@dashrender said in SPF records - for all A records?:

This site is pretty good also for checking the whole mailing stack
https://www.checktls.com/TestReceiver

That one was new to me. I'm going to check it out.

Another awesome resource, one that can test your own email from the receiving end is https://www.learndmarc.com/
It just great and will explain what happens.

It's made by uriports. We just started to evaluate their DMARC report monitoring service. Looking good so far.

@dashrender said in Recommendation: Non-Profit Site hosting:

Why do you need WordPress?

Do you need that level of functionality?

We're going to be looking at redoing my company's website this year (I think). it's on WP now, but really, it's completely just static pages, there is no need for on the fly changes - unless they wanted to change the whole theme.

It's more of the feature set... being able to use a WYSIWYG editor for events, announcements and such. In some regard- yes WP is over powered, but it also allows for the tie ins like Calendar, Mailing list, and more.

@dustinb3403 said in TacticalRMM issue today, anyone else?:

Sounds like you're using this in production, correct?

Truth. It's not the only remote tool that we're using, but it's a nice backup / complement to our other options.

@voip_n00b Yes

I'm going to make sure that registry setting is applied correctly on a few PCs and then restart them. I'll report my findings on Monday.

@dashrender said in Where are MSP managed on-prem workloads moving?:

@pete-s said in Where are MSP managed on-prem workloads moving?:

Thanks, it does makes sense to move to SaaS solutions for a single customer that is doing their own IT.

But a MSP is in a different position because they, besides know-how, have a larger scale. So it can make economic sense to host things for their customers that doesn't make sense for each individual customer.

For instance does it makes sense for a company to have a server to host their website on? No, it doesn't. But if you're an MSP and your customers have a thousand websites that needs to live somewhere, it might make sense for you to host them.

I guess it also depends if you're an MSP that just manages things or if you also have your own hosting/cloud infrastructure or use another provider for that.

All good points. I have no view into that world, the few ITSPs I know are using other companies solutions, not rolling their own, or even hosting their own. Though some of them, we'll take JB for example, do manage all the stuffs other than hypervisor and hardware for things like a Ubiquiti controller, and PBXs.

If you really do have need to host 1000's of websites (or really massive sites, it could make sense to manage the whole stack, but then again, it could be better to get services from someone like Vultr, or in extreme cases like Amazon/Azure.

It's possible that ITSP/MSPs in the SMB space in general don't own any infrastructure themselves.

I know large companies that fully outsource their workloads to service providers. Those service providers host the workloads primarily in their own datacenters but also on public cloud infrastructure. But these service providers are often large companies themselves so they have scale.

@dashrender said in Patch your Windows DCs - else they will break in July 2022 from a patch:

@notverypunny said in Patch your Windows DCs - else they will break in July 2022 from a patch:

How about this month's updates that sent 2 of our DCs into a wonderful boot loop first thing this morning...

it could be related.

Here's the article that saved us
https://borncity.com/win/2022/01/12/windows-server-januar-2022-sicherheitsupdates-verursachen-boot-schleife/

Had to boot the VMs without networking and remove KB5009624 and KB5009595 as they were both 2012R2.

@dbeato said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:

@dashrender However centrally managed doesn't mean site to site VPN. I don't get MSP that have site to site VPNs to their customers. It is not feasible to maintain, it is a high risk and very old school.

of course it doesn't.

using a tool like ScreenConnect - having all customer machines in a single account - means SC's hacked, then ever client is hacked...

@pete-s said in Yealink T41P and T41S difference?:

I've actually found one difference and that is that the T41S has a USB port and I don't think T41P has one.

Additionally, the general difference between the G and S line was the USB port and the ability to handle the OPUS codec. I would assume the T41P did not have OPUS support either.

@dafyre Connection closed by foreign host after a couple seconds lol

@scottalanmiller said in ProxMox eating SSDs?:

@dashrender said in ProxMox eating SSDs?:

Anyone run into this issue on enterprise hardware?

There is no "issue". Even those that claim that they are running into it, it's consumer drives with HA logging going to those drives. Its' nothing to do with ProxMox, it's just standard, everyday CoroSync logging. The people saying "this is system administration basics" are correct.

Or just understanding what hardware you need for the job.

All VM guest OS will write to the same drive as well. So 10 guests will generate 10 times as many writes + whatever the hypervisor itself is generating.

I just checked and Crucial MX500 have 0.2 DWPD, which is not bad for a consumer drive.
But compare that to enterprise drives that usually start at:

1 DWPD (read-intensive) 3 DWPD (mixed use) 10 to 100 DWPD (write intensive)

@jasgot said in Nextcloud 23:

You'd think they would use the same name for everything and outline the steps somewhere to get is all installed properly. Sheesh!

