Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Silly Newbie
Jul 25, 2007
How do I?
I was on a call this morning with two directors, and engineer, and three licensing resellers. I was the only person on the call who understood Microsoft cloud licensing.

Adbot
ADBOT LOVES YOU

Silly Newbie
Jul 25, 2007
How do I?
One of my operating companies apparently hired a senior VP like a month ago, but didn't bother to assign our MAM-WE policies or MFA to them. I found out via seeing a name I didn't know via LinkedIn.
Pushing the buttons is not difficult, what the hell.

Silly Newbie
Jul 25, 2007
How do I?
I've been with 8x8 for a couple years and found them easy to work with, if we're talking about similar services.

Silly Newbie
Jul 25, 2007
How do I?

Bob Morales posted:

MSP 'updated' firewall configs without saying anything...have some users complaining about connectivity issues this morning.

xxxxxxx Aerospace & Defense - Ticket #94158 - MS Review - Months 2, 5, 8, 11- (ALL)
Started thorough review of firewall configuration:
- created revision backup prior to making these changes
- Uploaded latest Standard Address List
- Applied latest hardening commands
- Update to latest Security Profiles and upload scripts as needed
- For 6.4 code - updated to latest AV profiles of both Proxy and Flow based versions
- Configured MSP Allow/Block lists and updated spreadsheet
- Applied MSP Allow/Block lists to appropriate policies
- Configure policies in flow mode destined for BFAL-MSP-Subnets with no UTM
- Applied proxy based AV and appropriate UTM to all inbound (Static NATs) and Internet bound traffic
- Applied flow based AV and appropriate UTM to all site to site, LAN to LAN and SSLVPN traffic
- Configured Full Mgmt local-in policy locking down HTTPS, SSH, SSLVPN and routing protocols further
- Verified all VIPs are in an associated VIP group (VIP-WAN1, VIP-WAN2, etc)
- Verified proper Deny Rules are in place including VIP groups
- Reviewed policies including those associated with VIPs to assess any security concerns
- Verified no open RDP configuration is in place
- Removed disabled policies if they are no longer needed.

N.S. Need to continue with firewall review


Chippy McChippy
Network Engineer II
CCNA Security
support@msp.com


Neat, fortinet stuff. Do you get a significant processor efficiency savings using flow based vs proxy based on some policies?

Silly Newbie
Jul 25, 2007
How do I?

Biowarfare posted:

I don't even get the option on win10 at install time if it even vaguely thinks there's an open wlan AP nearby or anything, it needs like x minutes offline with all cables pulled and no internet until you get the option, it's not just a small hidden text link.

Home or pro? Home totally bones you, yeah, but pro you always have the option for domain join.

Silly Newbie
Jul 25, 2007
How do I?

Steakandchips posted:

All fine and dandy, but I guarantee you, once it is up and running, your company will scan to one SP directory or local folder till the end of time, and said dir/folder will grow to hold tens of thousands of scans, such as scan9945667.pdf and it will never be cleaned out and finding anything in it will be impossible.

I'm converting all of the internal scan to folder crap that I inherited to scan to email. I'm not giving them any other options. There's no excuse for them to need anything else in 2022.

Silly Newbie
Jul 25, 2007
How do I?
In my current gig, most of my workforce is union low voltage electricians who run fiber and copper in data centers, underground, etc, that being our business.
It's loving heaven. I haven't bought or made a cable in years, and when I need a new run in the building, or some patch to switch stuff, I just ask. They're happy to do it, they're paid by the hour.
Downside: I'm no longer allowed to cable any poo poo by myself, because it's never pretty enough.

Silly Newbie
Jul 25, 2007
How do I?

Sywert of Thieves posted:

I had my yearly review last week and my boss tried shaming me for occasionally stepping away from the computer during WFH to answer the door, pick up my kids from school, leave early for a doctor's appointment etc. (last december was pretty hectic with my youngest catching Covid at school) and I absolutely wouldn't have any of it. These are unexpected events and if they were structural, I'd announce them earlier. Hell, I *did* announce most of these at the start of the day. Just not at the start of the week. :rolleyes:

Didn't apologize, review went well & got the standard 7% raise.


