@garak0410 A friend of mine has a phobia of claymation as a result of things similar to this

@Dashrender said in What Are You Doing Right Now:

@wirestyle22 said in What Are You Doing Right Now:

Apparently dell is parting ways with Cylance. They are still supporting cylance customers but they are moving to Crowdstrike which I haven't heard of before

What was your AV pre attack?
Has it changed now?

Did you ever discover how you became infected?

It was being pushed out of one of our domain controllers. Unsure how it initially got in

@Dashrender said in What Are You Doing Right Now:

@wirestyle22 said in What Are You Doing Right Now:

Apparently dell is parting ways with Cylance. They are still supporting cylance customers but they are moving to Crowdstrike which I haven't heard of before

What was your AV pre attack?
Has it changed now?

Did you ever discover how you became infected?

It was Cylance before and I think we may be moving to Crowdstrike. How hasn't been shared with me yet

FileCoder.A was the ransomware we got infected with btw for anyone asking before

Apparently dell is parting ways with Cylance. They are still supporting cylance customers but they are moving to Crowdstrike which I haven't heard of before

@coliver said in What Are You Watching Now:

@notverypunny said in What Are You Watching Now:

Just finished Good Omens yesterday. Worth watching, just not sure if / how they could do a second season. I'm tempted to read the book just to see what was changed.

Worth reading the book. It is one of my favorites.

Neil Gaiman is crushing it lately

@Dashrender said in DeviceMetadataServiceURL Bad Certificate:

@wirestyle22 said in DeviceMetadataServiceURL Bad Certificate:

This is an easy line of questioning

I wonder how their alerts can be missing this for days?

This is an easy line of questioning

@Dashrender said in DeviceMetadataServiceURL Bad Certificate:

@wirestyle22 said in DeviceMetadataServiceURL Bad Certificate:

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

So, this is caused by cert expiration/url issues and not a windows update?

Yes

Did Ms fix it yet?

Nope

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

So, this is caused by cert expiration/url issues and not a windows update?

Yes

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

@Dashrender said in DeviceMetadataServiceURL Bad Certificate:

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

@wirestyle22 said in DeviceMetadataServiceURL Bad Certificate:

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

@wirestyle22 said in DeviceMetadataServiceURL Bad Certificate:

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

OK. Sorry for not being clear enough. How does the error manifest itself? What problems were occurring that prompted an investigation into this?

What happens is your printers will have a black clock next to them. You'll lose the ability to right-click them or access the print server settings. You can't install new printers or remove printers already installed. The status of the printer will be "device setup in process" infinitely. This is due to it trying to pull the icons for the printers from an MS service that is not functional.

Oh, wow. That would suck. I wonder if this is already happening here and I haven't heard about it yet.

Yeah it legit ruined my weekend trying to figure it out. We got hit with ransomware and our group policy was affected so I thought it was related. Just really really bad luck.

Yeah, bad timing for sure. So this affects Windows 10 with shared printers?

Yes, the printer will act like it's installing - and just stall there.

Even if it is already installed?

Yes

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

@wirestyle22 said in DeviceMetadataServiceURL Bad Certificate:

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

OK. Sorry for not being clear enough. How does the error manifest itself? What problems were occurring that prompted an investigation into this?

What happens is your printers will have a black clock next to them. You'll lose the ability to right-click them or access the print server settings. You can't install new printers or remove printers already installed. The status of the printer will be "device setup in process" infinitely. This is due to it trying to pull the icons for the printers from an MS service that is not functional.

Oh, wow. That would suck. I wonder if this is already happening here and I haven't heard about it yet.

Yeah it legit ruined my weekend trying to figure it out. We got hit with ransomware and our group policy was affected so I thought it was related. Just really really bad luck.

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

OK. Sorry for not being clear enough. How does the error manifest itself? What problems were occurring that prompted an investigation into this?

What happens is your printers will have a black clock next to them. You'll lose the ability to right-click them or access the print server settings. You can't install new printers or remove printers already installed. The status of the printer will be "device setup in process" infinitely. This is due to it trying to pull the icons for the printers from an MS service that is not functional.

@wrx7m said in DeviceMetadataServiceURL Bad Certificate:

Where is this error appearing? I looked at the linked post, but couldn't really tell.

\SOFTWARE\Policies\Microsoft\Windows\Device Metadata\DeviceMetaDataServiceURL

You'll see:
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409

If you try to access that website it will give you a certificate error.

@Dashrender already posted the event log so I won't bother

@dafyre said in Random Thread - Anything Goes:

@hobbit666 said in Random Thread - Anything Goes:

If it was a Nokia, he'd need a new wall.

The Nokia Brick

https://social.technet.microsoft.com/Forums/en-US/4ffda40e-bc70-4a49-9423-cba3fdc7ec0d/devicemetadataserviceurl-httpgomicrosoftcomfwlinklinkid252669ampclcid0x409?forum=win10itprosetup

So this ruined my weekend. Broke all of our printers. This was the registry entry I had to apply via GPO in order to fix it. We all assumed this was due to ransomware and it wasn't.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Device Metadata\

Value Name: PreventDeviceMetadataFromNetwork

Type: REG_DWORD
Value: 1

@Dashrender said in DLP (Data Loss Prevention) solution:

@wirestyle22 said in DLP (Data Loss Prevention) solution:

@DustinB3403 said in DLP (Data Loss Prevention) solution:

@wirestyle22 said in DLP (Data Loss Prevention) solution:

Doctors don't care enough about security until they have to pay fines. @Dashrender you're still in the medical field right?

No one

FTFY

My mother in law is the litmus test. She "cares about security" but is not willing to do anything about it

I think you meant - clearly she doesn't care about security, because she's unwilling to do anything about it.

Yes, she's a typical user

@DustinB3403 said in DLP (Data Loss Prevention) solution:

@wirestyle22 said in DLP (Data Loss Prevention) solution:

Doctors don't care enough about security until they have to pay fines. @Dashrender you're still in the medical field right?

No one

FTFY

My mother in law is the litmus test. She "cares about security" but is not willing to do anything about it

We're using Dell Data Protection. Without the encryption they don't work on any of our workstations. Doctors don't care enough about security until they have to pay fines. @Dashrender you're still in the medical field right?

For the first time in like 4 years I helped someone guys