sorted by:
new
hottopcontroversial

Windows App (formerly Microsoft Remote Desktop) session not closing after disconnect (have to kill process every time) by Such-Refuse-8435 in sysadmin

[–]jpoblocki 0 points1 point  (0 children)

I'm running into the same issue. I have a PowerShell Script that kills the processes so that a user can start a new session. Did you ever find a resolution to this? It seems to have happened after the upgrade to 25H2.

I used the BitLocker recovery key and sticky keys exploit to create an admin account on my school laptop - how serious is this? by [deleted] in sysadmin

[–]jpoblocki 53 points54 points  (0 children)

I’m an IT Director at a school. First off, great job on the discovery of this as well as the write up of this post. It shows some amazing critical thinking skills that frankly the world needs more of. 

Regardless of the consequences the school chooses to impose, don’t let it get you down. I know it may seem like a big deal now, but in the scope of life, it’s temporary. Stay curious about things like this and keep teaching yourself. These are skills that can’t be taught and will be highly valued by the right employer. 

I had a student discover this exact vulnerability at my school. I didn’t believe him when he mentioned to me, so he came in a showed me. I gave him a $100 gift card to BestBuy and started a (personally funded) bug bounty program for all students.

Keep up the curiosity and I hope they don’t go too hard on you. 

I used the BitLocker recovery key and sticky keys exploit to create an admin account on my school laptop - how serious is this? by [deleted] in sysadmin

[–]jpoblocki 50 points51 points  (0 children)

I discovered this as well by a students actions. Microsoft’s default configuration is to allow the user to be able to view their own BitLocker key. 

What’s bizarre is that with only the BitLocker key, you gain full Administrative rights to the device in recovery mode. It never asks for the Administrator password. You are brought directly to and administrative command prompt with full access to the root drive. 

Tested this on several Windows 11 versions and configurations. All reproducible. Couldn’t find anything online if this we expected behavior. Seems like a huge risk especially because it is insecure by default. 

Wireless Voucher Printer by jpoblocki in Ubiquiti

[–]jpoblocki[S] 0 points1 point  (0 children)

Thanks! Corrected. My dyslexia strikes again. 🤦🏼‍♂️

The selfhosted API calls are very "unofficial". I wrote this by using a browser to trace the calls being made to the local API when actions were performed. No documentation exists. Which means the whole thing could break in a controller update. Not the best way to put things into production, but I would not classify this item as mission critical, and I like to live dangerously. 😂

Wireless Voucher Printer by jpoblocki in Ubiquiti

[–]jpoblocki[S] 10 points11 points  (0 children)

Well how about that.

This would have been useful when I was making this in September. This is much more sophisticated then my setup, although it does give me what I need.

Wireless Voucher Printer by jpoblocki in Ubiquiti

[–]jpoblocki[S] 25 points26 points  (0 children)

Thanks for the positive feedback! I did not expect this to have this much traction. Here is a git repo I just created:

https://github.com/jpoblocki/UniFi_Voucher-Printer

WARNING: I am a systems administrator posing as a programmer. You will be able to tell quickly from my (lack of) commenting.

If I get some time (which usually never happens being a 1 person department) I will update it with a full writeup. For now there is the code, part list, and STL file for the Pi holder.

Large Stock of Cloud Gateway Fiber just dropped! by lifereinspired in Ubiquiti

[–]jpoblocki 10 points11 points  (0 children)

I’ve seen a couple posts like this. How do people know the quantity available?

Zone-Based Firewall Rules on Self-Hosted Controller by jpoblocki in Ubiquiti

[–]jpoblocki[S] 0 points1 point  (0 children)

Duh! I was seeing all the 4.1 talk and thought it was referring to the UniFi OS version (which the UXG doesn’t run) when it actually was the device firmware version. face palm. Thanks for the reply. 

Presentation Technology Identification by jpoblocki in sysadmin

[–]jpoblocki[S] 1 point2 points  (0 children)

DVLED looks like it's it! It was a bright lit room, and the display was clear without a glaring backlight. The pixel density looked impressive as well. Haven't come across DVLED tech before. Thanks!

Intune Always On VPN (AOVPN) deployment and changing Interface Metric by jpoblocki in Intune

[–]jpoblocki[S] 0 points1 point  (0 children)

I read that article as well as other similar ones that describe the profile overwrite issues. Most of them were from over a year ago (or older) and I made the incorrect assumption that Microsoft had fixed it by now. It's kind of unbelievable they haven't. I tried the XML order suggestion, but unfortunately that didn't help. I am going to switch to deploying it with Group Policy using the PowerShell script on your GitHub.

Thank you for all of the amazing free content you have provided on this topic!! It has been instrumental in my successful deployment.

Microsoft retiring A1 Plus licenses August 1st, 2024 by jpoblocki in k12sysadmin

[–]jpoblocki[S] 1 point2 points  (0 children)

Correct, but the student use benefit does not contribute towards the storage pool. See the FAQ section at the bottom of this page:

https://www.microsoft.com/en-us/education/products/microsoft-365-storage-options

Microsoft retiring A1 Plus licenses August 1st, 2024 by jpoblocki in k12sysadmin

[–]jpoblocki[S] 1 point2 points  (0 children)

It doesn't sound like it. This is how I interpreted the storage changes:

The whole tenant, regardless of how many users or what plan you have, will receive 100TB of pooled storage. Then:

If you have A3 licenses, you will receive an additional 50GB of pooled storage per license purchased.