Yeah gently caress that guy. When I do my project hours forecasting, I assume that 80% of all "work" time is at all productive, because life happens. End results matter. So long as the work gets done, I don't need to micromanage anyone's time, that's bullshit.


DoomTrainPhD posted:

You didn't get a raise. You got a COL adjustment. You broke even.

lol my company is allotting 3.8%. I've given up asking how the hell we're going to retain talent and just started trying to make it up to my team in other ways.
Fuckin private equity.

Silly Newbie
Jul 25, 2007
How do I?

Polio Vax Scene posted:

I love Ofice365 SSO when I only have to work with one login. Unfortunately my work involves working with maybe 5 of them on an average day and NOTHING in the O365 suite takes this gracefully

Chrome, chrome incognito, edge, edge incognito, Firefox. Each maintains their own login sessions.

Silly Newbie
Jul 25, 2007
How do I?

KillHour posted:

Put your finger on the left shift key and drag it to the right shift. Boom - throwaway password that works on nearly everything and takes no time to put in.

I used to use it as the default password on trash VMs I'm going to throw out anyways and it always astounded everyone who saw me do it.

I've got a handful of laptops in the field in the US that I recovered from a closed branch in Ireland.
Turns out, Irish keyboard layouts are different than ours. Not just the symbols on the keys, but some of the key layouts themselves. I'm waiting for someone to get stung on something like this.

Silly Newbie
Jul 25, 2007
How do I?

Thanks Ants posted:

It's the tall enter key vs the short one and moving the backslash and tilde keys around. I struggle to type on a US layout as it turns out I hit enter towards the top.

I had the opposite problem - I apparently hit enter toward the left, and standard US keyboards have a horizontal bar enter. I typed a lot of accidental backslashes, which is oddly what the pound currency symbol remaps to in a US layout.

Silly Newbie
Jul 25, 2007
How do I?

Lum posted:

So I create an SFTP account, get the supplier to send me a public key, all good. My contact at the supplier then passes it on to his developer.

Developer contacts me direct with a screenshot of google chrome failing to load sftp.$Company.com and asks me for the password.

FFS

One of our customers is Verizon. Verizon wants to ship us a bunch of data over sftp. Cool.
They say that I should make a box.com account or stand up and sftp server.
No thank you, I say. I'm a sub-1k person company and you're loving Verizon. I'll run a client on my side and talk to your server. Two weeks of me calling their bluff, they admit to having a server.
They ask me to generate the keys, send them my public key, and give me their QA and Prod server addresses. To get the data that they want me to have.
Cool.
I submit that.
In August of 2021.
According to them they're just waiting on a test file from their dev.
I set up this same system for a different child operating company of mine in July 2021, it took about three weeks. It works well, except that every couple months they forget the public key and have me send it to them again.
I'm working with the exact same people, or at least people who respond to the same email addresses and sound the same on voice meetings, on their side.
They do not remember me.
Fuckin Verizon.

Silly Newbie
Jul 25, 2007
How do I?

Mercurius posted:

Yeah, two months is about the standard for laptops from all of our vendors at the moment. Desktops without discrete GPUs are a bit better, desktops with GPUs may as well not exist.

Outside of standard computers Surfaces are 3+ months stretching out to infinity, docks for both laptops and surfaces are looking June at the earliest. Quite a few of our suppliers have run out of the wireless mice/keyboards we often use and have no ETA on a restock.

Everything is a giant mess right now.

I bought a surface dock from Amazon last week and it arrived two days later. Dell got me my last lot of D6000s in like two weeks, although I couldn't get anything fancier.
Firewalls, though, that's at least a few months.

Silly Newbie
Jul 25, 2007
How do I?
Adobe deleted our company account at 3am Tuesday morning with no warning.
Contacted support, got an "oops, a senior tech will call you in a few minutes!" And an unsolicited refund offer for our inconvenience.
Currently 14 hours into waiting for that callback, with no licensing.
What does everyone recommend for both a PDF editor and a replacement for Adobe Creative Suite for my marketing folks?

