbound traffic on UDP port 1701.

Step 7: Configure Internet Facing Firewall

On the Firewall facing the Internet you will need to open the ports for the traffic to pass through.

To allow L2TP w/ IPSec traffic, open UDP ports 500, 1701 & 4500

In the below image you will see an example from a pfSense firewall (the server which holds the Remote Access Role has the ip: 172.21.29.21

Step 8: Allow VPN User to Connect

On your VPN users properties, navigate to Dial-in tab. Now, select Allow access option for Network Access Permissions setting. Click OK to save the properties.

Our L2TP/IPSec VPN server is now ready and can accept the connections.

Step 9: Monitoring VPN

Search for Remote Access Management Console in the start menu and open the console. You should see the status of the VPN. If you have followed the tutorial correctly, you will see all green checkmark on all services. You can also view the details of connected clients on this console.

Tip: Deploy with Powershell

Open Powershell and run the below commands which holds configuration.

(In the below command ” c6lWJ%MK=oiKfe” is the PreShared Key)

Add-VpnConnection -Name "NAME OF VPN" -ServerAddress "vpn.server.dk" -TunnelType "L2tp" -AuthenticationMethod MSChapv2 -UseWinlogonCredential -L2tpPsk c6lWJ%MK=oiKfe

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent' -Name 'AssumeUDPEncapsulationContextOnSendRule' -Value "2" -PropertyType DWORD -Force

Requirement: Add the necessary registry setting:

1. Press the Windows Key and R at the same time to bring up the Run box.
2. Type in: regedit and click OK. Click Yes if asked if you’d like to allow the app to make changes to your PC.
3. In the left pane, locate and click the folder: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
4. Click the Edit menu and hover your cursor over New. Click DWORD Value. A new registry will appear in the right pane, named New Value #1.
5. Rename that file: AssumeUDPEncapsulationContextOnSendRule (this is case-sensitive and contains no spaces) and press ENTER.
6. Right-click AssumeUDPEncapsulationContextOnSendRule, then click Modify.
7. In the Value data box, type 2 and click OK.
8. Reboot the computer.

Connect to L2TP/IPsec VPN FROM Mac

Prerequisites

• Mac OS X
• Access to your Mac OS X with admin or a user that has administrator permissions

Step 1 – Log in to Mac OS X

Click on the  icon in the left top corner and click System Preferences

Click on Network

Click on + to add a new interface

Select  VPN via the Interface dropdown list. Select L2TP over IPsec as VPN-type.

Enter the VPN server information.

Once everything is entered/selected click Create

Select VPN (L2TP)in the left menu and enter your VPN information. In our tutorial, we use as example Server Address 193.33.61.185 and we are using Administrator as Account Name.

Click on  Authentication Settings... and enter Password in the password field of your VPN user. In our article, it’s the password of the administrator user of our VPN server followed by the Shared Secret that you have entered in step 5 of this article as Preshared key and click on OK

Click on Advanced...

If your VPN server allows sending your traffic through the server, you can enable this to send all traffic over your VPN connection.

Select Send all traffic over VPN connection to send all traffic over the secure VPN connection.

Step 2 – Connect with VPN

The Mac OS X VPN client is now configured. Click on  Connect to make a connection with your VPN server.

We have made a successful connection to our VPN server via VPN.

Conclusion

Congratulations, you have configured a VPN client on a Mac OS X.

wmic product get name, version, vendor

wmic /output:%USERPROFILE%\DESKTOP\InstalledSoftware.html product get Name, Version /format:htable

Echo Y|WMIC Product Where "Name='<INSERT PRODUCT NAME HERE>'" Call Uninstall

Using MSIEXEC

Programs installed with an .MSI are easy and has two choices:

Uninstall Using the Installation MSI

If you still have access to the .MSI installation file you can simply run:

msiexec /x <PROGRAM NAME HERE>.msi /q

Uninstall Using the App’s GUID

If you don’t have access to the .MSI installation file:

1. Figure out what the GUID of the program is with this Powershell Command:

   get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

2. Either in a CMD window running as an ADMIN or a script running as an ADMIN

   msiexec /quiet /norestart /uninstall {<GUID>}

   like:

   msiexec /quiet /norestart /uninstall {7FCA6452-46F2-452F-A5A7-DAB7DE12D0E6}

Using PowerShell

1. You can use the first two steps in e WMIC method above to determine the exact program nae
2. Use the following commands in a PowerShell running as an admin:

   $app = Get-WmiObject -Class Win32_Product -Filter "Name = '<PROGRAM NAME HERE>'" $app.Uninstall()

Description

Many administrators are familiar with SPF (Sender Policy Framework) as a system to declare and verify who can send emails from a domain. In the fight against spam and phishing, SPF is not enough anymore.

