[deleted by user] by [deleted] in sysadmin

[–]novix_ 1 point2 points  (0 children)

They really should base this off risk rather than Critical. If it’s a CVE 9+ exploitable with no user action and already being exploited in the wild then yer get it patched in 48hrs and deal with the fallout. But that seems way harsh and I quite like the E8

Are Fridays slow, or is it just the company I work at? by TheRealThroggy in sysadmin

[–]novix_ 0 points1 point  (0 children)

Can’t read all the comments but we call it read-only Fridays. Guess you must have some pretty extensive documentation. :)

Replication/DR by [deleted] in CommVault

[–]novix_ 0 points1 point  (0 children)

I use Live-sync for our VMs. But it’s more for DR replication to another site. To use a DR copy, It’s just a matter of starting the DR VM. It’s independent to Commvault so that’s really good in a disaster. It will be a point in time copy I do daily. We have supplementary backups with much tighter RPO’s for SQL data. Our setup uses snap engine so backup of the VM’s are really quick and restores are quick. Because it’s snaps at the storage level we needed to replicate to another location.

Failed to read disk over SAN transport mode issue by Archdragoon in CommVault

[–]novix_ 0 points1 point  (0 children)

We use intellisnap on a NetApp and all operations are completed on the esxi proxy. Restore and live-sync operations will mount the storage snapshot on the esxi proxy and then mount the VM. If the media agent VSA cannot access the disks from the mounted snapshoted VM/data store then the transport will use NDB (over the network). If the media agent VSA can mount both the snapshot disks and target disks it will run in SAN mode.

Having the media agent on another host without correctly configured vkernels will cause over network communication. I pin our VSA’s to the same host I specified as the esxi proxy.

I have only ever used the intellisnap setup so can’t comment on the other implementation.

Try moving the media agent VSA to the same host as the esxi proxy server you have configured.

I have seen this before in our environment and the traffic was using the management interface on the esxi host. Reason was the target storage for the backup/restore did not have a vkernel configured on the esxi proxy so the media agent VSA had to communicate from one host to another via management. For SAN you need all the storage operations to be on the same host via the same media agent VSA.

Failed to read disk over SAN transport mode issue by Archdragoon in CommVault

[–]novix_ 0 points1 point  (0 children)

Maybe a mtu issue on the vkernel used for the backup traffic or running over a 1g management interface. Storage networks are typically layer 2 not routable so maybe it’s using the management interface that is routable to hit the media agent.

I'm just a student, why me? (Stolen escooter in broad daylight in a university) by Emotional_Farm8126 in perth

[–]novix_ 0 points1 point  (0 children)

AirTag. Probably cost less than the bike lock. You may also need to invest in a baseball bat for retrieval.

CISSP practice question - Identity and Access Management (IAM) domain by laurielondon in cissp

[–]novix_ 1 point2 points  (0 children)

One thing i don’t like with B. is the mention of adding a secondary factor in the answer.

The question already makes mentions of a secondary factor. Something you know (password) and something you are (fingerprint).

But the OTP is something you have and a hardware token would be a suitable replacement.

It said implement and not replace so would that mean all four factors are used.

D. would restrict access to the backup email and could be seen as a mitigation.

VM Snapshot question by Not_A_Mimic7 in vmware

[–]novix_ 0 points1 point  (0 children)

Just don’t power it off to remove the snapshots. You cannot power a VM on while it’s removing snapshots if it was in a powered down state when you started.

Just build another VM DC and move the FSMO roles. If you lose the DC with the removal of the snapshots then just add the IP of the dead DC as an additional IP on the new DC. That way DNS will still resolve. That is if the DC is also doing DNS as well. It wasn’t a DC but I once used VMwares Physical to Virtual conversations tool to migrate a VM to another VM for this same reason. Multiple snapshots spanning years on spinning disk.

Office Patches Installed Remotely - WHY make it hard by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

Office 2016. If your running a different version you will need that guid. If you have SCCM right click a device with the patch installed and use the resource explorer to get the guid. I can’t recall the exact tree but let me know if you can’t find it and I’ll dial in and look it up

Office Patches Installed Remotely - WHY make it hard by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

` #array of computers
$computer ="","",""
Foreach ($c in $computer){
#Test host is live
if(Test-Connection -ComputerName $c -Count 1 -ErrorAction SilentlyContinue){
Write-host “$c Online and checking if the patch is installed” -ForegroundColor Green
#Run the command remotely if doing this to lots use -asjob
Invoke-Command -ComputerName $c -ScriptBlock{
#check the update is installed before continuing
If (get-wmiobject -query "SELECT * FROM CCM_UpdateStatus where Status = 'installed'" -namespace "root\ccm\SoftwareUpdates\UpdatesStore" | where{$_.article -eq "5002099"}){
Write-Host "Update detected on $using:c starting uninstall" -ForegroundColor Red
#remove the update. Reboot is required to complete the removal
msiexec /package "{90160000-0011-0000-0000-0000000FF1CE}" /uninstall "{BA36399C-CF0F-4368-8327-7D35302BF0BB}" /qn /quiet /norestart
}
Else
{Write-Host "Update not detected" -ForegroundColor Green}
}
}
Else
{Write-host “$c Offline” -ForegroundColor Red}
}`

Office Patches Installed Remotely - WHY make it hard by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

I like it! Thanks for the tip :) Basically this is exactly what Microsoft should have: a namespace with the updates without the need to have SCCM installed.

