@scottalanmiller said in Blocking spoofed emails O365:

https://support.knowbe4.com/hc/en-us/articles/212679977-Domain-Spoof-Prevention-in-Exchange-2013-2016-Office-365

Actually that might work. If the sender is outside the organization and the sender address includes our domain, just put in junk. I'll test this out tonight and see if it works right. Thanks!

@BraswellJay said in FreePBX conference scheduling ...:

With the FreePBX implementation the same PIN is set for every call that occurs on a particular conference bridge which would seem to be a security concern.

That's the same as the others, they are just changing it automatically in between meetings. You'd have to do the same thing... either manually or through automation. It's the lack of pre-existing automation that makes it tough.

@scottalanmiller said in Recover Deleted Items in Outlook:

If there is a way to know this, it would be from the email system, not from Outlook, and would be dependent on what the email system is and how it logs and so forth. But since emails in folders is ephemeral (they can move around all the time) it's a complicated thing to answer regardless.

Indeed. I always forget people attach outlook to non exchange servers.

@Markferron said in NGINX config issues:

@EddieJennings said in NGINX config issues:

I want to make sure I understand the problem. When you request http://my.testingtesting.com you receive a 301 redirect https://1.2.3.4 ?

...You know what. I think I have bigger problems. My machine off campus all of a sudden cannot ping the FQDN. When I remote into campus and ping the website I get the public IP address. Ugh, well I guess ignore this, maybe it'll straighten itself out once I fix this issue.

Use DNS to test what the FQDN is pointing to. Pings are always by IP, so if it doesn't work then it is the wrong IP.

@Dashrender said in Windows Domain routing question - dual-nic:

Though - if you have a second layer network like this, you'll need to inform your external router on the internal networks and how to route them.

Routing to the internet is mostly just a nice to have.

This is how drive testing is such a deep topic. You need to try and match the load, and consider all the things. CrystalDisk does not do that.

You can set up some really good tests with iometer. (I think that's waht it's called, i can't remember now it's been a long time and can't look it up atm)

@Dashrender said in Exchange Online ActiveSync Organization Setting Effect:

So you have to then manually approve them?

You can create rules that would allow devices and such, but, for right now, On-High wants everything quarantined and then manually approved. So specific to your question: "yes"

@brandon220 said in Show Active Users in NextCloud:

Mine is on 18.0.5 via the stable channel and shows there is an update to 18.0.6
Capture.PNG

I ended up with two systems that will not upgrade path 17 all the rest of them are upgraded 18 on the stable channel

@JaredBusch

Nevermind - never knew that was an option

@IRJ

based on this value, the rule worked

<if_matched_sid>31101</if_matched_sid>

<!-- Local rules -->
<!-- Modify it at your will. -->
<!-- Copyright (C) 2015-2020, Wazuh Inc. -->
<!-- Example -->
<!-- ################################### -->
<!-- # NMAP Detection Rule # -->
<!-- ################################### -->
<group name="NMAP_Security_Correlations,">
<rule id="100100" level="10">
<if_matched_sid>31101</if_matched_sid>
<match>Nmap Scripting Engine</match>
<description>NMap Scripting Engine Detected</description>
<location>/var/log/apache2/access.log</location>
</rule>
</group>

0245-web_rules.xml

I examined and combined but I did not understand the logic

9cff8a60-526c-41c4-8594-c6b35d178f29-image.png

@scottalanmiller said in how to disassemble Canon MF644?:

@AshKetchum said in how to disassemble Canon MF644?:

@scottalanmiller lol, nice one.

For real. 🙂

Same.

@Super-Sundae : Can you run Sysinternal's RegMon and patch another machine with InTune? That way you can capture the changes.
Perhaps running SysMon at the same time in case it makes changes to file permissions would help..

If you can find out what the policy changes then you should be able to revert on both machines. Hopefully 🙂

@jt1001001 said in "Microsoft print to PDF" feature in windows 10 not showing drivers when activated:

Sadly latest version of Foxit free (10) got rid of their PDF printer, so Its win10 or Adobe now (haven't checked other PDF utilities)

Boo 😞

@scottalanmiller said in How to monitor switch ports via The Dude Monitoring?:

@Grey said in How to monitor switch ports via The Dude Monitoring?:

OP wants to see what ports are going offline. My Ubiquiti system tells me that. It is a Software Defined Network (SDN). Do you see where I'm going with this? Did you look at the mp4 that I linked?