DKIM (DomainKeys Identified Mail) is an email authentication system based on asymmetric cryptographic keys. A sending email server signs the message body and/or headers with a private key. A receiving email server verifies the key signature, checking for changes in the message fields. The additional identity verification includes a data integrity component using the signature keys to ensure the original message is arriving intact.

Applies to:

Office 365 (O365), Exchange Online, DKIM

Implicit DKIM Signing in Office 365

Administrators with domains on an Office 365 tenant already have an implicit DKIM signature applied to the tenant domain. The tenant domain is the “.onmicrosoft.com” domain, sometimes called the initial domain. Microsoft does this because it controls the DNS for onmicrosoft.com, publishing the public key and storing the private key on behalf of all subscribed tenants. The implicit signing is the basis of creating an explicit signature for your primary domain, the one without the onmicrosoft.com portion.

Implementing DKIM with Office 365

Preparation

• This article assumes you have access to the Office 365 Admin Center for the tenant domain you are managing.
• You must have access to the domain’s public DNS zone.

Office 365 Admin Center Prep

1. Login to the O365 Admin Center and open the Exchange Admin Center 
2. From the Exchange Admin Center, click on Protection > DKIM 
   
   Click on the domain and notice the right-side information bar shows the status is “Not signing DKIM signatures for this domain”.Click on the Enable link to turn on explicit DKIM signing on the primary domain.
3. Note down the information from the yellow pop-up and add it in a Cname record as described below.

Add Two CNAME Records

Depending on the DNS zone management tool being used, the steps below provide the data needed for adding the CNAME records.

1. Log into the DNS zone management tool for the domain you are working on. 
2. Add two CNAME records with the following information:
   • 1st CNAME Record
     Host Name: selector1._domainkey.<yourdomain>
     Points to: selector1-<domainGUID>._domainkey.<tenantDomain>
   • 2nd CNAME Record
     Host Name: selector2._domainkey.<yourdomain>
     Points to: selector2-<domainGUID>._domainkey.<tenantDomain>

You can also get your DKIM Records by connecting to Exchange Online via Powershell and running this command:
Get-DkimSigningConfig -Identity <domain> | Format-List Selector1CNAME, Selector2CNAME

Enable DKIM Signing for the Domain in Office 365

1. Go back to the O365 Admin Center and open the Exchange Admin Center as shown in Figure 3.
   
2. From the Exchange Admin Center, click on Protection > DKIM as shown in Figure 4.
   
3. Click on the primary domain and notice the right-side information bar shows the status is “Not signing DKIM signatures for this domain” as shown in Figure 5.Since the CNAME records have been added to your domain’s DNS zone the signing of messages for the domain can be enabled. Click on the Enable link to turn on explicit DKIM signing on the primary domain.
   

How to Create a Master Installation Flash Drive with Multiple Versions of Windows

You’ve got your collection of Windows ISOs and maybe you’ve burned installation DVDs or flash drives for them. But why not make yourself a master installation drive that you can use to install any version of Windows?

Setting up a bootable USB Drive that includes multiple ISOs is actually pretty easy, We’re going to do it using a clever little free tool named WinSetupFromUSB, so go ahead and download the latest version of that. You can even include some non-windows ISOs on the disk, like Linux distributions and antivirus rescue disks. For a complete list of what you can include on your USB drive, check out their supported sources page. There is one important note from that page worth calling out. The tool works with single Windows ISOs from Microsoft. If you have a dual ISO that includes both the 32-bit and 64-bit versions of Windows, you won’t be able to use it. But you can always download single ISOs (one for 32-bit and one for 64-bit) and stick them both on the USB if you need to.

