THE JOATMON's questions

So I went through the process of deploying WHFB. I set up all the prereqs (as far as I know) following the Cloud Trust deployment guide. I added four test machines to the test OU with the appropriate WHFB GPO applied. Two of these machines, which are running Windows 11, worked flawlessly. On next boot we were able to enroll and everything is working fine. However, I'm now testing the two Windows 10 (22H2) machines and they still show "This setting is managed by your administrator" and cannot be enrolled. I have confirmed with RSOP that the policy did apply. When I check the event viewer, I see the following events (On both machines):

And then that entire series of events repeats like 3 times.

The devices show as Hybrid-Joined. AD Sync is working fine. I don't see any obvious problems. I don't understand why it's even looking for a CA since I'm using Cloud Trust and the two Win11 devices are working fine (and do not show any of these errors in their event logs).

Any guidance appreciated.

I am receiving the following alert for an internal address:

Potentially compromised account. Anomalous sending patterns were detected resulting in the user being restricted from sending mail

Ironically, it's my alerts@ address. It's sending multiple external emails to cell phone addresses (@vtext.com, etc).

I have unblocked the address a few times following the directions here, but it keeps getting flagged again. How can I whitelist this address so it does not trigger this policy?

I have set up some phishing/malware mail-flow rules that will forward emails to me for review based on attachments or a list of domains. I can then choose to accept or reject the message. It seems to work well. The problem I'm having is that this weekend, some were automatically rejected because I didn't respond in time.

How do I change this time to "auto reject"?

I'm viewing a message trace from https://admin.exchange.microsoft.com/#/messagetrace

If I expand "More Information" on the selected email, I see "Message id". When I go to https://security.microsoft.com/reportsubmission and try to submit it, it asks for a "Network Message ID". I tried entering the "Message id" from above, but it says it's invalid. I can't find "Network Message ID" (or any other ID) anywhere in the trace. What am I missing?

How do I submit a message to Microsoft?

I found this post, but it's 5 years old, so I thought I'd ask again to see if anything has changed.

I have built an email signature in HTML and applied it as a mail flow rule to append to all emails. It works well for new chains. However, if someone emails me and I reply, it appends the "disclaimer" to the very bottom of the message and makes it look like their signature.

Is there a way to append this "inline"?

I created two IIS sites which both have Windows Authentication and Directory Browsing enabled.

For the first one, let's call it "admin", I set no special permissions. I navigated to the site and was prompted for credentials. I logged in with an administrator account on the machine and was able to browse the folder. Perfect.

For the second one, let's call it "test", I created a new Windows user and removed it from ALL groups including "Users". I created a new folder on the drive and gave this new user permissions to the folder. When I access this site via a browser and login with the new account, I am able to browse the folder as expected. However, I am also able to browse the "admin" site above with this new account. This is not expected, as the only users that have permissions to the folder on the drive are "CREATOR OWNER", "SYSTEM", "Administrators" and "Users". My new user is not a member of any of those groups.

Why is this happening? What is the proper way, with IIS, to secure a folder with a local account, but ensure that account has no access to other folders?

I'm using a portable version of Xlight FTP Server Personal for Windows. I have created a "Virtual server" running on port 21 with no SSL enabled. I have added Firewall rules. I have created a user with a very simple username and password. I have also tried anonymous login. I have set the user path to c:\ and given RWCLA--S permissions. I have tried turning PASV mode off on the client.

When I attempt to login from another machine (I have used WinSCP and FTP command) I just get a "530 permission denied" error.

What else am I missing?

Here is the log from the server:

07/24/2020 15:43:37 (not login x.x.40.164<--x.x.42.64:21) "220 Xlight FTP Server 3.9 ready..."
07/24/2020 15:43:37 (not login x.x.40.164-->x.x.42.64:21) "OPTS UTF8 ON"
07/24/2020 15:43:37 (not login x.x.40.164<--x.x.42.64:21) "530 Not login, please login first"
07/24/2020 15:43:40 (not login x.x.40.164-->x.x.42.64:21) "USER ftpusr"
07/24/2020 15:43:40 (not login x.x.40.164<--x.x.42.64:21) "331 Password required for ftpusr"
07/24/2020 15:43:41 (not login x.x.40.164-->x.x.42.64:21) "PASS *****"
07/24/2020 15:43:41 (not login x.x.40.164<--x.x.42.64:21) "530 Permission denied"

our Nginx config has quite a few server and location declarations. I'm working on adding some whitelisting using deny all and allow x.x.x.x directives. I'm wondering how I can define a global list of IPs and then allow them for multiple sites without listing them all explicitly under every server and location.

