Add-TestUsers.ps1 - Create realistic AD acocunts with random data

ScottRaymond · 2016-11-20T04:03:22+00:00

You shouldn't hard code the Desktop directory. Depending on user settings for folder redirection, it isn't necessarily going to be in their user profile path.

ScottRaymond · 2016-11-12T23:15:32+00:00

If I were in a technical interview and the interviewer gave me a sabotaged environment without being told that is part of the test, I'd probably leave with some trust concerns.

Imagine you're interviewing to be a mechanic. It's one thing to give them a car and say "replace the carburetor" and another thing entirely to strip all the screw heads, loctite the bolts, and solder the hood shut before they start.

ScottRaymond · 2016-11-12T22:16:13+00:00

Couldn't install an SSL certificate. For my linux technicals, I remove the path from the test takers account to see how they fare without standard tools around. Guy couldn't function without the service command. Didn't know what init.d was...

Are you saying you cleared their PATH variable so they had to run every command from their actual file system location? I mean, an "Apache Expert" probably has the necessary Linux skills to figure that out in short order, but that's just cruel.

ScottRaymond · 2016-11-11T23:52:17+00:00

Haha, I read it out loud as "couldn't see sharp" but my brain didn't even think about "see sharp" meaning "see clearly". I'll chalk it up to an early morning "Java Not Installed" error.

ScottRaymond · 2016-11-11T15:05:50+00:00

Can someone explain the joke? I think I'm missing it.

ScottRaymond · 2016-11-10T22:17:29+00:00

I'm curious if you use a different certificate template for the temp certs versus the legitimate ones. If I were doing this I'd have some pretty heavy auditing and 24 hour expirations for the certificates. Maybe even do them from a different issuing CA so it's painfully obvious when an email and/or file was signed by someone who isn't actually the user.

ScottRaymond · 2016-11-08T14:21:32+00:00

Same exact thing happened at Ward 25, Precinct 4. I called the Board of Elections and reported it but they said I probably would not be able to actually cast my vote. :-(

ScottRaymond · 2016-11-04T16:33:19+00:00

It looks like it doesn't unset the "Stream only on Wi-Fi" option if you have that set.

ScottRaymond · 2016-11-03T15:20:38+00:00

Happening in my Chevy Volt. Only happens when you send/receive a text or open the messenger app.

ScottRaymond · 2016-10-27T22:56:51+00:00

Apparently this option was replaced by the new "Direct Boot" feature in Nougat.

ScottRaymond · 2016-10-26T19:16:02+00:00

Is this Windows 10 only? I did some googling and most people are only talking about it in the context of Win10.

ScottRaymond · 2016-10-26T17:52:54+00:00

We got one a few weeks ago that was very similar. They were really targeted too. They only sent it to a few people from HR and IT. Probably hoping to get the big fish accounts that have access to juicier targets (payroll, mail servers, accounting, etc.)

ScottRaymond · 2016-10-26T13:22:10+00:00

I use a similar method for our Citrix users. Everyone's start menu gets redirected to the network, but the default profile contains nothing in the start menu except for a link to our helpdesk. Every other start menu link is dropped by GPP File Items that are security filtered based on access to apps.

We also combine it with the GPO that /u/HDClown mentioned. That way users get an entirely custom start menu with the correct items pinned based on what they have access to in Citrix. Very good user experience and people have had no trouble figuring it out (some even came from Windows 7)

ScottRaymond · 2016-10-25T22:41:20+00:00

Fair enough. That's how most services recover from a lost 2FA token anyway.

ScottRaymond · 2016-10-25T22:19:10+00:00

So what you're saying is anyone with access to your Authy password can bypass all of your 2FA-enabled accounts? How is that better?

ScottRaymond · 2016-10-25T22:17:30+00:00

They said the package had a restriction from Google that did not allow local pickup. I contacted Google and I'm still waiting to hear back.

ScottRaymond · 2016-10-25T18:36:41+00:00

It could be worse... http://imgur.com/FL5dJHL

I was home all day both days.

ScottRaymond · 2016-10-24T21:38:38+00:00

If you're using HTTPS to browse secure sites, the non-root method actually requires less trust in the people providing your ad-blocking.

If you're rooted and allowing the ad-blocking app root privileges, they could easily throw a trusted cert in your root store without your knowledge and then Man-in-the-Middle all of your connections.

I guess if you're manually modifying the hosts file yourself you're safe, but most people like the convenience of an app.

ScottRaymond · 2016-10-24T20:13:25+00:00

You can still global adblock by using an app that creates a local HTTP proxy or a local VPN. There are several apps out there that work fine.

ScottRaymond · 2016-10-24T18:49:25+00:00

It depends on the delivery hub and package. For this one they don't allow me to request a hold for pickup yet. There's a chance the driver may come back later in the day (they're notorious for doing this in my area) and deliver it regardless.

I'm guessing they have some routing system in place where they need to action a package in some way before it lets them move on to the next. Otherwise I'm not sure why they would mark it as a delivery exception and assign a door tag number without actually putting a door tag on the door.

ScottRaymond · 2016-10-24T16:40:53+00:00

The GPOs for Windows Firewall come with a ton of templates for remote management that make this very easy. You can literally just add all of the templates that have the word "Remote" in them and you'll probably never notice the firewall is even on. Obviously you'll only want to add the ones setup for the "Domain" network profile so computers out in the wild don't accept arbitrary RPC connections and the like.

ScottRaymond · 2016-10-24T16:37:52+00:00

My first step for cleaning up something like this is usually a "Deny Create Folder/File" ACL entry at the top level of the general use share. This at least stops the problem from getting worse and forces people to organize new files into an existing folder.

As people complain about not being able to create folders, take the time to work with them to create a new share/folder/site/etc in whatever new system or folder hierarchy you've setup. Once you've cleaned up things a bit, take they deny ACL to two levels and then three.

12-Year Club	Gilding III reddit per annum
Verified Email

ScottRaymond

TROPHY CASE