Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

AAAAA! Real Muenster posted:

Once I hit the reply button to ask, it updated! There are three pages! I wonder why mine wasnt updating when I was spending all that time looking at it...

I actually can't tell if you're joking or not here because this is a legitimate known issue that happens on SA :lol:

Adbot
ADBOT LOVES YOU

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
gently caress printers

I'm still sometimes tempted to buy a production xerox for my apartment since at least that'll break fewer times and I can actually get support :v:

Because goddamn printers are poo poo. I have no idea how something so essential to everyday life is so broken across literally every single vendor.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Dravs posted:

That is why AWS and Microsoft will be so badly impacted because their butt processing is massive.

cloud to butt continues to be pay dividends

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

minusX posted:

Yep that's what I was gonna say.

Next people well learn and use win + x

win-x is great on windows 10 for quickly launching admin consoles and completely useless/redundant on Windows 7

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Avenging_Mikon posted:

A ticket came in!


Now, they're at a satellite location, so I can't just send off a ticket willy-nilly. The main network for staff is named "admin."

this is suuuuuuuuuuuuuch a bad idea.


So glad we've mostly purged systems who have "Administrator's Macbook Pro" as their localhost names. Now it's all P/M + asset tag + city location. So a PC located in New York would be P002456NYC, whereas a Mac in Toronto would be M000123TOR. Simple, easy, good for braindead management.

It used to be first initial+lastname but that a) doesn't work great as you scale up the business and get people with similar names, and b) a localhost name is for the computer, not the user.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
you know it's a fun ticket when you literally have to start citing research papers in your response

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

I didn't elaborate as it's wasn't actually that fun other than the fact I had to cite a research paper in the comments :v:. I was analyzing various DNS records/IP logs in response to possible domain fluxing and I had to rely on a study which distinguished between characteristics of legitimate domain names and pseudo-random domain names, that's it. The only funny bit is the actual citation

The Iron Rose fucked around with this message at 21:49 on Jan 16, 2018

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

The Macaroni posted:

I could see my way to a kind of forgiveness if the password were 256 characters long, including dozens of special/numeric characters. But it's always something like Sentinel7.

at a certain point I don't understand why enterprises don't use password managers.

The one we use in my company is literally free aghhhhhh


E: I know that the answer is "lol government IT" but still

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
Larches, you're the goon stuck in a well. You're stuck in that well for a lot of good reasons, but stuck you remain.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Oyster posted:

He came back with $2k higher than what the other company was offering (and what he offered this morning) and specific instructions on how to get certs counted as tuition reimbursement. You raise a valid point about future raises and that crossed my mind as well, along with the fact that the other company has set advancements that my current one does not. I have 24 hours yet, and it may come down to if I can get milestones for advancement with my current company that ends with me in an analyst position.

Talk to the competitor, say that you'd need their salary to be higher due to your corporation's counter offer. If they cave, great. If they don't, take the counter.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
A ticket came in.

Manager wants one of their new employees to have access to some software for reviewing emails, sure, fine, whatever. I work the later shift so I'm the only one in the office, but whatever, I found the logon creds so I'll muddle my way through it.

So I go to see what access the other users have so I can grant the appropriate credentials and what do I find?

Dozens of people, including former freelancers, with full analytical access to emails across our entire domain including unredacted PII.

:suicide:

larchesdanrew posted:

Reagan is back, albeit in a far more cartoonish fashion from a guest artist.



this is fantastic though.

The Iron Rose fucked around with this message at 03:12 on Jan 26, 2018

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

guppy posted:

We have dealt with complaints like this before. Even if it were feasible, interfering with a wi-fi network not your own is an FCC violation. Telling them that it's illegal is generally enough to get them off your back.

It's not an unreasonable request. What if vendors or clients see that? Not a good look.

There's no real way to solve that though. You could probably stay in compliance if you did it only on employee hardware, which doesn't solve the problem.

