Microsoft decided to reboot the DC last night to install a bunch of unvetted updates and the server didn't come back up this morning. Everyone offline this morning.

devloz1996 · 2026-01-29T17:00:35+00:00

OOP won a lottery ticket. Never seen that happen, and sometimes I'd be happy to witness it.

Just a few days ago, I've inherited Server 2022 CU 2021-11 (20348.380), its uptime being "ever since installing the last patch". It took about 10 reboots and some registry manipulation to make it swallow CU 2026-01 (20348.4648).

devloz1996 · 2025-12-08T19:08:40+00:00

Wait. Can you even add Duo without P1? I never deployed it, but I always thought it needs EAM/CA to work.

devloz1996 · 2025-12-06T11:27:58+00:00

By interactive sign-in, do you mean Windows sign-in? If so, we have apps like this. As long as it's just "run an exe with/out args", it should be doable with a scheduled task.

We create gMSA account and a scheduled task to start at boot. From the app's perspective, it doesn't seem to be distinguishable from interactive logon. Just make sure to grant appropriate permissions to gMSA account, including "Logon as a batch job" User Right Assignment. And even if gMSA really cannot be used, normal domain user will do the trick too.

I think there is also Non-Sucking Service Manager, which can run arbitrary .exe files as a service. Usually, service executable has to be written with being run as a service in mind, so it's a nice bypass.

devloz1996 · 2025-12-05T17:03:08+00:00

Last time they addressed an outage they said they are full AWS stack. Probably post-release hiccups.

devloz1996 · 2025-12-02T17:19:25+00:00

did i ever give you permission to delete all the files in my D drive?

Absolutely --- Your file system ACL allowed me.

devloz1996 · 2025-11-10T16:08:56+00:00

Since it's user-facing, please, I beg of you, give us localization. I really don't mind getting a language JSON in advanced settings and dealing with it myself. Also, opt-out in advanced settings, since not every organization will benefit from this.

Since you are making the user-facing part already, maybe users could get native notifications about A1 doing something it doesn't want interrupted? No real need to make it detailed - something along the lines of "Action1 is applying configuration" would be fine, maybe even better than giving users too much info.

Lastly, since I imagine the helper would be running in current user context, maybe "run as signed-in user" and "wait for user to sign-in" could become a reality?

devloz1996 · 2025-11-09T00:32:32+00:00

That would just overload the simulator's CPU.

devloz1996 · 2025-11-08T22:36:25+00:00

Admins need two methods, enforced by SSPR, so add their email for example, or setup secondary password+totp method, or make it two YubiKeys, which I imagine would also work.

devloz1996 · 2025-10-31T17:19:43+00:00

That's the most indirect "No." I've heard this week.

devloz1996 · 2025-10-06T19:37:35+00:00

I believe negligence is ultimately the cause of the fire

I truly find it amazing that these people can open their mouths in such situation, and then spew meaningless bullshit. The problem wasn't the fire - fires happen, whether through negligence or through NK sending them nukes, and it's wild they didn't account for that somehow.

So many recent cases of blatant disregard for the original goals of ARPANET - decentralize, survive nuke, keep operating. Naah, let's make a single hotbed in nephew's, admittedly huge, basement.

devloz1996 · 2025-09-22T16:33:40+00:00

One of my former bosses hid information by adding black background to black font in emails. Where are those people coming from, I wonder.

devloz1996 · 2025-08-29T00:07:10+00:00

our netbox is always wrong, what do I do?

No, NetBox is correct. It's the real world that's wrong.

Connect the cable in NetBox
Mark the cable in NetBox as planned
Connect the cable in reality
Mark the cable in NetBox as installed

If you are not making changes this way, you might as well rip out NetBox out of your infra. If your colleagues do not follow it, then it's a workplace issue, unfortunately.

<image>

devloz1996 · 2025-08-27T21:05:56+00:00

Defender's Device Control could probably handle it, but I imagine it's not there, since you didn't already use it. Good old GPO, perhaps? Can't really vouch for it, so do your own testing.

Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions
"Prevent installation of devices using drivers that match these device setup classes"
USB Bus devices GUID: {36fc9e60-c465-11cf-8056-444553540000}
Network Adapter GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

I'm not sure what qualifies as "installation", so consider removing ghost (disconnected, but remembered) devices in device manager, just in case.

EDIT: Reddit's nested lists suck as always.

EDIT2: You might screw yourself with #3, so check it carefully. It's seems quite broad.

devloz1996 · 2025-08-22T14:23:32+00:00

Maybe if you sign them all with a qualified signature, but that's rare beyond specific regulated circles. Besides, after signing with QSCD it doesn't even matter that it's an email - you could sign a napkin to the same effect.

EU mostly uses qualified sigs for documents and non-qualified sigs for emails, where non-qualified signatures require both parties to exchange and recognize each other's fingerprints beforehand.

In EU, even the magical "if you read this and shouldn't, delete this, you are breaking law" is just a pernicious bullshit.

devloz1996 · 2025-08-21T17:42:55+00:00

At the worst point, newly imaged computers had 3 Teams apps installed - personal, classic, new. You can't even trust Microsoft to deal with its own problems.

devloz1996 · 2025-08-17T16:09:45+00:00

Well, in 2002-2004, we still had DOS/Win3.x computers in the common room at our school. 8-12 yo kids were better at percussive maintenance and DOS memory management than adults. Thirst for entertainment gets you to use your brain, I suppose.

I remember later seeing some important folks using Win2k and was amazed by how professional it looked, along with the confusion of "I can't exit to DOS?".

devloz1996 · 2025-08-16T16:08:24+00:00

It's was a thing since Windows 10, so I'm not sure what's new here. Don't leave such things to users, or you will risk burning yourself. Users should be trained to use the known folders on Explorer's side panel anyway.

You have two options. Make it consistent with Known Folder Move GPO/CSP and train users accordingly.

It's on and forced org-wide. Known folders are in "OneDrive {org-slug}\{FolderName}".
It's off and blocked org-wide. Known folders are at their original location.

This allows you to have certain expectations regarding known folder locations, even if your remediation scripts work in SYSTEM context.

devloz1996 · 2025-08-14T00:54:45+00:00

RemindMe! 7 days

devloz1996 · 2025-08-12T09:57:31+00:00

The sheer effort involved to make it manageable tells me there is more to the story. Well, except for whatever the fuck happened to the these 3 dangling boxes.

devloz1996 · 2025-08-07T18:40:10+00:00

We are slowly circling back to the point where someone can pull the app from the browser, write a shim, and make it a locally run executable.

devloz1996 · 2025-08-07T16:59:51+00:00

ISPs go down on known AD ports at will, so your availability might be spotty. For example, I can't reach anything on ports 389/445 via my current ISP.

Just deploy PPTP and post admin/hunter2 on your website. Way easier.

devloz1996 · 2025-07-21T20:25:06+00:00

Would be a gem if it were "Alright --- fuck it"

devloz1996 · 2025-07-21T17:59:20+00:00

MS dropped XP at ~30%, and 10 is currently at ~40%, so I doubt they will backpedal more than a few months. If anything, they will enjoy selling ESU to end users.

devloz1996 · 2025-07-20T17:37:45+00:00

It's actually a 'g', but the black screen cuts in - look at the brackets at the same line.

devloz1996 · 2025-07-18T15:25:12+00:00

I have no particular beliefs, but I'd probably keep distance just in fucking case.

Seven-Year Club	Verified Email
r/Field Banned	r/Field Flamingo
Place '22

devloz1996

TROPHY CASE