In doing some research, it looks like variables are not recommended in the Nginx config due to performance? However, I'm more worried about user error when updating the whitelist causing security issues.

Here is my goal (pseudocode):

set iplist1 [10.1.0.0/16, 100.100.100.100, 200.200.200.200]
#local addresses, remote dev 1, remote dev 2
set iplist2 [10.1.0.0/16, 50.50.50.50, 30.30.30.30]
#local addresses, remote site 1, remote site 2

server {
  server_name devportal.domain.com
  location / {
    allow $iplist1;
    deny all;
  }
}

server {
  server_name siteportal.domain.com
  location / {
    allow $iplist2;
    deny all;
  }
}

If it's not recommended to use variables, is there another way to accomplish this? The primary goal being that I don't have to update 10 sites when my whitelist changes.

If I run the following command, everything works as expected:

sudo mongod --fork --dbpath /path/to_data/ --port 27027 --syslog

However, if I put the following command in startmongo.sh and run it with sudo, I get an error:

mongod --fork --dbpath /path/to_data/ --port 27027 --syslog

Error:

[root@server Folder]# sudo ./startmongo.sh
about to fork child process, waiting until server is ready for connections.
forked process: 2394
ERROR: child process failed, exited with error number 100
To see additional information in this output, start without the "--fork" option.

If I look at the log file I see the following:

STORAGE [initandlisten] exception in initAndListn: Location28596: Unable to determine status of lock file in the data directory /path/to_data/: boost::filesystem::status: Permission denied: "/path/tod_data/mongod.lock", terminating

So how can I start Mongo from a script?

I've exported a few old VMs the last few days to clean up our environments. I was trying to reimport one and received an error in the ESXi web client. Upon investigation, I noticed that the majority of the OVF files I exported show as 1kb but are completely empty.

I was looking through one of the good OVFs and I could probably replicate most of the XML elements, but I'm worried about things like disk size (ovf:capacityAllocationUnits="byte * 2^30").

I also just tried uploading the VMDK to the datastore and attaching it to a new VM but it failed and said something about "importing" the disk.

How can I ensure these exports are able to be restored if necessary?

I've tried some googling with mixed results. It looks like IMAP natively is not push but there is a "push-IMAP" draft? What does Exhcange Online use? Essentially I just want to know if using Exchange Online with Office 365 and outlook 2016 on a Windows desktop is a "push" or "pull" scenario. I'd like to know the default configuration and also if it supports push via configuration.

Here is the newly configured vlan on my Juniper:

vlans {
    vlan1 {
        vlan-id 3;
        l3-interface vlan.1;
    }
}
interfaces {
    vlan {
        unit 1 {
            family inet {
                sampling {
                    input;
                    output;
                }
                address 10.1.0.1/24;
            }
        }
    }
}

If I set my PC statically to 10.1.0.2 with a subnet mask of 255.255.0.0 I can ping/access the Juniper. However, if I set my PC to 10.1.2.2 with the same subnet, I cannot access it.

Clearly, I'm new to vlans and subnetting, but my understanding was that with a mask of 255.255.0.0 I would be able to access 10.1.*.*.

What do I need to do so that my workstations can be set to 10.1.2.x and access networking devices on 10.1.0.x and servers on 10.1.1.x? Is there something I'm missing on the Juniper?

I have a console app that runs on a few machines. I can access it using a websocket client by entering the URL ws://192.168.1.152/h264/. I need to be able to establish connections to these machines externally. I have tried many options in Nginx. I would like to be able to connect to ws://streams.mydomain.com/101 and have it go to the IP above. Here is a table of examples.

ws://streams.mydomain.com/152/ > ws://192.168.1.152

ws://streams.mydomain.com/153/ > ws://192.168.1.153

ws://streams.mydomain.com/154/ > ws://192.168.1.154

I have tried various options including the following:

Method 1

http {
    server {
        listen      *;
        server_name streams.mydomain.com;
        location /101/ {
            proxy_pass $scheme://192.168.1.52;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
        }
    }
}

This method results in "Invalid response" (gets a 301 and expects a 101)

Method 2

http {
    server {
        listen      *;
        server_name streams.mydomain.com;
        location /101/ {
            add_header  'Connection'    'Upgrade';
            add_header  'Upgrade'       websocket;
            return      101             $scheme://192.168.1.52;
        }
    }
}

This results in "Missing upgrade header".

