@jn19 said in Implement new Active Directory across Azure, on-prem, offsite, and cell-data IoT devices:
@matteo-nunziati
You're very correct about the automation PCs--they're a horror show as far as security goes.
They autologon with admin privileges, and they rarely get updates due to bandwidth and manageability issues. To be clear, the automation PCs don't actually need to be joined to our organization Active Directory, and it'd probably be best if they weren't. If there's a different solution available to monitor/patch/secure them, I'm all for it. Unfortunately, we're stuck with Windows, as a lot of the automation tools we have to interface with only have Windows drivers and utilities available.
unfortunately it is not a good idea to keep them update. unless you can recover them.
In theory if you can filter security updates only, those machines should be NOT subject to relevant alterations, but automation software could relay on specifica behaviours (even if the imolementor doesn't know) and any change can be risky.
at least, if you have access to the machines and vendor doesn't put a veto, just keep an image of the system before any update (with stuff like veeam free agent + a recovery usb pen - made by veeam) and then and only then patch the system.
manually.
I mean how many of those systems do you have?! treat them as a server patch manually and never do automatic updates on them.
just my 2 cents.