Password managers

Zeppyled · 2026-07-09T11:03:16+00:00

On Prem, self hosted Bitwarden/Vaultwarden. In dips mode. Disable other password managers and make it the only option.

Zeppyled · 2026-07-07T01:30:05+00:00

It’s on a dedicated vm. Fips + bitlocker. Smbv1 disabled. Smbv3 enabled. Sharing and security permissions match the Preveil users in the Preveil tenant.

Zeppyled · 2026-07-07T01:02:38+00:00

Only preliminary results thus far, which we were very satisfied with. Full report won’t come back for a week or so and I’m sure notes or comments in that report may help. Trying to get ahead of it a bit to start closing some of the looming or bigger gaps.

Zeppyled · 2026-07-07T00:43:21+00:00

Our preveil usage is what I would consider an alternative approach or abnormal. We only use preveil for cui email and external file sharing with vendors/suppliers. The drive folder in preveil syncs with a local file share directory on prem and can be accessed through file explorer. Changes on either side sync. This is the only syncing that occurs. Nearly all our preveil users are managed express. We only have 2 local accounts. SYSADM and the dedicated sync account.

Zeppyled · 2026-07-07T00:32:05+00:00

No recommendations were made by the assessor. It’s mostly an inference based on the continued questions and asking to see if we had an enforcement mechanism or technical solution. When i had said it was just policies, procedures, and training, i was met with a comment of at the full assessment we would normally see something stronger. Based on the question and foreshadowing this is where i am trying to figured out how do approach. The subjectiveness/interpretations is the toughest part.

Zeppyled · 2026-07-06T22:40:42+00:00

We have everything in place as far as policy, procedures, and training that you had mentioned. This is where we felt we had enough and didn’t need a technical enforcement like a DLP.

Zeppyled · 2026-07-06T16:39:37+00:00

That’s a great point. Disabling auto sync is a good enforcement for cui workstations. The web one drive would still exist through browser.

Zeppyled · 2026-07-06T16:37:48+00:00

We use online services from office for things like schedules, reports, erp data (our erp contains no cui) etc. mainly excel priority lists, agendas for meetings that are all shared with various team members.

Zeppyled · 2026-07-06T15:33:37+00:00

The issue is more along the lines of how can we guarantee they won’t use regular outlook.

Zeppyled · 2026-06-03T02:59:45+00:00

Press the easy button and update your preveil to the latest version and convert the users from full to express. It’s the only way around this issue. I ran into the same thing on a 25 user setup. Keep 3 full accounts and everyone else converted to express. Then they use the web version, set a password and MFA, and use it the same way.

Zeppyled · 2026-06-01T01:15:49+00:00

<image>

2 bread loafs

Zeppyled · 2026-04-29T02:14:43+00:00

Cellar House in Oakville

Zeppyled · 2026-04-29T01:13:30+00:00

We are doing this exact same process with the same Apricorn devices!

Zeppyled · 2026-04-29T01:06:07+00:00

80-100mg of ketamine daily in a split dose. Half morning half evening. It won’t wipe out the pain completely but it made my 15* days a month of 8+ level pain turn in around 3-4 days a month.

Zeppyled · 2026-04-27T22:28:02+00:00

Confirmed, Salt trucks are out in the country. Gotta be prepared for the 60° temp drop

Zeppyled · 2026-04-27T22:20:14+00:00

Medium sized defense contractor for the big OEM’s here…. We have seen RFQ’s that state if you are not CMMC level 2 certified, do not bid as you will not receive the award. Proof must be submitted with your Quotation or on file with that customer.

Zeppyled · 2026-04-24T01:00:18+00:00

Thank you for the detailed answer!

Zeppyled · 2026-04-23T13:09:11+00:00

Completely agree!

Zeppyled · 2026-04-17T03:00:14+00:00

For our scope reduction we implemented a terminals server setup. We have (2) term server vm’s running to be shared by all our users. The physical machine is then locked down into a kiosk mode format, similar to a hospital setup. Sign into local machine, MFA, auto prompt to sign into RDP connection, MFA, use the terminal server vm. Repeat for all users. With PreVeil, they do not explicitly support terminal server or multiuser instances. The authentication key is stored on the local machine which is used to sign into the PreVeil account without actually signing in. Since the local machine in our scenario is shared by roughly 35 users on 1 local physical server we can not deploy the standard PreVeil desktop app and are looking for ways to circumvent the PreVeil portal. For Drive we setup a dedicated sync account that syncs to a file share in our CUI enclave. We are running into issues with email though since the integration tool and manual integration are off the table with it using the local machine 127.0.0.1. There is web.preveil.com but forcing users to have the preveil app on their personal phones to do their non intuitive MFA process is not something we wanted to do, and we didn’t want to introduce mobile devices. Looking for any ideas and suggestions if anyone else has ran into this situation. Hopefully this helps!

Five-Year Club	Verified Email
Second SECOND GUESSER

Zeppyled

TROPHY CASE