@JaredBusch said in Domain Time off for some members:

@Donahue said in Domain Time off for some members:

found it. It was the individual time for that ESXi member. It was running on it's own time, neither host time or any NTP. It was off by the 6 minutes. So for some reason, VMWare was syncing this setting with the host's ESXi clock, not the hardware clock, even though the settings disallow that.

How do you know the VMware tools was doing the sync?. As I said in my earlier post if windows goes and tries to get the hardware clock no matter what your tool says for heartbeat or times are pretty station it’s going to get the Clock from the host.

look at the picture I posted above. It was vmtoolsd.exe that was causing it to jump forward and svchost.exe that was correcting it. I found this under event 4616

@DustinB3403 said in Windows Server 2012 Essentials Cannot Find Login Server for AD:

That's rough.

Very

@Obsolesce - Yeah, thanks.

Thanks all

@Dashrender said in Why are Windows Management GUI Elements So Tiny?:

@scottalanmiller said in Why are Windows Management GUI Elements So Tiny?:

@WrCombs said in Why are Windows Management GUI Elements So Tiny?:

I was actually just talking about this with some coworkers of mine.

If you ever work with any other system, then work with Windows, it's shocking how silly and ridiculous it is. You can't "see" anything. It's like they wanted to mock people for choosing the GUI.

I love how you frequently go to this - they must want to mock people..

I'm sure it rarely if ever actually starts there. As already said - it was legacy, and never updated. They are finally getting around to updating most of the control panel applets - but we're still frequently stuck dealing with the old style for things like the java security admin, etc.

But wouldn't that be hilarious if it were true?

Internal MS plot to fuck with people: "Haha these idiots buying our operating system for the GUI... you know what would REALLY be funny? Release management tools that they can't see, so they have to squint their eyes and get really close to the screen. Their eyesight will get worse and they'll look even older while doing it with that stupid look on their face. HAH!!"

@wrx7m said in PowerShell - Create New AD User Using Prompts and Variables:

If I get rid of the attempt to combine the 2 existing variables into a 3rd, I get this error.

New-ADUser : A positional parameter cannot be found that accepts argument '+'. At \\FP02\it\Scripts\AD\AD-InitialUserCreationVariables.ps1:5 char:1 + New-ADUser -Name "$GivenName $Surname" ` + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (:) [New-ADUser], ParameterBindingException + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.ActiveDirectory.Management.Commands.NewADUser

Like this I think:

New-ADUser -Name "$($GivenName) $($Surname)"`

From: https://blogs.technet.microsoft.com/stefan_stranger/2013/09/25/powershell-sub-expressions/

Just had our first person report issues this evening.

Using noop would be useful when you are checking on the status of a machine that you don't necessarily manage.

@obsolesce said in Handling DNS in a Single Active Directory Domain Controller Environment:

@scottalanmiller said in Handling DNS in a Single Active Directory Domain Controller Environment:

@obsolesce said in Handling DNS in a Single Active Directory Domain Controller Environment:

@stuartjordan said in Handling DNS in a Single Active Directory Domain Controller Environment:

I believe the forest level with Samba can only be 2008R2 though.

If you're not using Windows AD, what's it matter?

If he's merging in DFS, it might. It's rare to do, but could matter.

Oh I see, so Windows AD and other services were involved at some point.

Depending on what you want to do, sometimes AD has to support it.

@black3dynamite said in Outlook Out of Memory to Open Large Folder:

Email/Mailbox hoarder!

Definitely

@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:

@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.

Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?

One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.

Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process.

It is expected to be automated. SSL Cert updates should not be intrusive. All of the tools for LE SSL Certs are designed around the idea that you will automate them and never need to worry about them again. It's about being less of a snag, not more of one.

Got it thanks. Looks like a bit of a learning curve then. 🙂

It's not bad. I find learning the LE pieces easier than learning to do it the old fashioned way 🙂 And with LE it is "learn once and ignore", rather than "learn once, forget, do again in a year or two all over again."

Via the ActiveDir list:

https://github.com/CarlWebster

There are some amazing scripts in there for ADDS but also for XenApp, NetScaler, Citrix, and others.

Site: https://carlwebster.com/downloads/download-info/active-directory-2/

@vhinzsanchez said in Re-Enable BitLocker on Windows 10 Home:

Thanks SAM, we are accepting the fact that the encryption will not be done at this moment.

