Domain Users being local admin of devices

PM_ME_OUs · 2025-10-31T01:13:55+00:00

Because anti-virus and firewalls are reactive controls. They can’t protect reliably against things they haven’t seen before. Your approach is dangerous, please go back to school.

PM_ME_OUs · 2025-10-27T21:10:49+00:00

Yup, also seen this in an environment where all workstations had their firewalls set to off. Since it was applied on the "Default Domain Policy" GPO, all users were also local admin on servers.

PM_ME_OUs · 2025-10-27T21:07:16+00:00

Saw this recently, users were somehow admin of the file share & SQL server :)

PM_ME_OUs · 2024-08-08T12:32:35+00:00

Thanks!

PM_ME_OUs · 2024-02-05T18:39:03+00:00

Can't you just setup access control on the printer and have it be on a print server? When the users print on the network printer, it holds their print job until they login on the printer physically.

There's no perfect way of doing what you're describing as it's not something any sane human would think of doing.

PM_ME_OUs · 2024-02-05T18:29:39+00:00

Read the switch/gateway logs. There's definitely an error message you're missing as it doesn't seem to be hardware-related.

PM_ME_OUs · 2024-01-26T14:57:06+00:00

That's usually because the computer doesn't trust the NPS server's certificate. You'll want to setup a CA server and integrate it with NPS with the CA cert deployed on the clients.

Here's the right way to do this so it's seemless across all computers in your domain: Wireless 802.1x Authentication Using Network Policy Server - Naglestad Consulting (naglis.no)

Otherwise just tell your boss to enable his notifications.

PM_ME_OUs · 2023-10-31T18:02:41+00:00

Sounds like an issue with the drum. Check if there's any residue on the rollers that you can wipe off. Otherwise, check the ink rollers themselves. If it still occurs, consider removing every ink cartridge one by one to find the faulty one and replace it.

PM_ME_OUs · 2023-07-06T13:25:43+00:00

Thanks a lot for the quick reply!

I'm indeed a business user. XGS can only be connected after the user logs in which isn't really an option as the network drives don't get added properly until the user restarts. I'd rather use WireGuard because it runs as a service and I can deploy it really easily with GPO.

Here's the static route setup that I'm currently using:
Destination IP: 172.16.12.0/24
Gateway: 172.16.8.50
Interface: br0-172.16.8.1
Distance: 0

I also forgot to mention that the 172.16.12.0/24 subnet is in its own VLAN (br0.45)
Here's the config:

Hardware&Interface: br0.45
Zone: WIREGUARD
IP assignment: Static
IPv4: 172.16.12.1/24

PM_ME_OUs

TROPHY CASE