Topics created by Dashrender

@dashrender said in ISPs inject malware into chat download streams:

@scottalanmiller said in ISPs inject malware into chat download streams:

@dashrender said in ISPs inject malware into chat download streams:

@scottalanmiller said in ISPs inject malware into chat download streams:

@dashrender said in ISPs inject malware into chat download streams:

@scottalanmiller said in ISPs inject malware into chat download streams:

@dashrender said in ISPs inject malware into chat download streams:

How do they MiT you on an encrypted connection? i.e. if you're using HTTPS, they have no ability to inject anything.

Oh there are ways. How do you think that tools like Palo Alto do deep channel inspection?

And of course there are ways - but I will never install an ISP cert as long as another internet connection option is available.

But once that option is gone, well, so is the free and open internet.

Lots of people don't have alternative options to check and see if they are getting an ISP cert or not.

Oh.. I think I see where you are going here... but now my question is - will that work?

Let's assuming I'm trying to download telegram, so I go to https://telegram.org. The ISP can't fake the cert for Telegram.org - I mean they can, but your browser won't trust their fake cert, unless they got the ISP's own root cert into the user's computer's root store.

But when EVERY site says you have a fake cert, I know no one that doesn't accept them. One time, sure. I stopped Dominica just the other night because some site had a cert problem and I knew something had happened. But when it is every site and you can't do anything without accepting them, you start accepting them. What else can you do?

You can get another ISP - at least until there is no option for another ISP.

But things like Chrome completely freak out when it runs into a fake google cert - I'm not sure if that freak out includes simply not working for google properties or not though.

Sometimes you can. Sometimes you can't. Often you can't.

Additionally, I'm looking at the firewall settings

https://i.imgur.com/qCbus6z.png

Is this expected? I get the list of my trusted items, it shows an empty list for other, but local, internet, and rejected all provide zero feedback.

I have the Let's Encrypt sites added to local on the same page as I have my trusted sites added, yet they don't show up as seen above.

Thoughts?

This makes me think that I have somehow disabled the local zone

@mike-davis said in Business thinking - PC replacements:

@scottalanmiller said in Business thinking - PC replacements:

I did this for a shop last week. Everything done in one day, the whole thing. Even replaced the firewall, apps, basically everything. If you have a company that has weekends off, you can do this in a weekend.

How many users and how many apps? Did you migrate user profiles? Was it part of the job to make sure the My Little Pony screen saver was migrated?

Fourteen users, not a lot of apps. Mostly MS Office, some basic stuff that you'd expect like new browsers, a few odds and ends utilities as requested by people and their medical system (which was not large.) Please installing printers, scanners, shared drives and such. All pretty basic, but you generally expect pretty basic in an office of that size.

I've had less than stellar experiences with HP's laptops. There are always little niggling issues. Our most recent (and likely last) set of them had significant issues with USB C docks that worked flawlessly on equivalent generation Dells.

As for MacBook Pros, they make up about 90% of our machines. And I really, really dislike them. The more that Apple does to lock them down, the harder they are to work with. Then you add in the issues that are still extant with docking solutions (slowly being solved a year after release). The '16/17 MBPs are not the same build quality as the '12-14s. Not even close.

We are buying Dells almost exclusively for our Windows needs. I really like the XPS line for power, portability, and battery life.

ListeningOn = ::1, fe80::ad99:8e4d:c356:9939%5, fe80::c0a1:571b:2955:87be%7, fe80::cda4:4841:5bff:7b5c%8, fe80::f902:5ea5:2d74:a154%3

Interesting - the server is only listening on IPv6 addresses.

Turns out IPvX filters are for the addresses that are listening (i.e. the local IP on the machine you are trying to remote into).
I set a filter like this 10.0.0.1-10.0.5.254 (where my admin machines would live).
Unfortunately, since this isn't an incoming filter (that's the firewall's job) this filter wasn't large enough to cover all of my production networks. I had 10.1.0.1-10.1.0.254 that wasn't inside the above range, and of course keep the machine from listening on it's IPv4 (the IPv6 was listening because I just left it wide open - testing, not using IPv6 in general, so left it as default (*))

So tweaking my filter to 10.0.0.1-10.0.5.254, 10.1.0.1-10.1.0.254 solved my problem.

@momurda said in Windows 10 Pro for Workstation:

Does Win10 Pro and Server 2016 support NVDIMM yet?
This feature is supported in Workstation edition

Win 10 Pro does not, that's part of this release. 2016 has had it.

This is now working. We have asset connections in tickets and it has been tested.

@Dashrender now that you are able to create tickets and so is scott, would you mind resolving this? I've already got that other thing logic ticketid point on my to do list.

@dashrender Yeah... which means you are stuck with what you have unless there is some design change or migration to another domain.

@dashrender Yes, you can. But you just need to have the domain added as main in Exchange and you will be all set.

@dashrender said in Shrinking many domains to few or one:

@wirestyle22 said in Shrinking many domains to few or one:

@coliver said in Shrinking many domains to few or one:

@wirestyle22 said in Shrinking many domains to few or one:

@coliver Next cloud is such a sore subject for me. Why they won't do it:

They won't spend the maximum of $15 a year on a domain for us to use for it. so I said we can just create an a-record for nc.domain.com and port forward to our Next Cloud instance. I can even do the SSL certification for free. Management says no. Why? Because the guy who runs the website doesn't know how to do that. I'll do it. No, you can't. Why? Because you can't.

It's actually infuriating

That's fine you've presented it to them and they've declined. So move on.