Ah, but it's that it is Ubiquiti, not SDN, that does that. It's that he would want a monitored system like Ubiquiti. ZeroTier is a more traditional SDN and would not in any way do what he wants. SDN is a red herring here. It's Ubiquiti itself that is what matters.

I suppose that's true. There are different levels of a software defined network and a ZeroTier or Silver Peak would be at a level that's too high to see ports, while a smaller Ubiquiti system definitely looks at ports. I think Meraki hardware & software shows the same thing, and I know they really defined the SDN space for site management. By definition, however, they're all SDNs. The days of using a command line to add a switch, define a vlan, or extend your footprint in to a new building are done, except for troubleshooting.

@black3dynamite said in Simple Linux Swap File Creation:

I automatically ignore Fedora and CentOS warning about that.

I ignored it also. just pointing out the default behavior.

@fuznutz04 said in Site to Site VPN - not passing audio traffic properly:

This one was interesting to get to the bottom of. @JaredBusch With the VPN tunnel enabled, the phone system was trying to send RTP to the phone on the internal IP. There is a setting in FreePBX on the extension level called "RTP Symmetric". Normally, this is set to yes. I changed it to no and the audio started flowing normally. However, I didn't like this solution. So, as a test, (and what I should have done from the beginning) I blocked all outbound traffic FROM my phone system, to any local network. (10.x, 172.16, 192.168, etc) This immediately solved the issue. I did not yet do a packet capture AFTER the fact to confirm, but I am assuming that blocking the PBX's ability to get to an internal private IP, forces the system to renegotiate and send the RTP to the correct public IP.

Definitely an odd issue.

nice you found a solution - I'm curious why it happens in the first place? Are some of the original phone's packet data still containing the original IP? And if so, why?
Are you using encrypted RTP?

@Pete-S said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@pmoncho said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@JaredBusch said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@scottalanmiller said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@pmoncho said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@scottalanmiller said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@Pete-S said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

@scottalanmiller said in How to Connect Power Disable SATA Drive to Dell Inspiron 5676:

Confirmed, snipping the orange wire (I needed help as I can't see orange) did the job, drive showed up immediately.

Congrats! I wasn't sure you'd be up for the task. A lot of people are afraid to make permanent changes to their equipment.

You can't believe how much pushback I got from @Dominica and @pchiodo about snipping a simple cable on a $2 SATA extension part! For me, it was a no brainer once knowing what it was. But they were up for spending hundreds of dollars to avoid snipping that wire. And it isn't even hard wired to the power supply or anything it's literally just a SATA extension piece! lol Like $2 tops if you don't shop around.

I would have been with @Dominica and @pchiodo on this. Electric scares me. I would think snipping the wire would cause a spark while I wasn't home and come home to a few burning cinders. 🙂

That was mentioned as a concern. lol

FFS people need to just STFU if they don’t know how electricity works.

That was exactly my point and why I wouldn't have done it. As for STFU about well, that is where we differ. Those concerns could be alleviated with an explanation of why it would not be an issue.

For electrons to flow you need a circuit. If you cut the wire you don't have a circuit anymore and because of that you don't have any electricity flowing. Since there is no electricity, there can't be any sparks.

If you just cut the wire but don't remove it, then one end can come in contact with the chassis and then you have a circuit and electricity flowing.

Modern switched power supplies (as in your computer) have short-circuit protection. So nothing would happen except that 3.3V will go down to 0V. So if there is anything in your computer that need 3.3V power from the power supply, it will not get it.

If you had something else producing 3.3V (for instance a battery) and you'd short-circuit that, then it can get cause a fire. Just because it's only 3.3V doesn't mean anything.

And sparks is not a problem unless you're in an explosive environment. The problem is that a short-circuit cause increased current running in the wire. That current will turn into heat. That heat causes things to melt and catch fire. And that's how you burn down a house.

Also nice to know is that any electrical circuit inside a computer is low voltage, 12V or below. It can't kill you no matter what you do. It's the same voltage as you have in an ordinary car battery.

The only way to get into trouble with a computer is by disassembling the power supply. There you have lethal voltage.

Thank you for the explanation. Very helpful.

@Grey said in Issues uninstalling Windows Server 2012 R2 Key:

You mean sfc /scannow? Or DISM.exe /Online /Cleanup-image /Restorehealth?

@op Check your event logs for more information, and try running the commands above.

Ran both, so far nothing, but I will run chkdsk tonight to see if that fixes anything. So far I can't find anything in the logs but I'll keep looking.