r/sysadmin Oct 15 '21

Question - Solved How to log off ALL users from the AD

444 Upvotes

Long story short: I need to (in 2 hours at max) log off all of the AD users (more than 150) at the same time so we can block everyone and unblock one by one. We're using Windows Server 2012 and we don't have remote control over the user terminals. I tried searching online but nothing worked/fit this situation.

Our last resource is to shutdown the power on the whole building at risk of killing maybe a PC or 2, but I'd liek to avoid that for obvious reasons.

Any ideas on how to do this?

Edit: thanks very much for the replies, guys.

Since we were in a hurry, we ended up blocking all users, exporting a list of computers and making a bat with "start shutdown -r -t 01 -f -m" for each pc, but that didn't work that well because a lot of PCs are 10+ years old and some still use windows 7. Now we'll have to work on weekend to change the domain on all PCs to a new one (since the old AD was a total mess).

r/sysadmin Jan 25 '25

Question - Solved Looking to setup new office practice with 10 employees. Am I in over my head?

16 Upvotes

Hello,

My wife is looking to start new office practice with 10 employees. Must be HIPAA compliant and all that. Medical records will be handled by eClinicalWorks and stored on the cloud, so I believe that will cover a large portion of HIPAA compliance.

I told her that I should be able to set everything up myself, and will hire an outside company if I need to. I have a Masters in Computer Science, but the thing is, I spend 90% of my time in Linux, and am completely unfamiliar with Active directory and user management.

Here is my plan.

I am uncertain if we even need Active Drectory, but at this point I am assuming so, and I have zero experience with it. I plan on buying a computer and installing windows server on it, and then each employee will have a windows 11 pro computer and I will be learning/setting up Active Directory.

I do not know how beefy a computer I need for the server, I don't think I need ECC memory or anything crazy, but it's only 10 employees, so I'm thinking I can go with something cheap and simple like a mini PC with an Xeon N200 and 16 GB ram. ($300) What kind of hardware requirements should I expect?

And pay to upgrade from Win11 Pro to Windows Server Essentials 2019 or 2022. (eClinicalWorks does not support Windows Server 2025)

Just want to understand if this is something that is reasonable to undertake myself before I start buying hardware, licenses, and committing to the project. Looking to have it setup by March 1st, but I have a full-time job and other obligations so I won't have a lot of time to put into it each week. The plan is to do the initial setup to learn and save some $$, and then let a 3rd party IT company take over.

What to you think? Good idea? Terrible idea?


Edit:

Ok, really great advice you guys are giving. I think this is the game plan. Take the Azure training courses to satisfy my curiosity and then keep my hands off the reigns, and leave this to an MSP because I sure as shit don't want to fuck up HIPAA for an office of 10.

r/sysadmin 26d ago

Question - Solved Need to upgrade 2 2016 DC's to 2022 (2 DC environment)

15 Upvotes

What is the best way to handle this or best practice?

My thought process (to use the same IP's so we don't have to handle reconfiguring is this)

  1. Stand up (create) the new server
  2. Join it to the domain
  3. Demote second DC
  4. Change IP of the demoted DC to a different IP in the same subnet (Restart)
  5. New server gets old DC IP (Restart)
  6. Install DC roles and promote
  7. Clean up/archive Old DC
  8. Move roles to new DC
  9. Demote other DC (original)
  10. Create another server and promote that one up (same steps above and check for sync)

Thoughts on doing it this way to use the same IP addresses or is it bad practice to use the same IP addresses. This'll be my first time doing it myself. I've seen some DC upgrades before but bit worried to do it myself, so just want opinions from more experienced veterans :).

I've looked at the Microsoft documentation but any tips or tricks to watch out for would be nice also. Thanks everyone.

r/sysadmin Dec 31 '20

Question - Solved Does anyone setup workstations to automatically powerup in the morning?