Silly Newbie
Jul 25, 2007
How do I?
Update to my Adobe bullshit:
I ended up having to make a new team and recreate all of the accounts and licensing. Fuckers.
Still no responses to my request for a root cause of what made it happen, and finance is checking to see if they billed us for Feb on the old team.

Re: ransomware chat, that take above is absolutely right - if you get stung, you call your cyber insurance people immediately and they deploy someone they hire to handle everything. In addition to covering your liability, this also makes sure you don't do anything during your initial remediation that would make them void the claim.
I had a meeting with my CFO and the cyber insurance people last Friday, then put together a short presentation on "What happens when we get hit" for the CFO and controller on Monday, and now I can spend whatever I want on backups. So that's nice.

Silly Newbie
Jul 25, 2007
How do I?

The Fool posted:

Why are you using a factory load on business computers

Dell's factory load out (on the stuff they send me, at least) is super tight. It's basically Dell Command Update, Office, and that's it.
Going through them direct has also been super smooth, although I get to leverage Core Trust via my parent company, so that may have something to do with it.
Man Core Trust pricing OWNS.

Silly Newbie
Jul 25, 2007
How do I?

incoherent posted:

Tell me your organization is owned by private equity without telling me they're owned by private equity.

I, for one, welcome my private equity overlords.

Yeah it feels a little scummy, but at least they bought a bunch of companies in an already kinda scummy industry and put absolutely no one in my chain of command who has any idea what I do, so I get left alone so long as I adhere to my budget projections.
Being able to build an entire infrastructure from first principles from a standpoint of correct, supportable, and secure, with no one able to try to gently caress with me for political clout, and being able to develop and protect a team is kind of a dream.

Silly Newbie
Jul 25, 2007
How do I?

incoherent posted:

All i'm saying is enjoy the freedom now. They may want to size you and your dept up if they go and drill in some commonality ( like shared technologies in their portfolio like...rackspace 🤢). Coretrust was one of them and for me it was easy to "embrace and extended" as while coretrust give you the cheap hardware these coretrust VARs are looking to make up on implementation projects. I had a stable of VARs and that aggressively quoted projects me and my CT reps couldn't touch.

Hell, they took a loss on a dollar on each office 365 licenses just to wildly swing their knife at any one coming within a feet of my organization.

I had to go to my overlords and ask about their Coretrust, we're getting primed to be sold in 2-5 years, so it's whatever. I haven't even talked to a VAR, the portfolio is big enough that I get the pricing from my Dell rep direct.
I hadn't even thought of leveraging them for 365, and I've been shopping for a CSP lately, so I'll have to check that out.
Every dollar I shave from the estimated budget is a dollar I can shove into another project, or ideally shove into my team's bonus pool.

Silly Newbie
Jul 25, 2007
How do I?
My cyber security insurance providers are among my favorite people on the planet right now.
Turns out it's way easier to get security policies and good hardware in place when I can tell the finance people "if we don't do this, and something bad happens, they won't pay us." And then have them do the math on how much a minimum two week work stoppage will cost in lost revenue and productivity.

Silly Newbie
Jul 25, 2007
How do I?

ptier posted:

Similar. It can sometimes be ok. It's either Cyber Security insurance or "This is the law we have to abide by" is also a pretty decent one (public sector so those actually count).

I've had good luck with those two, and also "I have a signed statement from the previous Director saying we were adhering to these policies, and if Meta/Microsoft/Amazon/etc decides to ask us to prove it, they'll nuke our contracts if we can't" goes a long way.
Making the consequences starkly apparent in terms of dollars works super well if it's a known entity who wants to gently caress you at every opportunity that's going to leverage those consequences.

Silly Newbie
Jul 25, 2007
How do I?

stevewm posted:

Well I just likely ruined someone's day.

I was looking over some of our telecom/internet bills and discovered one of them was charging sales tax. In the state of Indiana internet access/internet services are non-taxable. (http://iga.in.gov/legislative/laws/2021/ic/titles/006#6-10) And indeed, checking all the other providers we use in the state, none of them are charging taxes of any kind on the Internet portion of the bill. Except for this one provider.