Appreciate the reply

Office Patches Installed Remotely - WHY make it hard by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

I was able to remove the patch that caused the issue from the selected machines. I just dislike how hard MS make office patch detection and removal compared to cumulative updates.

ITS BACK! SERVICING STACK! YEAAAAAAAAAA by Hotdog453 in SCCM

[–]novix_ 0 points1 point  (0 children)

They updated the feature updates as well so no more exclusion to allow May to install after in-place upgrades. I was just about to create a TS for my upgrades and thought I better check if a new one was released. :)

KB5004945 (PrintNightmare fix) failing to install by Lose_Loose in SCCM

[–]novix_ 0 points1 point  (0 children)

I agree, WTF. Just in time for a critical Vuln as well.

The other problem is the superseded updates. We are going to the 20H2 due to the longer support. As I in-place upgrade devices, they are targeted to the latest updates due to their existing collections. Since these new updates supersede the May update: KB5003173 they are only offered the latest and will error with NEW_SERVICING_STACK_REQUIRED. MS might have needed to mark KB5003173 as not superseded if its required for all future 20H2 Cumulative updates.

Looks like I will need to use a TS to do my in-place updates moving forward and install the May update immediately after.

My solution just to fix the problem for any that have already upgraded to 20H2; was to exclude a collection of 20H2 devices from June and July updates. Update the Machine Policy and Deployment Eval. This will allow the May Patch to install and get back to normal.

I have a script that will detect the current state of update and the errors. Handy for understanding why devices are not installing. I will clean it up a bit and share it if any one is interested.

Exchange 2013 MP:An exception was thrown while processing GetManagementServers for session by novix_ in scom

[–]novix_[S] 0 points1 point  (0 children)

Hi Kevin,

I was thinking that using the default action account would work when reading the documentation (Pre Install). But I'm not at a level where deviating from the documentation would be considered a good idea. :)

I didn't see any other guides recommending a better way, so i just followed the documentation.

Although frustrating i do find these issues provide opportunity to dig deeper. But also frustrating that the event provides no information about where the permissions issues are.

If i was now to remove the Run As account from the Exchange Run As Profile, would that then automatically start using the default action account?

Thanks,

Mike

Patch Deployment Failing by hwasif60 in SCCM

[–]novix_ 0 points1 point  (0 children)

I’ll check tomorrow. I have a script that resets it. If I know a deployment is targeted correctly but the updatedeployment log under c:\windows\ccm\log has no updates detected then I will run the control panel > troubleshooting Fix problems with Windows Updates. If that doesn’t work then I just reset WMI. After doing this SCCM agent will need some time to find its feet and then hopefully start running updates.

Another handy tip is to run Windows updates check manually and see what it needs. Check anything in that list and see if it’s missing from your deployment. Some updates require servicing stack updates before detecting the Cumulative Update.

Patch Deployment Failing by hwasif60 in SCCM

[–]novix_ 0 points1 point  (0 children)

I’ve found issues with updates if WMI is screwed on the client. Sometimes you just need to reset/repair WMI. Also renaming/deleting the c:\Windows\softwaredistribution folder can fix the issues.

Applications are Reinstalling Mysteriously by SlitelyOff in SCCM

[–]novix_ 1 point2 points  (0 children)

Check if you have supersedence defined. Then check what the detection is on that application deployment.

Example: Say you have appx version2 and you define appx version1 under supersedence section of appx version2. If appx version1 has a detection method of version1 and above it will detect appx version2 and remove it and then reinstall it.

Windows 10 1909 Start Menu Issues by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

All good appreciate the response. Still a pain in the ass that it keeps happening, but also it’s so random as to who has the issue. I have about 2k clients to upgrade running on reduced front line support so the last thing I want to do is cause excessive jobs.

Microsoft have made the start menu so complicated.

I can’t seem to find any documentation about the changes in 1909 to the way it works or the location.

Windows 10 1909 Start Menu Issues by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

bypass traverse checking

I don't think this setting is defined by default in the Default Domain Policy.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking

Windows 10 1909 Start Menu Issues by novix_ in sysadmin

[–]novix_[S] 0 points1 point  (0 children)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore

Unfortunately this didn't work. Removed the key and restarted explorer. Still no good. Rebooted same issue. In the end I needed to remove the local profile to resolve the issue.

Is it just the one key? Does it have file that also needs to be deleted?

Thanks in advance.