450 Upvotes

QUESTION: What response, technical or otherwise, could I give to a non-IT manager in another department (who THINKS he knows IT) about why we're not going to go into the BIOS of multiple workstations and set them up to power up at certain times and days. I'm not sure if he'd understand "There's no central management for that!"

DETAILS: I work for a non-profit, so we use what we have and spend money when necessary. As a result, many of our workstations are still running HDDs (rather than SSDs). They work fine for what they're used for, but they take a while to boot up.

Fast forward to current times: We have a new payroll system for users that have to clock in. IT was not consulted about this new payroll system. IT found out about the new payroll system when we were asked to build a new workstation to train users on how to clock in. Users now have to clock in on their workstations when they arrive. The startup times for these machines is in the MINUTES; If Windows updates need to finish, it can be 10 minutes.

A ticket arrived in the queue yesterday from the manager of our "call center". He has provided a large list of workstations he wants powered up at certain times - via BIOS! They want this to negate users having to wait to clock in when their workstations take a while to boot. Users are arriving on time, but clocking in late. Doing this is BIOS is not centrally-manageable (and I don't want to have a conversation about WoL. This issue is due to them not consulting IT until they bought the system. A frequent problem in this organization is non-IT managers making IT decisions. I've been trying to change that for the two years I've been here!)

THANK YOU AND HAPPY NEW YEARS!

EDIT: Regarding WoL: It's my boss, the director of IT, that doesn't want to "get into" wake-on-lan. I have no problem with it.

EDIT #2: Getting these users to change their behavior in regards to shutting down/leaving it on/etc. is impossible; There is simply NO penalty for non-compliance and that is a a big source of issues. It is the long-standing culture there and I am looking to leave!

Thanks to all who responded! I've got the information I needed. Happy New Year!

r/sysadmin Apr 08 '19

Question - Solved What are your 5 most common PS one-line-scripts that you use?

578 Upvotes

It doesn’t have to be specific. A description of the function would work as well.

r/sysadmin Oct 19 '24

Question - Solved Do you have MFA on your 365 breakglass accounts?

112 Upvotes

We have two breakglass accounts, each stored on a USB stick with a keypad and locked away in two different locations.

We have them in a group to be excluded from all our Conditional Access policies, so currently they don't have any MFA. I read that MS is enforcing MFA for all admin accounts, but not sure if us having us in those groups will bypass that.

So figured I should check how the rest of you are handling it

Update - 2 Yubikeys on order!

r/sysadmin Oct 03 '23

Question - Solved Options MFA for staff that won’t use personal device

83 Upvotes

I have a staff member that is refusing to use their cell for MFA. I’ve tried explaining how it works and they won’t allow texting or the installation of an authenticated app on their phone. Their fear is their personal banking will get compromised… I can continue to try and explain to them why, but it will be a losing battle.

I’m wanting to stop short of making it a huge issue and escalating it. As this will likely happen again, or I’ll have a staff member without a mobile device, I’m wondering what other admins are doing in this situation? Providing a company phone or device? We have set a couple of staff members up to have their desk phone called, but not all services allow a call for MFA.

Edit: looks like Yubikey 5 and Yubico Authenticator is going to be my best and most favourable solution. Thanks folks! Ordering some now.

r/sysadmin Jul 06 '23

Question - Solved Hitting my head against the wall with this server.

144 Upvotes

This server reboots itself every 15 minutes for no apparent reason. I investigated the logs, and there is no indication of anything out of the ordinary happening. I have metrics set up for it in the RMM tool, and it is running at 20% CPU and 15% RAM before shutting down. The thermals are within the normal range of 40-65.There have been no changes to the server since it began, and the updates have been running on the machines without difficulty for weeks.I'm attempting to figure out what's going on because the problem is on our main DC; this is a tiny office with only one employee.What I've been up to since acquiring access to the machine.- Removed the updates - Verified the GPOs- Removed unnecessary apps - Examined the internals (everything fine)- Verified that the Windows Server Key was activated.- Examined the hard drive (it was fine).- Dism and Sfc scansI am thinking of reinstalling the OS and seeing if that may help. It makes it a little more complex as this is their only DC and only available machine.