Other methods

I also tried using the stream directive with no luck as well as rewrite under HTTP, also with varying success.

I posted a question about the second method specifically, but I'm hoping that this question will open up answers for methods I haven't been able to find.

Here is a pastebin of the FULL config: https://pastebin.com/1H49n5LB

I get the "SecInfo Database Missing" error:

SCAP and/or CERT database missing on OMP server.

Even though I manually started a sync task and in the status it appears they are all complete (and have been for 20 minutes)

And in the console "about": Feed Version: Thu Feb 7 13:52:00 2019

I'm using the ISO from https://www.greenbone.net/en/install_use_gce/. Brand new installation.

I have 3 VMWare hosts. I have root access to VSphere on each of the hosts. There is a small computer in the office that runs VCenter to which all the hosts are connected. I do not know the login to that machine.

I have removed the hosts from VCenter using the "Unregister this host from VCenter" option in VSphere, but I get a warning that when it is rebooted it may add itself back.

My question is, if I just wipe the VCenter PC after removing all the hosts, will I have any negative consequences?

I'm new to EC2. I went through the process of creating an instance. I used a p3-2xl because the hardware fit my needs. However, I didn't know much about AMIs, so I just picked Windows Server 2016 in the "quick start" section. I had all kinds of trouble with the server. Obviously RDP did not work because the software I'm using could not see the graphics card. After multiple failed attempts to get VNC communicating (TightVNC, UltraVNC...) I finally found this:

When using Microsoft Remote Desktop Protocol (RDP), GPUs that use the WDDM driver model are replaced with a non-accelerated Remote Desktop display driver. To access your GPU hardware, you must use a different remote access tool, such as Teradici Cloud Access Software, NICE Desktop Cloud Visualization (DCV), or VNC. You can also use one of the GPU AMIs from the AWS Marketplace because they provide remote access tools that support 3D acceleration.

The only AMI I found when searching for GPU and Windows was "Microsoft Windows Server 2016 with NVIDIA Tesla Driver". But upon reading the description, I don't see any mention of any remote tools preinstalled. It looks like it's just the driver, which I already installed manually. I don't want to spend the time and money launching that one only to discover I'm in the exact same place.

So I guess my question is, is there a Windows AMI somewhere that has remote access already set up for 3D/graphics processing software?

Any input or tips would be greatly appreciated.

Let's say I have a RAID 1 array with two mirrored drives. One goes bad. If I order a spare online and just put it in, the hardware controller will rebuild the array, right? How does it know which drive to mirror? What if the drive I ordered wasn't wiped and was in another RAID1 array? Is there any risk of it mirroring that drive's contents to my drive?

I'm having trouble finding documentation on this RAID controller. The Windows system details aren't very specific. It just says LSI Adapter, SAS 3000 series, 8-port with 1068E.

The server is an HP Z800.

Here is a screenshot of the device manager:

I initially installed the Intel RST software, but it shows no attached drives.

I then installed the MegaRAID Manager and was able to see the drives.

This is a VM host with multiple company VMs, so I don't want to shut it down just to get the exact model of the card (if it's even visible). How can I find out the exact model of the controller without physical access? What other information can I provide?

EDIT: According to this answer, it looks like SAS is inherently (intended to be) hot swappable. So I've reworded the question.

I'm trying to clone a 480GB SSD to a 3TB drive. I'm using device-image. It gets to about %1.7 and tells me that /home/partimage is full. I'm sure I selected /sda2 (the 3tb drive) as home/partimage. I've tried a couple different options in the advanced wizard with no luck.

The only thing I can think is that these drives are both encrypted with bitlocker. Is this an issue? If so, what is the fix? If not, what in the heck is going on?

I signed up for a trial of Amazon EC2 and created a new instance with all the defaults. Upon first login the 30GB C: Drive only had 150 megs free. I went ahead and created a new volume and have a D drive, but when I tried to download some installation files in IE they won't even download to the D drive. It acts like it does, but then it says it's corrupt. I'm assuming because the C drive is full. By the way, it is full now. 0 bytes free.

So, what do I do? I don't want to get charged. Did I miss something?

update I created a new instance, during the storage part of the wizard, this message is prominently displayed:

Free tier eligible customers can get up to 30 GB of EBS General Purpose (SSD) or Magnetic storage. Learn more about free usage tier eligibility and usage restrictions.