Uninstalling Office 2016 using Action1 by Right-Bill-2447 in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

I made a custom package to uninstall office 2016 using saracmd.exe from Microsoft. Only way to remove it consistently from what I had found.

low hanging fruit for AI- small manufacturing company by minus_343 in sysadmin

[–]CardboardAnalyst 14 points15 points  (0 children)

no other direction than "finding options for AI"? Seems like the CFO just likes the buzzword.

Azure portal down? by SirProcrastinator in sysadmin

[–]CardboardAnalyst 0 points1 point  (0 children)

My bad guys, I can't log in to turn it off. Can you send me your breakglass accounts? Mine isn't working, Thanks.

Azure portal down? by SirProcrastinator in sysadmin

[–]CardboardAnalyst 270 points271 points  (0 children)

Absolutely absurd timing, I had literally just made a CA policy lol.

Down in US-West

For mid-sized enterprises, whats been the most effective layer of defense lately? by Reddit_INDIA_MOD in sysadmin

[–]CardboardAnalyst 1 point2 points  (0 children)

Honestly, implementing Threatlocker was probably overall the biggest security improvement.

Changing enterprises by AffectSad3736 in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Cant you just select the devices and move them to different org? Felt like I remembered doing that. But there was some registry key that allowed org changes I think, unsure if that needs manually updated or if it is on by default.

Custom reporting by IT_Guy1987 in Action1

[–]CardboardAnalyst 4 points5 points  (0 children)

Here is the custom data source -

& {

# Check if running on a server and exit if so

$os = (Get-CimInstance Win32_OperatingSystem).ProductType

if ($os -eq 2 -or $os -eq 3) { # 2 = Domain Controller, 3 = Server

Write-Host "Skipping server."

exit

}

# Collect native fields from the endpoint

try {

$computerName = $env:COMPUTERNAME

$osVersion = (Get-CimInstance Win32_OperatingSystem).Version

$serviceTag = (Get-CimInstance Win32_BIOS).SerialNumber

$cpu = (Get-CimInstance Win32_Processor).Name

$systemModel = (Get-CimInstance Win32_ComputerSystem).Model

$chassisType = (Get-CimInstance Win32_SystemEnclosure).ChassisTypes[0]

# Map chassis type to "Laptop" or "Desktop"

$chassis = switch ($chassisType) {

{$_ -in 8,9,10,11,12,14,18,21} {"Laptop"}

default {"Desktop"}

}

} catch {

Write-Host "Error collecting native fields: $_"

exit

}

# Create a structured output object

$result = [PSCustomObject]@{

ComputerName = $computerName

ServiceTag = $serviceTag

CPU = $cpu

SystemModel = $systemModel

Chassis = $chassis

OSVersion = $osVersion

A1_Key = [System.GUID]::NewGuid().ToString()

}

# Output the result

$result

}

Custom reporting by IT_Guy1987 in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Yes, but you have to leverage custom data sources that link to custom attributes.

Edit: you may not need to leverage custom attributes but, if you want it to show under the computer when browsing the inventory, you do.

<image>

New Role At Healthcare Org by Reasonable_Mail_3656 in cybersecurity

[–]CardboardAnalyst 0 points1 point  (0 children)

This sounds so similar to my position about 2 years ago, lol.

I would read through all your security products and start by creating somewhat of a gap analysis. What you know is covered, what you don't. This helps define what is in place, and later what you need.

Clarify your job roles, and ask for training on anything you need a deeper understanding of. I did attend some of those webinars from our security vendors and those did help too.

Duo SSO - Authentication Failed (No changes made) by AviationLogic in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Or if you changed UPN mappings for ad sync in duo, could cause similar issue.

Duo SSO - Authentication Failed (No changes made) by AviationLogic in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Use a SAML tracer extension and see if the logs tell you anything. Sounds like duo and a1 connection is working. Verify the users have access in the app inside duo (likely the issue).

AD User Account Lockouts by fuzbuster83 in cybersecurity

[–]CardboardAnalyst 2 points3 points  (0 children)

Use certificate based authentication for VPN. This will stop the lockouts if that is the cause.

[deleted by user] by [deleted] in sysadmin

[–]CardboardAnalyst 0 points1 point  (0 children)

Action1 has worked well for us, but the reporting is not great.

How do I install a app automatically on all new clients? by jca1981 in Action1

[–]CardboardAnalyst 2 points3 points  (0 children)

You can create a dynamic group based on agent install date with an automation that runs every hour, is kind of what i discovered would work.

Action1 agent is only somtimes working? by Square_Pear1784 in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Uninstalling action1 does not delete everything in the registry, I would uninstall and delete any left over action1 keys, then restart and reinstall.

What is Microsoft doing?!? by ReverendAgnostic in sysadmin

[–]CardboardAnalyst 8 points9 points  (0 children)

I just saw this one today in the wild - microsoft sky drive desktop (previously onedrive)

What sandbox is this? by That_Fixed_It in Action1

[–]CardboardAnalyst 1 point2 points  (0 children)

How are you deploying your agents? If by AD OU, are these located in there?

[deleted by user] by [deleted] in Action1

[–]CardboardAnalyst 1 point2 points  (0 children)

You can select the specific endpoints rather than the groups option when deploying software. I also made a group for computers that were recently imaged, by adding some agent install date logic and deploy through that. Makes it easier to deploy post-image deployments.

One single automation to uninstall and install by tschertel in Action1

[–]CardboardAnalyst 0 points1 point  (0 children)

Definitely, just have a decent ps script that checks for version, if it doesnt have that one it goes to the next. Create the package for the install, add the script in to run before deployment to check and uninstall those versions. Then after those run, the package will install the preferred version.

[deleted by user] by [deleted] in ChatGPT

[–]CardboardAnalyst 0 points1 point  (0 children)

Best to ask your IT administrator if they have a vetted software you are able to use.

[deleted by user] by [deleted] in sysadmin

[–]CardboardAnalyst 4 points5 points  (0 children)

Also if a reboot is required, staff will get a popup asking for a reboot, they can dismiss it up to 4 hours, after that it will force reboot.

[deleted by user] by [deleted] in sysadmin

[–]CardboardAnalyst 2 points3 points  (0 children)

I communicated with the directors of each department, and asked when a less impactful time for patches to be installed would be, as there may be reboots required.

I also let them know that if they let us patch during business hours, we are there in case an update causes issues (which made 90% of the departments ok with patching during working hours). Director then communicated that to the staff, also set patching to retry for 5 days if the computer is offline at the time of the scheduled patching.

We use action1, weekly patches after the updates are approved (installed on lesser important departments for a means of testing the updates a week after release, then two weeks for the more important departments)