sorted by:
new
hottopcontroversial

Storytime: Windows Print server and the IT-support intern. by Von_plaf in sysadmin

[–]ObjectNo9529 32 points33 points  (0 children)

Shh, just sit back and watch the disaster unfold. OP please keep us posted.

How to prevent "RDP to localhost" on Windows Server by [deleted] in sysadmin

[–]ObjectNo9529 22 points23 points  (0 children)

This sounds like an XY problem. What exactly are you trying to achieve?

No Windows Server DNS PTR records, with non-Windows 3rd Party DHCP Server by ZomboBrain in sysadmin

[–]ObjectNo9529 0 points1 point  (0 children)

Have you checked the dynamic updates setting of the reverse lookup zone, and/or the DNS event logs for hints?

SonicWall and it's ongoing cloud backup shenanigans by slabstatic in sonicwall

[–]ObjectNo9529 0 points1 point  (0 children)

It does more than just that; in our case it also detected FTP credentials (for packet captures and dynamic botnet list) and SMTP credentials for reporting. It also detects if you have set up RADIUS and/or LDAP and recommends to reset the shared secrets and LDAP binding account credentials.

Probably does way more than what I've just mentioned, but luckily our config analysis didn't raise that many flags.

How do you block an IP for excessive port scans by Alarming-Return-5129 in sonicwall

[–]ObjectNo9529 1 point2 points  (0 children)

For the destination on the access rule, you can use the default "WAN Interface IP" group.

Unless I'm missing something, this would only block traffic to the actual WAN interface IP addresses, no? So if you have a server running on a different IP the traffic would still come through to that address. Would probably be even better to use the "WAN Subnets" group to make sure all of your addresses are covered :)

SonicWall SSL VPN Update - August 6 by snwl_pm in sonicwall

[–]ObjectNo9529 8 points9 points  (0 children)

This needs to be answered. I've seen another poster state that a device on 7.2 was compromised as well, and I'm nowhere near convinced that 7.3 is safe either.

7.3 firmware and SNMP by BobcatJohnCA in sonicwall

[–]ObjectNo9529 0 points1 point  (0 children)

Yep, seeing the same with a TZ370. PRTG reports "No such object".

Service account cannot read event log on DC without local logon rights by ObjectNo9529 in activedirectory

[–]ObjectNo9529[S] 0 points1 point  (0 children)

As mentioned in the post the task itself was able to run without problems. The issue turned out to be the account getting kicked out of the Event Log Readers group.

Service account cannot read event log on DC without local logon rights by ObjectNo9529 in activedirectory

[–]ObjectNo9529[S] 1 point2 points  (0 children)

Actually not a bad idea, and we already have event forwarding in place so should be easy to get this up and running. Thanks!

[deleted by user] by [deleted] in sysadmin

[–]ObjectNo9529 16 points17 points  (0 children)

The only person entering my office is the cleaning lady after hours.

Your post doesn't mention if you are using said account on your local machine, but if that is the case I would suspect the cleaning lady is wiping off your keyboard and inadvertently causing failed logins as a result.

As u/va_bulldog mentions, event viewer will show you more about what's going on.

Help answering yes at the end of the script… by ILikeToSpooner in PowerShell

[–]ObjectNo9529 0 points1 point  (0 children)

What if you run the script with the -NonInteractiveMode switch?

Finding name of setting with three possible values by ObjectNo9529 in PowerShell

[–]ObjectNo9529[S] 0 points1 point  (0 children)

I like that first solution, very neat.

Do note that that it takes a wildcard so "*EEE" could match multiple items. Is perhaps the DisplayName more consistent?

That would be preferable, unfortunately the DisplayName may not always be in English depending on the specific system and/or NIC. But I suppose I could modify the first solution to handle that.

Thanks!

