Here is basically what the old configuration looked like:

Thanks for the suggestions. Let me whip up a diagram.

I should add I'm running on a server in vultr so there is a cost, but better than running my own server.

@dafyre said in EdgeRouter routing:

You will likely have to add a route from the CorpLan back to your EdgeRouter as well.

I should probably explain the backstory. The client contacted us and said they wanted to disconnect from the Corp LAN and run on their own network. They ordered up their own internet connection and we came in with a bunch of Ubiquiti gear and cut them over. A day later they told us that one app didn't work anymore. We looked at the app and it was connecting to 10.66.1.100 so we figured that on their old network they must have had a site to site VPN running. That's when we got the idea to just connect back in to the corp LAN with ETH3 on our router as if it was just one of the computers. Seems like if a computer on that subnet could reach the server, the router could. Does that make sense?

@jaredbusch said in EdgeRouter routing:

Don’t pull dhcp on eth3

Thanks @JaredBusch that let me plug it in without locking up the network. I added the routes below and still can't connect. When I do a tracert from a windows machine, it shows my first hop is 10.1.62.1, so it doesn't appear to be using the ETH3 interface.

I'm using SpiceWorks. I'm getting to the point where I would like some accounting integration. I have written some SQL reports that kind of give me the information I need, but as the company grows, I could use a little more information.

I have a client with an EdgeRouter and they want to have their own internet connection, but still be able to connect to another LAN (we'll call it Corp LAN) in the building that has a site to site connection to a server they need to access. Internet connection is working fine. When ever I put a patch cable in to Eth3 to connect to the Corp LAN, it kills the ER LAN clients. In troubleshooting I noticed that the ER creates a route out of both interfaces and won't let me edit them. I want to create a static route so that only the traffic destined for the one server goes out Eth3.

I will almost always do stuff with a GPO. I inherited a network where the guy did stuff manually. (like a net route statement) It was very difficult figuring out what he had done by hand and where.

@stacksofplates Does *nix have an OCR engine that works well? Last time I looked for an open source one that worked under Windows, I couldn't find anything that worked.

@fateknollogee I think they are still selling their OmniPage line. https://www.nuance.com/print-capture-and-pdf-solutions/optical-character-recognition/omnipage.html
I'm not sure what the difference is between that and the PowerPDF line.

@hobbit666 Even on the Android for business site, they refer you to 3rd party options for device management.

Creating them as a resource seems like it will be the better move going forward. Public Folder support in o365 has been sketchy at best. Even with resources, you may have to drill in using powershell to change some of the options, but it works.

I just bought a Microsoft Wireless Display Adapter. Worked like a champ for Windows 10 computers.

I have 4 Samsung Android based tablets that are for corporate use. I would like to prevent the users from installing anything. Does anyone have a tool for lock down they like? I read about KioWare for Android on Spiceworks, but the posts were from 3 years ago.

@ghani said in asp.net web pages shows HTTP 500 internal server error:

HTTP 500 internal server error

Do you have more information in inetpub\logs\Logfiles ?

I keep hearing people mention Salt. Is anyone using this in their environment to manage Windows machines? I was trying to get an idea of how much work it would be to deploy it to just do the local user password change task, and came across this in regards to installing the client on the minion:

CREATE THE UNPRIVILEGED USER THAT THE SALT MINION WILL RUN AS

Click Start > Control Panel > User Accounts.
Click Add or remove user accounts.
Click Create new account.
Enter salt-user (or a name of your preference) in the New account name field.
Select the Standard user radio button.
Click the Create Account button.
Click on the newly created user account.
Click the Create a password link.
In the New password and Confirm new password fields, provide a password (e.g "SuperSecretMinionPassword4Me!").
In the Type a password hint field, provide appropriate text (e.g. "My Salt Password").
Click the Create password button.
Close the Change an Account window.
ADD THE NEW USER TO THE ACCESS CONTROL LIST FOR THE SALT FOLDER