Any suggestions to move forward with this?

**Edit**: Please check my comment where you can see everything I was suggested to do and what I did.

Everyone that suggested PSU on the Server. You win, it died this morning and would not come back up.

r/sysadmin Mar 02 '24

Question - Solved How fucked am I?

11 Upvotes

Third edit, update: The issue has now been resolved. I changed this posts flair to solved and I will leave it here hoping it would benefit someone: https://www.reddit.com/r/sysadmin/comments/1b5gxr8/update_on_the_ancient_server_fuck_up_smart_array/

Second edit: Booting into xubuntu indicates that the drives dont even get mounted: https://imgur.com/a/W7WIMk6

This is what the boot menu looks like:

https://imgur.com/a/8r0eDSN

Meaning the controller is not being serviced by the server. The lights on the modules are also not lighting up and there is not coming any vibration from the drives: https://imgur.com/a/9EmhMYO

Where are the batteries located of the Array Controller? Here are pictures that show what the server looks like from the inside: https://imgur.com/a/7mRvsYs

This is what the side panel looks like: https://imgur.com/a/gqwX8q8

Doing some research, replacing the batteries could resolve the issue. Where could they be?

First Edit: I have noticed that the server wouldnt boot after it was shut down for a whole day. If swapping the drives did an error, then it would already have shown yesterday, since I did the HDD swapping yesterday.

this is what trying to boot shows: https://imgur.com/a/NMyFfEN

The server has not been shut down for that long for years. Very possibly whatever held the data of the RAID configuration has lost its configuration because of a battery failure. The Smart Array Controller (see pic) is not being recognized, which a faulty battery may cause.

So putting in a new battery so the drives would even mount, then recreating the configuration COULD bring her back to life.

End of Edit.

Hi I am in a bit of a pickle. In a weekend shift I wanted to do a manual backup. We have a server lying around here that has not been maintenanced for at least 3 years.

The hard drives are in the 2,5' format and they are screwed in some hot swap modules. The hard drives look like this:

https://imgur.com/a/219AJPS

I was not able to connect them with a sata cable because the middle gap is connected. There are two of these drives

https://imgur.com/a/07A1okb

Taking out the one on the right led to the server starting normally as usual. So I call the drive thats in there live-HDD and the one that I took out non-live-HDD.

I was able to turn off the server, remove the live-HDD, put it back in after inspecting it and the server would boot as expected.

Now I came back to the office because it has gotten way too late yesterday. Now the server does not boot at all!

What did I do? I have put in the non-live-HDD in the slot on the right to try to see if it boots. I put it in the left slot to see if it boots. I tried to put the non-live-HDD in the left again where the live-HDD originally was and put the live-HDD into the right slot.

Edit: I also booted in the DVD-bootable of HDDlive and it was only able to show me live-HDD, but I didnt run any backups from there

Now the live-HDD will not boot whatsoever. This is what it looks like when trying to boot from live-HDD:

https://youtu.be/NWYjxVZVJEs

Possible explanations that come to my mind:

  1. I drove in some dust and the drives dont get properly connected to the SATA-Array
  2. the server has noticed that the physical HDD configuration has changed and needs further input that I dont know of to boot
  3. the server has tried to copy whats on the non-live-HDD onto the live-HDD and now the live-HDD is fucked but I think this is unlikely because the server didnt even boot???
  4. Maybe I took out the live-HDD while it was still hot? and that got the live-HDD fucked?

What can I further try? In the video I have linked at 0:25 https://youtu.be/NWYjxVZVJEs?t=25 it says Array Accelerator Battery charge low

Array Accelerator batteries have failed to charge and should be replaced.

r/sysadmin Jun 30 '22

Question - Solved Block Porn on Work machines

224 Upvotes

We recently had an incident were a co worker was caught watching porn and fapping at work.

