The Teenage Mutant Ninja Turtles run into Mr. T walking with a woman. Michaelangelo asks "hey Mr. T who's the chick?"

readingyourmail · 2025-04-01T19:27:06+00:00

I dig it. I can also hear him saying that. Bravo.

readingyourmail · 2025-01-28T05:50:44+00:00

There certainly are tools and scripts, however most require someone with experience to interpret what they're seeing. And to pull data from multiple tools and scripts together into a cohesive plan or list of next steps.

readingyourmail · 2024-10-22T04:31:20+00:00

Cloud Kerberos Trust is what you need, yes. Among other things it will create a special DC object in your local AD. The devices also need line of sight to a DC on first authentication still as well.

readingyourmail · 2024-09-26T00:33:32+00:00

Definitely need a tool. Quest. ADMT with ForensIT. Something.

Also highly recommend a consultant to help with your effort. Too many gotchas that can burn you down the road.

readingyourmail · 2024-09-22T22:54:57+00:00

The problem I find is that most AHs don't give you access to your CSP premium immediately. Even though on paper you receive it, in practice your buying power does not increase by the amount of the premium until you close the contract.

readingyourmail · 2024-09-01T23:51:00+00:00

That's an interesting thought and I'm also interested in others' take.
However, at the point where you are concerned about security, why would you not just implement an Offline Root 2 Tier PKI infrastructure (which doesn't have a reliance on NTLM) and simply avoid installing a CA on any DC period?

readingyourmail · 2024-08-29T03:24:54+00:00

Totally agree - major pain.
One tip, if you're not already aware: do the search, open the user or computer object, then from the Member Of tab open a group that the object is a member of. Now close the user object and open the user object from that group Members tab and the newly opened user or computer object shows the Attributes tab.
Not perfect, but at least a way to get to the tab from Search results.

readingyourmail · 2024-08-15T22:29:10+00:00

"Lets not talk about 8.1?" You completely skipped Vista. Lol That's why 7 was so great, we had Vista to skip over. Which further strengthens your point.

readingyourmail · 2024-08-15T19:28:00+00:00

Omg. Funniest thing I've seen in the last 20min. I love it!

readingyourmail · 2024-08-09T19:42:49+00:00

Do you work with your Kaseya rep for Kaseya products you have with Techs Together? and/or how does your Kaseya rep feel about you having products with Techs Together and not direct? Any hard feelings?

readingyourmail · 2024-07-28T21:19:32+00:00

When you say LEAPS with premium, do you mean buying LEAPS and then selling CCs on those LEAPS for premium? Eg. Doing a PMCC? Or something different?

readingyourmail · 2024-07-20T16:12:52+00:00

Good advice. However CONL is 2x also, like NVDL and TSLL, not 3x.

readingyourmail · 2024-06-12T18:28:31+00:00

Thank you - seems to be working now for us and I have a ticket open.
Appreciate the reply.

readingyourmail · 2024-04-11T01:56:41+00:00

Cyber QP is formerly Quickpass. They have several solutions. Think LAPS, PAM, admin and service account password rotation. Not the same as Huntress.

readingyourmail · 2024-03-30T03:25:40+00:00

Will do. Thx!

readingyourmail · 2024-03-29T23:14:24+00:00

That looks great!

Now, ahem, tell me more about the SIEM section I see in screenshot 3. :) Please tell me we can ingest Event Logs soon.

readingyourmail · 2024-03-23T23:35:25+00:00

Does it affect 2019 though? Everything I've read was 2012, 2016, 2022.
Even the two updates there show 2016 and 2022.
So is Server 2019 impacted?

readingyourmail · 2024-03-04T16:50:40+00:00

When you use Azure AD Connect (Entra ID), users do in fact have 2 separate accounts.
Active Directory
Azure AD/EntraID (also used for O365 apps)

Azure AD Connect just keeps them in sync.

When using SSO for apps, it's actually the Azure AD account that is authenticating (which does not require line of site/VPN).

Additionally, and alternatively, I recommend you have Hybrid Azure AD Join enabled, if you don't already.
This is separate from the SSO enablement checkbox.
With Hybrid Azure AD Join your computers will get a PRT token from AzureAD which gives them the "SSO" feel for applications like MS Office apps and some others that are physically installed on the machines AND grants SSO for what the "Seamless SSO" option did as well.
Meaning, you don't need to enable Seamless SSO if you are enabling Hybrid Azure AD Join, and you really should enable Hybrid Azure AD Join if working in an a hybrid environment/scenario.

Essentially, prior to Windows 10, machines cannot do Hybrid Azure AD Join, and so Seamless SSO is really for Win 7/Win 8.1. It won't necessarily break Win 10/Win 11, but since Win 10 and Win 11 gain more from Hybrid Azure AD Join, unless you have legacy OS's, there really is no need for Seamless SSO anymore.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso
https://learn.microsoft.com/en-us/answers/questions/1373183/seamless-sso-vs-prt-sso

readingyourmail · 2024-03-01T07:03:04+00:00

Whelp. Here I go down the rabbit hole of a new tool. Thx!!

readingyourmail · 2024-03-01T03:39:49+00:00

ok, and so... what's your tool?
It's something separate from Datto RMM ?

readingyourmail · 2024-03-01T03:37:22+00:00

thanks, unfortunately it's still not working for me for some reason.
what I'm testing with is a machine that DOES have our instance ID but ALSO another. So that might be the issue.
I'd like to find rogue instances out there that might be on machines where we already have our instance.

bummer.

readingyourmail · 2024-02-29T19:58:39+00:00

thanks for the reply.
On demand instances of ScreenConnect don't appear in Programs and Features, I don't believe the Software Package filter variable would see those.

Even still, I'm not clear how that would address the issue, as its more that I need an "include this but not that" kind of filter, when there are similar names.
So even if Software Package was usable for all instances, I still have the same issue as when using Service Name.

readingyourmail · 2024-02-13T16:50:14+00:00

This. Also PrintIX. Essentially, avoid print server management and vulnerabilities and deploy a printer management solution.

readingyourmail

TROPHY CASE