I am currently using this script (and deploying via GPO startup script) to create a local admin account that will, shortly thereafter, be administered by LAPS -

net user "Company Admin" passwordgoeshere /add /passwordreq:yes /fullname:"Company Admin"
net localgroup Administrators "Company Admin" /add

Looks like they want to scale back the color printing at some point. Hopefully, to a trickle

I am going to look at some more lower - mid-range ($500-700) print-only models.

I am trialing Webroot (for business) and am working through the policies. I am not sure if I am missing a setting somewhere or what, but I would like to only allow admins to shutdown protection for troubleshooting or installing a new application. I don't see a admin-specific or user-specific option anywhere.

If I allow it, any user can shutdown protection by entering a captcha. If I disable the setting, not even the admin can shut it down. Surely, there has to be a way to only allow admins this capability. What am I missing?

I did end up ditching Trend for Webroot. Overall, I like it much better. It is much lighter-weight and I don't have to run my own server. There are some minor annoyances that I have encountered. After some negotiations, I was able to get each endpoint for a little more than a dollar less than Trend's renewal cost and less than half of their initial endpoint license cost!

Here are the items that I find annoying-

1. File Overrides are not currently able to be applied to a policy (or endpoint) after the fact. Period. It has to be done at the time you create the override. This makes absolutely no sense and can be implemented with extremely minor code tweaks at the UI level. Also, overrides can only be applied to a single policy or globally, but not an endpoint. This means, you must have created a policy for one or more endpoints prior to creating your override If you want to separate policies and have the same overrides, you have to create duplicates, which it does not allow you to do automatically.

The first audit was stressful and we ended up having to purchase some things but it wasn't terrible. The most recent audit was ridiculous and I had to track down invoices for Exchange 2010 and corresponding CALs from January 2011 from Dell. I had the invoice but for some reason, MS couldn't find my agreements in their system so after 3 months, they finally were able to find them. I also had to take 5 pictures EACH of OEM license stickers from 7, 8, 8.1 and 10 Pro, to prove that I was actually using upgrades from OEM. Every question I had was met with a 1-week delayed response. It was unbelievable.

What passed for proof in the first one wasn't enough in the second. I also had received the intent to audit letter a year after the first and had to tell them that they already had audited me the year prior. MS licensing is the absolute worst. Period.

It just so happens that my favorite SMB backup repository NAS is the same as my favorite home NAS. Synology FTW!

A /16 seems pretty drastic when coming from a /24

I run a Sophos SG-210 here (for the past 2.5 years) and am gun shy on updates because I have seen them break more than they fix. I am seriously considering moving to ubnt next year. The interface on the 9.x UTM version is really easy to learn and use. I really only use a few features. Namely, the routing/firewall, gateway AV, proxy and IDS. I tried application control (for throttling Youtube) but it never worked correctly and that was when we only had a 10/10 Mbps connection. Now we have 150/150 so it is less of an issue.

@storageninja said in Arg! The money spent the month before I stated here.:

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch Right but my question was related to ACLs, not IDS/IPS.

Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...

The modern argument against proxy and IDS/IPS is that you have to set it up so that your proxy device is the man in the middle and decrypts and encrypts everything again.

@smartkid808 said in Synology Backup:

@scottalanmiller OK, Im getting .004*1024 = $4.10.. Am i missing something, or calculating wrong, or is it $.50/TB.

I am with you on recovery.. Hopefully its never, but even then, my current NAS that died is 7 years old, which I got for free from Drobo on SW..

@scottalanmiller, Have you used any of the Synology built in apps to back up to glacier?

I used it for years. Never had a problem.

@obsolesce said in Creating Scheduled Task with Powershell - Using specific user account:

I know this post is old, but I've found doing scheduled tasks with SaltStack is insanely simple and very effective lately... so much more than using MS Group Policy.

https://docs.saltstack.com/en/latest/ref/modules/all/salt.modules.win_task.html

I really want to get back into learning saltstack again.

Here is the post that contains more specific information on the patch and necessary configurations
https://www.askwoody.com/2018/patch-lady-tracking-some-post-release-issues/
and straight from Microsoft-
https://support.microsoft.com/en-us/help/4093492/credssp-updates-for-cve-2018-0886-march-13-2018

@scottalanmiller said in Certifications in the toilet:

Next time someone complains that you took your mobile phone into the toilet with you, send them this picture.

LOL. I take mine with me all the time. Quality learning time.

As a partner, do you get better support? I had an MSP that "used one of their support incidents" to help with an Exchange 2010 issue, several years ago. They were very meticulous and just kept going and going til they resolved it. It was a couple of hours. As far as other things, I have only dealt with Office 365 support, which was decent. Although, they always say that someone will contact you in less than an hour, but it has never been less than 6 or the next day.

For the Outlook sigs, just copy them from a sent message.

@bbigford said in Handling user AppData - Windows:

@dbeato said in Handling user AppData - Windows:

I responded to you on another forum but basically I said was Sync bookmarks through Firefox and Chrome Sync with their accounts. For signatures copy it from a sent message.

Relying on users to log in is too much manual. Needs to be fully automated where possible.

Are you the one that creates their signatures in the first place? If not, they can copy and paste that from a sent message in a few seconds. It is way easier than creating a signature from scratch.

Edit: Also, how often do you have a system fail this bad, where copying and pasting a signature is TMW?

Yeah. This type of scenario and even worse ones are why seizing FSMO roles is a thing. In this situation, you should have just chalked up the infected DC-A as a complete loss (in terms of AD) and just seized the roles on DC-B. Restoring a DC would only be done if all DCs were wiped out.

If you try to save credentials in Windows 10, it will work the first time, but subsequent times, it will fail with an error. To overcome this, I had to run this (not as admin) on the Windows 10 client while the user is logged in.

reg.exe Add "HKCU\Software\Microsoft\Terminal Server Client" /V "RDGClientTransport" /T REG_DWORD /D "1"

Update -

I explained the points made here to the person who requested I investigate this. They have backed off for now. Hopefully, it is the end of this request.