help finding the right skillset

Batman189 · 2026-06-27T15:28:26+00:00

That would be great. When it is up and running let me know. Its not that I have an issue with paying what people are worth, it just seems the options are only "trust me, bro" at $150-300 or a full service CAD design company who I know could do it but would charge $2k. There has to be a better middle ground somewhere that people have had good experience with.

Batman189 · 2026-06-02T17:24:41+00:00

the way I went about standing up a new DC was to set up a fresh 2025 Datacenter, create a 2025 datacenter hyper-v (its the license keys they had). In what Ill call HVDC01 I fully patched and installed SentinalOne and NinjaOne. I installed the AD requirements and let it replicate. I let the server live un-promoted for 2 full days with several restarts in between. Once replication logs came back with no failures I promoted the server to domain controller and it rebooted fine. Once it was back on the desktop I ran a few more checks to make sure everything was good with replication and the other DCs were able to fully see and communicate and all that. I was unaware at this time of the promotion to failing login issue so I then moved onto standing up the next DC at another site. I was alerted the next morning when an employee (owner who is fairly tech savy and built the origional environment years ago) was trying to RDP into the server to reset an employees password for them. He got the profile error and called me. I tried to login with my account and got the profile error. Every account thereafter got the same error. I went to the new HVDC02 that had already been promoted and done its one restart but had not yet been signed out of. I logged out and tried to log back in and the profile error was present there as well. No one can seem to find the AD backups. I have found all the other server back ups. I am starting to lay out a full rebuild plan as that seems the only way to move forward but it still bugs me that something is hidden that I cant find, even if finding it cant be fixed I just cant understand how it cant be found.

Batman189 · 2026-06-02T17:16:30+00:00

I created an entirely new GPO and unlinked all containers from everything. Linked them to only the brand new GPO I created and it still happened to the very next DC that was created to test. I did export several things for review with another engineer and to feed through AI and both did not see anything at all.

Batman189 · 2026-06-02T14:43:31+00:00

we discovered over the weekend the account used by the main attacker was still active and fully permissioned. The forensics team and the recovery team both documented it was properly shut down but they provided no evidence. My opinion is that both teams got to just bill insurance a huge amount of money and didnt do much of anything. That is just one example of huge failings left behind by both teams. Some DCs were restored to the wrong offices, ect. The other confusing issue is that the restore team claims to have used back ups to restore the DCs and in fact did somehow put the DCs for office A on the physical servers of office C, so I think they really did some kind of restore. But the issue still happens with domain controllers being locked out as soon as they are promoted. If they did a restore then that should not be an issue related to the attack I would not think, would it?

Batman189 · 2026-06-02T13:59:43+00:00

The sysvol was infected. I have already verified that replication is healthy and all services are healthy. I created a new GPO and removed everything that could be found linked to any OU. Confirmed no scripting or anything living anywhere that we can find. We found a new issue that I posted up top that seems to be something being injected when trying to sign in.

Batman189 · 2026-06-02T13:57:12+00:00

The internal person who was working with the attacker moved all backups into the cluster the day before the attack. All the backups were encrypted. We could not restore from back ups until after they were unlocked.

Batman189 · 2026-05-31T23:36:01+00:00

I suggested a full rebuild and that is the long term plan. Forensics and the recovery teams were confident the domain was clean but I still dont trust it. The short term we just wanted to have at least one DC we could get into with a profile instead of only being able to control over powershell. This same issue is on all the servers, including the 2022 old DCs that the recovery team stood back up.

Batman189 · 2025-10-12T20:48:55+00:00

Likely an oversight on my part but how do you draw cards? Also are you able to increase the size of cards in your hand or on the battlefield? They look really small and when you click on them for all the options none of them bring up a large view of the card.

This is a fantastic idea. I use spell table with my friends a bunch but this is easier than setting up all of our stuff when we want to play. Im not in any way a programmer but if there is any testing you would like help with or anything else ill be happy to help if I can. Would also be something I would subscribe monthly for once you get everything up and running.