Next, make sure you have blank USB drive big enough to hold all the ISOs you want to install, along with a little extra space. A 16 GB drive should give you enough space for two or three versions of Windows. If you have a 32 GB drive, you should be able to fit all the versions of Windows you could want. If you want to include other ISOs as well, you might need a bigger drive.

WinSetupFromUSB is a portable tool, so there’s no installation. Once you have it downloaded, double-click the archive to extract the files a new folder. If you’re running a 64-bit version of Windows, run the executable with “x64” in the name. If you’re running a 32-bit version of Windows, run the file without the “x64” in the name.

If you already had your USB drive inserted when you launched the tool, it should be listed in the box at the top of the window. If you didn’t have it inserted already, go ahead and plug it in now and then click Refresh.

Next, click the “Advanced Options” check box.

Instead of working like a regular check box, clicking it opens an “Advanced Options” dialog box. In the Advanced Options dialog, select the “Custom menu names for Vista/7/8/10/Server Source” check box. This setting allows you to provide your own names for the folders in which the Windows ISOs are stored and the boot menu names you see when you start a computer using the USB drive. You can close the “Advanced options” dialog when you’re done.

Now comes the somewhat tricky part. You’ll be adding Windows versions one at a time. The first time you add something to the USB drive (and only the first time), you’ll want to make sure that the “Auto format it with FBinst” check box is selected. This lets WinSetupFromUSB format the drive appropriately for booting. If you know you’ll be booting a computer in UEFI mode (or if you’re unsure), then select the “FAT32” option. Otherwise, you can use the “NTFS” option.

Next, select your first Windows ISO. Select the check box next to the “Windows Vista / 7 / 8 / 10 /Server 2008/2012 based ISO” section and then click the browse button (“…”) to its right. Locate and open the ISO you want to add.

If it’s a large ISO and you’re using the FAT32 file system, you may get a notification that the file is too large and will be split in two. That’s fine, so go ahead and click OK.

Double-check that you have the correct USB drive selected at the top of the window and that the right ISO is shown in the box. Then, click “GO.”

If you’re using a large USB drive, you may get a warning asking if you’re sure that’s the drive you want to use. Go ahead and click “Yes.”

If the auto format option is enabled (and it should be for the first ISO you add to a disk), you’ll also get a warning letting you know that the drive will be formatted and anything on it will be erased. Click “Yes” to continue.

WinSetupFromUSB will now format the drive and then pop up a window where you can enter a custom folder name for the ISO that’s between 1 and 7 characters. If you don’t type anything for 30 seconds, the default will be used automatically.

A similar window will now open that lets you type a custom name that should appear in the boot menu. This time, the name can be between 5 and 35 characters, so you have a bit more room to be specific. And again, you have 30 seconds to type a new name before the default is used automatically.

At this point, WinSetupFromUSB will begin creating folders, adding the ISO to your USB drive, and adding the options to the boot menu. This can take several minutes and you can gauge the progress in the window’s status bar.

When WinSetupFromUSB is done, you’ll get a simple “Job done” confirmation window. Click “OK.”

WinSetupFromUSB now returns you to the main window. You can exit the program or you can continue adding additional ISOs to your boot disk. You’ll add additional ISOs using the same process, but there are a couple of things to keep in mind as you do it:

• When you add additional ISOs to an existing boot disk, make sure the “Auto format it with FBinst” check box is not selected. It won’t be by default when you return to the window (or when you start the program again), but it doesn’t hurt to make sure. You only want to format the disk with the very first ISO you add.
• You’ll need to click “Advanced Options” and enable the “Custom menu names for Vista/7/8/10/Server Source” check box each time you add a new ISO. Make sure you don’t forget this step before clicking Go or you won’t be able to add a custom name for the ISO to your menu.

But that’s it. Otherwise, just follow the same steps each time you want to add a new ISO to the boot disk. You don’t have to add them all in one session either. You can come back any time and add something new. When you’re done, you can boot up a computer using your USB drive (which you may be able to do even if your BIOS won’t let you) and be rewarded with a nice boot menu like this:

While it doesn’t sport the most intuitive interface, WinSetupFromUSB is lightweight and works well. And once you get the hang of adding ISOs to the package, it’s a breeze to set yourself up with a powerful boot disk that will let you install whatever version of Windows you want, as well as a number of other bootable tools.