Best posts made by Mike Davis

It's a nice area being so close to the Adirondacks. It doesn't matter if there a 100 good jobs there, you only need one. Start making connections and doing some gorilla marketing to find your next job. Start asking people "Is there anyone that you know that I should know?" (quote from John Maxwell)

I'll often say "It's best to sell your truck while it's still running." (that should be a song, oh wait...) Tell the owners that it's better to replace equipment on their terms when they have time to price shop and schedule the replacement rather than run it till it dies and then scramble to replace it.

I wrote this article after years of experience and some very open account reps sharing their side with me:
http://extramile-tech.com/how-to-find-a-good-account-representative/

Do you think other IT pros would find information such as territories and deal registrations helpful?

@Minion-Queen yep, I work in a town where sound was first added to motion pictures, and we make the national news because of some idiot.

Thanks to those of you that offered a suggestion. I built a second RDS server and applied my group policy and browsing was fine. I then started to think about what I needed to do to move it in to production and replace the one that had the browsing issue. Then it hit me.... I have load balancing on my SonicWall. RDS is mapped through the firewall on https. Therefore requests that went out over https could go out over either interface, but always came back on one. This is why it would sometimes work. This is also why most other sites would work, but https (in this case Office 365 which always goes over https) would only work once in a while. Adding a route to force all traffic from the RDS server out over the interface that traffic will come in on fixed the problem.

Figured out how it happened. Shut it down and started on the ugly analysis. In this case there was no ransom note file. Therefore there was no .txt file to check the permissions on. In the filename that got changed, the hacker put his email address.... Restores should be done in 2 hours. The infection bypassed cryptolocker group policies because a hacker launched it. It was not picked up by Microsoft Endpoint Protection (no surprise there) or MalwareBytes. Webroot detected it. It looks like a weak password on a service account that was allowed to log in to remote desktop caused all this.

I know an admin that once the mailboxes were migrated to o365 went in to exchange and deleted the mailboxes. Seems logical, but also deletes their AD account...

Almost every time I'm helping someone with an exchange issue on Spiceworks, they chime in with their spam. No information about how it does it different or what it does that the free Microsoft tools don't do, just spam. A couple of times I have ask them for more information about how their product will help the OP and they never reply.

I've got a printer deployment GPO that is applying to objects in an OU with blocked inheritance. I have a printers deployment GP that is linked to a physical computer OU. Then I have a RDS Server OU. In addition I have the RDS Server OU set to block inheritance just in case. The server is taking a long time to log in to and sits at "Applying Group Policy Printers policy." I did a GP result and can see it processing all the printers even through that GP isn't applied.

When I google the issue it seems that everyone else has an issue applying GPs and not the other way around. Any ideas?

I'm looking at a school that would like about 50 cameras right from the start. The UBNT NVR says it can handle 50 cameras. What do you do if you're going beyond that? Are there specs for what the VM would need if you went that route?

vssadmin add shadowstorage /for=e: /on=e: /maxsize=100GB

did the trick. I had to use command line since this a Hyper-V core install.

We used the SARA tool and then pored over the logs. We found this line:
="'15'" Title="Possible problems due to non-default values specified under \RedirectServers" Text="Non-default server entries found under the 'HKCU\Software\Microsoft\Office{2}.0\Outlook\AutoDiscover\RedirectServers' key. Please check with your administrator to make sure this is a desired configuration." GUID="620115" SSID="5f098891-0092-47b6-b3da-88599a1aaca2" P9="$CloudMbxRegistry_fCloudMbxDetected/Result" Cloud="{9}" SaraSvc="True" Weight="10000" Symptoms="Autodiscover" Pass="False" />

We opened up the registry and deleted the value HKCU\Software\Microsoft\Office\15.0\Outlook\Autodiscover
The two keys that were in there were:
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\AutoDiscover\RedirectServers]
"autodiscover-s.outlook.com"=hex(0):
"autodiscover.hotmail.com"=hex(0):

With that said, it created the exact same values, but this time it worked when we created a profile. Not sure why that worked, but it did.

Server is back online now. Bringing the files in one by one and making sure they had the right name seemed to do it.

I have a small school that is looking at renewing the Barracuda content filter for about $500 for the next year. (They already own the appliance.) Are there any other content filters I should consider? They probably filter 50-100 devices.

Since they have a Ubiquiti EdgeRouter, I considered the SquidProxy, but from what I read, it doesn't filter https traffic. I also have to wonder how they can keep to date with the list of blocked sites.

I'm looking for a program/service that will alert me if a server or service running on a server is down. Any recommendations?

@scottalanmiller said in Migrate and/or replace old cert server?:

@Shuey said in Migrate and/or replace old cert server?:

Is it common for every business/company that has a domain network to have a cert server for issuing/updating all of the AD account certificates?

Maybe I've lost my mind but... what is an "AD Account Certificate"?

You can integrate AD with certificate services so that the workstations use the certs for communication. I've never seen it done.

The only time I have used certificate services is to generate certificates for securing communication between Wireless APs and company owned devices.

First let me say that I have very little experience with linux, so I'm probably missing something obvious. I built a Zabbix server on CentOS. It seemed to be working and I went through the initial web config. Then I went to configuration and Hosts and enabled the Zabbix server. As far as I remember everything was green in the dashboard, so I downloaded an agent, installed it on a Windows box and pointed it towards my Zabbix server. I went back to the dashboard and at the bottom it's saying "Zabbix server is not running: the information displayed may not be current."

I ran this to see if the zabbix service was running:

systemctl status zabbix-server -l

output
● zabbix-server.service - Zabbix Server
Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2016-10-20 05:03:48 UTC; 9h ago
Process: 1112 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS)
Main PID: 1141 (zabbix_server)
CGroup: /system.slice/zabbix-server.service
└─1141 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf

Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Starting Zabbix Server...
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Started Zabbix Server.
Oct 20 05:08:58 vny-lnx-zabbix systemd[1]: Started Zabbix Server.

Before I google and find some random guide on how to setup email alerts for a Zabbix server, does someone have a guide I can follow?

@dafyre Thanks. I added an email address to our administrator account which is already set to get notifications. I'll see the next time something is triggered if we get an email.

A local vendor is looking for someone that can support an AS400 and called me. I have no experience with them. Do any of you still support AS400s? I guess they are looking for someone they can call if something goes wrong while they try to port the jobs that were running on it to other platforms.