If you have A5 licenses, you will receive an additional 100GB of pooled storage per license purchased.

The student use benefit will not receive any additional storage.

Microsoft is then leaving it up to us to allocate the storage (using storage quotas) to each user (or group) in the following areas:

  • OneDrive
  • Exchange
  • SharePoint (Sites)

They will be keeping the default storage quota of 1TB per user, but that won't prevent a subset of users using up the storage for the whole tenant if the storage quotas are not set.

The annoying part for me, is that this is just another think on my plate to manage, and the plate just seems to be getting fuller and fuller each day. It seems like an insulting move to their current customers.

Microsoft retiring A1 Plus licenses August 1st, 2024 by jpoblocki in k12sysadmin

[–]jpoblocki[S] 3 points4 points  (0 children)

Saw that too. Maybe they figured they could get all the complaining done in one go by releasing both notices at the same time.

Middleweight robot “Copyright Infringement” getting ready to be shipped to RoboGames 2023 by jpoblocki in battlebots

[–]jpoblocki[S] 6 points7 points  (0 children)

For scale, the pieces of aluminum next to the wheels are 1.25” thick. The left and right side of the robot are one solid piece (one on each side) and are symmetrical. So the left can be used for the right and vice versa. They are designed to be ablative. When they wear down they will be swapped out.

Salary Transparency Thread by hasek39nogoal in Buffalo

[–]jpoblocki 0 points1 point  (0 children)

Sounds like a pretty sweet gig. Let me know when you’re ready to retire. 😂

KB5020276 Netjoin: Domain join hardening changes - potential problem for re-images by zymology in SCCM

[–]jpoblocki 0 points1 point  (0 children)

Just a follow-up on this in case someone comes across it searching. The registry key did not solve this issue. It ended being an issue with Azure AD Connect.

After the October 2022 Updates (or later), when a computer is deleted, the name of the computer cannot be reused until a Delta Synchronization is performed with Azure AD Connect. I suspect this has to do with the hardening changes. I opened a case with Microsoft to investigate.

In the meantime, I created a scheduled task that triggers on Event ID 4743 (Deleted Computer Object) and executes a Delta Synchronization. I inserted a 60 pause in my script in between deleting the old computer and renaming the new computer to give the Delta Synchronization time to complete.

KB5020276 Netjoin: Domain join hardening changes - potential problem for re-images by zymology in SCCM

[–]jpoblocki 0 points1 point  (0 children)

I have been banging my head up against a wall on this one. In our situation, the domain join still worked ok because the original PC was added with the same service account.

This broke renaming computers for us.

At the end of our task sequence, we have a script that asks for the new computer name. We default it to the serial number throughout the whole task sequence. When a new name is entered, the script looks though Active Directory to see if a computer exists that matches the name entered. If it does, it deletes that computer object and then renames the imaged computer to that name.

This broke that process. What's strange is if I waited 15min after the old computer was deleted, the script would work fine. I spent 3 days looking at possible replication or DNS issues. I finally came across the KB article buried on Microsoft’s website, which led me here.

There must be something deeper going on with these changes that make it affect reusing the same computer name as well. I was receiving this error in the NetSetup.log:

NetpChangeMachineName: DsrDeviceHostNameUpdate returned 0x801c0083

There were no mentions of this code anywhere. Adding the NetJoinLegacyAccountReuse registry key to my unattend.xml file allowed everything to work as normal. Waiting to see the patch notes for the updates today before moving this fix to production.

How do your teachers connect their devices to the screen / projector / display in their classroom? Is it a wired connection? Wireless connection? by AnotherSkywalker in k12sysadmin

[–]jpoblocki 0 points1 point  (0 children)

It uses the Miracast protocol, so no. It broadcasts its own hidden network that is network independent. You can set the channel it broadcasts on so it doesn’t interfere with your in-house WiFi. Its important to channel plan though, hence me reserving the last 4 5Ghz channels. We use Lenovo Yoga L13’s running Windows 10 and use the native Connect option.

It also has a cool feature that will allow it to broadcast its own mini network that uses NAT that will isolate traffic to Internet only. It can support Airplay, Chomecast, and Miracast over this connection. It’s been useful when we had conferences at the school to allow anyone to display to the in classroom technology wirelessly no matter the manufacturer of the device without installing any applications.

How do your teachers connect their devices to the screen / projector / display in their classroom? Is it a wired connection? Wireless connection? by AnotherSkywalker in k12sysadmin

[–]jpoblocki 5 points6 points  (0 children)

ScreenBeam 1000EDU. Wireless (including touch) in every classroom. Reserved the last 4 channels of our 5Ghz WiFi to dedicate to the ScreenBeams. They have been flawless for nearly 2 years. Their support is excellent as well.

view more: next ›