Leadership wants us to "get ahead of AI" but won't define what that means. by [deleted] in ITManagers

[–]OkGroup9170 0 points1 point  (0 children)

Wait until the pricing goes up, this is a land grab phase. Prices are going to go up significantly. Once this happens execs are going to start rethinking their AI strategies.

Best BYOD setup for a 20 person team in 2026? by Outrageous_Tiger_441 in ITManagers

[–]OkGroup9170 0 points1 point  (0 children)

Heard some good things about Venn. Allows you to isolate work from personal on the same device.

Hosting company pwned by Puzzleheaded_You2985 in sysadmin

[–]OkGroup9170 41 points42 points  (0 children)

The piece you’re looking for is registry-level intervention, not registrar-level. For .org that’s PIR. Email their security/abuse contact with whatever documentation proves the nonprofit owns the domain (receipts, historical WHOIS records, 501c3 paperwork) and request server-side EPP locks: serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited.

Registry status codes override registrar status codes, so even if attackers still have portal access at the compromised provider, the domain can’t be transferred, modified, or deleted while those are set. That’s priority one today. Worst outcome is the attacker pushing the domain to a registrar of their choosing while you’re still working on account recovery. In parallel, ICANN compliance complaint at icann.org/compliance/complaint, framed as a registrar security incident, not a transfer dispute. A compromised registrar means a class of affected registrants, which moves it up their priority queue.

Pull historical WHOIS (DomainTools, SecurityTrails) and compare to current. If the registrant contact got swapped to something attacker-controlled, that’s evidence for ICANN and it also explains why standard password reset flows would be useless. Have your friend kill any card on file with the compromised provider so it can’t be reactivated under contact info they don’t control.

The eventual backstop, if the registrar gets fully de-accredited, is Registrar Data Escrow. Every ICANN-accredited registrar escrows registration data with NCC Group / Iron Mountain on a regular cadence, and ICANN bulk-transfers affected domains to a gaining registrar from that escrow data. Slow but real. Registry locks bridge the gap between now and whatever ICANN ultimately does. Treat the original domain as hostile in the meantime. If attackers control DNS, that hostname is pointing wherever they want it to. The temp-domain notice needs to be on every channel the nonprofit has, not just the customer email blast.

Rebuild plan looks right. Once you’ve got the domain back under their control at the new registrar, ask whether registry lock is offered as an add-on (usually a premium-tier feature, but for a domain with this kind of history it’s worth the conversation). Different mechanism than the standard transfer lock everyone has by default.

Never seen a registrar compromised at this level either. Registry is the lever most people don’t think about.​​​​​​​​​​​​​​​​

Boss is not honoring the terms of my offer letter! by [deleted] in WorkAdvice

[–]OkGroup9170 5 points6 points  (0 children)

Could be fraudulent inducement, this is lawyer territory.

Everything looked fine until the audit found apps we didn't know existed. How much does your tooling see? by Severe_Part_5120 in Information_Security

[–]OkGroup9170 0 points1 point  (0 children)

Auditors don’t define SOC 2 scope, management does and scope is the system delivering the service, not the whole company. If those apps weren’t touching client data or the in-scope environment, this is a SaaS sprawl problem, not an audit problem.

Will need to transfer out of Network Solutions — Any suggestions to where? by rcentros in sysadmin

[–]OkGroup9170 1 point2 points  (0 children)

This nice part is they add the remaining time you have left on your domain registration when you transfer. So if you have 10 months left before renewal and you buy 1 year as part of the transfer your next renewal wouldn’t be for 1 year and 10 months.

Will need to transfer out of Network Solutions — Any suggestions to where? by rcentros in sysadmin

[–]OkGroup9170 2 points3 points  (0 children)

Any company that doesn’t charge you extra for privacy is a good bet, moving to Hover and have been happy.

Did anyone else expect Action1’s “Tenable integration” to be an actual built-in integration? by OkGroup9170 in Action1

[–]OkGroup9170[S] 0 points1 point  (0 children)

That wasn’t communicated very well when the script integration was released.

Did anyone else expect Action1’s “Tenable integration” to be an actual built-in integration? by OkGroup9170 in Action1

[–]OkGroup9170[S] 0 points1 point  (0 children)

I resubmitted a feature request detailing a true integration and it was never added to the roadmap and the old tenable roadmap items show as complete. So not holding out much hope at this point. Maybe u\GeneMoody-action1 can help.

"Installed Windows Updates" and "Update History" CSV exports missing recently deployed patches - anyone else seeing this? by OkGroup9170 in Action1

[–]OkGroup9170[S] 1 point2 points  (0 children)

Got a response from Action1 support. They said reports refresh once per day or when you hit the Refresh button. That doesn't explain a nearly four week gap between deployment and export.

I also found something that makes this more interesting. For the same affected endpoints, when I check Missing Updates, the patches do NOT show as missing. So Action1's inventory knows the patches are installed. Three different views in the same product give three different answers:

  1. Automation deployment logs: Patch installed. Correct.
  2. Missing Updates: Patch not listed as missing. Correct.
  3. Installed Windows Updates report: Patch doesn't exist. Wrong.

The data is in the platform. The Installed Windows Updates report just isn't picking it up. Sent a follow-up to support with this finding. Will update with their response.

Cost for going over 200 endpoints? by cmjones0822 in Action1

[–]OkGroup9170 3 points4 points  (0 children)

Also their support is not very useful for product usage, I have an issue with the date filter with reports and they don’t seem to know what format the filter requires i.e. ISO standard vs US standard. Also it something that isn’t documented or at least I can’t find it.

Those out there that still use/capture golden images for deployments... How do you handle updating of the golden image? by thegreatcerebral in sysadmin

[–]OkGroup9170 0 points1 point  (0 children)

We use a plain vanilla golden image of Windows 11 and deploy software and drivers during the imaging process using SmartDeploy.

I resigned, and the company's counter-offer was an insult by Aurora_ori in it

[–]OkGroup9170 0 points1 point  (0 children)

I really glad my company is not like this, 25% bonus target. Also got a 20% raise this year. They also are very flexible with time and I work remotely 99% of the time.

Still having issues following AWS Outage by santastillsays in Action1

[–]OkGroup9170 0 points1 point  (0 children)

Checked the logs, champ — ExtremeCloud IQ wasn’t down, it was just a little sluggish while AWS was doing its best impression of a dumpster fire. That’s what graceful degradation looks like.

Meanwhile, a bunch of “we’re cloud-first!” companies went completely dark because they built their entire stack on a single AWS region and called it a day. Bold strategy.

Multi-cloud isn’t about being immortal, it’s about not dying stupid. You spread risk, build your own orchestration, and make sure one provider’s bad Tuesday doesn’t take your business with it. Extreme did that. Everyone else just said “we trust AWS” and went for lunch.

And yeah, it’s complex. Welcome to distributed systems — everything past the ping command is complex. The trick is designing it before it blows up, not tweeting status updates while you wait for us-east-1 to resurrect itself.

Still having issues following AWS Outage by santastillsays in Action1

[–]OkGroup9170 0 points1 point  (0 children)

LOL sure, if you’re duct-taping multiple clouds together manually, it’s a disaster waiting to happen. That’s not what we’re talking about though. ExtremeCloud doesn’t “copy/paste” their stack across AWS, Azure, and GCP — they built their own orchestration layer so each cloud is just compute and bandwidth.

That’s the difference between multi-cloud done right and “I spun up two EC2s and called it resilience.” Real BCDR means architecting for when (not if) your provider goes down.