Yeah it's just annoying that they don't want to save themselves money. The city has so many dropboxes they are paying for right now and then ask us to come up with a solution that saves them a ton of money, but they refuse.

/rant

So the next time they are whining about drop box costs, tell them, we have a solution ready to bang out, it only costs $x and will take me 2 hours to get up and running - etc.

It's sitting on one of my hyper-v hosts, 100% ready. Only thing I need is the port forwarding and a-record. It would take 2 mins.

@dbeato said in Citrix: clicking app link and nothing happens:

@dashrender Man this looks like the nightmare I go through every day!

Yeah, every 3 to 6 months, you know.. when they bother to do any updates.

BES is dead, Good is how you make smartphones dumb, and Mobile Iron lacks good training resources and is more complicated than it needs to be.

@stacksofplates I went thru Airwatch SE training a few years back and was blown away at what it could do, and how easy it was compared to everything else I'd used. (Full discloser) Technically my current employer owns Airwatch (The company) but that's a different BU so these days I don't keep up with it too much. AirWatch is licensed either per user or device. There is a hosted option (My recommendation) or an on premises solution (For people like the DoD). Talk to the Airwatch/EUC SE's about that stuff as they know hospital requirements really well and live and breathe all the weird what is supported by what platform. When evaluating any MDM solution ask for references in your industry that you can talk to, and talk to the vendor directly not just resellers. It's too complicated for 3rd parties to keep up with 100%.

Yeah, every year they do this, I just the multiple downloader for this.

@dafyre said in Windows 10 Start Bar change:

@jaredbusch said in Windows 10 Start Bar change:

@dashrender FFS scroll down

0_1499951401167_IMG_0126.PNG

I wish software vendors would leave the freaking scrollbars visible when there's stuff to be scrolled!

Agreed!

@dashrender said in IT Environment update questions:

@scottalanmiller said in IT Environment update questions:

@msff-amman-itofficer said in IT Environment update questions:

@dashrender said in Greenfield (OK not really) setup questions:

Additional options: use something like Salt to create network mappings for the computers.

I am interested to hear about:

"Salt to create network mappings for the computers."

Since salt works only when minions connected, and for reason my NAS and windows clients loses the connections every 2-3 days and requires the user to re-input username/password (maybe related to Windows limtiation)

how will you effectively use salt for that purpose ? just put script to run at user login ? any other neat ways to do this ?

Salt is meant to run continuously. For example, mine run every 10 minutes or so to verify the environment. So if a mapped drive failed, it would be fixed again in a few minutes.

The same goes for GPO. It refreshes every 15 min I think by default.

Every 90 minutes with a 30 minute flux. So every 60-120 minutes for GPO.

@scottalanmiller said in Quickbooks replacement:

@dashrender said in Quickbooks replacement:

@scottalanmiller said in Quickbooks replacement:

@travisdh1 said in Quickbooks replacement:

How Intuit is still in business blows my mind, they should've lost all their customers years ago.

And any accountant or bookkeeper that recommends them should be fired. How could you trust an accountant that thinks using a tool like that is okay for a real business?

Other than the lack of real two sided accounting, what is it about this product you don't like?

https://mangolassi.it/topic/14350/why-quickbooks-is-not-a-business-tool

Other than the support none of those apply to the hosted SaaS version.

@scottalanmiller said in O'Reilly goes subscription:

@Dashrender said in O'Reilly goes subscription:

@scottalanmiller said in O'Reilly goes subscription:

Looked it up, 17.5 years ago this came out 😉

weird, I just got this email today.

But was it an announcement, or an ad? Safari has been the industry standard book service since my early 20s. NTG used to provide subscriptions long ago to staff. Most companies I've worked at offered it.

at this point, I'm sure it was an ad. It wasn't presented as an ad, and I've never head of Safari book services before, so it seemed like a new service they were now providing.

@dashrender said in Managing Hyper-V:

@scottalanmiller said in Managing Hyper-V:

@dashrender said in Managing Hyper-V:

The fuss I'm kicking is simply the fact that you have two machines. Nothing more, nothing less.

Which two, what do you mean?

He claims to have two computers - a Windows based computer from which to mange his Hyper-V host, and a Chromebook he uses for everything else - this seems like a waste - why have two computers when a single Windows machine will do it all?

Oh, I missed the dedicated machine for Windows. Just make that a VM on top of the cluster, problem solved.

@coliver said in Sysprep won't run if a drive has Bitlocker enabled:

@Dashrender said in Sysprep won't run if a drive has Bitlocker enabled:

@coliver said in Sysprep won't run if a drive has Bitlocker enabled:

@dbeato said in Sysprep won't run if a drive has Bitlocker enabled:

@coliver Did you setup a Microsoft account on them?

No domain joined machines.

Are you sure Bitlocker isn't on, just not activated?

I'm not sure what you mean? Bitlocker is a part of the operating system... you need to turn it on to enable encryption. So if you're asking if it is installed the answer is yes. If you're asking if it is enabled the answer is no.

Bitlocker has three states, as far as I can tell

Bitlocker Off Bitlocker On, but not activated - not encrypting drive Bitlocker activated

In my experience, a BIOS based machine puts Windows 10 into option 1 above.
My recent experience has shown that machines with UEFI and Secure Boot enabled that Windows 10 puts the system in option 2 or 3 depending on setup.
If you add a Microsoft Account while going through OOBE, the Windows will create a recovery key for Bitlocker, save it to your OneDrive account, and use option 3.
If you add a local account during OOBE, Windows will put the system into option 2.