And that's if it's even possible to hide a SSID in that way.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

wolrah posted:

It is an unreasonable request though. It's someone outside of the company's control doing something that's completely legal and within their power. There's nothing for anyone at the company to do about it except trying to find the person and politely ask them to change it. If it was a banner hanging in their window no one would consider it reasonable to ask maintenance to prevent it from being seen, how is asking IT to stop an external WiFi signal from appearing any different?

That said I'd half expect the kind of person who'd set their SSID to "sendnudes" to be the kind of person to change it to something like "$company toilet camera" if that happened.

Sorry, I should have amended that. It's a reasonable request for HR, who knows gently caress all about how computers or wifi networks work, to make. It's obviously unfeasible and unreasonable, if not actively impossible, to do anything about. But it's not a ridiculous request to make if you don't know anything about computers.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

RedMagus posted:

Today in "Why you should check your software patches on a test domain before rollout":

our software deployment team rolled out a Malware Bytes update (ie: just let it pull from the update server from the actual company) and it completely hosed DNS on all the machines on our network. So we helpdesk grunts are seeing call hold times of 10+ minutes while we manually remote into each device and remove the software, and hope SCCM doesn't reinstall it tonight.

at least we're getting catered lunch? I hope it's not pizza

...how the hell did that even happen?

More to the point, SCCM will absolutely reinstall it, depending on how the update was rolled out. But unless the deployment has been removed from the device collection, it's just going to keep reinstalling on every machine.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

fishmech posted:

The girl they tried to kill survived. Still hosed up, but at least nobody actually died.

I actually didn't know that and it makes it significantly better


Still horrible of course

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
yeah i'm 100% okay with giving finance and accounting overpowered laptops so they can brute force their way through pivot tables rather than calling us in

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Garrand posted:

Wait, really? That's a thing now? Because when I hear "cyber" the first thing I think of is 2000 era chat rooms and hot singles in my area.

the amount of family members who think I do "cybersecurity" is staggering


like i investigate endpoints guys. calling that cybersec is ridiculous

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Kurieg posted:

I picked up the first season of CSI:Cyber super cheap and was watching it just to laugh at everything that was so hilariously wrong. My favorite was their visual depiction of tracking traffic through the deep web as if the deep web were a physical place below the internet, indicated by big scary red glowing letters that said DEEP WEB.

So darktrace decided to go full bore on the CYBER GRAPHICS poo poo and it's incredibly infurating to use this slow as hell web service that's running a ridiculously fancy and ridiculously useless topology in the background.

My dude. If I'm analyzing DNS logs seeing some fancy CSI crap is exactly what I don't want or need.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
It's the fact that it spoils Season 1 of Mr. Robot.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Kurieg posted:

Hey if you guys need to convince your bosses to not use Apples in a work environment, Any program can take a screenshot of your entire desktop at any time and run it through an OCR

If someone wants to use a program installed on your computer maliciously you're essentially hosed anyways. The fact that it's easy to program doesn't really change the threat model, since if you're at the point where malicious software is installed as a program on an endpoint then it's compromised anyways.

Proper remediation for this is software restriction policies and removing local administrator from your users.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

ElehemEare posted:

L O L if you work in IT and you haven’t met the cleaning staff coming through after 7pm, I envy you.

:hf:

My partner just poo poo talks her racist old boss in Spanish with the cleaning staff and apparently it's great

I mostly just get looks of muted sympathy on the rare occasions I'm working after the lights turn off

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
so i'm pretty sure that if a computer has lost its trust relationship with the dc and the local admin account is disabled, i'm just entirely hosed, right?

It's a surface book so I can't even rip the drive :laffo:

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Varkk posted:

Pull it off the network and log in with a cached domain account. Then you can repair the trust relationship. Assuming the cached account has admin privileges.

this might be the first time in my career so far I've seen an entirely legitimate reason why you'd need a user's domain password


all this time i've been telling folks "hey we'll never ask for your password, if we need access for reasons we can always reset poo poo, never tell anyone your password" in the vain hope of stopping people from loudly volunteering their system password for all to hear.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
Turns out it has bitlocker (good), but it also turns out the recovery key wasn't saved like it should have been so ¯\_(ツ)_/¯

I'll try the cached domain account first, but thank you for all those wonderfully fun ideas! This is much more exciting now.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Kurieg posted:

https://thehustle.co/european-clocks-serbian-power-grid/

Basically, there's a lot of ethnic Serbians who live in Northern Kosovo that refuse to pay their electricity bills and Kosovo stopped providing power to them for free in December, this slight dip in the amount of power provided to the entirety of europe caused clocks to lose 6 minutes in the last 3 months.