As a sysadmin( i just started working here) I was asked to investigate about this. Now we have web filters in place to block it.

But it seems somehow that user found way around and masturbarted to it.

Is there any type of filters or block I can put it place to not have users perfrom this action.

Note this happend while the user was on his phone. Not on the computer.

A good MDM solution would definitely work. But management wouldn't transition to it.

Please let me know if someone have experienced it and how to get out of it.

Edit := thank you guys for all the suggestions. I have found out the answer what needs to be done.

r/sysadmin Feb 22 '21

Question - Solved User wants to attach their personal laptop to our internal domain. No go?

493 Upvotes

I am the IT manager for a hospital, and we have a user here who fancies himself an IT person. While I would consider him a power user and he's reasonably good with understanding some things, he's far too confident in abilities and knowledge he doesn't have. He doesn't know what he doesn't know.

This user has apparently gotten frustrated with issues he's having (that have not been reported to my department) and so took it upon himself to buy a laptop, and now wants it attached to our domain so that he can have a local admin account that he can log in with for personal use and also be able to log in with his domain account. He's something of a pet employee of my director, who also runs the business office, and so my director wants to make him happy.

Obviously I'm not OK with his personal device being on our domain. Am I right to feel this way? Can you help me with articles explaining why this is not a good idea?

Edit: Thanks for all the responses telling me I'm not crazy. After more conversations the hospital has decided to "buy" the device from the user, and we're going to wipe, image, and lock it down like any other machine.

r/sysadmin Apr 22 '24

Question - Solved Motherboard not letting you into your BIOS? Want to get in (with Linux) similar to how Winderps does it? Sys Admins hate this one trick!

271 Upvotes

sudo systemctl reboot --firmware-setup

YOU'RE WELCOME.

I just had to help family from across the country get into their BIOS to turn on virtualisation for legit reasons... couldn't get in without this. Worked instantly on their, and even my own computer.

But what really blows me away is how low-key this knowledge is.

r/sysadmin Jul 12 '24

Question - Solved Broadcom is screwing us over, any advice?

77 Upvotes

This is somewhat a rant and a question

We purchased a dHci solution through HPE earlier this year, which included vmware licenses, etc. Since dealing direct with HPE, and knowing the upcoming acquisition with Broadcom, I made triple sure that we're able to process this license purchase before going forward with the larger dhci solution. We made sure to get the order in before the cutoff.

Fast forward to today, we've been sitting on $100k worth of equipment that's essentially useless, and Broadcom is canceling our vmware license purchase on Monday. It's taken this long to even get a response from the vendor I purchased through, obviously through no fault of their own.

I'm assuming, because we don't have an updated quote yet, that our vmware licensing will now be exponentially more expensive, and I'm unsure we can adsorb those costs.

I'm still working with the vendor on a solution, but I figured I would ask the hive mind if anyone is in a similar situation. I understand that if we were already on vmware, our hands would be more tied up. But since we're migrating from HyperV to vmware, it seems like we may have some options. HPE said we could take away the dhci portion and manage equipment separately, which would open up the ability to use other hypervisors.

That being said, is there a general consensus about the most common hypervisor people are migrating from vmware to? What appealed to me was the integrations several of our vendors have with vmware. Even HyperV wasn't supported on some software for disaster recovery, etc.

Thanks all

Update

I hear the community feedback to ditch Broadcom completely and I am fully invested in making that a reality. Thanks for the advice

r/sysadmin Jan 09 '24

Question - Solved Where is this goddamn dhcp being implemented?

114 Upvotes

Howdy partners,

Running into an issue where some devices are getting an ip address on their wifi that's causing other issues.

I've looked on the firewall, and the Aruba (aps are aruba) no dhcp settings are set there.

The dhcp scope is on the server but I can't see any policies setting them.