In a File Explorer window, browse to the path where Salt is installed (the default path is C:\Salt).
Right-click on the Salt folder and select Properties.
Click on the Security tab.
Click the Edit button.
Click the Add button.
Type the name of your designated Salt user and click the OK button.
Check the box to Allow the Modify permission.
Click the OK button.
Click the OK button to close the Salt Properties window.
UPDATE THE WINDOWS SERVICE USER FOR THE SALT-MINION SERVICE

Click Start > Administrative Tools > Services.
In the Services list, right-click on salt-minion and select Properties.
Click the Log On tab.
Click the This account radio button.
Provide the account credentials created in section A.
Click the OK button.
Click the OK button to the prompt confirming that the user has been granted the Log On As A Service right.
Click the OK button to the prompt confirming that The new logon name will not take effect until you stop and restart the service.
Right-Click on salt-minion and select Stop.
Right-Click on salt-minion and select Start.

That's a whole lot of manual stuff on each machine just to get the client installed. Am I reading that right or is there an easier way?

@larsen161 said in domain controller in the cloud for small office?:

@mike-davis do you have an hhs.gov or gpo.gov link to where it mentions the requirement for passwords to be changed?

From what I understand §164.308(a)(5)(ii)(D) requires you to define the password policy. Since the "best practice" in many circles was to change your password every XX days in case someone observed your password, many places still have it in their policy to change passwords every 90 days.

It was only last year that mainstream media ran that article that explained that a longer pass phrase is better than a short complex password, but getting organizations to change their policies doesn't happen quickly.

Do you have a sample policy (or just that part) that you could share to replace the complexity and change requirement?

Oddly enough, the password seems to be encrypted when you view the Groups.xml file that creates that policy, but maybe it doesn't take much to reverse it. The code looks like this:

<?xml version="1.0" encoding="UTF-8"?>

-<Groups clsid="{3125E937-EB16-4b4c-9934-54123DEA4D26}">


-<User clsid="{DF5F1855-51E5-4d24-8B1A-D9AD348BA1D1}" removePolicy="0" userContext="0" uid="{E2123A2D-7D20-4C9A-A2C9-474CFAF1E5FE}" changed="2017-01-25 14:28:38" image="2" name="user">

<Properties userName="user" subAuthority="" acctDisabled="0" neverExpires="1" noChange="1" changeLogon="0" cpassword="TAF+vMr9+ieePdksvnsN/2i0T+u3P5E+PQ08jnVEgHs" description="" fullName="" newName="" action="U"/>

</User>


-<Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" uid="{617359A3-9040-4F00-BFED-0FE86588FAF1}" changed="2017-01-25 14:31:18" image="2" name="Administrators (built-in)">


-<Properties description="" newName="" action="U" groupName="Administrators (built-in)" groupSid="S-1-5-32-544" removeAccounts="0" deleteAllGroups="0" deleteAllUsers="0">


-<Members>

<Member name=".\user" action="ADD" sid=""/>

</Members>

</Properties>

</Group>

</Groups>

@jmoore said in Local Admin PW:

@dafyre My boss told me that microsoft took away the ability to change the passwords via gpo because of some issue where they were being sent in plain text. I have no way to verify but thats what he told me

This is true. An automatic update now disables the ability to change the password if you were setting it that way. If you try to edit an existing policy, you get this warning:

And if you click OK, you get this where the password field is disabled:

@penguinwrangler said in Stress Relievers:

I have always thought Kayaking would be fun/cool to do. Any suggestions for someone that has never done it before?

Never partner with someone that has all new gear.

Lake kayaking is different than white water. There isn't much to lake kayaking. Watch a youtube video for the basics and that's about it. If you roll, you fall out.

White water is different. When you roll falling out doesn't come naturally. You don't have to be able to roll to enjoy it, but getting pummeled by rocks as you lug your boat out isn't much fun. If you can find a class or someone willing to let you play on some flat water to see if you like it, that's a good place to start.

You can also rent what we call a duck. I'm not sure if that is just a local term. It's a personal rubber raft. You can take it down white water and see if you like it. It doesn't lock you in, so if you roll, you don't feel like you're trapped.