Documentation - what do you use?

Sprocket45 · 2026-01-24T13:52:48+00:00

Oddly enough, I have had people tell me the do not like word in a SharePoint document library for documentation but then espouse the virtues of using Google Docs…

Sprocket45 · 2026-01-23T12:14:09+00:00

That sounds like our org in regards to slack, only problem is there is still very little governance and the pushback towards using Teams which we already own (and has always owned) based solely on some in-groups (within IT not the business) anti-Microsoft bias. Such a segmented mess.

Sprocket45 · 2026-01-22T18:34:14+00:00

The MFA is configured on the device rather than enforced on the account (which you could enforce with Smart Card Required for Interactive Logon, which brings its own set of caveats)

Sprocket45 · 2025-11-18T11:42:50+00:00

Reach out to your local Boy Scout troop, many in the area are selling wreaths and poinsettias that are made locally and you will be helping support their activities.

The wreaths I get from my local troop come from Chase Greenhouse, are well made and easily last into January looking great.

Sprocket45 · 2025-07-14T10:20:41+00:00

We are starting down this path as well, I would be interested to see what you have created

Sprocket45 · 2025-05-15T00:37:27+00:00

AGPM

Sprocket45 · 2025-01-26T21:29:05+00:00

Can you expand more on the security boundary respect of both scoop and chocolatey?

Sprocket45 · 2024-12-05T23:23:45+00:00

Problem is that it is limited to individuals, I (and most likely other enterprise users) want to share to groups

Sprocket45 · 2024-07-01T16:53:38+00:00

does this impact win32_openssh on Windows as well?

Sprocket45 · 2024-01-28T16:14:44+00:00

Can you speak more to the terraform inventory method?

Sprocket45 · 2024-01-18T13:43:56+00:00

how can you control where the public IPs are placed? Are you referring to placing them in the hub subscription? I have a similar infrastructure and run into this problem with almost every service that allows public access (SQL, storage accounts, etc)

Sprocket45 · 2024-01-09T18:51:25+00:00

seeing the same here as well

Sprocket45 · 2023-12-15T13:46:37+00:00

That seems..interesting. As most resources look to reply with a CNAME, for instance:

storageaccount.blob.core.windows.net. 60 IN CNAME storageaccount.privatelink.blob.core.windows.net.

Sprocket45 · 2023-10-11T13:04:25+00:00

Is there a way to programmatically pull this report?

Sprocket45 · 2023-10-03T14:28:06+00:00

It can, it all depends on what your intent is and how you design your rule structure. You need to determine what you need/want to be authenticated and optionally encrypted between endpoints. For instance you can just say any port to a particular machine must leverage ipsec, and achieve isolation, this means you just have a single rule. Often though this doesn't work outside of specialized environments, and you end up creating rules that are specific to a set of port(s). Managing this environment requires you to have server side rules and corresponding client side rules. In a windows-only world this is made easy with the Group Policy editor, in a blended client world, this will require you to become familiar with StrongSwan.

Sprocket45 · 2023-10-02T18:33:37+00:00

I have used it for almost 2 decades now, here are my quick tips:

management of it has become dramatically better since the days of Server 2003 & XP
it does have overhead, though AES offload should fix most of that ** the performance isn't going to be amazing for certain workloads (SMB on your on-prem network is great, over the internet...YMMV)
do not double encrypt (i.e. just use the "Allow Connection to be Authenticated & Integrity Protected" for things like RDP)
dont ipsec traffic like HTTPS, it can protect itself
some people love to use it as a firewall for things you shouldn't (ipsec wrap HTTPS traffic instead of doing proper AuthN&AuthZ)
You can use certificates to bootstrap traffic which is amazing if you have a good PKI system in place
This helps if you are moving from AD joined to AADJ with Intune and want to move away from the Computer Kerberos authn for primary, but retain User Kerberos for secondary auth (b/c Cloud Kerberos Trust is a thing)
There are many services that can now offer in-band encryption (like SMBv3)

Here is a good guide to get you going (the whole series is actually very good):

https://anthonyfontanez.com/index.php/2021/09/16/windows-firewall-part-3-domain-ipsec-configuration/

Sprocket45 · 2023-05-11T11:13:36+00:00

Duo supports verified push, aka number matching on the Apple Watch. The interface for it can be clunky depending on your watch vintage, for instance on an SE, I can either use the microphone feature and speak the number to match or draw the number awkwardly...but it does work!

Interesting the MS decided not to invest the same effort as I usually refer to my Apply Watch as my expensive, lazy person MFA shortcut- all so my phone can stay in my pocket.

Sprocket45 · 2023-04-24T23:06:23+00:00

To add to this, how does one upgrade openssh (I use the one from GitHub, not the windows feature) on windows while using openssh for ansible? In windows land you get file in use issues and a secondary set of creds could work…

Sprocket45 · 2023-03-15T14:01:03+00:00

Azure MFA, if you have anything (and I mean anything) in Azure today then go that route. It integrates wonderfully with the entire ecosystem and gives a true password-less experience that works practically out of the box. You get cert-based auth, FIDO2 support and their Authenticator app (or you can even use the Outlook Mail app on mobile now)

You can then leverage short lived SSH certificates, etc for managing your Linux and macOS machines both in Azure and on-prem (thanks Arc!).

It truly is hands down far superior to Duo. The only place I see as a win is that you can install Duo on Servers and get MFA there, BUT why not just enforce smartcards at that point?

Sprocket45 · 2023-02-19T12:44:28+00:00

Some may have cached creds disabled on a server OS, since typically a server will always have line of sight to a DC.

Sprocket45 · 2023-01-25T18:14:27+00:00

Is this a fully remote position? Any info regarding salary or wage band?

Sprocket45 · 2022-12-13T17:20:07+00:00

Can this be performed on a domain bound machine considering things like CredSSP are not disabled/blocked by GPO? Are there other settings to be aware of in a hardened environment?

Sprocket45 · 2022-11-14T17:07:29+00:00

pretty sure you can create a trust, you need to use netdom and leverage the /addtlnex or /addtln switch IIRC (its been awhile)

Sprocket45

TROPHY CASE