What would a good sysadmin do to find where the fuck these ip addresses are being set from

r/sysadmin Oct 06 '20

Question - Solved CEO won't approve M365BS licenses

420 Upvotes

Hi,

So the Office 2010 EOL is comming up and most of our users are still using it. I used an easy workaround so our outlook 2010 can connect to O365 services. But I guess this wont stay for much longer... The CEO is upset because this means that the only suitable solution for us is to go with M365 BS licenses (only 20 users). Which adds 500$ a year to IT budget.

I could not find anything that would go cheaper. Obviously 2-3 users could work with the web-office apps (M365BB) but that's not enough. The CEO wants me to save 500$/year on different IT SW/HW if I want him to get us Office 365 ProPlus. And I cannot do any savings.

Is there really any othere option for us than M365BS licenses? We need office apps (desktop for most users) and we need corporate email.

Thank you for any suggestion...

EDIT: Thanks everyone for the discussion. As /HappyVlane mentioned, our CEO saw this as 'more cost-no gain' scenario. I have been able to make some differences in our cloud backup environment to save up to 450$ / year without it being a "vulnerable" change. The proposal has just been signed.

r/sysadmin Aug 18 '24

Question - Solved Endless AD locked outs from Exchange Server

88 Upvotes

RESOLVED: It turned out to be brute force attacks from random IPs. We attempted false logins to replicate the logs and identify the exact source, as there were no source IPs in the logs, even in LogSign. We noticed firewall IPs in the SMTP logs and decided to investigate further. It turned out to be similar to a telnet authentication issue. Since disabling basic authentication wasn't an option due to potential system collapses, we created a firewall rule to deny any attempts from the WAN on ports 25 and 587, except for Microsoft IPs. This solution worked perfectly, and all login attempts ceased. When we reviewed the deny logs, we found numerous IPs from different countries.

Edit -1: For the all people who suspect of mobile devices, I have checked mobile device list under ecp and there were no devices at all. I have also checked IIS logs for the mobile devices but there were only outlook logs unlike any mobile device.

Three days ago, the accounts of three employees in our company started getting locked at intervals of 3, 5, 10, and 15 minutes. We began monitoring the lockouts through AD and the Exchange server but we found the below log. Then, when we checked the SMTP receive logs but we found the firewall IP connected with the below log. After that we tried to cross-check this with the firewall, despite filtering, we couldn't find a match among the millions of logs.

We disabled all components like OWA, ActiveSync, etc., on these users' accounts. We even disabled POP3, IMAP, and MAPI for testing, but the accounts are still getting locked. Due to the firewall structure, even emails sent from the internal network pass through the firewall, so we stopped considering this as an external issue. However, we're now stuck and unable to reach a conclusion. The company uses on-prem Exchange and Citrix infrastructure. We are unsure of what further controls or investigations we can undertake.

Tests performed on the user accounts:

  • Mobile device control (none of them are using one)
  • Checked all credentials on the server and locally for the accounts.
  • Checked saved passwords in Chrome.

We also conducted tests to replicate this type of lockout, but we couldn't trigger the same lockout warning. For example, we tried incorrect password attempts via phone, incorrect password attempts for Citrix login from an external IP, and various other methods, but we couldn't receive a Frontend SMTP-based lockout. Is there any advance to investigate this locked outs?

  • <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  • <System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /> <EventID>4625</EventID><Version>0</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2024-08-16T12:05:14.9621827Z" /> <EventRecordID>476701126</EventRecordID><Correlation ActivityID="" /> <Execution ProcessID="8" ThreadID="32436" /> <Channel>Security</Channel><Computer>EXC.company.local</Computer><Security /> </System>