I noticed the same mess. They have had this all screwed up for some time. It makes no sense and there is no automatic dependency handling or clear guidance.

@obsolesce said in Dreaded Windows Recovery:

@gjacobse said in Dreaded Windows Recovery:

Just over a week ago I let my older laptop install updates - and now - the dreaded Windows Recovery screen is all I see.

6cb44c85-48b2-4167-946f-a62a1f991495-image.png

I've backed out Quality and Features with no success. There are no System Restore Points and even trying to Reset all fail.

While I am able to recover my data - before I go and kill it, I wanted to ensure that I hadn't missed anything on trying to recover what I have...

BIOS is up to date, same version as was installed, and no new hardware has been installed.

Is this a lost cause - and best to just duck my head and re-install, or just migrate this poor soul to Ubuntu.

You should also check the health of the drive in the system. For example, if it's a Samsung SSD, run Samsung Magician to verify the drive is still in good health. A drive going bad can corrupt a Windows install and updates or something similar can be disk intensive enough to make it noticeable.

Installing Linux on an otherwise failed or failing drive can be brewing storm. So I'd still check the drive first before doing that.

Good point. I don't recall what brand of drive I have installed. I may hold this drive if I have another that I can use...

@wrcombs said in NTFS Permissions Tools:

@voip_n00b said in NTFS Permissions Tools:

I'm looking for a NTFS Permissions Tool that can give me a simply report to show who has access to what.

Anyone have a tool they like?

have you tried the powershell script for this?

I actually have one written, I'll try to remember to post it when I get a free minute.

@scottalanmiller said in Responding to "This BS called URE" from Synology Forums:

if the OS rather than simply flagging that file on the drive as being corrupt, would rather flag the whole drive, it comes across as a rather short sighted screwup.

This is actually what it does. Except not the OS. The RAID controller (hardware or software) flags the file (array) as being corruption, not any drive. Any drive(s) with a URE are flagged as being healthy.

If you were to divide up the drives into many arrays, and you hit an exposed URE, only the single array (file) in which the URE was found would be corrupt. The drives, and other arrays (files) on them would be just as healthy as ever.

It only comes across as a short sighted screw up if you don't realize that the "fix" takes us right back to where we already are.

Will any of these help:
https://blog.desdelinux.net/en/5-maneras-desconectar-conectar-dispositivo-usb-sin-retirar-las-manos-del-teclado/#Metodo_5_Reinciar_el_subsistema_USB

@skyetel Do you have an integration guides?

@gjacobse said in kdevtmpfsi malware:

That is malware I have not encountered. But, in many cases the first most direct and preferred way to deal with any malware is to:

Nuke it.

Reloading the OS can be faster and more reliable that trying to remove any malware / virus. All mainly due to time/cost.

Yup - I never attempt to recover a machine that's been infected - backup the data to an online source if possible - like onedrive or Box, etc... then pave the machine and start over.

@travisdh1 said in Best practice MFP scanning to email for M365 shop?:

@dashrender said in Best practice MFP scanning to email for M365 shop?:

@travisdh1 said in Best practice MFP scanning to email for M365 shop?:

@pete-s said in Best practice MFP scanning to email for M365 shop?:

@dashrender said in Best practice MFP scanning to email for M365 shop?:

@gjacobse
what brand MFPs are those?

My Canon's do fine with 1.2 to MS.

Do you set up the MFP with credentials from a M365 user?

Yep, need a licensed account, and the lowest priced one doesn't work. I forget what it's called at the moment, but you need a license that includes the local apps.

Even if you go with option 1, not sure why the lowest account with an email account wouldn't work?

Because the lowest cost email account is online only. A local device can't login.

I don't understand - why can't a local device login? Sure it likely can't use modern auth - but normal SMTP logon should work (though I think MS is killing that)

Also, as I mentioned - i'm using a totally free account (a shared account - shared only with me :P) through option 2 in the link I provided.

@scottalanmiller said in Active Directory Domain name:

@stacksofplates said in Active Directory Domain name:

@dbeato said in Active Directory Domain name:

@scottalanmiller said in Active Directory Domain name:

used that way. No certificate maker should ever have included it (and I've never heard of that as it would always indicate a scam CA as you cannot own that domain by definition).

The Majority if not all did add the .local, .lan and others, unless you think all CA are scams then I wouldn't say they are a scam.

Yeah from a quick search looks like at least GoDaddy and Digicert offered them.

Nov 2015 is when CA/Browser Forum set the standard to not allow internal domains. So looks like most if not all would have supported it before that.

https://cabforum.org/internal-names/

Damn, that's a major security hole! So I could go get a cert issued for a domain someone else used and there had to be zero verification since.... there was nothing to verify!

Yup.