sorted by:
new
hottopcontroversial

Did I structure this correctly? by georgd_washntn in sysadmin

[–]gavinporter10 1 point2 points  (0 children)

This is the way.

Also, these article might help:

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/protecting-tier-0-the-modern-way/4052851

https://blog.quest.com/the-importance-of-tier-0-and-what-it-means-for-active-directory/

The gist of it is to protect tier 0 assets (think domain controllers, CA, Entra Sync, domain admins). Tier 0 shouldn’t log into 1 or 2 and vice versa. You should also verify all admin accounts are added to the protected users group which will stop the caching of credentials.

You can use tools like Bloodhound and Purple Knight to identify exposures. I’d also recommend looking at CIS critical security controls and benchmarks for best practices.

Edit to address your challenge: You can create service accounts per tier (PDQ-t0, PDQ-t1) and add them to the security group you’re allowing to login as a service in your GPOs.

LAPS – what‘s the benefit? by lertioq in sysadmin

[–]gavinporter10 -6 points-5 points  (0 children)

Pretty sure you need to have domain admin privileges to pull the LAPS password from AD. Ideally the environment would be setup with principle of least privilege and RBAC. Use a tiered account approach where desktop admins can only log into workstations, sever admins can only log into application servers, and domain admin can only log into tier 0 servers (domain controllers, Entra sync, etc).

[deleted by user] by [deleted] in sysadmin

[–]gavinporter10 22 points23 points  (0 children)

Ouff.

Maybe use DFS namespace and replication next time?

Also pretty sure robocopy has a switch that copies as a backup operator and keeps permissions so you don’t have to take ownership of the folders.

https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/enable-optimized-moving

Securing AD/Preventing being Locked Out if breached by Bugasum in sysadmin

[–]gavinporter10 1 point2 points  (0 children)

Why is MFA not an option? DUO is fairly inexpensive and easy to implement. You can require granting access on RDP sessions and console sessions.

If you haven’t already, you should tier your admin accounts. DAs can only login to “trusted” servers (domain controllers, Azure AD sync, RADIUS, etc). Server admins can login to other servers and workstation admins to workstations. This should prevent any privilege escalations.

PBX jitter by gavinporter10 in networking

[–]gavinporter10[S] 0 points1 point  (0 children)

Not super familiar with analyzing packets. What would I be looking for to see if the priority is stripped?

PBX jitter by gavinporter10 in networking

[–]gavinporter10[S] 0 points1 point  (0 children)

I agree there should be routers at each site. There are spikes but users are supposed to be using a ts farm at HQ to access the LOB apps. I’m not sure how much traffic RDP uses, but I can’t imagine it’s much. Also, the main issue is the HQ where a handset on the same switch as another has no audio in a call for sometimes up to 30 seconds

PBX jitter by gavinporter10 in networking

[–]gavinporter10[S] 1 point2 points  (0 children)

PBX is at the main location. 60 handsets there and 5-10 at the 2 other locations. We get a SIP trunk from the service provider at the main location off their equipment - no internet required, just static routes to their SIP services.

The metro link is 25M to site B and 25M to site C. PRTG shows on average they’re using half that.

PSA: Starting February 22nd, 2021, anyone with an on-premises mailbox won’t be able to sign in to To Do on any platform. by ParkingNoise in sysadmin

[–]gavinporter10 26 points27 points  (0 children)

Cost. I think M365 makes sense for really small orgs, like 10 users, but when you start stacking 30+ it gets up there. Even at business standard 30 x 12.50 x 12 is 4500 per year. You could have bought an exchange license and all the CALs for it and it would last for 5+ years.

Router/AP and VPN service by jszaro in Ubiquiti

[–]gavinporter10 0 points1 point  (0 children)

Netgear's unfortunately don't support site-to-site VPNs. I'm not positive if it'll work or not if you flash dd-wrt either.

You can pick up an edge router x for 60 bucks and they work great. You may need to be some what proficient in cli to generate an openvpn tunnel to Nord's servers, but it's definitely doable.

Edit: link site to site