Regards,

VhinzSanchez

https://www.howtogeek.com/234826/how-to-enable-full-disk-encryption-on-windows-10/

@scottalanmiller said in Network error Windows 7:

@wrcombs said in Network error Windows 7:

@dashrender said in Network error Windows 7:

@wrcombs said in Network error Windows 7:

@scottalanmiller said in Network error Windows 7:

@wrcombs said in Network error Windows 7:

@scottalanmiller said in Network error Windows 7:

@wrcombs said in Network error Windows 7:

Anyone ever see this error before? do you know what it means ? how to get rid of it?
0_1536843443200_netowrk error.PNG

No, because I carefully never do that, lol.

I didnt do this, this is from someone saying " This is how I think it goes" and changing settings.

Also something to avoid 😉

Random people who don't know the basics, making completely crazy configuration changes... that's a disaster waiting to happen. Imagine if they were doing that on a PCI network or something 😉

They did! we use 2 NICs, one for internet, one for the PoS system so they are "seperated" the best they can be. They stacked and added IP's to the PoS NIC, So all of the PoS were accessing the internet...

Sure, but the internal POS network doesn't have a gateway to some place else inside it, right?
So you don't have a gateway on that network interface.

I dont believe there is a gateway, its just communicating within the PoS and the back office.

If that were the case then I shouldn't be getting this message correct?

Shouldn't. The warning seems like it would be genuine - it's warning you that someone messed up the configuration.

When I used to have these type of setups, I would set the gateway to the POS and set the metric to 10 for either that NIC or that subnet. That's assuming that you're talking directly to the one and only POS and nothing else on that network. While you don't have to alter the metric, it helped stop Windows from wigging out seeing two NICs or two IPs and two gateways on one NIC. If you experiment, you can always put it back. Different VASCs and different brands & processors specify what's ok with them. Because PCI.

@scottalanmiller said in Options for Windows Desktop Deployments without Windows Server:

@obsolesce said in Options for Windows Desktop Deployments without Windows Server:

@dustinb3403 said in Options for Windows Desktop Deployments without Windows Server:

@obsolesce said in Options for Windows Desktop Deployments without Windows Server:

Yes, I like it more than FOG (though, I haven't used FOG yet) because I'm under the impression FOG is clone-based imaging only.

How can you say you like it more if you've never tried it?

Are you saying I should I like something that I haven't used yet more?

I think he's saying that "more" can't apply. Because you like MDT "X" amount, but FOG you like "null" amount. In math, you can't compare against a null, because it doesn't exist. No value, of X can ever me more likely to be "more" than a null than it is to be "less" than a null. Using the logic that you've never tried FOG, you can't say that you then like MDT more, any more than you can say that you like it less. There is simply no comparison.

That was his point.

Otherwise we could interpret it at random. You love MDT, hate MDT, find it exactly the same as FOG... are all equally incorrect based on a null comparison.

Because I have read about Fog and seen some of it, it's not null. Therefore I am able to have some like or dislike and form an opinion.

Just like I never drove a Lamborghini, but still like them more than a VW Beetle which I've owned in the past.

@wrcombs said in Site Moved a PC=A MESS:

@scottalanmiller said in Site Moved a PC=A MESS:

@wrcombs said in Site Moved a PC=A MESS:

My boss was pushing the compliance issues, Yes, Because it is his job to make sure compliance is met within every site. You're telling me, If im not mistaken, That following directions coming from the vendor is my boss being Dumb? or Being an Ass?

Straight from PCI Data Security Standard: Build and Maintain a Secure Network:
1. Install and maintain a firewall configuration to protect cardholder data.
2. Do no use Vendor- supplied Defaults for system passwords and other security parameters .

I guess reading this more thoroughly so I could continue this conversation: no where does it say It has to be a separate or isolated network, Only that It needs to be behind a firewall as far as Networking is concerned.

Correct, I'm telling you, straight up, that if your boss claims that those words in ANY WAY suggest you can't use a VLAN, he's either insanely stupid, or a ridiculous liar who thinks you easy to push around.

There is NOTHING about a separate network there. Not one thing.

I understand that now, at first I was a little confused, but now having seen and looked into everything more based off of what you are telling me , I find that everything you are saying makes perfect sense

Not that it means you can do something about it. But knowing that the boss is most likely just trying to blow you off, or just trying to make things complicated for some personal reason at the expense of the company makes it far better to be able to at least learn from the scenario.

Your quality take aways here include...

Your boss is not to be trusted (why, we don't know, but a reliable source, he is not.) Look for another job (you know this, but it's a reminder.) You now know PCI far better than before (and better than your boss.) You now have more experience in evaluating someone giving excuses rather than actual logic.

Thank you for the help. By posting the screenshots, I realized I had a typo in the file extension. .png vs .jpg
Once I double checked them all it now works.