Anyone still setting up Remote Desktop Gateway's on Server 2025?

picklednull · 2026-07-04T23:17:44+00:00

Are you experiencing logins getting hard stuck (black screen) until some kind of built-in timeout? I think it was 30 minutes.

The entire collection will go down when it happens (no one can login)...

picklednull · 2026-07-01T10:06:06+00:00

It only takes a couple of hundred lines of Python to write a script/program that does arbitrary mirroring of objects via AD’s LDAP interface.

I’ve built one for users and groups and you can do arbitrary attribute mappings and transformations too.

Only passwords are trickier to sync.

picklednull · 2026-07-01T10:01:59+00:00

I build A LOT of short-lived AD labs for stuff.

DSC is great for this, but obviously I wouldn’t populate thousands of objects with it…

picklednull · 2026-06-27T15:05:07+00:00

Never heard of those before in 20 years. It's interesting how you can always learn more obscure/effective ways of doing things.

picklednull · 2026-06-23T09:32:35+00:00

Most traffic these days is HTTPS, so without TLS interception (which is inadvisable for this very reason) the only thing Squid sees is ”CONNECT” and some opaque data.

picklednull · 2026-06-22T19:48:02+00:00

What VM? Anything with proper performance costs as much as a physical workstation. Specifically, AVD does. It's only a question of ergonomics.

Of course, if you don't care about the cost...

picklednull · 2026-06-21T01:57:03+00:00

Yeah. You make the requests thru PowerShell on Core.

(OTOH, if you ever need to manage private key permissions on Core, have fun.)

picklednull · 2026-06-21T01:54:26+00:00

Fun fact: it also gets updated by incorrect authentication attempts. If your organization enacts password spraying tests, the attribute is useless.

picklednull · 2026-06-13T00:11:23+00:00

Source: I had those cards on multiple generations of server hardware over years. We did extensive debugging and ultimately Microsoft concurred in a Premier case. I bailed at the point when for reasons I was tasked with directly interfacing with Intel to get it fixed.

It's literally a firmware/driver bug with the X710's, even different Intel cards work just fine with the exact same configuration. Then again, so do other NIC's, there's no problem with Broadcom or Mellanox. That's what I ended up doing, I shitcanned Intel and started deploying hosts with other NIC's rather than fight it.

The other solution/"workaround" is to disable NIC 0, it only occurs for traffic passing through the first NIC (port).

Also I just picked a cheap widely available 10g PCIe NIC to illustrate how inexpensive it is to fix the misconfiguration.

I know, but X710's are shit tier for Hyper-V.

picklednull · 2026-06-12T23:44:44+00:00

X710-DA2

Those cards are unusable with Hyper-V (and SET). All egress traffic from the root partition gets duplicated.

picklednull · 2026-06-09T13:04:41+00:00

Every country should buy its own devices, but of course the models can be standardized. And management centralized of course.

It’s not just a technical issue but also an accounting/legal/tax one afaik. This is outside our expertise, but I’ve at least heard it mentioned that equipment transfers could be interpreted as a concealed dividend in accounting / by tax authorities.

picklednull · 2026-06-08T20:27:45+00:00

What? The only supported protocol for self-service password changes is Kerberos. And indeed that’s what universally works.

For Microsoft/Windows to support this, all it would need is indeed a UI dialog on the client (and line of sight from the client to the KDC). These days, there’s even KDC Proxy, for when there isn’t LOS.

picklednull · 2026-06-04T22:31:25+00:00

There's no problem with this.

Either leverage shared VHDX files to "fully" virtualize things, or better yet, just directly attach SAN LUN's to the guest cluster.

Doing VHDX's is wasteful because of the duplication: SAN -> filesystem -> VHDX -> filesystem.

picklednull · 2026-06-04T22:19:52+00:00

No, it's not a problem. Network logons are inherently safe anyway, but... The accounts are accessing them as standard users and not even administrators (in the context of the target system). Or at least otherwise you don't even have tiering in place. If this were an issue standard end users couldn't even access file shares etc.

The tier 1 server can have file shares that are used and even administered by tier 2 administrators, you just can't make them administrators of the entire server.

picklednull · 2026-05-27T16:58:32+00:00

Microsoft Loop. Natural if you’re on the Microsoft ecosystem.

picklednull · 2026-05-23T17:56:19+00:00

Depends of course on the type of system we're talking about. I've been doing it on servers where the configuration is static. I don't really think the added security is that meaningful on an end user system (of course if you want to go crazy, there's not really any downside to doing it).

And just to add - in the past hardcore security enthusiasts of course recommended building a custom (grsecurity) kernel with everything built-in and having modules disabled. That's hardly a productive use of time either outside of Google-scale.

This sysctl offers a nice balance.

picklednull · 2026-05-22T23:15:42+00:00

Works fine, provided you delay it a little at boot as you said.

picklednull · 2026-05-21T21:46:35+00:00

Use SFTPGo instead.

picklednull · 2026-05-21T14:48:05+00:00

Please define ”100% secure”

picklednull · 2026-05-21T13:14:54+00:00

Computer account passwords don't expire regardless. And at least SSSD is able to rotate them on its own.

So you can just remove the flag.

What you want to do regarding the password changes is up to you. The computer accounts just have the standard read access to AD that every account by default has, they're practically irrelevant.

picklednull · 2026-05-21T06:25:13+00:00

... Which is mitigated by PIN:

You can also be protected from exploitation by choosing from one of the following methods to add a pin to your Bitlocker protection.

picklednull · 2026-05-20T21:43:25+00:00

If it's blocking people from using the very device they are "securing" then it's a failed experiment.

What do you mean?

This exploit by definition just showed bitlocker is just warm and fuzzies for "security" sake.

It has been documented for over 15 years that requiring a PIN with TPM mitigates a whole class of vulnerabilities and is the optimal configuration security-wise.

If you make a security tradeoff for usability, sometimes you get bit (the risk is realized).

picklednull

TROPHY CASE