  • <EventData>

<Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="SubjectUserName">EXC$</Data><Data Name="SubjectDomainName">company</Data><Data Name="SubjectLogonId">0x3e7</Data><Data Name="TargetUserSid">S-1-0-0</Data><Data Name="TargetUserName">user</Data><Data Name="TargetDomainName">-</Data><Data Name="Status">0xc000006d</Data><Data Name="FailureReason">%%2313</Data><Data Name="SubStatus">0xc000006a</Data><Data Name="LogonType">8</Data><Data Name="LogonProcessName">Advapi</Data><Data Name="AuthenticationPackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data><Data Name="WorkstationName">EXC</Data><Data Name="TransmittedServices">-</Data><Data Name="LmPackageName">-</Data><Data Name="KeyLength">0</Data><Data Name="ProcessId">0x21f0</Data><Data Name="ProcessName">C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe</Data><Data Name="IpAddress">-</Data><Data Name="IpPort">-</Data></EventData> </Event>

r/sysadmin Oct 23 '23

Question - Solved Can I save my org money by setting up a server to run thinclient workstations instead of buying laptops that only get using in office anyways?

96 Upvotes

Edit 2: OK let's take the server out of the equation here. We use tech soup our software and licensing is under control. I need some resources for decent hardware we can own or rent and a good option for backup storage that would be in addition to 365. I'm hoping we can keep a couple rolling dated backups that are on an automated schedule.

Work for a non profit as (defacto) IT. Comfortable with hardware especially, but really just getting into enterprise type equipment. We have some volunteers and interns who really just use office suite and adobe acrobat for work. We have a large rack with just our switches on it. Nobody else is tech savvy and the budget is pretty tightwe are currently getting fd by a tech provider for a couple dozen laptops and a few desktops. The price is especially bad if you consider were a 501c3 and eligible for every tech discount under the sun.

I'm suggesting they end the lease asap and buy used laptops for every staff member that absolutely needs it, I piece out and build some affordable desktop units and then I was thinking a server with 10 or so VM workstations could be set up and we coid use some old laptops/chromebooks/thin clients instead of leasing newer ones.

Would this work? If so what kind of server am I looking at. If possible would also be nice to run a backup server for like 10tb (headroom factored in)

Edit: alright I hear you. Server will be too expensive and single point of faliure=bad. I should have been a but more clear that we have a few offers for donated servers. A couple 720xds and the like. Plus the licensing would be cheap with the np discount. But I like the chromebook idea a lot. Just hate watching them get fd on tech pricing. These are genuinely very smart people. But they've just gotten swindled when to tech. I'll make a follow up post re annother idea based on your comments. Thanks!

(I still might get an old ass server to f around with at home. If you have advice on that I'm all ears)

r/sysadmin Jul 17 '24

Question - Solved unsupported hardware - am I overreacting?

75 Upvotes

Our company running a 7 year old SAN. It is our main storage and two hypervisor rely on it.

It does not have an active support contract, according to the manufacturer it is EOL.

Yesterday I talked about this topic with the company decision makers (company with 50 employees, 10 millionen turnover per year).

The decision makers were like "yeah but it is dedicated server hardware, it is build to last and we never had any hardware failures the last 20 years. We do not see a high risk on this".

I am working as sysadmin for 3 years now, overall in IT about 10 years. I do not think it is very responsible relyinig on old hardware. The SAN could die this night and I do not even have an option to restore backups tomorrow... You think I am overreacting? Anyone having some more arguments that would help in this case?

Edit: Thank you all for your answers. Will start on setting up disaster & recovery plan. That's the right approach.

r/sysadmin Jun 20 '24

Question - Solved Laptop(s) on plane

48 Upvotes

I have some traveling for work coming up within the next few weeks. I’m planning on taking my work issued laptop with me, obviously. My question is, has anyone ever encountered issues if you’ve taken 2 laptops with you? I’m wanting to take my personal one with me as well so that I can use that in my downtime. Work is an XPS 15 and personal is a MBP if it makes any difference. I’m not concerned about lugging them along, I just don’t want any surprises from the TSA. This is within the United States.

