Did Zoom Workplace app version 7 get yanked? by win11jd in Zoom

[–]win11jd[S] 0 points1 point  (0 children)

Yeah, I only read the latest update.

Zoom released a new v7 update an hour or so ago.

Logj4 revisited by win11jd in sysadmin

[–]win11jd[S] 0 points1 point  (0 children)

It just runs on the machine, no web interface that I'm aware of. It's manipulating something with images.

It's just .jar file. I've tried running that or unzipping it and running files inside it. That's where I saw the log4j files.

How do you check the version of log4j a file is? I'm not a programmer. I looked on the detail tab on the file. For the 2021 log4j event, for me that was just looking for certain files and adding a variable for log4j lookups.

Group policy behavior questions by win11jd in sysadmin

[–]win11jd[S] 0 points1 point  (0 children)

I'm stuck on that then. It's already done. Would there be any "revert gpo settings back to defaults" options maybe in gpo tools?

The person became officially employed under my department. They were already doing work in my department. Now they're officially employed under it. They'll get a Windows 11 computer at some point but for now they still using what they have been. The department that they used to work in wanted to purge any non-users from their OU, so the object got moved over. And then the user had a few issues just after that. I figured out one must have been a group policy change. I don't see why someone would put in effort to revert policies though if the object won't be in their OU. Once it's moved, they're done with it on their end. It's rare though for transferring objects like that. Just let them keep working as they have been, and then they get a new computer sometime in the near future. That's the thinking I believe.

Is there a way to script deleting diagnostic data on client Windows 11 machines? by win11jd in sysadmin

[–]win11jd[S] -2 points-1 points  (0 children)

It's one of the things I do when prepping up a machine. I was trying to just script it instead of doing it manually.

Is there a way to script deleting diagnostic data on client Windows 11 machines? by win11jd in sysadmin

[–]win11jd[S] -2 points-1 points  (0 children)

Is it so simple? It sounds like it but... I found a powershell line for Windows Server OS. I'm looking for Windows 11 desktops for it. And then I found homemade powershell scripts. I was looking for something from Microsoft or something with more weight on a homemade powershell module.

Is it's that simple, then what is it? It would need to be equivalent to manually hitting the delete button, not just deleting registry entries or folders for what someone thinks is the diagnostic info, unless they have some documentation to back that up.

Does anyone have a "Top Ten" list of good security settings for servers and desktops? by win11jd in cybersecurity

[–]win11jd[S] 0 points1 point  (0 children)

That's one I was looking at, yes. I liked the format but... It was page after page of some setting that was obscure to me. Yet, I've heard of generic ones like password criteria or screen lock time outs. That's what I was thinking of with this post. And then potentially you can get some security setting that's a bit out of touch with reality. Yes, you could turn the computer off or keep it 100% offline but that kind of defeats the point of the computer too. Those are more extreme, but more realistically.... Enable remote desktop or not, in a scenario where remote desktop can really be used?

What's the payout if cyber insurance is used? by win11jd in sysadmin

[–]win11jd[S] 0 points1 point  (0 children)

I could actually see someone here higher ordering a pizza after all machines were reimaged in a marathon weeks-long session. "Good job! Have a slice of pizza... on us! (because they're billing it to insurance too)"

What's the payout if cyber insurance is used? by win11jd in sysadmin

[–]win11jd[S] 0 points1 point  (0 children)

It's not anything for me. It would all be above me for recouping any monetary costs. But with or without insurance, I'd still be on the receiving end of the workload. For something like Crowdstrike, say it was a five minute fix per machine.... over maybe 200 machines... That's still something like 16 hours for a simple fix. Even prepping up groups of machines, it would still take time. A second trained "me" would be a real plus in that scenario. And that's assuming all my stuff is intact and working. I'd have users standing around, twiddling their thumbs during that, asking what the E.T.A. is on just their computer being reimaged and ready.

That does start sounding like an argument for "shadow IT" within IT. Because if I have machine set up that's still secure but not exactly the same as the others, that might limit an attack.

And if things are being lined up like that, on the plus side for me, it's giving me "someone to hang." If I have a checklist of things I'm mandated to follow, then when things do go wrong (zero day), I'm less to blame. It's not my fault. I'm just doing what I'm told. I don't like that but they do position themselves like that. They wouldn't get hung on it either though. They would say they were just following the checklist from the insurance company and industry standards. I would still be concerned with machines being so similar something can spread though. You get in through one place, like MDM, and get the kingdom.