I let them know and they responded back it was the first they had ever heard of it. :doh: They are a internet provider... you think this would be something they SHOULD know!

Granted it is not much... but it adds up and by law they should not be collecting it.

I love poo poo like this. I recently got Dell to figure out and quote on my core trust pricing. I'm going to receive my first order, and then ask that they go over my last six months of invoices where their sales rep assured me I was getting my CTG list price, but apparently was not, since it was a three week process to get this last order figured out.
gently caress vendors, call them out at every opportunity.

Silly Newbie
Jul 25, 2007
How do I?
Brand new printer fuckery today.
Our leased Canon MFP suddenly can't scan to email. Call the company, they registered a Gmail account and pass the traffic through there, which no longer works.
I tell the tech I'm going to route it through my O365, no problem. He happily gives me the login credentials, and I'm off.
Except it doesn't work. Same config as on the rest of my Canons.
Turns out this model defaults to 465 for SMTP instead of 25. And changing it can't be done through the GUl, only on the printer itself via a very specific set of key presses to get into a debug menu. Which is only documented by random people on the internet who found it one time.
Works now though.

Silly Newbie
Jul 25, 2007
How do I?
Is there something going around? I had like six sales cold calls today, some of which to a phone number not connected to my title.

Silly Newbie
Jul 25, 2007
How do I?

Arquinsiel posted:

"CEO is too important for MFA"/"Bob in accounting is not important enough for MFA".

Response: please give me that in writing so I can properly attest to our cyber security insurance people.

Silly Newbie
Jul 25, 2007
How do I?

dragonshardz posted:

here we go again with my loving job

earlier this year I used a Windows 11 machine every day for testing purposes and determined that yep, it's Windows, works fine except for the office WiFi

Now Boss^2 wants us to test Windows 11 again, with a priority of fixing the WiFi issue because it must be a bad driver or something, even though the symptoms don't look like a bad driver at all, oh and we have to figure out what exactly needs to be tested even though that's not what we do but "just make Service Desk do it" is the eternal loving refrain

this place sucks rear end and i need to GTFO

At least if the same hardware works with your office wifi on 10 but not 11, there are a severely limited number of causes.

...you guys don't have admin access to the office wifi to test, or any resident experts in wireless authentication, do you? That's not going to be fun.

Silly Newbie
Jul 25, 2007
How do I?

ASAPRockySituation posted:

Is it heretical to map shared network locations by ip when using a vpn because I always do that because DNS is poopbutt and I don't trust it

No, assuming your network engineers are rear end (they are).

Silly Newbie
Jul 25, 2007
How do I?
A cpu fan went dodgy in my girlfriend's 2018 Alienware laptop.
Apparently you have to remove 25 screws and the motherboard to replace a cpu fan. Which, by nature, sits on top of everything else, so it can access the external vents. What the gently caress.

Silly Newbie
Jul 25, 2007
How do I?

Thanks Ants posted:

If you let me specify how I prefer to be contacted, and I pick email, don’t loving phone me 15 minutes later.

365 support?

Edit - I commented without reading. Nice to know that it's the same across the board though.
My current unironic favorite support line is Freshworks. They respond to chat quickly, I often get the same guy somewhere on the Indian subcontinent, and they just do things over chat with high effieicnency. It's like they know that a big part of their customer base did incoming phone call help desk and we all have voice call with strangers PTSD about it.
Honorable mention to GoDaddy, who fixed my issue in the quickest but most hilariously insecure way possible over website chat.
We bought a company who had their own GoDaddy account with domains registered. I need to transfer those domains to our Corp account. I don't have access to the previous owner's personal email, to which a code will be sent to authorize the transfer.
I hit up support, and the answer is that, because I can log into the old account with a username and password, I can just turn on MFA with no other proof needed and use that MFA token to transfer domains. Brilliant!