6 minutes eh

Clearly someone in Kosovo really hates kerberos :v:

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Weedle posted:

It has been decreed that instead of earmarking a portion of the operations budget for network infrastructure, all funding for that will now come from the school’s yearly fundraising auction. Makes sense.

:catstare:

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

MF_James posted:

That reminds me of a job interview I was on a few weeks ago, I talk to the IT director about their environment and their practices "Oh yeah we have pre-prod environment, dev environment, QA environment" etc etc. Then he brought in a DBA to ask me some questions and walked out of the room, at some point I asked him about how they do testing etc before rolling out software updates "Oh yeah that's kind of a shitshow, we test a lot in production, we don't really have a QA environment and none of the guys actually writing code know how to manipulate a DB properly so I'm constantly putting out fires when they push new code" ... one of these things is not like the other :yikes:

That's pretty shockingly honest, jesus. It must really be a dumpster fire if he warned you in the interview.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Hungry Computer posted:

It would help if vendors stopped listing ridiculous minimum or recommended requirements. Just look at these for SCCM:



:laffo:

SCCM is a beast that will happily use as much RAM as you give it, but <10000 endpoints and you can make do just fine with 32 or 64 gb of RAM on your CAS with the sql database installed locally.

That being said sccm is also the weird beast where things will just fail in weird and unexpected ways and giving it more RAM will definitely ease the load on your poor SCCM admins.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Apex Rogers posted:

Instead of disabling avatars, I use Decreased Productivity. It ghosts all images/videos so you can mouseover to see them, but leaves them as greyed-out versions by default. You can still see the outline of an avatar, but it's pretty much invisible to someone behind you or walking by.

this is pretty cool and seeing avs is trippy after like 6 months without them but man it does not play nice with salr

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Thanks Ants posted:

Yeah it's called Casper Jamf Pro and it's practically free for education.

you pretty much need a dedicated resource to run it though. This will take a significant amount of time to configure, set up, and administer.

Pro tip - make hella use out of that support contract. Their support staff tend to be both knowledgeable and very responsive.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
A ticket came in: someone on our recruiting team's desk phone wasn't getting a network link!

So I saunter on over to the recruiting den and what lo and behold, it indeed can't access the network. Phone looks fine, so I trace the cables and find that it's plugged into a dinky little desktop switch. That, in turn, is plugged into a $3,000 48 port managed Cisco switch, which powers the other three other desk phones and literally nothing else.

It ended up just being a bad cable from the Cisco switch to the lovely desktop switch but who in their right loving mind thought that this was a good networking setup it was my boss

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Zero VGS posted:

OK, CEO of the company is pissed because our cloud-based embedded Win10 Pro digital signage occasionally pops up Windows Update things in the middle of the screen.

There's no sensitive stuff on these things whatsoever, but they need the internet for digital signage updates. What's the latest guide for 100% preventing all Windows Updates? All the stuff I'm finding online is out of date (i.e. setting a WSUS server to a fake IP doesn't work, it'll still seek out the Microsoft servers). Can I set a HOSTS files to loopback all of microsoft.com? Or does it try to use static IPs? Anything to get rid of these loving update popups.

We had a similar problem at our old company - we used Intel PC sticks for in-office digital signage and patching them was a biiiiiiiiiiiitch.

the correct answer - and the one we ended up going with - was to figure out a way to patch the machines properly. Even if they are only connecting to the internet for digital signage updates, that's still connecting to one of your corporate networks and whether it is segmented off into its own purgatory or not, denying updates is only going to come back to bite you later on. Set up WSUS or SCCM, define your maintenance windows for out-of-hours, test your solution, and make sure it works.

