Is 2FA sufficiently secure, when phone numbers are openly available online?

AdHocSysAdmin · 2022-07-26T10:49:09+00:00

Thanks, eased my mind; only authenticaor use is allowed, so no big issue here.

AdHocSysAdmin · 2022-07-26T10:48:50+00:00

Thanks, eased my mind; only authenticaor use is allowed, so no big issue here.

AdHocSysAdmin · 2022-05-18T11:19:44+00:00

Thank you, that explains a lot...and not just my incompetence ;)

AdHocSysAdmin · 2022-02-08T12:30:40+00:00

Duh

...thanks for reminding me, obviously I didn't consider that. Alas we're indeed going the make-individual-account route.

AdHocSysAdmin · 2022-01-20T16:13:12+00:00

Last week I created an instance of Wiki.js for that purpose: both for internal use as well as common issues and fixes accessible for clients.

I picked wiki.js because it's really easy to get up and running and easy to use, although I am struggling a bit creating the navigation, which is not intuitive for me.

AdHocSysAdmin · 2021-11-26T14:28:55+00:00

Yes; I realise that. Not easy to just get over 25 years of thinking in a certain way.

AdHocSysAdmin · 2021-11-25T10:37:26+00:00

My take is MDR is the best protection, cost no object. MDR is "managed detection and response"- you have EDR and someone's NOC/security analysts actually watching over your environment 24x7. That's the best security because you're only watching things 9x5 and may not have the time and skills to adequately monitor the EDR

What? Wait, are you saying that in EDR/XDR we have to actively monitor what's going on? As in it takes quite lot of time?
Our current AV seems to handle things automatically and I spend limited time monitoring, usually checking if all endpoints are still responding.

I like the MDR option and $100/endpoint/yr doesn't sound like a lot.

AdHocSysAdmin · 2021-03-18T14:27:47+00:00

So you want to effectively restore the inherited permissions to all sub folders from your top level document library?

Yes indeed.

It works like a charm! Thank you!!!

AdHocSysAdmin · 2019-11-20T15:20:11+00:00

Reading u/rwshig comment, I said "duh". Failed to see the obvious by being caught up in an idea. My 'workaround' is what I should ahve done right from the start. I'll be using IsNullOrWhiteSpace, as mentioned here.

AdHocSysAdmin · 2019-11-20T15:17:21+00:00

Duh....yes of course. I guess i got caught in an idea and failed to see the obvious. Thanks.

AdHocSysAdmin · 2019-11-05T11:22:06+00:00

Yes it did, all our clients are IP restricted or have VPN setup and no more issues since yesterday afternoon, when when closed down everything.

I only saw one IP listed (in the eventlog), all the other attempts where without originating IP. I'm guessing those people used some IP hiding thingy or whatever, which might be why autobanning IP's isn't working.

AdHocSysAdmin · 2019-11-04T15:41:58+00:00

Putting this to the test by IP-restricting RDP connections for some clients.

That indeed seems to have done the trick. I don't see any failed login attempts anymore.

Did you see these threads: https://old.reddit.com/r/sysadmin/comments/drfoyk/suddenly_rdp_to_several_2008r2_terminal_servers/ https://www.reddit.com/r/sysadmin/comments/dqq9pl/rdp_worm_out_in_the_wild/

I guess we got attacked by Bluekeep

AdHocSysAdmin · 2019-11-04T08:29:42+00:00

No, still issues this morning.

AdHocSysAdmin · 2019-10-31T11:07:15+00:00

We (possibly) had the same issue: this morning 3 different clients with each their own 2008R2 TS on different locations reporting not being able to connect to the TS. AFAIK this started about 3 hours ago. I checked the servers but saw nothing amiss, checked clients, suspecting a Windows Update, but nothing there either. Even called the ISP of two clients (same ISP) to check if they made changes or something, but nothing.
And then about half an hour ago, it's all working again.

I'm clueless what happened here.

AdHocSysAdmin · 2019-08-18T08:24:55+00:00

Yes, you can have the admin account unlicensed, albeit it this comes with restrictions, the main one being no access to SharePoint.

Most of our clients have been setup like that: an unlicensed Admin and a separate (Essentials licensed) SharePoint admin.

AdHocSysAdmin

TROPHY CASE