Silly Newbie fucked around with this message at 07:52 on Jan 8, 2023

Silly Newbie
Jul 25, 2007
How do I?
A lot of the issues with Infosec teams that I've seen, particularly with the younger (like just out of college) or more tunnel visioned crowd is that no one bothered to teach them infrastructure at all. They can know things like "my tools said the version of TLS you're running is vulnerable and my research confirmed it" but don't have the depth in even servers or networking to suggest alternatives.
I've got a guy who is probably going to graduate with a BS in cyber security in June or so, and we're teaching him on the job stuff like how IP addresses work and what the Windows Registry is.
They're just given pure theory, no context.

Silly Newbie
Jul 25, 2007
How do I?
I'm pretty sure I got my job because the mission statement I proposed was
1. Give the people who actually make us money the tools they need to do so
2. Make sure our poo poo doesn't get stolen or vanish into the ether
That's it. That's a successful IT department where IT isn't the product.
My best security guy (and best friend for a couple decades) is in it because he likes to break stuff, runs his home automation off raspberry pis, and does bird photography as a hobby. YMMV.

Silly Newbie
Jul 25, 2007
How do I?

CommieGIR posted:

This is happening in the US a lot more often too, many IT companies prefer a contract to hire approach for that exact reason.

My last job, their entire thing for engineers was that they would only take them via TekSystems. Like I went and interviewed there, they liked me, they said "cool, go get on with TekSystems and you're a contractor through them for 90 days". Credit to them though, they played it straight. Every person I saw including myself did the 90 days as a contractor with Tek, then got brought on as an FTE at the previously agreed upon salary, or more if they proved to be that valuable. They just used it as a dodge to not have to worry about candidates that couldn't hack it. Still felt scummy.
Fun fact - when you work a deal like that, Tek pays you the converted hourly rate you would be making plus a markup for benefits, so like if the eventual job is 80k salary, you're at $40/hr + $17/hr because you're not getting FTE benefits for a total of them paying you $57/hr as an hourly employee. Then they go charge the company whatever flat rate.
We had a major outage I was uniquely suited to handle, turned in an 80 hour week timecard that the business verified, and gave my handler a panic attack, it ruled.

Silly Newbie
Jul 25, 2007
How do I?

Wizard of the Deep posted:

I can say in our instance, we use a contacting house to get folks in the door. They're W2 through the third party, with an agreement to hire them (or not) in a certain period of time. Typically six months. That means we're budgeted for the contractor for that long, and will negotiate their salary and any bonuses when (if) they convert. If we want to convert them early, there's a buyout price in the contract with TPCH.

Third Party Contract House had them as W2 employees, pays them a percentage of what we pay TPCH, and offers lovely benefits (expensive health insurance, maybe a couple days PTO, unmatched 401k).

We've got long-term relationships with a couple of TPCH, and we'll typically reach out and say "Hey, we need two Linux people for an upgrade project" or "We've got space for a new .NET developer, who ya got?"

We rarely 1099 folks, at least in IT.


That's how it worked for me. I was a W2 employee of the third party contract house, and got paid may more than the eventual position, and also was hourly. They charged some ungodly amount to the actual company, and contracted me out to them. The company liked me after 3 months, so I was "terminated" from the tpch and "hired" by the company. I'm sure money changed hands per their contract with each other.


If you're doing contracting on your own, rule of thumb is your rate = 3x going rate for the position. If it's 100k/year to hire a permanent person, you take that, divide it by the number of regular work hours in a year (2080), which is $48/hr, and then your contractor rate is $150/hr baseline, with a cap of whatever you can get away with.
The MSP I was with paid it's engineers between 85 and 110k, and billed them to clients at $165/hr, with minimum hours for on site call outs.

Silly Newbie
Jul 25, 2007
How do I?

The Iron Rose posted:

deploy a new eck cluster and do a remote reindex

It’ll still suck but it’ll be easier to manage that way

You can't convince me that these are real things and you aren't doing a bit.
Also I initially read that as "do a remote reindeer" and I'm not sure if that's better or worse.

Silly Newbie
Jul 25, 2007
How do I?

Hughmoris posted:

I'm not an email config expert but doesn't M365 have a setting that prevents 'REPLY ALL' for some distribution lists?

Just had a guy 'reply all' to ask an inane question to 33,000 people.

Just lol at anyone who makes a large distro and doesn't restrict who can email to it.