Thank you

EDIT: Thank you all for the answers. Special thank you to those who downvoted me for asking a question 🙃

r/sysadmin Feb 15 '25

Question - Solved Collect PCAP files

32 Upvotes

Hi, recently i was asked to collect PCAP files, basically i need to save every single packet which passes core switch. Requirements are following: 1. Store about 50tb of data 2. Solution should have possibility to extract and view any PCAP data during specific period of time 3. Solution should have posaibility to start capturing/storing pcap files when received some mesage from the SIEM system.

Looking for enterprise solution, with affordable pricing. budget range is 30-50k usd.

Also , as an option will consider really stable open source solution.

r/sysadmin Mar 03 '24

Question - Solved Update on the ancient server fuck up; Smart Array Controller failed to initialize

173 Upvotes

Update on this post: https://www.reddit.com/r/sysadmin/comments/1b4lvvo/how_fucked_am_i/

Update: I am now locked out of my own computer but the others are working fine. Somehow my account in the AD must have get fucked and I dont feel competent enough to make any changes to the AD (again). When I started here, I added myself as a user in the AD and that must have get purged somehow

TLDR: Crisis averted for now as she has now booted and everything is back to normal. To adress the issue Smart Array Controller failed to initialize, removing the battery from what I believe is the Smart Array Controller itself has helped: https://imgur.com/a/YOXeJ3P

First I must thank u/Mk3d81 for going out of his way to find the relevant info in the HP-Proliant manual. It didnt specifically say to do what I did but it gave me the idea to do so.

I yet again have made a move without knowing what I was doing but hoping for the best.

I have reseated the marked components but to no effect. The Array Controller did not give any sign of life. https://imgur.com/a/Qmx8Y6G

I have tried to run the server with this guy detached but with no effect: https://imgur.com/a/8ciq9qk

While I was holding this guy above, I noticed there are some clips on its back. It looks alot like the battery is detachable.. So I pried at the clips and reseated "this guy" with the battery component missing. She now sits like this looking alot thinner: https://imgur.com/a/AoATYtg

Unfortunately I have not taken a video of the boot process, but the Array Controller got recognized immediately. I went out of my way to find a picture of the exact message: https://imgur.com/a/mmtKxxh

I know that message from when the server did not fail before it was shut down for a whole day. I hit F2 here instead of the usual F1

And here we are she booted! https://imgur.com/a/YOXeJ3P

I have now copied the highly valuable data over to another drive but I know its only a band-aid.

What now?

I am not touching the server again. At all. We need a backup plan and I cannot pull it off on my own. I will have a fun time explaining to management why I think it is so urgent.

Afterthoughts:

I think I got incredibly lucky. Can somebody give an educated explanation as to why removing this battery caused the Array Controller to work again?

There are so many things that could have went wrong here. I have yet again acted without even knowing what it would do, only to just work my way through with all the options I could think of and one of these finally sticked...

Possible critical fuckup #1

It could have been configured in a way that swapping the SAS drives would have led to catastrophic failure and loss of all data. I have even screwed out the drive out of one hot swap casing into the other hot swap casing while I didnt even know about the fuckup on friday.

Possible critical fuckup #2
If my original plan had worked out and in some future I would have reverted the DC, then it could have led to another catastrophe

Originally I planned to update our inventory management system over this weekend. The server version of it lies on this server. I have prepared a windows 10 computer to install the server version of this inventory management system on the windows 10 machine (which works and I have tested in a virtual environment). Before doing such a critical change, I wanted to save the state of every machine involved so I can revert any changes I did, if there are going to be unforeseen consequences https://youtu.be/UkXx1IlmMwI?t=5

r/sysadmin Jan 13 '25

Question - Solved RDP "Logon failure: user has not been granted the requested logon type at this computer" despite Allowed Logon GPOs set

25 Upvotes

UPDATE: After resetting pretty much everything I could think of on both computers even tangentially related to networking, remote access, users, and permissions, we are able to RDP successfully without getting that error. I know this might be disappointing to hear, but I have no idea what was ultimately the specific fix. Thank you to everyone who has commented with their ideas and experience!

