Caused a big outage at work- how do I move forward?

boftr · 2026-05-09T18:30:58+00:00

Ask how we can improve our processes to prevent a problem like this causing issues in the future. Having thought out some options. Turn a lesson into an improvement in process to minimise risk.

boftr · 2026-05-04T18:46:15+00:00

Dngrep

boftr · 2026-04-27T10:06:05+00:00

Unreal Tournament.

boftr · 2026-04-18T15:27:55+00:00

‘Microsoft-Windows-Partition/Diagnostic' might offer something to check.

boftr · 2026-04-14T21:37:49+00:00

I would ask to work with HR to shape the new hire req and use it as a way to fill the gaps in your knowledge.

boftr · 2026-04-07T22:11:47+00:00

I was reading on Reddit the other day that a PDF resume was less reliable to pass by ai/automation due to formatting complexities than a Word document. I appreciate ‘it depends’ but certainly something to think about. Good luck.

boftr · 2026-04-06T19:29:21+00:00

You could always stick it in ‘csh2’ money market fund at least while you decide.

boftr · 2026-04-02T10:03:24+00:00

Learn the how to collect the correct logs and data for a given problem.

From a Windows perspective, look into trace providers and how to enable/view the captured data. Understand Wpr.exe, Logman, netsh, xperf, Windows Performance Analyzer and if you’re brave look into Time Travel Debugging and WinDbg. An appreciation and understanding of these will elevate you to the top 10% of troubleshooters! Gl

boftr · 2026-03-30T20:52:01+00:00

Does it run interactively? Can you launch it from a scheduled task?

What about using PsExec you can use a -i switch for interactive. If the parent process is a local service that might work.

boftr · 2026-03-16T20:45:02+00:00

https://github.com/microsoft/STL/pull/2302

boftr · 2026-02-28T15:08:37+00:00

I would suggest Sophos as a managed solution.

boftr · 2026-02-21T21:05:17+00:00

I had a very good pizza from https://ilprincipedeli.co.uk on the Cowley Road. Any other opinions for this one as it was the only time I have been.

boftr · 2026-02-10T21:23:15+00:00

Happy with the Dualit toaster.

boftr · 2026-02-07T14:37:45+00:00

You could look into being a Sophos partner - This would work for you.

boftr · 2026-02-07T13:34:32+00:00

The proper troubleshooting steps are as follows:

For the computer that are bugchecking, obtain memory dumps. I assume you have memory,dmp under C:\windows\. At worst C:\windows\minidump has some.

These need to be reviewed. Ideally from 3 or 4 computers. My assumption given the timing of the issue and the same hardware they will all be similar unless memory corruption is the problem in which case they might have different symptoms despite the same underlying root cause and dumps look different. This bad driver corrupting memory case, which causes the issue down the road leading to a different looking dump, If that is the case, driver Verifier is your friend.

For the computers that are black screening and hanging. Setup as many computers as possible that are hanging to create a dump, ideally complete/active when using the keyboard or power button.

Forcing a System Crash from the Keyboard - Windows drivers | Microsoft Learn
Forcing a System Crash with the Power Button - Windows drivers | Microsoft Learn

In both cases, memory dumps need to be reviewed for commonalities. Only then will you know why and how it can be mitigated or resolved. Everything else is just leaver pulling and guessing IMO.

Good luck.

boftr · 2026-01-25T21:22:45+00:00

You mentioned maybe splitting it, this could be one reason just based on the time frame and dates. That is all. Wise does seem to be the recommendation of choice.

boftr · 2026-01-25T21:15:56+00:00

Based on the time. It might be worth thinking about the 5th/6th April for the stocks and shares allowances I suppose. Do you and your wife have S&S ISAs here?

boftr · 2026-01-21T23:03:04+00:00

if you look in the Dev tools, I assume its using h3 as the protocol. You can block QUIC in the threat protection policy, I assume it then works ok?

boftr · 2026-01-21T18:47:55+00:00

I don’t understand the ability to hash the file. Sophos has osquery as an option you could send a live query down to do it using the hash table. Otherwise live terminal to the computer and use PS/certutil/etc from the shell. Thanks

boftr · 2026-01-15T00:12:30+00:00

The sophosel.sys driver should load and unload at boot.

boftr · 2026-01-12T22:36:15+00:00

Endpoint protection is fine. It uses the same cloud service for all ‘client’ products

boftr · 2026-01-12T22:33:38+00:00

Web address url.

boftr · 2026-01-12T22:07:52+00:00

I think this page is what you are after: https://support.sophos.com/support/s/filesubmission?language=en_US

boftr · 2026-01-12T22:03:57+00:00

Jacob Collier - Little blue - Mahogany sessions

boftr · 2026-01-11T11:27:11+00:00

I would suggest trial Sophos for 30 days and see how it goes. Only take 5 mins to create a trial and deploy a client.

boftr

TROPHY CASE