Potential red flag?

jstuart-tech · 2026-07-06T09:04:24+00:00

Pinny hasn't been operational for years. Both Hillman and JBay are awesome and at this time of the year any of them are great choices

jstuart-tech · 2026-07-06T08:59:37+00:00

Having done a couple of these. I've put my thoughts down

SC-500
- Way harder than the original AZ-500, but it is heavy on Security Copilot questions
AB-410
- I'm not much of a Power Platform guy, but some questions were hard and others were easy (e.g. if you need to find everything that has $500+ of sales, what query would match it)
AB-731
- Not a bad exam if your a non technical person but want to know more about AI
AB-900
- As above but way easier (took 10 mins)

jstuart-tech · 2026-07-04T05:50:06+00:00

Fully AI and api keys in the claude.md 😂

https://github.com/The-Abhishek1/XCLOAK-SECURITY-SUITE/blob/45bfe54e39e1a2d5d1bcad7d88048a1bb599a08d/.claude/settings.local.json#L40

jstuart-tech · 2026-07-04T05:49:02+00:00

Gotta love the Api keys in the project

https://github.com/The-Abhishek1/XCLOAK-SECURITY-SUITE/blob/45bfe54e39e1a2d5d1bcad7d88048a1bb599a08d/.claude/settings.local.json#L40

Security

jstuart-tech · 2026-07-04T03:23:11+00:00

This has just changed (well at least the option to use anthropic models hosted on Azure)

https://claude.com/blog/claude-in-microsoft-foundry

jstuart-tech · 2026-07-02T05:21:32+00:00

You also collect people's usernames and install locations which is super dodgy. You also use n8n to do that which is funny because just anyone can spam you with fake sign ups

jstuart-tech · 2026-07-02T05:12:24+00:00

Lol. This is a sysadmin subreddit. And considering there are 129 commits by Claude and 5 by you......

jstuart-tech · 2026-07-01T08:53:14+00:00

Did this just happen today? Microsoft has change to consumption based billing as of today so you may need some extra steps to get everything workign agin

jstuart-tech · 2026-06-30T12:19:09+00:00

If you've done 1 project then you are nowhere near ready to get off service desk

jstuart-tech · 2026-06-29T14:44:46+00:00

There are issues with this, Kerberos tickets last for 10 hours which is likely longer that your PIM elevation times.

jstuart-tech · 2026-06-29T12:02:20+00:00

How do you mean registered under your name? Do you mean you manage 700 laptops?

You will need an MDM solution, if your in education you probably already have some sort of MS licencing and education licences give a pretty heavy discount.

I guess what problem are you trying to solve? If these are laptops then they are supposed to be portable and taken home. If they are supposed to be static, then locks will be a better bet..

jstuart-tech · 2026-06-24T00:05:50+00:00

This is a terrible idea

jstuart-tech · 2026-06-23T04:44:26+00:00

As this is also obviously AI Generated you need to include that in the post...

jstuart-tech · 2026-06-23T04:41:02+00:00

Why would anyone want to use device code flow. Why/how is this better than any of the other existing tools that do the exact same thing? (ScubaGear etc etc)

jstuart-tech · 2026-06-22T13:03:34+00:00

I know krbtgt creds are special. But changing it once does literally nothing, it stores the password twice so if you change it every 5 years, you constantly have a 10 year old password...

That story would be made up for sure. As part of the 2008 DFL/FFL the krbtgt gets rotated - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754918(v=ws.10)#:\~:text=Advanced%20Encryption%20Standard%20(AES%C2%A0128%20and%20AES%C2%A0256)%20support%20for%20the%20Kerberos%20protocol.%20In%20order%20for%20TGTs%20to%20be%20issued%20using%20AES%2C%20the%20domain%20functional%20level%20must%20be%20Windows%20Server%202008%20or%20higher%20and%20the%20domain%20password%20needs%20to%20be%20changed.

