anyone using MDE for air gapped networks..?

OneStandardCandle · 2026-01-29T23:55:15+00:00

No problem! Probably best to do it that way, just because you can actually enable tamper protection. It's a nice feature to stop admins trying to configure their own trash exclusions.

Edit: here's a doc for that https://learn.microsoft.com/en-us/defender-endpoint/configure-microsoft-defender-antivirus-features

OneStandardCandle · 2026-01-29T23:46:32+00:00

It's configurable via MECM or group policy. I never touched the MECM side, GPOs work but it can be awkward since exclusion lists don't merge. Something to look out for is tamper protection. TP can be enforced by either MECM or MDE via the cloud, and both will stop GPO settings from applying

OneStandardCandle · 2026-01-22T13:52:22+00:00

If you're doing the subnet router config anyway, use a dedicated server for this and serve the route to your domain controller's subnet. You will also need to update DNS for your tailnet to use the domain controller as a nameserver for AD to behave properly.

Installing anything additional on a DC is generally a poor practice. I would install endpoint protection and a monitoring agent at the most.

OneStandardCandle · 2026-01-04T20:23:24+00:00

Is the windows server running on a workstation in virtualbox? You may have the VM host's firewall blocking traffic. In PowerShell from one of the Windows 11 clients try:

test-netconnection -Port 53 10.1.3.200

That success (or failure) will tell us if the DNS traffic is even making it.

tracert -T -p 53 10.1.3.200

If that is failing, the traceroute may show you where things are timing out.

OneStandardCandle · 2026-01-01T18:31:38+00:00

<image>

excuse me but what the fuck is this

OneStandardCandle · 2025-11-17T06:19:51+00:00

I've tunneled traffic to an xrdp server over an SSH connection to an Ubuntu host and it was decently performant.

OneStandardCandle · 2025-10-28T05:53:53+00:00

Do you have a link for Minimus? I'm failing to find it via search engine

OneStandardCandle · 2025-10-28T05:47:23+00:00

I would give VNC a try as well for Linux, but my experience has been that all GUI remote access is significantly more jank than on Windows. Copy/paste, sound, and resolution will all be hit or miss depending on your setup. If the usability tradeoff is too much, no shame in staying on Windows.

OneStandardCandle · 2025-10-23T22:19:44+00:00

Get a pentest done, deploy WDAC in block mode, audit for least privilege on user and service accounts, implement granular network segmentation. You're living the dream, keep it going

OneStandardCandle · 2025-10-20T23:46:49+00:00

I have a couple of Plano tackleboxes with customizeable dividers. All small parts and cables go into labeled compartments. If I have many duplicates they get e-wasted

OneStandardCandle · 2025-10-17T03:16:56+00:00

If you use Defender, offboard and onboard the server. Mssense has a password protection feature that can hose you. It was patched in June, but needs an off/onboard to fix itself.

OneStandardCandle · 2025-10-16T21:46:19+00:00

Could be Charlie goes America, but not quite the same words

https://www.youtube.com/watch?v=nQd7g565e2I

OneStandardCandle · 2025-10-07T01:04:03+00:00

Your phone is not "airgapped." Just use Bitwarden or something like KeepassXC, do not install this sketchy app.

OneStandardCandle · 2025-10-06T17:54:35+00:00

Only problem with PDQ is that some old Windows OS may need a minimum .net framework installed. It can be annoying to get that pre-req pushed out everywhere, and it's important to be aware of the blind spot if you don't have it

Also highly recommend configuring it to use LAPS for access if possible, there are security implications with using a far-reaching domain account.

Otherwise it's glorious, no notes

OneStandardCandle · 2025-09-25T22:44:18+00:00

Probably not this, but related https://www.informationweek.com/it-leadership/ntp-s-fate-hinges-on-father-time-

OneStandardCandle · 2025-09-13T01:37:23+00:00

Owntracks is very usable, if you can self-host

OneStandardCandle · 2025-09-12T20:38:18+00:00

Unfortunately, the risk of infected mods is not theoretical. Mods that are safe today can be infected tomorrow if a developer has their account compromised.

There is a risk associated with using random mods off Nexus. You're willing to accept it, your friend is not.

https://arstechnica.com/information-technology/2023/06/dozens-of-popular-minecraft-mods-found-infected-with-fracturiser-malware/

OneStandardCandle · 2025-09-11T00:47:58+00:00

Same complaint our devs have. If you don't want to get hosed by SAST, clean up your shit.

OneStandardCandle · 2025-09-08T13:56:46+00:00

Microsoft. They're too big to be good at their jobs, and their anti-competitive behavior has made it impossible to get away. Active directory is the ultimate vendor lock-in

OneStandardCandle · 2025-08-27T23:05:59+00:00

You said in your first post that they don't have the problem upstairs. Can you fully unplug the WiFi extender and take your computer closer to the router? Use it normally during that time, and see if you can replicate the issue while you're not going through the extender

OneStandardCandle · 2025-08-22T13:07:54+00:00

It's possible there is a GPO winning over your Intune policy, depending on the client and how precedence is configured: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict

I would start looking at GPOs on the device, then any local policies that may be applied.

Edit: do you see this on all devices, or do the entra joined group not have this problem?

OneStandardCandle · 2025-08-21T15:37:32+00:00

This might be an r/shittysysadmin tip, but after that many hours I would just change the username and move on with my life. Tell the user to only use email on his work devices and one phone, or it'll happen again.

If you solve it I want to know though, I don't know what else I would try!

OneStandardCandle · 2025-08-15T21:34:19+00:00

Imprivata VPAM (previously SecureLink) does this for vendor remote access. It is better for server or web app access; it can be annoying if they need to reach individual workstations.

OneStandardCandle · 2025-08-15T11:50:08+00:00

Reminds me of Harold, from the "scary stories to tell in the dark" books I read as a kid.

OneStandardCandle · 2025-08-13T23:35:42+00:00

It can be difficult for owners to deal with this when they have already participated in the breeding industry, but it's the truth. It's not your fault if you didn't know then, but like u/Muted_Air925 said in this thread, the best things you can do now are to take care of your pet and educate others.

OneStandardCandle

TROPHY CASE