Or get something like a Chromebit or AirTame or one of the other digital signage vendors out there that let you do something similar without the overhead of a full windows OS which is really the best option if you can spring for the money.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
Which brings us to the broader question, why would anyone use the app instead of a mobile chrome browser...

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
Nord VPN is fine. It's cheap, it works, and it's based in Panema. Not sure what else you'd really want?

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

nexxai posted:

Ok I've had it up to my loving eyeballs with the complete shitshow that is MaaS360 MDM and need a replacement. I don't need anything fancy - the ability to lock down the iPad so users can't install apps, the ability to push apps to a group of iPads, the ability to "design" a home screen (our users are roughnecks in the field and the simpler we can make things for them, the better) and the ability to use non-DEP-purchased iPads if necessary using Apple Configurator. One nice to have would be an interface that was designed after the year 2000.

What do you guys use and why should I use it too?

JAMF, if and only if you're willing to have someone whose primary job is to manage JAMF.

A simple solution it is not. It took us about 8 months to roll JAMF out to iPads to manage digital signage and we proceeded to screw up signage for our entire company for about two weeks once we started managing them.

now, iPads are a terrible choice for digital signage to begin with, but my point is that you need to be careful because it's easier than you think to screw things up.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Renegret posted:

It gets me stuck in a loop where I just smash yes on everything, then I don't notice when it says something different.

Then I call IT and claim I didn't touch anything it just magically stopped working and WHAT DO WE PAY YOU FOR

i don't understand people who just mash OK on computer popups

like i literally watch it happen in front of me, or people who ask me if it's OK to click next on a screen where the only options are next and cancel...

I genuinely don't understand how they're not even bothering to read what their computer is desperately flashing in their faces.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Antioch posted:

One of the best parts of my new job is being able to fix things like this. SQL server running low on space? Prop it up with an extra 100gb, that's what the SAN is for.

Previous job that was a Change Request, which went to committee once a week, then went to a decision board, then a plan would be submitted, budget drawn and approved, cost centre negotiated, outage window planned (yes even for non outage changes *just in case*), then finally a change could be implemented. Followed by a post mortem, change control completion form, and a follow-up email from the change board manager.

When I left my old job, I had an open change for a certificate renewal. I had opened the change 3 months before expiry. When I left it was a week past expiry and hadn't hit budget yet.

sounds exactly like my current workplace. Not five minutes ago I just sent off an email to apply for a Zones of Trust "Deviation" allowance which might be the most dramatic way possible to frame a firewall rule.

SLA on reviewing the request before a decision is 2 weeks. The ticket is a month and a half old at this point.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Renegret posted:


e: and as an aside, I don't care if the god drat CEO has a service outage, he should have to call customer service just like everyone else.

If he doesn't like the service that he gets going through the same channels as our customers, then maybe he should do something about that and stop cutting and outsourcing staff.

nah I pretty shamelessly give preferential treatment to AVPs and up because a) they have more important things to do with their time than wait on hold with the helpdesk and b) it means I build a relationship and positive facetime. It's precisely because of that personalized and preferential treatment that my department is getting additional oversight and permission to actually administer our domain. That will cut down the time it takes to process newhires from 3 weeks down to 1, and eliminate delays on ~30% of our ticket count where it takes 5 to 10 days to add someone to a drat security group.

Also it means I can get internal promotions and title bumps easier, my company gets a better contracting rate at the next renegotiation period, and the CEO gets to do the work he needs to do.

Standing on some moral high ground doesn't do anyone any favours.

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:
Ok that one is pretty annoying yeah. I’d be salty too.

Adbot
ADBOT LOVES YOU

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

kensei posted:

This is my wall paper for my desktop at work. I am in charge of our DNS and SSL. :sigh:

Same and it's a big hit. A+ wallpaper

  • 1
  • 2
  • 3
  • 4
  • 5