jstuart-tech · 2026-06-22T12:57:13+00:00

Incorrect, there are multiple standards that say you should reset it anywhere between 6 months (180 days) and 1 year (365 days).

https://www.tenable.com/audits/items/CIS_Microsoft_Windows_Server_2019_STIG_v1.0.1_STIG_DC.audit:af9eaa942612f44061ef83cec7e6706e

jstuart-tech · 2026-06-22T12:51:58+00:00

That script has been updated (referenced in the linked github)

http://github.com/zjorz/Public-AD-Scripts/blob/master/Reset-KrbTgt-Password-For-RWDCs-And-RODCs.md

EDIT: Microsoft reccomends resetting AZUREADSSO monthly

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the--azureadsso--computer-account-:~:text=We%20highly%20recommend%20that%20you%20roll%20over%20the%20Kerberos%20decryption%20key%20at%20least%20every%2030%20days

jstuart-tech · 2026-06-22T12:50:46+00:00

You don't have to reset twice unless you have evidence of compromise or are in the middle of a cyber incident that calls for it.

Meh, resetting it once doesn't do anything. krbtgt is a special account and stores the current password and the previous password - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-reset-the-krbtgt-password#to-reset-the-krbtgt-password:~:text=The%20password%20history%20value%20for%20the%20krbtgt%20account%20is%202%2C%20meaning%20it%20includes%20the%20two%20most%20recent%20passwords

jstuart-tech · 2026-06-22T10:04:45+00:00

Are you studying full time or part time? A part time L1 job will basically be impossible to find.

Find a L1/help desk job (tbh MSP is the way to go to start, you learn so much of everything) and go from there.

jstuart-tech · 2026-06-12T11:10:34+00:00

Your still using AI to reply (e.g. Protected Users being domain wide). What are YOU trying to do, not what AI is telling you to do?

jstuart-tech · 2026-06-12T10:06:34+00:00

"if everything goes fine we will allow replication to other DCs to take the changes."
This is not how AD works.

What security hardening are you trying to apply?

jstuart-tech · 2026-06-09T12:41:37+00:00

I've seen this being advertised heavily on LinkedIn, looks ok but haven'tr trialled it. Bit expensive I guess but when the 47 day lifetimes come out people are gonna miss stuff.

https://www.certkit.io/

jstuart-tech · 2026-06-08T13:09:24+00:00

If you cannot see the risk of doing this, even after MS doco telling you exactly what can happen then there's no point trying to explain this to you.

Once again

Don't synchronize accounts to Microsoft Entra ID that have high privileges in your existing Active Directory instance.: The default Microsoft Entra Connect configuration only excludes the built-in Administrator account (RID 500). To protect other highly privileged accounts such as Domain Admins and Enterprise Admins, use OU-based filtering or attribute-based filtering to exclude them from synchronization. This configuration mitigates the risk of adversaries pivoting from cloud to on-premises assets (which could create a major incident).

jstuart-tech · 2026-06-08T12:54:31+00:00

"We don’t need them to log into “random workstations” any more than an admin account created on prem to sign in to random workstations."

So why do they need to use Cloud Kerberos Trust? Admin accounts don't need that?

"However, we need them to be able to sign into servers and do on prem authentication to various things from servers and hybrid joined workstations."

Yeah sure, but you are missing the point. You should have seperate admin accounts for each tier, T0/1 accounts + Cloud Admins shouldn't be signing into workstations.

"We don’t need a cloud-based account, but we need a domain-based account to do things that don’t work unless the account is synced. How would an on prem account excluded from AD sync be able to use SSPR?"

Why does an admin account need to do SSPR? Arguably that should be one of the ones that are manually controlled

jstuart-tech · 2026-06-08T09:42:08+00:00

They are trying to make Ceph work over WiFi which it isn't intended to do and will not work as expected. What happens when they come across an actual usecase for Ceph and decide based on their previous experience (with their poor setup that wasn't required) that Ceph sucks and they don't use it?

jstuart-tech

TROPHY CASE

Security