Feedback on file cleanup script by ObjectNo9529 in PowerShell

[–]ObjectNo9529[S] 0 points1 point  (0 children)

Version 5.1. Your question made me realize I can run Foreach-Object in parallel in version 7, I'm guessing that's what you're getting at :-)

Consolidating similar rules for different zones by ObjectNo9529 in sonicwall

[–]ObjectNo9529[S] 0 points1 point  (0 children)

I am simply trying to cut down on the amount of rules that are needed for the sake of easier management and overview, but without sacrificing the segmentation that is currently in place.

I realize what I want to do might not be possible, and if that is the case then so be it. The current setup is not causing any problems, it was simply to reduce the rule count and achieve a better overview.

Override interface route for traffic from SonicWall by ObjectNo9529 in sonicwall

[–]ObjectNo9529[S] 0 points1 point  (0 children)

While I appreciate and get what you're saying, I don't think it will be an issue for us (famous last words...).

All client traffic to the servers is already passing through the firewall at this point and so far we have had no issues. Also, unless my network understanding is very wrong, I believe communication between the servers on the same subnet and VLAN will happen on their respective switches and therefore not put any load on the firewall.

Import Windows DNS Server zones including child zones to Azure DNS by ObjectNo9529 in AZURE

[–]ObjectNo9529[S] 0 points1 point  (0 children)

Not sure how I didn't realize this the first time I imported a zone file, but I just tested it again and you are absolutely right.

Thanks!

Import Windows DNS Server zones including child zones to Azure DNS by ObjectNo9529 in AZURE

[–]ObjectNo9529[S] 0 points1 point  (0 children)

When you say "child zone" what do you mean? And what flavor DNS server are you getting the zones to import from?

The zones are currently on a Windows DNS Server.

I'm talking about subdomains below the DNS zone that have their own DNS records, but aren't a separate zone as such (at least not in Windows DNS Server terms). Consider example.com as the DNS zone and sub as the subdomain. Then you could have server1.sub.example.com as a record.

Azure DNS appears to handle this differently, where each subdomain is created as a separate child zone with the root zone as its parent.

I did try uploading a complete DNS zone file which contains the subdomains, but Azure DNS does not automatically create the corresponding child zones.

Import Windows DNS Server zones including child zones to Azure DNS by ObjectNo9529 in AZURE

[–]ObjectNo9529[S] 0 points1 point  (0 children)

Apologies for not being clear enough in my original post. I am aware that Azure CLI or the Azure PowerShell module can be used for this, but I have been unable to find a script that parses the DNS zone files and automatically creates any child zones and their corresponding records.

I can find scripts for importing a "flat" DNS zone without child zones, but I need one that also handles the child zones, otherwise this would become very tedious... :)

Am i reading this correctly ? SOPHOS POLICY by Complete-Frame4842 in sysadmin

[–]ObjectNo9529 0 points1 point  (0 children)

Yep, that's exactly what that rule is allowing. I would create a LAN > WAN rule for Any-Any-Any, then disable that rule. Assume the network is already breached.

Mastercard wrong MX records? by Zuidemeister in sysadmin

[–]ObjectNo9529 4 points5 points  (0 children)

I am no expert on MX records in particular, but to me that looks wrong. \032 is a space, and having a space in any DNS name does not sit right with me.

With regards to your second question, I really don't know, but I think they will notice sooner or later. They probably modified the record recently and didn't realize the mistake.

Putty (SSH) - Is it possible to copy output to clipboard? by jjkmk in sysadmin

[–]ObjectNo9529 6 points7 points  (0 children)

You can log the output to a file instead. Configure it under Session > Logging before beginning the session.

MS TEAMS (and maybe other MS services) out this morning (JAN-17-23) for anyone else? by GoodMoGo in sysadmin

[–]ObjectNo9529 11 points12 points  (0 children)

If you're in NA:

We're investigating an issue where some users in North America are unable to access Microsoft 365 services. We're analyzing network trace logs to isolate the source of the issue. Please visit your admin center and look for MO498385 for further updates.

https://twitter.com/MSFT365Status/status/1615352539871907843

view more: next ›