It doesn't appear to be a robocopy issue since I can't access the files through Windows. I can rename them, but not open or copy them.

no randsomware. From what I read and what I can see, the files were from a zip file that was extracted by a Mac. Most of the files are somewhere else in the folder tree.

I put the robocopy in a .bat file called "copyPublicFiles.bat" being run from the root of the drive.

robocopy /mir /r:0 is cranking through skipping the inaccessible files.

I can't seem to uncheck the encrypted box or take ownership of the files. The server they are on is Server 2008 R2.

I just noticed in Windows, the files are green. Advanced properties shows they think they are encrypted.

I'm doing a tried and true robocopy /mir to copy files from one server to another. Apparantly a Mac has been writing to a share on the old server. I keep getting these errors:

            New File                  82        ._HistoryBrochure_
Back copy.jpg
2017/04/21 21:51:45 ERROR 5 (0x00000005) Copying File \\server1\public\Sales-Ad
s-Marketing2014\History2-17-14\__MACOSX\._HistoryBrochure_Backcopy.jpg
Access is denied.
Waiting 1 seconds... Retrying...

It's not a NTFS permissions thing. In fact, the last admin discovered giving everyone full control made things work... I thought the leading . in the file name might be the issue, but renaming the file didn't work.

In fact, that's another odd thing. I can rename the files, but not open them. Any ideas?

@scottalanmiller said in What Are You Doing Right Now:

Can you get the domain registered?

I just wanted to update some DNS settings for an o365 deployment. Their current provider (ipage) doesn't support adding srv records to DNS through their web interface.

their main site https://www.networksolutions.com is up now.

I don't know. I don't follow them on twitter or anything, so I don't know how I would find out what's going on with them. All I know is I've been waiting to update a domain for a client since yesterday.

Considering Network Solutions has been down since last night, a few minutes of downtime is ok.

For a company that size I can't believe they have been down this long.

yep, got booted.

@Breffni-Potter said in Xiaomi's New $362 Bests Samsung Galaxy S8 for Half the Price:

And for a phone that is outside the Chinese market. Look at the OnePlus

https://oneplus.net

Currently using a OnePlus 3 and have been since October. Great quality phone, delighted with it.

What is a "Dash Type-C Cable"? Is it proprietary? Now that I'm used to inductive charging, and being able to charge with any old micro USB cable if I'm away from my home/home office, I don't know if I could deal with a proprietary cable.

@wirestyle22 said in Domain Controller and WINS Server Powered Down and Removed without Proper Demotion:

We don't use DHCP at all

I would go the other direction then and check for WINS queries and then visit all the NICs that are still using WINS and remove the entry. This article explains it:
https://blogs.technet.microsoft.com/craigf/2010/07/09/decommissioning-wins/

@wirestyle22 If you inherited a domain that was running like that, you'll want to check your DHCP options. Look for option 44 to see if a WINS server was specified. Option 46 may also be present. That one told the computer which order to try to look up addresses. With those out of the way, you can just shut the WINS servers down.

@IRJ said in Anyone else familiar with US-Cert Traffic Light Protocol?:

I get their emails everyday and have to act on them as part of my job. All their emails are classified at a different level.

What kind of stuff have they sent that was actionable?

That's what I get for posting before I'm totally awake. This is what I get when I run the command on my group:

BackupTarget> show member
Name       Status  Version    Disks Capacity   FreeSpace  Connections
---------- ------- ---------- ----- ---------- ---------- -----------
16TB       online  V7.0.7 (R3 16    11.34TB    6.72TB     2
                     97085)
syr-8TB    online  V7.1.2 (R4 16    5.66TB     3.69TB     3
                     02088)
4TB        online  V7.0.7 (R3 16    2.83TB     1.84TB     2
                     97085)
BackupTarget>

I think the command is showing the free space on the volumes after creation, not before since I think I have mine fully provisioned.

Just type:
show
and it will scroll through all the things under the show command and you should be able to figure out the size of your member. This is just the first of like 4 pages:

BackupTarget> show
______________________________ Group Information ______________________________
Name: BackupTarget                     Group-Ipaddress: 192.168.100.21
DateAndTime: Thu Apr 20 03:32:04 2017  TimeZone: America/New_York
TotalVolumes: 3                        VolumesOnline: 3
VolumesInUse: 3                        TotalSnapshots: 0
SnapshotsOnline: 0                     SnapshotsInUse: 0
TotalMembers: 3                        MembersOnline: 3
MembersInUse: 3                        TotalCapacity: 19.83TB
VolumeReserve: 7.58TB                  VolumeReportedSpace: 7.58TB
SnapReservedSpace: 3GB                 SnapReservedSpaceInUse: 0MB
ReplicationReservedSpace: 0MB          FailbackReservedSpace: 0MB
DelegatedSpace: 0MB                    DelegatedSpaceInUse: 0MB
FreeSpace: 12.24TB                     TotalDisks: 48
OnlineDisks: 45                        SpareDisks: 3
OfflineDisks: 0                        FailedDisks: 0
Collections: 0                         Snapcols: 0
CustomSnapcols: 0                      ThinProvFreeSpace: 122.49TB
TotalSpaceBorrowing: 0MB               Connections: 7
_______________________________________________________________________________

pretty sure:
show member

will show you what you want.

So the malware was called by an autorun.inf, or you clicked on something on the pen drive?

BTW, I didn't check them all, but the IPs I did check are already registered in the https://www.abuseipdb.com so it's not like this is secret information.

I received a builtin today because I support an agency that works with New York State. It was an advisory about some IP addresses to watch out for. They recommended keeping my system patched up to date and said I should consider blocking the suspicious IP addresses from third world countries they have identified. The real joke was that this information was coded "TLP:Amber" meaning these IPs shouldn't be shared with the public. Maybe someone from the public should tell them about geo-blocking. This is the first alert they have sent me. Has anyone else received these "alerts" before? Are they all like this?