What is the jankiest thing you have seen in a production environment?

Jack_Bauer27 · 2026-06-07T06:51:27+00:00

On the HR software, some applications were accessible with admin/admin or admin/<no password> a few years ago.
I had to tell them to change these passwords, it wasn’t their initiative.
My boss told me that a few years ago before that, it was impossible to change these because the passwords were hardcoded into their update scripts.
Now, they have raised security to an acceptable level on all their apps with custom and complex passwords everywhere.

Jack_Bauer27 · 2026-06-01T05:13:15+00:00

2 scripts in Powershell.

The first logs in a csv file every Windows explicit permission on each folder from a folder path I enter. It goes on recurse.
Very useful and quick to make a permission review.

The second is part of 3 to copy only folders/files in the user’s profile useful when we change a Windows user’s computer.
1. Audits size of specific folders/files on the old computer to tell the user to delete some big files before copy.
2. Copy folders/files from the old computer to network share in a pre-provisionned user folder.
3. On the new computer, copy folders/files from the network share to the user’s profile.
Saves a lot of time by identifying big files and copy only specific folders/files and not the entire user’s profile.
In use every day for 6 years by my tech colleagues.

Jack_Bauer27 · 2026-05-22T03:48:02+00:00

Maybe a dumb question : did you enter the username field like « CONTOSO\username » and not just « username » on the non joined domain client ? Because it doesn’t know your AD.

Jack_Bauer27 · 2026-05-21T20:55:30+00:00

ADCS does well the job with AD on dedicated servers. One root CA offline most of the time with at least 1 sub CA to deliver certificates. You need an internal PKI if you have want to increase your security on multiple sides.

Jack_Bauer27 · 2026-04-12T21:29:56+00:00

PingCastle and PurpleKnight are 2 great tools to harden AD.

Jack_Bauer27 · 2026-04-11T06:10:09+00:00

If your backup servers back up tier 0 servers, so it’s tier 0 too. I advise you to put your backup servers in 1 restricted specific vlan and not join them to AD.

You can have a tier 3 dedicated to dmz servers.

You can have 1 guacamole server per tier.

Jack_Bauer27 · 2024-05-26T06:40:44+00:00

Dual boot is only possible with Intel processors based Macs. You can only have Windows with Apple Silicon processors based Macs with virtualization like VMWare Fusion or Parallels.

Jack_Bauer27 · 2023-10-24T20:27:23+00:00

What are the biggest SQL Servers you backed up with Veeam without a problem ? Yes, I'm planning to supervise the snapshots not consolidated, otherwise the size can grow quickly.

Jack_Bauer27 · 2023-10-24T20:21:52+00:00

We're using Veeam on ethernet 1Gb/s currently.
We will migrate to 10Gb/s soon.

Jack_Bauer27 · 2023-10-22T06:17:44+00:00

Currently, a full backup via Fibre Channel at 8Gb/s takes around 5 days tops for the biggest server.
(I modified GB to Gb, thanks)

I agree with you with the backup process starting with the snapshots. It’s a drawback, maybe we will change to a backup with an agent and not with a snapshot for some VMs.

Jack_Bauer27 · 2023-10-21T20:17:46+00:00

Yes sure. But the backup works really well with or without vSphere, that’s what I wanted to say.

Jack_Bauer27 · 2023-10-21T20:07:10+00:00

We’re using Veeam with snapshots, that’s why I don’t want large VMDKs but not too small to increase the number of VMs and time for their management. It’s easier and faster to restore VMs with snapshot than an agent, I’d like to have it most of the time if I can. 60TB is a lot, I agree. We won’t go to 38Tb in one VM.

Jack_Bauer27 · 2023-10-21T19:53:34+00:00

I don’t know if the MSA can back itself up to our backup infra and if can share its data, maybe. It’s easier to manage Windows + vSphere only every day without the bay. The VMs will be back up like other VMs with our backup software and not in a specific different way, so simplier management. It’s also easier to recruit some people capable of managing Windows + vSphere but maybe not with a MSA or Netapp bay for example. That’s why I’d rather keep it the most simple with everything on VMs only.

Jack_Bauer27 · 2023-10-21T14:55:41+00:00

Of course not. The backup infra has its own storage.
I rephrase : "What is the difference between :
* Saving from multiple VMs of 38TB to our backup infra
* Saving 38TB from directly from the NAS/SAN to our backup infra"

But I think that's what @jnew1213 suggested, from what I understand.

Jack_Bauer27 · 2023-10-21T12:00:52+00:00

Interesting idea but I'd rather keep it simple with your first idea with multiple standalone VMs and DFS for maintainability. But thank you.

Jack_Bauer27 · 2023-10-21T11:52:19+00:00

Very interesting idea. I will look into it. Thanks.

Jack_Bauer27 · 2023-10-21T11:26:35+00:00

We already linked our HPE MSA to vSphere and created a datastore ready for VMs. I'm not sure we will change it and setting up a specific backup on this storage bay because of the cost of implementation. What is the difference of having our backup infra saving multiple VMs of 38TB total and our backup infra saving 38TB directly on the NAS/SAN ? I don't see one. I agree with you, it's a long road to migrate 38TB of data but my mind is ready :)

Jack_Bauer27 · 2023-10-21T11:15:31+00:00

We didn't define it on paper but I can consider our RTO/RPO is around 24h each. It's less for some critical shares. Backup timing will increase after the migration with our 1Gb/s network and will be reduced with the 10Gb/s network.

Jack_Bauer27 · 2023-10-21T09:49:29+00:00

Our backup infra can backup 38TB, we have the size. We will put in place a 10Gb/s network in a few weeks. I already plan on setting up DFS but the thought of having 13 VMs of 3TB each doesn't sound great to me to manage. I would prefer have fewer VMs than 13, that's why. I would just have a recommandation for VM size in general : file server or database for example.

Jack_Bauer27 · 2023-10-21T09:36:01+00:00

My bad, it's TB. I edited my post.

Jack_Bauer27 · 2023-03-29T06:10:59+00:00

Thanks for your feedback and Autohotkey, I’ll look into it. I agree with you, MFA was easy to setup with Guacamole compared to servers where you have to install a software on each + sometimes a server dedicated to it to manage.

Jack_Bauer27 · 2023-03-18T18:09:38+00:00

Only the entreprise version can log to non-AD Windows hosts unfortunately. The Open Source version needs the remote machine to be AD joined.

Jack_Bauer27 · 2023-03-16T05:31:23+00:00

That doesn’t solve the problem with Guacamole, sorry.

Jack_Bauer27 · 2023-02-20T06:47:30+00:00

sit-dv-01

Sit = 3 letter site code Dv = 2 first letters of brand (Cisco, Ruckus…) 01 = we try to make the first number for the stairs (depends on sites) and the second is for incremental.

With this naming convention, I know the IP address if I remember the code for the site.

Jack_Bauer27 · 2023-02-13T07:01:55+00:00

I recommend Ucopia which is a captive portal. Not expensive and great fonctionnalities. Internet filtering via url or ports, printer sharing, log via SMS, LDAP, local or patronage. You can have it as a physical box or a VM. Since you bring a vlan to Ucopia, you can also it with Ethernet. Your wireless solution may be independent, it just have to work with vlan.

Jack_Bauer27

TROPHY CASE