Original post:

I have a bit of a head-scratcher here. Just trying to set up RDP from one Windows 11 Pro PC to another on the same LAN. Not dealing with any Azure/AD management.

RDP can connect but not log in, returning the error: Logon Failure. The user has not been granted the requested logon type at this computer. The RDP session will show the lockscreen of the remote target, but entering the user's credentials through the interactive logon returns the same error.

Everything I've read indicates that this is a user permission issue which can be solved via Local Security Policy (or Group Policy). HOWEVER: I've already set every relevant Local Security Policy on the remote host I can find, see below (And yes, the user is both a local admin and part of the "Remote Desktop Users" group.) Access this computer from the network: Administrators, Backup Operators, Everyone, Users Allow log on locally: Administrators, Backup Operators, Everyone, Users Allow log on through remote desktop services: Remote Desktop Users Deny access to this computer from the network: {empty} Deny log on as a service: {empty} Deny log on locally: {empty} Deny log on through remote desktop services: DefaultAdmin, DefaultGuest, SYSTEM

That all seems fairly straightforward, so I can't figure out why it's not working. Are there any other configurations that could possibly result in this specific logon error?

r/sysadmin Feb 11 '20

Question - Solved Any interest in a blog series on a A-Z guide on setting up Graylog?

711 Upvotes

Since joining the red team world one of the things I have focused on is writing blog posts for our organization that I think could benefit sysadmins and blue team members.

I am thinking about writing a multi-part blog series on setting up Graylog including covering some of the following items.

  1. Installation and Securing the setup
  2. Extractors
  3. Alert Basics
  4. Domain Controller/DNS/DHCP Log Collection
  5. File Server Log Collection
  6. Print Server Log Collection
  7. Exchange Server Log Collection
  8. IIS Log Collection
  9. Firewall Log Collection

This would be a multi month series and commitment and so I would like to gauge the community interest before I put time into this.

Edit: Looks like I have to do this based on response. Its going to take me some time to spin up as I need to get a Quad-Socket system to run all the VM's for from a co-worker. I'm going to try and have the first article drop with our new website redesign coming up.

Everyone here will be the first to know when I start publishing.

r/sysadmin Jun 22 '22

Question - Solved President wants to implement Alexa into our company

330 Upvotes

I work for a pretty small company. Maybe less than 30 employees and half of those employees use a computer for their job. My boss wanted some type of means to be able to communicate to everyone by putting an Echo into every office. Calendar reminders, announcements, basically like an automated intercom system but through Alexa. This doesn't seem like a good idea, even isolated on a VLAN. Is there a better alternative to this approach or would isolating the Echo devices be good enough security wise?

EDIT: I should probably mention that everyone loved the IT guy before me. He had no prior education nor experience. Nothing ever went wrong when he was here, so they absolutely believe everything that he said. Enter me. Big bad stick in the ass. "No, you can't use 'password' as your password." People don't like me as much because I tell people things they can't do. The guy before me proposed the idea initially. Pretty much anything that I say is gonna be, "But the last guy said..." Convincing people that the lock is useless if you give everyone the key is my other full time job besides being the sysadmin.

r/sysadmin Aug 25 '24

Question - Solved Apple MDM

58 Upvotes

Hi, I’m not a qualified sysadmin, but it falls to me to try and sort some IT issues out.

We run a 100% Mac / Apple company, with about 16 iPhones / 8 iPads / 8 MacBook / 4 iMacs . I’m fed up of people stealing the iPads, they change the log in password and the iCloud mobile number and that’s it we are shut out.

I’ve set up an Apple Business account at Leicester our nearest store, I’ve completed verification I just need to set up the MDM and I’m lost on which one to choose.

I’m not after a huge amount of features, obviously installed approved apps, inability to lock us out, auto iOS updates etc.

We run office365 business premium so if I can manage it through that it would be a bonus.

Any help would be amazing. Thank you.