I was looking at a system that someone else built and I have doubts as to how the network is set up due to the problems they are experiencing. It's a HP Proliant ML350 G9 running Hyper-V with 4 ports plugged in to a 3COM 3CRBSG2893.

I don't have access to the system (yet) but is it possible that this configuration could work if they selected "Switch Independent" mode when they set up the NIC teaming?

On one level I'm wondering if any of that was even necessary since they only have 30-40 users.

In my experience I have to agree with Scott. It's the only office where everyone can read everyone else's email and the file server is a free for all.

I would ask them what regulatory requirements they have.

@Mike-Davis said in Zabbix gone wild:

@dafyre said in Zabbix gone wild:

From your Zabbix server...

try to run this command a few times and see if it returns everything like it should:

zabbix_get -s ipofyourhost -k "vfs.fs.size[C:,pfree]"

Run it a few times back-to-back and see what you get... and then compare with the results of...

zabbix_get -s ipofyourhost -k "vfs.fs.size[C:,free]"

Where do I find the zabbix_get command? I tried it and got "-bash: zabbix_get: command not found"

and then I googled it and ran:
yum install -y zabbix-get

OK 9 minutes because I didn't have an account. It looks like I'll be able to check back tomorrow to see some analytics.

After 2 minutes I've had to turn off "Alert when an IP address is blocked".

There is a bit of a delay since the admin had other services running on his domain controller. He has a SQL that he has to address before he can reboot the other domain controller. I got AD replicating between the domain controllers and DHCP/DNS working properly, but as far as the AD certs, I'm bowing out of this one at this point. I don't know enough about the underpinnings to know how to test it properly since an attempt to set it up was botched halfway through.

I'll be interested to hear myself how it is resolved.

CloudFlare is still seeing the same amount of traffic, but ASmallOrange is seeing way less bandwidth. (It's actually reading 0 for the day.) The WordFence live feed is a constant stream of blocked requests.

I would poke around it long enough to figure out if the server had been logged in to, or if a user's computer encrypted all the files. You don't want it coming right back. Like others said, figure out how it got infected and then restore back before the infection.

I'm looking for a way to tell if a machine has downloaded and applied all available Microsoft Windows Updates? Other applications would be nice as well. Is anyone using Ninite pro? Is there something else I should look at? This would be for about 140 computers.

I've had two servers now for different clients reboot in the work day when they are scheduled to install updates at 2AM.

In both cases it was the hyper-v host that rebooted and it took down the production server.

Time/date and timezone were set correctly. Anyone else see this happen?

If it actually is two SSDs they will be worth more than the server they are going in. (It's a little HPE microserver.)

Does anyone have a UPS for a desktop computer they like? Is there something that comes with the software to do a graceful shutdown of a computer if it's going to run out of battery?

I've used Advanced IP Scanner to quickly figure out if there are devices configured statically on certain addresses, etc.

I used Angry IP too, but it requires Java.

I would think taking ownership of the files makes the most sense. Does your backup account have access? If not, those files aren't getting backed up. How did files get created that an admin doesn't have permissions to? Were permission set on the drive where a user has full control?

In part of my strategy to prevent CryptoLocker or a bad actor from taking out my backups if a computer/server gets infected, I'm not domain joining my hosts now. I realized that even with a share on the network that used a service account, if a hacker elevates privileges and gets domain admin, they can reset the password on the backup service account and then wipe out my backups. If the backup target is not domain joined, they can't do that. Same idea with the host.

I'm curious as to what others are thinking. We love disk to disk backups, but it's really hard to air gap them with out physical interaction.

On the flip side of things I can't even convince my own accountant to use something else. What choices do I have? In a small town you may not be able to find an accountant that is willing to consider something else.

I agree QuickBooks sucks to support. Getting people to switch is even harder...

If you have to migrate users desktops, download the User State Migration Tools (USMT) and find a tutorial on scanstate and loadstate. You can keep it really simple, or get pretty involved depending on your needs.

Do all your users do the same tasks? Can you justify replacing 20% of your computers to give the power users new machines? Then in year two or three trickle those computers down to other users and get the power users a new batch. That's what I do in CAD environments. The power CAD users always have fast machines and their two and three year old machines are plenty fast for normal office work.

I like the continuous replacement model because you don't get bogged down in a replacement project for months. It's just a background task that entry level people can do.