@DustinB3403 Ahh I see, then yes a prompt for input script is best then.

PowerShell Empire has some good modules that will do all that 😉
Check out BloodHound.

@Dashrender said in Windows Offline Files query:

I'm guessing those 8 people didn't make any offline updates to files in that folder, so Windows never checked to see if there were new versions.

They have Read-Only access to the network folder. Another group is tasked of updating it.

@Kelly said in Where do you see Microsoft in 5, 10, and 15 years?:

Well, this will prolong the lifespan of Windows on the desktop: http://news.softpedia.com/news/nsa-approved-windows-10-cleared-for-classified-use-512841.shtml.

If the NSA has cleared it, it'll likely still be there is 2040.

FYI - to get into a Volume License agreement with Microsoft, you must purchase 5 licenses to start. Any 5. For example 5 Windows desktops Software Assurance licenses.

The cheapest option that I am currently aware of is 4 Windows Server CALs and a single Windows Desktop upgrade or SA.

@scotth said in Rolling Out Scale Driver Updates with Group Policy on Windows Server 2012 R2:

@scottalanmiller said in Rolling Out Scale Driver Updates with Group Policy on Windows Server 2012 R2:

@scotth said in Rolling Out Scale Driver Updates with Group Policy on Windows Server 2012 R2:

We are just starting to plan our hardware refresh. I'm seriously considering Scale. I like the info that I've seen so far.

We love ours, it has been great.

I'm still pulling down information..... I need a vibrant DR plan in place or decided on before I commit to a platform. It always seems to be overlooked as an afterthought.

Common approach is to get something like a Synology or a ReadyNAS and use the Scale HC3 built in snapshot and export backup functionality to push full image backups on a schedule out to the NAS.

@Dashrender said in Windows DNS best practice:

@wirestyle22 said in Windows DNS best practice:

@Mike-Davis He is actually asking this in regards to my network. We have one root domain with two subdomains, all on their own subnets. How mine differs from the OP is both the primary and secondary DNS are in the main building attached to the root domain. We only use static IP's. There is no DHCP here. We don not even use wireless, although that will change in the near future.

What Wire didn't mention is that all servers and all clients in the entire organization use those two DNS servers at headquarters. That seems very odd to me.

FYI - Wire just came on with that client, so he didn't set this up.

This is correct

I've been looking at this too as part of a overall project.

@BRRABill said in Repos Make All of the Difference:

Can you explain all of the different repos?

Basically ever major OS except for Windows and Mac OSX, comes with a set of default repositories for software that represent what is considered to be supported as part of the base OS. CentOS, for example, as the core repos that include the repos for the Base OS, one for pulling source files and a few others that are normally off by default. This allows you to easily install the smallest possible or reasonable OS and add additional software as needed only. No need to bundle it all in and bloat the system, yet still trivially easy to add on what you need.

Anyone can operate their own repo. So you can make your own if you want. The ML servers use a repo from the MongoDB folks so that we pull the latest and greatest, supported and official MongoDB database servers directly from MongoDB instead of waiting for Red Hat to put older, Red Hat supported versions into the RH repos. So our MongoDB is managed transparently with the rest of the system, but we configure it to be much more modern than the MongoDB instance available with the OS itself.

We use Cisco Any Connect that authenticates against AD, but is not tied to any kind of GPS and it works for us just fine. Except for deployment, I see no need in using GPS.

If we use GPS for anything, it's with RADIUS for our wireless network. That works in one location but not the other. And this is only because both locations have different wireless systems and in how each system implements RADIUS and authenticates a laptop against an OU.

aww please share the list. but start a new thread - Gene's new laptop thread.

@Ambarishrh said in Scoop- Chocolatey alternative:

How is Scoop different to Chocolatey?

Doesn't pollute your path. Where possible, Scoop puts your program shims in a single directory and just adds that to your path

Doesn't use NuGet. NuGet is a great solution to the problem of managing software library dependencies. Scoop avoids this problem altogether: each program you install is isolated and independent.

These two seem to be at odds with one another - if not, please educate me.
I suppose the "where possible" is the exception ; 🙂

@momurda said in Printer Using WSD vs IP:

You can try disabling WSD on the printer itself, if it isn't a service for Windows to see perhaps it wont try to use it.

This is the same thing we do to avoid this nasty printer plague 😄

So if it doesn't provide privilege escalation and only allows you to access processes which you are running, then how is it really any different from any normal hooking? So yes, it's unpatchable in the same way deleting all the files in your own home directory in Unix is unpatchable.

Looking at the code as well... we were doing this stuff years ago to see what was being sent wrapped in SSL for reverse engineering purposes, because tcpdump or whatever couldn't read it.

@Dashrender said in Deploying Veeam Endpoint Backup on Windows with PDQ Deploy:

I'm not sure where else to mention this, but Chocolately would be another deployment method to consider.

Yes, no native package, though. So we need to make one for it. That would be my personally preferred method, of course.

@coliver said in Best Way to Deploy EXE Packages via Group Policy:

@coliver said in Best Way to Deploy EXE Packages via Group Policy:

If the EXE has a silent installer flag I would run it as a startup or login task the first time. Just add a check in there to see if it has already been installed.

Meant to say I would put it on a share and have a startup script execute it with the silent flag. Drop a installcomplete.txt file somewhere on the local disk and query for that at startup.

Cool, that's the direction that I was headed.

Oh this is another cool feature that was added recently.

Change Log 2.1.18 Image Mounting, browsing and archival.

Everything is still looking good!