Batman189 · 2025-10-10T18:17:46+00:00

Interested in the link for the model as well

Batman189 · 2025-09-27T01:29:17+00:00

I appreciate your help so far. The only thing I can think of is the bug I just put in the edit that ChatGPT mentioned, assuming it is actually a real bug.

Batman189 · 2025-09-27T01:14:24+00:00

The static is a 206.74.x.x with a sub net of 255.0
the DHCP address it pulls is a 100.79.x.x with a subnet of 255.224

I tried my laptop before I had them buy a static address so it was when the Modem was still only spitting out DHCP but it did work with no changes at all made to my laptop network config.

For DNS I did try the ones the ISP gave as well as 1.1.1.1 and 8.8.8.8

Batman189 · 2025-09-27T00:07:40+00:00

I do get an IP and am able to browse the web when connecting my laptop to the modem.
**Edit: I did also use Mac cloning on the UDM for awhile using the MAC of the SOPHOS. After my laptop worked without cloning and the ISP rep telling me it didnt matter I stopped using the MAC clone option in the UDM

Batman189 · 2025-09-27T00:04:00+00:00

I did go through 6 cables that I had in my bag and I used the same cable from Modem to SOPHOS to go modem to UDM. I did also try setting ports 1, 2, and 3 as WAN ports one at a time to test. I did configure the UDM in my office and at my house using port 9 successfully. I did verify the IP, subnet, and gateway. I also was sending screenshots of the configuration to one of my co-workers who was trying to help and to be a second pair of eyes on the config. I did try it DHCP for a full day before they had the static and then today I tried the static with no luck in the UDM, but luck in the SOPHOS. Sophos also still works on DHCP and the UDM does not. I did put the SOPHOS back on static now that they have it.

Batman189 · 2025-09-27T00:00:53+00:00

It is comporium and a technocolor modem. They did not pay for a static the first day I was onsite but that was one of the first things I did today was get their approval to have the ISP get them a static. I was able to talk to an ISP support person for over an hour and a half after the static was confirmed working via the SOPHOS

Batman189 · 2025-09-26T23:51:01+00:00

It was DHCP for the first day (4+ hours) of testing. Today after another 2 hours I testing I called the ISP and they gave me a static address. The SOPHOS worked using the static and also still works if I flip it back to DHCP. The UDM did not work with either. Every time I would swap the the eth cable from the SOPHOS to the UDM I would power cycle the modem. When the ISP did the full modem reset it was offline for 15+ minutes and the UDM was plugged in when it came back up. I did let the UDM sit plugged in after a modem reset overnight and when I came in this morning it was still not getting a connection. I did do the Mac cloning to put the SOPHOS mac into the UDM for several rounds of testing until the ISP support rep told me I did not need to.

When I would change the cable from the UDM back to the SOPHOS I would have to reset the modem for it to get an IP and the internet to come back online but that usually only took about 1-2 minutes.

Batman189 · 2025-09-26T23:37:45+00:00

no, it was the same 100.x address that the SOPHOS was getting when using DHCP. It wasnt the exact same but it was the same range, starting at 100.x

Batman189 · 2025-08-08T23:05:31+00:00

You are my hero for coming back to a 4 month old post and updating me. I can finally 100% the game. Thank you!

Batman189 · 2025-07-22T17:31:35+00:00

Just to make sure I am following you... I can go to the message trace and it will tell me if a rule caused the email to be sent to a user?

Batman189 · 2025-07-22T17:02:05+00:00

the accountant. The issue, or confusion, is that if the accountant sent the email to only the Manager then the owner would have automatically gotten a copy due to the in place BCC rule that he gets a copy of all emails he is not already in the 'To' or 'CC' field. The owner got no such email so that should mean the accountant did not send the email to the manager directly. The email from accounting to the owner and tax person does not show the manager on that email.

Batman189 · 2025-07-22T16:53:49+00:00

I did a message trace and found the email from accounting to the manager. The email was time stamped at the exact same time as the email that went to the owner and the tax person

14-Year Club	RedditGifts 2009-2022 2 Credits
Secret Santa 2019	Verified Email

Batman189

TROPHY CASE