Silly Newbie
Jul 25, 2007
How do I?

Rick posted:

I used to use powershell everyday. Once we went to 365 though I started using it less because of the extra step in connecting (lazy) but it still worked when I opened it. But over the last year, there hasn't been a time when I've opened it that I haven't had to spend an hour at least (or in the case of today, 2 hours) figuring out why it isn't connecting this time and I really dread the things that can't be done in the EAC now when I used to never use that thing at all.

I really should have just stuck with my first instinct and said "it's a truck, it's not room, it's equipment" and moved on with my life instead of trying to make them happy and have it show up on the room list.

I've never had connect-exchangeonline fail. 365 and azure PowerShell are the easiest to use they've ever been (until they move everything to graph and screw it all up).

Silly Newbie
Jul 25, 2007
How do I?

wolrah posted:

More often than not they're not wrong about that. A phone call will often get their specific issue resolved faster than if they had emailed it in.

The problem of course is that the people solving the issues usually have other poo poo to be doing and a phone call is effectively cutting in line and saying "my issue is more important than whatever you're doing right now" and 99.9999999999% of the time it sure as gently caress is not.

The people choosing to call about a problem that doesn't need an urgent response that moment are selfish and usually haven't even considered that they're not the only people in the world.

Basically this. When I put in a ticket to MS about Azure or 365, I'm doing it after I've exhausted what I can do. I request an email response because I'm probably going to drive home/go shopping/take my kid to the park, and it's not an issue that can be resolved via live session. I don't want to click on poo poo in my environment while you investigate why my licensing didn't apply, I want you to look on the back end at what licensing is applied and tell me where I hosed up, then email me the fix.

Silly Newbie
Jul 25, 2007
How do I?

tango alpha delta posted:

In 2005 part of my job was to grant military personnel access to the United States Department of Defense web portal. Soldiers under fire are still more respectful than most civilian customers. I still think about that from time to time.

Back in the early 2000s I was doing overnight (US Central Time) support for Motorola Canopy gear, which was line of sight point to point wireless over distance. It was in heavy military use in the Gulf theater, so I'd not infrequently get calls from Lance Corporal Crayonbreath trying to get the gear setup to connect this base to that camp or whatever. Those were some of the best calls I ever had - mutual respect both ways, taking notes and following instructions, and if we got to a point where we were beyond their competence it was just "I'm going to check with my superior and we'll call you back" and that was it, no waiting on hold tying me up nonsense. Absolute joys to work with from both a professionalism and competence standpoint.

Silly Newbie
Jul 25, 2007
How do I?

klosterdev posted:

I'm still pissed that MS is forcing authenticator apps on all users on all tenants. It's causing me problems right now, I've got a user who's phone is so drat old it won't support the App Store authenticator app.

Texting-based MFA is good enough security for most organizations, fight me.

Do you have a source on this? I've still got a whole bunch of users still on SMS who probably always will be.
Not everyone in a company who needs access to email or other SSO company resources is a white collar person in an office. We've got laborers with flip phones who only sign in to enter their hours in our ERP and get emails from HR, and they're still an important use case.

Silly Newbie
Jul 25, 2007
How do I?

CitizenKain posted:



Next email comes in a few hours later, from someone that didn't have a <letter><bunchofnumbers>@att.com address. (ATT didn't think most of their employees were worth a real email, so most got something like a2382874@att.com. Senior people got real addresses.)



AT&T does that both because they employ a poo poo load of people directly and also because, like most telcos, direct employees only do a fraction of the work and there are a metric poo poo ton of short lived contractors who need company email addresses or identities for whatever reason.

Adbot
ADBOT LOVES YOU

Silly Newbie
Jul 25, 2007
How do I?
SMART goals are pretty great if the org actually stands by them. In the first quarter of the year, the people that report to me and I agree on specific things they should accomplish over the year. I remind them of the goals periodically, and if I'm replaced, the goals are still there. At the end of the year I have a good case to reward them because, in theory, the goals we agreed on can be accomplished. Any system that can reform the goals with a change of management is hosed though, it's just an ephemeral moving target.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply