Quinn Favo's questions

I am trying to configure the Thycotic Plugin for Rundeck

I am following the documentation here but the service won't restart successfully after adding the suggested configuration:

https://docs.rundeck.com/docs/manual/key-storage/storage-plugins/thycotic-storage.html

We are using Rundeck community version

APIVERSION : 41

BASE : C:\rundeck

BUILD : 4.5.0-20220811

BUILDGIT : v4.5.0-0-g5b820d3

NODE : redacted

SERVERUUID : redacted

VERSION : 4.5.0-20220811

This is the error from C:\rundeck\server\logs

nested exception is java.lang.IllegalArgumentException: Storage Plugin named "thycotic-storage" could not be loaded

Does anyone know if this Thycotic plugin has bugs in the default configuration?

We are experiencing frequent and high-bandwidth connections from almost every machine in our environment with no recognizable pattern.

We transferred ~110GB to/from our main domain controllers(10.223.3.35 and 10.223.3.14) over the past 24hours over port 445

We recently made the following changes in our environment: (however these changes were made about 7 days after the network issues first occurred)

Digitally encrypt or sign secure channel data (always) – Enabled
Digitally encrypt secure channel data (when possible) – Enabled
Digitally sign secure channel data (when possible) – Enabled
Disable machine account password changes – DISABLED
Maximum machine account password age – 30
Require strong (Windows 2000 or later) session key – Enabled
Send unencrypted password to connect to third-party SMB servers – DISABLED
Allow anonymous SID/name translation – DISABLED
Do not allow anonymous enumeration of SAM accounts – Enabled
Do not allow anonymous enumeration of SAM accounts and shares – Enabled
Restrict anonymous access to Named Pipes and Shares – Enabled
Allow LocalSystem NULL session fallback – Disabled
Do not store LAN Manager hash value on next password change – Enabled
LAN Manager authentication level - Send NTLMv2 response only\refuse LM & NTLM
LDAP client signing requirements - Negotiate Signing Minimum session security for NTLM SSP based (including secure RPC) clients - Require NTLMv2 session security, Require 128bit encryption
Minimum session security for NTLM SSP based (including secure RPC) servers - Require NTLMv2 session security, Require 128bit encryption

Snort is coming back with this type of log frequently: 07/01-20:01:41.953634 [] [1:3276:2] NETBIOS DCERPC IActivation little endian bind attempt [] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} redactedIP:55424 -> 10.223.3.35:135

Event viewer seems to be logging an obscene number of security events but none of them seem to stand out. Disk utilization in resource monitor can sit around 100MB/s and network is sometimes uploading 150mbps or higher for seemingly no good reason. There is no identifiable, intentional major data transfer from any of the problematic machines.

Any insight that anyone can provide is much appreciated!